Edit tour

Windows Analysis Report
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient

Overview

General Information

Sample URL:	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
Analysis ID:	1396915
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to infect the boot sector

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Query firmware table information (likely to detect VMs)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body with high number of embedded SVGs detected

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3716 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5712 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6428 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

avast_free_antivirus_setup_online.exe (PID: 5336 cmdline: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe MD5: 21B56ABF76225D8337BD397FF6C75B51)

avast_free_antivirus_setup_online_x64.exe (PID: 2848 cmdline: "C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f MD5: 3BA1265F701C2D4A6EDEC89270D18B2F)

Instup.exe (PID: 1436 cmdline: "C:\Windows\Temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f MD5: CA4A5F3F1AADF421F89C19505055C7A9)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0030B0E0 CryptDestroyHash,CryptDestroyHash,	10_2_0030B0E0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00309250 CryptGenRandom,GetLastError,__CxxThrowException@8,	10_2_00309250
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003082F0 CryptDestroyHash,	10_2_003082F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00309450 CryptCreateHash,CryptDestroyHash,GetLastError,__CxxThrowException@8,	10_2_00309450
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00308DC0 lstrcatA,CryptAcquireContextA,CryptReleaseContext,GetLastError,__CxxThrowException@8,CryptReleaseContext,	10_2_00308DC0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00309020 CryptCreateHash,CryptDestroyHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,	10_2_00309020
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00308260 CryptDestroyHash,	10_2_00308260
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00309340 CryptGetHashParam,CryptGetHashParam,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,	10_2_00309340
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003094D0 CryptHashData,GetLastError,__CxxThrowException@8,	10_2_003094D0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00322660 CryptReleaseContext,	10_2_00322660
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00308EF0 CryptReleaseContext,	10_2_00308EF0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC507190 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GlobalMemoryStatusEx,GetDiskFreeSpaceExW,GetSystemTimes,QueryPerformanceCounter,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	13_2_00007FF7AC507190

Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_034667d0-2

Source: https://www.avast.com/en-us/index#pc	HTTP Parser: Total embedded SVG size: 111587
Source: https://www.avast.com/c-computer-virus	HTTP Parser: Total embedded SVG size: 459762
Source: https://www.avast.com/c-malware	HTTP Parser: Total embedded SVG size: 459762

Source: https://www.avast.com/en-us/lp-safe-emailing?full_trSrc=mmm_ava_esg_000_361_m&utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/lp-safe-emailing?full_trSrc=mmm_ava_esg_000_361_m&utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/lp-safe-emailing?full_trSrc=mmm_ava_esg_000_361_m&utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/lp-safe-emailing?full_trSrc=mmm_ava_esg_000_361_m&utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	HTTP Parser: No favicon
Source: https://4711400.fls.doubleclick.net/activityi;dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient?	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/index#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/index#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/index#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/index#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/index#pc	HTTP Parser: No favicon
Source: https://4711400.fls.doubleclick.net/activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex?	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775#cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true	HTTP Parser: No favicon
Source: https://www.avast.com/c-computer-virus	HTTP Parser: No favicon
Source: https://www.avast.com/c-computer-virus	HTTP Parser: No favicon
Source: https://www.avast.com/c-computer-virus	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775#locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775#locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true	HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775#locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true	HTTP Parser: No favicon
Source: https://4711400.fls.doubleclick.net/activityi;dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus?	HTTP Parser: No favicon
Source: https://www.avast.com/c-malware	HTTP Parser: No favicon
Source: https://www.avast.com/c-malware	HTTP Parser: No favicon
Source: https://4711400.fls.doubleclick.net/activityi;dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware?	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/eula#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/eula	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/about	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/about#pc	HTTP Parser: No favicon
Source: https://www.avast.com/en-us/about#pc	HTTP Parser: No favicon
Source: https://4711400.fls.doubleclick.net/activityi;dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout?	HTTP Parser: No favicon
Source: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.29.132.67:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.29.132.67:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50336 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50338 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:50340 version: TLS 1.2

Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\Sbr.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\InstCont.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmp, Instup.exe, 0000000D.00000000.2535888882.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmp, Instup.exe.12.dr
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxInst.pdbv source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\HTMLayout.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: MsiZap.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxInst.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\Instup.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000000.2471534604.0000000000323000.00000002.00000001.01000000.00000006.sdmp

Networking

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: Instup.dll.12.dr

Static PE information: Found NDIS imports: FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutEnum0, FwpmSubLayerDeleteByKey0, FwpmEngineClose0, FwpmFilterEnum0, FwpmCalloutCreateEnumHandle0, FwpmTransactionCommit0, FwpmSubLayerCreateEnumHandle0, FwpmFilterDeleteByKey0, FwpmEngineOpen0, FwpmProviderDeleteByKey0, FwpmTransactionAbort0, FwpmFreeMemory0, FwpmFilterCreateEnumHandle0, FwpmCalloutDeleteByKey0, FwpmFilterDestroyEnumHandle0, FwpmTransactionBegin0, FwpmCalloutDestroyEnumHandle0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.132.67
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.251.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.20
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.20
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.251.73
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1708603603112 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/mhubc.js HTTP/1.1Host: mstatic.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CvVersion%7C5.5.0; apex__avastLocale=en-us; sourceCodeCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; trafficSourceCodeCookie=006_a8b; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s42186399204533?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A43%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aothers%3Alp-safe-emailing&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=others&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aothers%3Alp-safe-emailing&v59=D%3Dc59&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-470805.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: symantec.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=61662999391982255092277607603117149548
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zdc41QAAAI5mXAOj HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=61662999391982255092277607603117149548
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.3ba69200791f16077ba8.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1708603603112 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=61662999391982255092277607603117149548
Source: global traffic	HTTP traffic detected: GET /active/avastcom.jsp HTTP/1.1Host: www.upsellit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s42186399204533?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A43%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aothers%3Alp-safe-emailing&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=others&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aothers%3Alp-safe-emailing&v59=D%3Dc59&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/ytc.js HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9975a534a66e6e60fea127a62c73d6c7"If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
Source: global traffic	HTTP traffic detected: GET /logos/static/powered_by_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/config/10156543.json HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sessions/470805?s=0.25&r=0.20568012387113743 HTTP/1.1Host: vc.hotjar.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activityi;dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /signals/config/334783782127169?v=2.9.147&r=stable&domain=www.avast.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4711400.fls.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zdc41QAAAI5mXAOj HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=61662999391982255092277607603117149548; dpm=61662999391982255092277607603117149548
Source: global traffic	HTTP traffic detected: GET /logos/static/powered_by_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger=navigation-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/config/10156543.json HTTP/1.1Host: s.yimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, triggerReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM HTTP/1.1Host: ampcid.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/generic1691916888878.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9975a534a66e6e60fea127a62c73d6c7"If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
Source: global traffic	HTTP traffic detected: GET /ajax/libs/apexcharts/3.45.2/apexcharts.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source=navigation-source, triggerReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s44976451605232?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A54%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Ahomepage%3Aindex-t1&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Ahomepage%3Aindex-t1&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=homepage&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Ahomepage%3Aindex-t1&v59=D%3Dc59&c60=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex&v118=avast.com%3Aothers%3Alp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A06%3A54%20GMT&n=-1&b=Avast%20%7C%20Download%20Free%20Antivirus%20%26%20VPN%20%7C%20100%25%20Free%20%26%20Easy&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s44976451605232?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A54%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Ahomepage%3Aindex-t1&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Ahomepage%3Aindex-t1&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=homepage&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Ahomepage%3Aindex-t1&v59=D%3Dc59&c60=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex&v118=avast.com%3Aothers%3Alp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /v4/receive/json/81 HTTP/1.1Host: analytics.ff.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=1&tt=7xs&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A54+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A06%3A54%20GMT&n=-1&b=Avast%20%7C%20Download%20Free%20Antivirus%20%26%20VPN%20%7C%20100%25%20Free%20%26%20Easy&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4711400.fls.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger=navigation-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trustboxes/5419b6ffb0d04a076446a9af/main.js HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en-us HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxImpression?cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxView?cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgfCBEb3dubG9hZCBGcmVlIEFudGl2aXJ1cyAmIFZQTiB8IDEwMCUgRnJlZSAmIEVhc3kiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTcwODYwMzYxNzcwNyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMThkZDBiNjE3YmYzOTctMDFkMzViZDNjZTkwN2QtMjYwMzFlNTEtMTQwMDAwLTE4ZGQwYjYxN2MwOTFjIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLWV1IiwiYWNjb3VudElkIjogODIzMTgsInVybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ3ZWJzaXRlSWQiOiA4MjMyMCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJtZF9pc1N1cnZleVN1Ym1pdHRlZEluU2Vzc2lvbiI6ICIiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMmRlZC0xYjEzLTYxNjEtOWRmNS01NzYwLTY5YzAtNzJiNy1mMWY2Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE3MDg2MDM2MTc2OTkiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMjcyNiwia2FtcHlsZV92ZXJzaW9uIjogIjIuNTIuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNTIuMCIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTcwODYwMzYxNzcwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19 HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en-us HTTP/1.1Host: widget.trustpilot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgfCBEb3dubG9hZCBGcmVlIEFudGl2aXJ1cyAmIFZQTiB8IDEwMCUgRnJlZSAmIEVhc3kiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTcwODYwMzYxNzcwNyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMThkZDBiNjE3YmYzOTctMDFkMzViZDNjZTkwN2QtMjYwMzFlNTEtMTQwMDAwLTE4ZGQwYjYxN2MwOTFjIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLWV1IiwiYWNjb3VudElkIjogODIzMTgsInVybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ3ZWJzaXRlSWQiOiA4MjMyMCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJtZF9pc1N1cnZleVN1Ym1pdHRlZEluU2Vzc2lvbiI6ICIiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMmRlZC0xYjEzLTYxNjEtOWRmNS01NzYwLTY5YzAtNzJiNy1mMWY2Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE3MDg2MDM2MTc2OTkiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMjcyNiwia2FtcHlsZV92ZXJzaW9uIjogIjIuNTIuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNTIuMCIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTcwODYwMzYxNzcwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19 HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&gjid=2012420660&_gid=1751936064.1708603609&_u=SCCACUABBAAGACAHKgB~&z=1129750105 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&_u=SCCACUABBAAGACAHKgB~&z=1034922770 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&_u=SCCACUABBAAGACAHKgB~&z=1034922770 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /hs/hsstatic/content_shared_assets/static-1.4092/css/public_common.css HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs/hsstatic/jquery-libs/static-1.1/jquery/jquery-1.7.1.js HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/css/redesign.min.css HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/css/subset_en.css HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/hamburguer-menu-bars.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/check.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/arrow.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
Source: global traffic	HTTP traffic detected: GET /hubfs/_global/assets/js/prebuild/hubspot.min.js HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/js/main.min.js HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
Source: global traffic	HTTP traffic detected: GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs/hsstatic/cos-i18n/static-1.10/bundles/project.js HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/js/sdl1.js HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/js/prebuild/nav.js HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/o/f/400/MierB03-SubsetEng-Regular.woff2 HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.avast.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/hamburguer-menu-bars.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/Computer%20Virus/Academy-Computer-Virus-Hero.jpg?width=1200&name=Academy-Computer-Virus-Hero.jpg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/check.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/o/f/800/MierB03-SubsetEng-ExtraBold.woff2 HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.avast.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/o/f/700/MierB03-SubsetEng-Bold.woff2 HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.avast.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger=navigation-sourceReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/arrow.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/arrow-blue.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A32%20GMT&n=-1&b=What%20Is%20a%20Computer%20Virus%3F%20%7C%20Computer%20Virus%20Definition%20%7C%20Avast&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/quote-redesign.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/Academy-Computer-Virus.png?width=1320&name=Academy-Computer-Virus.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-01.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-02.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-03.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-04.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: not-navigation-source, trigger, event-sourceReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-05.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxImpression?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/Computer%20Virus/Academy-Computer-Virus-Hero.jpg?width=1200&name=Academy-Computer-Virus-Hero.jpg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activityi;dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A32%20GMT&n=-1&b=What%20Is%20a%20Computer%20Virus%3F%20%7C%20Computer%20Virus%20Definition%20%7C%20Avast&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/arrow-blue.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/quote-redesign.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/Academy-Computer-Virus.png?width=1320&name=Academy-Computer-Virus.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/A1-Acanning-for-viruses.png?width=2207&name=A1-Acanning-for-viruses.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-computer-virusAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxView?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v4/receive/json/81 HTTP/1.1Host: analytics.ff.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en HTTP/1.1Host: widget.trustpilot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-01.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-02.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-03.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-04.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-05.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/A1-Acanning-for-viruses.png?width=2207&name=A1-Acanning-for-viruses.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4711400.fls.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source;navigation-source, triggerReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/infobox_corner.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/What%20is%20Malware/What_Is_Malware-Hero.png?width=1200&name=What_Is_Malware-Hero.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"If-None-Match: "5c90960290145851dc3d17bdf94b91fa"If-Modified-Since: Thu, 05
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"If-None-Match: "b9ec31f25d243816b9b40fbe06bba666"If-Modified-Since: Mon, 02 May 2022 10:43:06 GMT
Source: global traffic	HTTP traffic detected: GET /hubfs/Avast/Academy/assets/i/helpers/infobox_corner.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-01.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-05.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-06.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxImpression?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-malware&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxView?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-malware&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-02.svg HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware-EN.png?width=1684&height=1200&name=Types-of-Malware-EN.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware.png?width=1321&height=601&name=Types-of-Malware.png HTTP/1.1Host: academy.avast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/What%20is%20Malware/What_Is_Malware-Hero.png?width=1200&name=What_Is_Malware-Hero.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-01.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source=navigation-sourceReferer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-05.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-06.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /v4/receive/json/81 HTTP/1.1Host: analytics.ff.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activityi;dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.avast.com/c-malwareAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-02.svg HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware-EN.png?width=1684&height=1200&name=Types-of-Malware-EN.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware.png?width=1321&height=601&name=Types-of-Malware.png HTTP/1.1Host: academy.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4711400.fls.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9975a534a66e6e60fea127a62c73d6c7"If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9975a534a66e6e60fea127a62c73d6c7"If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiRW5kIHVzZXIgbGljZW5zZSBhZ3JlZW1lbnRzIHwgQXZhc3QiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvZXVsYSNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjY0OTA5IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9ldWxhI3BjIiwid2Vic2l0ZUlkIjogODIzMjAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRfaXNTdXJ2ZXlTdWJtaXR0ZWRJblNlc3Npb24iOiAiIiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjJkZWQtMWIxMy02MTYxLTlkZjUtNTc2MC02OWMwLTcyYjctZjFmNiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNzA4NjAzNjY0ODk3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDI3NDksImthbXB5bGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJoaXN0b3J5X2xlbmd0aCI6IDEsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE3MDg2MDM2NjQ5MDksInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlfQpdfQ== HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiRW5kIHVzZXIgbGljZW5zZSBhZ3JlZW1lbnRzIHwgQXZhc3QiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvZXVsYSNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjY0OTA5IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9ldWxhI3BjIiwid2Vic2l0ZUlkIjogODIzMjAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRfaXNTdXJ2ZXlTdWJtaXR0ZWRJblNlc3Npb24iOiAiIiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjJkZWQtMWIxMy02MTYxLTlkZjUtNTc2MC02OWMwLTcyYjctZjFmNiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNzA4NjAzNjY0ODk3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDI3NDksImthbXB5bGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJoaXN0b3J5X2xlbmd0aCI6IDEsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE3MDg2MDM2NjQ5MDksInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlfQpdfQ== HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.avast.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wdceu/82320/onsite/embed.js HTTP/1.1Host: resources.digital-cloud.medallia.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9975a534a66e6e60fea127a62c73d6c7"If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
Source: global traffic	HTTP traffic detected: GET /embed/Yo9K67ixJ10?enablejsapi=1 HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/www-player.css HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger=navigation-source, event-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /c/hotjar-470805.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/7aa25d5c5a008bd4a96eb7daf3924659
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s46211879239902?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A7%3A50%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aabout%3Aabout&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aabout%3Aabout&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=about&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aabout%3Aabout&v59=D%3Dc59&c60=avast.com%3Aus%3Ahomepage%3Aindex-t1&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout&v118=avast.com%3Ahomepage%3Aindex-t1&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=VYN2Qq7f9hA; VISITOR_INFO1_LIVE=ct0xFB5laIY
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A50%20GMT&n=-1&b=Avast%20About%20us%20%7C%20About%20AVAST%20Software&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/player_ias.vflset/en_US/embed.js HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/www-embed-player.vflset/www-embed-player.js HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/player_ias.vflset/en_US/base.js HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activityi;dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1Host: 4711400.fls.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v4/receive/json/81 HTTP/1.1Host: analytics.ff.avast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=5&tt=k5r&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603670.0.0.0; s_nr=1708603670374-New; s_gpv=avast.com%3Aus%3Aabout%3Aabout; s_gpv_custom=avast.com%3Aabout%3Aabout; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A50+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s46211879239902?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A7%3A50%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aabout%3Aabout&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aabout%3Aabout&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=about&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aabout%3Aabout&v59=D%3Dc59&c60=avast.com%3Aus%3Ahomepage%3Aindex-t1&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout&v118=avast.com%3Ahomepage%3Aindex-t1&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A50%20GMT&n=-1&b=Avast%20About%20us%20%7C%20About%20AVAST%20Software&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4711400.fls.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /vi/Yo9K67ixJ10/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB_gmAAtAFigIMCAAQARhyIEsoRjAP&rs=AOn4CLCJxsQZZEuXR5yZ_WuQyU6IJ0kWWQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/2070f79f/player_ias.vflset/en_US/remote.js HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/th/ToQOEX5gn9COOYOZ9__C9da2xlIrCzMPflL2asQoGhw.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube-nocookie.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /vi/Yo9K67ixJ10/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB_gmAAtAFigIMCAAQARhyIEsoRjAP&rs=AOn4CLCJxsQZZEuXR5yZ_WuQyU6IJ0kWWQ HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate_204?HTGzYg HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgQWJvdXQgdXMgfCBBYm91dCBBVkFTVCBTb2Z0d2FyZSIsInBhZ2VfdXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjc2NzgxIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsIndlYnNpdGVJZCI6IDgyMzIwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICIyZGVkLTFiMTMtNjE2MS05ZGY1LTU3NjAtNjljMC03MmI3LWYxZjYiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTcwODYwMzY3Njc3OSIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyNzM3LCJrYW1weWxlX3ZlcnNpb24iOiAiMi41Mi4wIiwib25zaXRlX3ZlcnNpb24iOiAiMi41Mi4wIiwiaGlzdG9yeV9sZW5ndGgiOiAxLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNzA4NjAzNjc2NzgxLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0= HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.avast.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgQWJvdXQgdXMgfCBBYm91dCBBVkFTVCBTb2Z0d2FyZSIsInBhZ2VfdXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjc2NzgxIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsIndlYnNpdGVJZCI6IDgyMzIwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICIyZGVkLTFiMTMtNjE2MS05ZGY1LTU3NjAtNjljMC03MmI3LWYxZjYiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTcwODYwMzY3Njc3OSIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyNzM3LCJrYW1weWxlX3ZlcnNpb24iOiAiMi41Mi4wIiwib25zaXRlX3ZlcnNpb24iOiAiMi41Mi4wIiwiaGlzdG9yeV9sZW5ndGgiOiAxLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNzA4NjAzNjc2NzgxLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0= HTTP/1.1Host: udc-neb.kampyle.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000DBAD2D9667 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_355.2.dr	String found in binary or memory: <a href="https://www.facebook.com/avast" title="facebook" aria-label="facebook"> equals www.facebook.com (Facebook)
Source: chromecache_355.2.dr	String found in binary or memory: <a href="https://www.youtube.com/avast" title="youtube" aria-label="youtube"> equals www.youtube.com (Youtube)
Source: chromecache_355.2.dr	String found in binary or memory: "https://www.facebook.com/avast", equals www.facebook.com (Facebook)
Source: chromecache_355.2.dr	String found in binary or memory: "https://www.linkedin.com/company/avast-software" equals www.linkedin.com (Linkedin)
Source: chromecache_355.2.dr	String found in binary or memory: "https://www.youtube.com/avast", equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: (g.Bo(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.Bo(c,"www.youtube.com"),d=c.toString()):(c=LAa(d),bK(c)&&(d=c));c=new g.UP(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: HPa=function(a,b){if(!a.j["0"]){var c=new aL("0","fakesb",{video:new XK(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new ZQ(new g.UP("http://www.youtube.com/videoplayback"),c,"fake"):new jR(new g.UP("http://www.youtube.com/videoplayback"),c,new IQ(0,0),new IQ(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: a))):this.Ud(g.xW(a.errorMessage)):this.Ud(zW(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.Nm(c,{hl:a})),this.Ud(zW(this,"GENERIC_WITH_LINK_AND_CPN",c,!0)),d.Jc&&!d.D&&jYa(this,function(e){if(g.jV(e,b.api,!sS(b.api.U()))){e={as3:!1,html5:!0,player:!0,cpn:b.api.getVideoData().clientPlaybackNonce};var f=b.api;f.zc("onFeedbackArticleRequest",{articleId:3037019,helpContext:"player_error", equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: a.hl);this.region=b?b.contentRegion\|\|"US":yC("US",a.cr);this.hostLanguage=b?b.hostLanguage\|\|"en":yC("en",a.host_language);this.Qo=!this.Xc&&Math.random()<g.xJ(this.experiments,"web_player_api_logging_fraction");this.gb=!this.Xc;this.enabledEngageTypes=new Set;this.deviceIsAudioOnly=!(null==b\|\|!b.deviceIsAudioOnly);this.Kd=xC(this.Kd,a.ismb);this.Wo?(r=a.vss_host\|\|"s.youtube.com","s.youtube.com"===r&&(r=oS(this.Ga)\|\|"www.youtube.com")):r="video.google.com";this.Xm=r;NQa(this,a,!0);this.Na=new MR;g.O(this, equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: a.severity,e,MK(a.details),f)}else this.va.qa("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),this.ze(a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.AD)(),CU(a,"manifest",function(h){b.G=!0;b.ra("pathprobe",h)},function(h){b.ze(h.errorCode,h.details)}))}}; equals www.youtube.com (Youtube)
Source: chromecache_288.2.dr	String found in binary or memory: function Or(a,b,c){this.o=this.g=this.h=null;this.i=0;this.G=!1;this.u=[];this.l=null;this.O={};if(!a)throw Error("YouTube player element ID required.");this.id=Oa(this);this.K=c;c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"===a.tagName.toLowerCase(),b.host\|\|(b.host=c?ac(a.src):"https://www.youtube.com"),this.h=new Ir(b),c\|\|(b=Pr(this,a),this.o=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.g=a,this.g.id\|\|(this.g.id="widget"+Oa(this.g)),Cr[this.g.id]=this,window.postMessage){this.l= equals www.youtube.com (Youtube)
Source: chromecache_268.2.dr	String found in binary or memory: f\|\|g.length\|\|h.length))return;var n={kh:d,ih:e,jh:f,Vh:g,Wh:h,He:m,vb:b},p=z.YT,q=function(){tD(n)};if(p)return p.ready&&p.ready(q),b;var r=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){r&&r();q()};H(function(){for(var t=C.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(wD(w,"iframe_api")\|\|wD(w,"player_api"))return b}for(var x=C.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!nD&&uD(x[B],n.He))return Ic("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: g.BS=function(a){var b=g.qS(a);YQa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: g.Ua("Goog_AdSense_Lidar_getUrlSignalsList",Qhb);var uAa=na(["//tpc.googlesyndication.com/sodar/",""]);var WLa={m4a:0,j4a:1,g4a:2,h4a:3,i4a:4,l4a:5,k4a:6};var Poa=(new Date).getTime();var Tka="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Uka=/\bocr\b/;var Wka=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;g.w(Hu,g.Ld);Hu.prototype.dispose=function(){window.removeEventListener("offline",this.C);window.removeEventListener("online",this.C);this.On.Tj(this.G);delete Hu.instance}; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e,f){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.qS(this);e="www.youtube.com"===c;!f&&d&&e?f="https://youtu.be/"+a:g.kS(this)?(f="https://"+c+"/fire",b.v=a):(f&&e?(f=this.protocol+"://"+c+"/shorts/"+a,d&&(b.feature="share")):(f=this.protocol+"://"+c+"/watch",b.v=a),PD&&(a=Boa())&&(b.ebc=a));return g.Nm(f,b)}; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: g.qS=function(a){a=oS(a.Ga);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: chromecache_268.2.dr	String found in binary or memory: return b}kD.D="internal.enableAutoEventOnTimer";var vc=da(["data-gtm-yt-inspected-"]),lD=["www.youtube.com","www.youtube-nocookie.com"],mD,nD=!1; equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: this.W.Ba&&(a.authuser=this.W.Ba);this.W.pageId&&(a.pageid=this.W.pageId);isNaN(this.cryptoPeriodIndex)\|\|(a.cpi=this.cryptoPeriodIndex.toString());var e=(e=/_(TV\|STB\|GAME\|OTT\|ATV\|BDP)_/.exec(g.oc()))?e[1]:"";"ATV"===e&&(a.cdt=e);this.G=a;this.G.session_id=d;this.ma=!0;"widevine"===this.B.flavor&&(this.G.hdr="1");"playready"===this.B.flavor&&(b=Number(KR(b.experiments,"playready_first_play_expiration")),!isNaN(b)&&0<=b&&(this.G.mfpe=""+b),this.ma=!1);b="";g.DR(this.B)?CR(this.B)?(d=c.B)&&(b="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";"adunit"===h?d=this.D?"embedded":"detailpage":"embedded"===h\|\|this.K?d=wC(d,h,IQa):h&&(d="embedded");this.Ma=d;vta();h=null;d=b?b.playerStyle:a.ps;f=g.Gb(JQa,d);!d\|\|f&&!this.K\|\|(h=d);this.playerStyle=h;this.ma=(this.N=g.Gb(JQa,this.playerStyle))&&"play"!==this.playerStyle&&"jamboard"!==this.playerStyle;this.Wo=!this.ma;this.Wa=vC(!1,a.disableplaybackui);this.disablePaidContentOverlay=vC(!1,null==b?void 0:b.disablePaidContentOverlay); equals www.youtube.com (Youtube)
Source: chromecache_436.2.dr	String found in binary or memory: var V3={};var Rdb=/[&\?]action_proxy=1/,Qdb=/[&\?]token=([\w-])/,Sdb=/[&\?]video_id=([\w-])/,Tdb=/[&\?]index=([\d-])/,Udb=/[&\?]m_pos_ms=([\d-])/,Wdb=/[&\?]vvt=([\w-]*)/,Idb="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),Vdb="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),Ldb={android:"ANDROID", equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Feb 2024 12:06:51 GMTContent-Type: text/html; charset=UTF-8Server: ESFContent-Length: 1629X-XSS-Protection: 0X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 22 Feb 2024 12:06:57 GMTContent-Type: text/plainContent-Length: 18Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 22 Feb 2024 12:07:35 GMTContent-Type: text/plainContent-Length: 18Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 22 Feb 2024 12:07:40 GMTContent-Type: text/plainContent-Length: 18Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 22 Feb 2024 12:07:52 GMTContent-Type: text/plainContent-Length: 18Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.iavs9x.u.avast.com/iavs9x-xprial=17
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.iavs9x.u.avast.com/iavs9x-xpy
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.iavs9x.u.avast.com/iavs9x8tinyN
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.ivps9tiny.u.avast.com/ivps9tinyAlpha
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.vps18tiny.u.avcdn.net/vps18tinyettings.
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.vps18tiny.u.avcdn.net/vps18tinyn
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.vpsnitro.u.avast.com/vpsnitro1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b7210692.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b7210692.vpsnitrotiny.u.avast.com/vpsnitrotinySI6InB
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.iavs5x.u.avast.com/iavs5xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.iavs9x.u.avast.com/iavs9x-xpE
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.iavs9x.u.avast.com/iavs9xcgiy
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.iavs9x.u.avast.com/iavs9xxpm2
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.ivps9x.u.avast.com/ivps9xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.vps18tiny.u.avcdn.net/vps18tinyY
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://b8003600.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.vpsnitrotiny.u.avast.com/vpsnitrotiny9
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b8003600.vpsnitrotiny.u.avast.com/vpsnitrotinya
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.iavs5x.u.avast.com/iavs5x9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.iavs5x.u.avast.com/iavs5xO
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.iavs9x.u.avast.c
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.iavs9x.u.avast.com/iavs9x-xpx.m
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.ivps9tiny.u.avast.com/ivps9tinyg
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.ivps9tiny.u.avast.com/ivps9tinyv.
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.ivps9x.u.avast.com/ivps9xH
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.ivps9x.u.avast.com/ivps9xX)
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.vps18tiny.u.avcdn.net/vps18tiny1
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.vps18tiny.u.avcdn.net/vps18tiny;-3
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.vpsnitro.u.avast.com/vpsnitroQ
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://c3978047.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.vpsnitrotiny.u.avast.com/vpsnitrotinyXV0b0l
Source: Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c3978047.vpsnitrotiny.u.avast.com/vpsnitrotinyeP
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://cnx.conceptsheartranch.com/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://cnx.conceptsheartranch.comirsBaseUrlTracking=Sending
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DB47000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524026047.000001313DB47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Instup.exe.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.iavs5x.u.avast.com/iavs5xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9x-xpi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9x.cgidef
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9xV4
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.iavs9x.u.avast.com/iavs9xa
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.ivps9x.u.avast.com/ivps9xU
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.vps18.u.avcdn.net/vps18jC
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.vps18tiny.u.avcdn.net/vps18tinym5
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d3176133.vpsnitro.u.avast.com/vpsnitroL
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://d3176133.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doubleclick-proxy.ff.a
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclid
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclidS%
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclidu
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ec.europa.eu/consumers/odr/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2500550523.000001313B419000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2500180018.000001313B41A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f346.i#
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.iavs5x.u.avast.com/iavs5x9tinyH
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.iavs9x.u.avas
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.iavs9x.u.avast.com/iavs9x-xpZ
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.iavs9x.u.avast.com/iavs9xedF
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.ivps9tiny.u.avast.com/ivps9tinyl
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.vps18.u.avcdn.net/vps186C
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.vps18tiny.u.avcdn.net/vps18tiny4
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://f3461309.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f3461309.vpsnitrotiny.u.avast.com/vpsnitrotiny_gdid
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://ftp://UnknownWindows-3.11Windows-95Windows-95-OSR2Windows-98Windows-98-SEWindows-MEWindows-CE
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.iavs9x.u.avast.com/iavs9x-xpC
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.iavs9x.u.avast.com/iavs9xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.ivps9tiny.u.avast.com/ivps9tiny.
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.ivps9tiny.u.avast.com/ivps9tinyJ(#
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.vpsnitro.u.avast.com/vpsnitro1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://g1928587.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.vpsnitrotiny.u.avast.com/vpsnitrotiny7:1
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g1928587.vpsnitrotiny.u.avast.com/vpsnitrotinycage
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://geoip.avast.com/geoip/geoip.php
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.php3
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.php5
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpA
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpE
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpK
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpU
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpVB
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpW
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpY
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpZB
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.php_
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpnB
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpq
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phptC
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoip.avast.com/geoip/geoip.phpz
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://gf.tools.avast.com/tools/gf/
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gf.tools.avast.com/tools/gf/a0fg
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.iavs9x.u.a
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.iavs9x.u.avast.com/iavs9x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.ivps9x.u.avast.com/ivps9x8t
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.vps18tiny.u.avcdn.net/vps18tinyr3z
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.vpsnitro.u.avast.com/vpsnitroy
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4305360.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.vpsnitrotiny.u.avast.com/vpsnitrotiny7:1m
Source: Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4305360.vpsnitrotiny.u.avast.com/vpsnitrotinye
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.iavs5x.u.avast.com/iavs5xnsFeature_KernelPort
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.iavs5x.u.avast.com/iavs5xxp0#5
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.iavs9x.u.avast.com/iavs9x-xpom/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.iavs9x.u.avast.com/iavs9x-xpq#z
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.ivps9tiny.u.avast.com/ivps9tinyleURL=ht
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.ivps9x.u.avast.com/ivps9x8tinyo#
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.ivps9x.u.avast.com/ivps9x;0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.vps18tiny.u.avcdn.net/vps18tinyare.ff.a#x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.vpsnitro.u.avast.com/vpsnitrocom
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://h4444966.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h4444966.vpsnitrotiny.u.avast.com/vpsnitrotinya
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000000.2471534604.0000000000323000.00000002.00000001.01000000.00000006.sdmp, chromecache_261.2.dr	String found in binary or memory: http://https://:allow_fallback/installer.exe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.iavs9x.u.avast.com/iavs9x-xpZ%
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.iavs9x.u.avast.com/iavs9xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.vps18.u.avcdn.net/vps188B
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.vpsnitro.u.avast.com/vpsnitro~%w
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://j0294597.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.vpsnitrotiny.u.avast.com/vpsnitrotiny24
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://j0294597.vpsnitrotiny.u.avast.com/vpsnitrotiny37:1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://keys.backup.norton.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://keys.backup.norton.comLO.3120accountkeysCCT
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.iavs5x.u.avast.com/iavs5x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.iavs9x.u.avast.com/iavs9x-xpr
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.iavs9x.u.avast.com/iavs9x.cgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.ivps9x.u.avast.com/ivps9xxp
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.vps18.u.avcdn.net/vps18HC
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.vps18.u.avcdn.net/vps18i
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.vps18tiny.u.avcdn.net/vps18tinyI5
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l2983942.vpsnitro.u.avast.com/vpsnitroZ
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l2983942.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.iavs9x.u.avast.com/iavs9xcgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.iavs9x.u.avast.com/iavs9xtro#.
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.vps18.u.avcdn.net/vps18xC:i
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.vps18tiny.u.avcdn.net/vps18tinys-
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.vpsnitro.u.avast.com/vpsnitroa-7
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l4691727.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l4691727.vpsnitrotiny.u.avast.com/vpsnitrotinyinstalHl
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.iavs5x.u.avast.com/iavs5xa
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.iavs5x.u.avast.com/iavs5xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.ivps9x.u.avast.com/ivps9xxpC/(
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.vps18.u.avcdn.net/vps18e
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.vps18tiny.u.avcdn.net/vps18tinya-
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.vps18tiny.u.avcdn.net/vps18tiny~
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://l7814800.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://l7814800.vpsnitrotiny.u.avast.com/vpsnitrotinyl19LHs
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://m0658849.iavs9x.u.ava
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://m0658849.iavs9x.u.avast.com/iavs9x-xpny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://m0658849.iavs9x.u.avast.com/iavs9xcgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://m0658849.iavs9x.u.avast.com/iavs9xxpU
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://m0658849.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://m0658849.vpsnitrotiny.u.avast.com/vpsnitrotinySwxNF1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.iavs9x.u.avast.com/iavs9x-xpny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.iavs9x.u.avast.com/iavs9x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.ivps9tiny.u.avast.com/ivps9tinyT
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.ivps9x.u.avast.com/ivps9xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.vps18.u.avcdn.net/vps181
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.vps18tiny.u.avcdn.net/vps18tinyW
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n2833777.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n2833777.vpsnitrotiny.u.avast.com/vpsnitrotinySwxNDQ
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n429.vp
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.iavs5x.u.avast.com/iavs5xxpH
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.iavs9x.u.avast.com/iavs9x-xpc
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.iavs9x.u.avast.com/iavs9x084
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.iavs9x.u.avast.com/iavs9xcgiy
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.vps18.u.avcdn.net/vps18Q
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.vps18tiny.u.avcdn.net/vps18tinyd2
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.vps18tiny.u.avcdn.net/vps18tinyr
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.vpsnitro.u.avast.com/vpsnitroU
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n4291289.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n4291289.vpsnitrotiny.u.avast.com/vpsnitrotinykZfVkF
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.iavs9x.u.avast.com/iavs9x-xps)x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.iavs9x.u.avast.com/iavs9x8tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.iavs9x.u.avast.com/iavs9xa
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.ivps9tiny.u.avast.com/ivps9tiny))
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.ivps9x.u.avast.com/ivps9x9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.vps18.u.avcdn.net/vps18DC
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.vpsnitro.u.avast.com/vpsnitroh
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.vpsnitro.u.avast.com/vpsnitroy
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://n8283613.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.vpsnitrotiny.u.avast.com/vpsnitrotiny7:15
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8283613.vpsnitrotiny.u.avast.com/vpsnitrotinyCJwbGF
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2497771231.000001313B382000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2497683753.000001313B37F000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2497851838.000001313B38D000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2498035249.000001313B38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ad
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.iavs5x.u.avast.com/iavs5xxp
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.iavs9x.u.avast.com/iavs9x8tinyr:z
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.iavs9x.u.avast.com/iavs9x9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.ivps9tiny.u.avast.com/ivps9tinyA
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.vps18.u.avcdn.net/vps18dB
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.vps18.u.avcdn.net/vps18fC
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.vps18.u.avcdn.net/vps18w
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p1043812.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p1043812.vpsnitrotiny.u.avast.com/vpsnitrotiny)
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs5x.u.avast.com/iavs5x8tinypStoreWi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs5x.u.avast.com/iavs5x8tinys&x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9x-xpAnalytic
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9x-xpj&
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9xa
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.iavs9x.u.avast.com/iavs9xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.ivps9tiny.u.avast.com/ivps9tinyline_set
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.ivps9x.u.avast.com/ivps9xu/release-one/avast_
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.vps18tiny.u.avcdn.net/vps18tinye
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.vpsnitro.u.avast.com/vpsnitroT_
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://p9854759.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://p9854759.vpsnitrotiny.u.avast.com/vpsnitrotinyb304a8
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://play.google.com
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://play.google.com/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://push.ff.avast.com
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://push.ff.avast.comOBES
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://push.ff.avast.comaldeath
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.iavs5x.u.avast.com/iavs5x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.iavs9x.u.avast.com/iavs9x-xpw
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.iavs9x.u.avast.com/iavs9x8tinyb
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.iavs9x.u.avast.com/iavs9x9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.ivps9tiny.u.avast.com/ivps9tiny-
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.ivps9x.u.avast.com/ivps9xa
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.vps18.u.avcdn.net/vps18;
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.vps18.u.avcdn.net/vps18BB
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.vps18tiny.u.avcdn.net/vps18tinysions/inq
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.vpsnitro.u.avast.com/vpsnitro-34
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r0965026.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r0965026.vpsnitrotiny.u.avast.com/vpsnitrotinyll1234
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.iavs5x.u.avast.com/iavs5x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.iavs9x.u.avast.com/iavs9x8tinyP
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.ivps
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.ivps9tiny.u.avast.com/ivps9tinyG
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.vps18tiny.u.avcdn.net/vps18tiny#
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r3802239.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3802239.vpsnitrotiny.u.avast.com/vpsnitrotiny20
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r4427608.iavs5x.u.avast.com/iavs5x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r4427608.iavs9x.u.avast.com/iavs9x-xp4%95
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r4427608.iavs9x.u.avast.com/iavs9xcgi8
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r4427608.vpsnitro.u.avast.com/vpsnitro1$:
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r4427608.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r4427608.vpsnitrotiny.u.avast.com/vpsnitrotinyt
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.iavs5x.u.avast.com/iavs5xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.iavs9x.u.avast.com/iavs9x-xpoutMinutes=480
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.iavs9x.u.avast.com/iavs9xa
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.iavs9x.u.avast.com/iavs9xcgiom
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.ivps9tiny.u.avast.com/ivps9tiny5
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.ivps9x.u.avast.com/ivps9x24
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.ivps9x.u.avast.com/ivps9x8tinyB#
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.vps18.u.avcdn.net/vps18LB
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.vps18tiny.u.avcdn.net/vps18tinyK#
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.vps18tiny.u.avcdn.net/vps18tinyurl=http
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r6726306.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.vpsnitrotiny.u.avast.com/vpsnitrotinyM
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r6726306.vpsnitrotiny.u.avast.com/vpsnitrotinyxzdCJHr
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.iavs5x.u.avast.com/iavs5x2
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.iavs5x.u.avast.com/iavs5xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.iavs9x.u.avast.com/iavs9x-xpp(u
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.iavs9x.u.avast.com/iavs9xa
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.ivps9tiny.u.avast.com/ivps9tiny-(
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.ivps9x.u.avast.com/ivps9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.vpsnitro.u.avast.com/vpsnitroQ
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://r9319236.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.vpsnitrotiny.u.avast.com/vpsnitrotiny37:1
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r9319236.vpsnitrotiny.u.avast.com/vpsnitrotinyB07436oH
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.iavs5x.u.avast.com/iavs5xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.iavs9x.u.avast.com/iavs9xcgiyl;
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.iavs9x.u.av~nS
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.ivps9x.u.avast.com/ivps9xT3
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.vps18tiny.u.avcdn.net/vps18tiny(3
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.vpsnitro.u.avast.com/vpsnitro0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://s1843811.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1843811.vpsnitrotiny.u.avast.com/vpsnitrotinyjEiLCJhm
Source: chromecache_355.2.dr	String found in binary or memory: http://schema.org
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsu
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup.n#
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi&4
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi8tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi8tinyO
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi9tiny24:
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgi=
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgiContent526=0
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgiHours=86
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgia
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgicgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgig
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgishing
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgitroy
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.cgixp
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sm00.avast.com/cgi-bin/iavsup2.c~iS
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://submit.sb.avast.com/V1/MD/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit.sb.avast.com/V1/MD/T
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit.sb.avast.com/V1/MD/WebScanner
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit.sb.avast.com/V1/MD/b
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: http://submit.sb.avast.com/V1/PD/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit.sb.avast.com/V1/PD/led
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgi(
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgi.#
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiA(
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiA7%
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiJY
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiO
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiU
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgig/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgilease-on
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgipdateChe
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiq1u
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgit_streamback
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiv
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiy
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiy(
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiyD&)
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiyc
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://submit5.avast.com/cgi-bin/submit50.cgiz
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.iavs5x.u.avast.com/iavs5xtrov
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.iavs9x.u.avast.com/iavs9xcgiit
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.ivps9x.u.avast.com/ivps9x8tiny5
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.ivps9x.u.avast.com/ivps9xcgi4
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.vps18tiny.u.avcdn.net/vps18tiny4;8
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.vps18tiny.u.avcdn.net/vps18tinyP6
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.vps18tiny.u.avcdn.net/vps18tinys
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.vpsnitro.u.avast.com/vpsnitro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://t1024579.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1024579.vpsnitrotiny.u.avast.com/vpsnitrotiny:
Source: chromecache_288.2.dr, chromecache_436.2.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.000000000502B000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2578020012.0000000008360000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2578020012.0000000008360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgiP
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgiV
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi_
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2578020012.0000000008360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgipN
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.000000000502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/l
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.000000000502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/~
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.iavs5x.u.avast.com/iavs5x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.iavs9x.u.avast.com/iavs9x-xpu0y
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.iavs9x.u.avast.com/iavs9x.cgiC:
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.iavs9x.u.avast.com/iavs9xa
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.ivps9tiny.u.avast.com/ivps9tinyS
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.ivps9x.u.avast.com/ivps9xa
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.ivps9x.u.avast.com/ivps9xxpb
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.vps18.u.avcdn.net/vps18hB
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.vpsnitro.u.avast.com/vpsnitroW
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w5805295.vpsnitro.u.avast.com/vpsnitrob6
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://w5805295.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apple.com/legal/internet-services/itunes/pl/terms.html
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apple.com/legal/internet-services/itunes/us/terms.html
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.avast.com/refund-policy
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.avast.com/vendor
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://www.avast.com0/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004FA9000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com/
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com/N
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com/collect
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com/collect(
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.google.com/intl/%s/toolbar/ie/partnereula.html
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502886059.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502767504.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2503112794.000001313B425000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502815056.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2503010320.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502955449.000001313B425000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502715512.000001313B417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502886059.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502472913.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502589470.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502767504.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502628573.000001313B425000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502815056.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502955449.000001313B425000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502715512.000001313B417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502767504.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502815056.000001313B417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netTTF
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: chromecache_436.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.iavs5x.u.avast.com/iavs5xH
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9x-xp$7
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9x-xpny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9x.cgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.iavs9x.u.avast.com/iavs9xcgi
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.ivps9x.u.avast.com/ivps9xxp87
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.vps18.u.avcdn.net/vps18NC
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y8002308.vpsnitro.u.avast.com/vpsnitroW
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y8002308.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.iavs5x.u.avast.com/iavs5x8tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.iavs9x.u.avast.com/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.iavs9x.u.avast.com/iavs9xcgiE
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.ivps9tiny.u.avast.com/ivps9tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.ivps9tiny.u.avast.com/ivps9tinyI
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.ivps9x.u.avast.com/ivps9x8tinyt
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.vps18.u.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.vps18.u.avcdn.net/vps184B
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.vps18tiny.u.avcdn.net/vps18tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.vpsnitro.u.avast.com/vpsnitroU
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://y9830512.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.vpsnitrotiny.u.avast.com/vpsnitrotiny0X
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://y9830512.vpsnitrotiny.u.avast.com/vpsnitrotinydpYWJ
Source: chromecache_436.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_436.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_436.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_436.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.iavs5x.u.avast.com/iavs5x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.iavs5x.u.avast.com/iavs5xe7
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.iavs9x.u.avast.com/iavs9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.iavs9x.u.avast.com/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.iavs9x.u.avast.com/iavs9xcgiy&:
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.ivps9tiny.u.avast.com/ivps9tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.ivps9x.u.avast.com/ivps9x
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.ivps9x.u.avast.com/ivps9xtro
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.vps18.u.avcdn.net/vps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.vps18tiny.u.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.vps18tiny.u.avcdn.net/vps18tinyI
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.vps18tiny.u.avcdn.net/vps18tinyi:
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.vpsnitro.u.avast.com/vpsnitro
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://z4055813.vpsnitro.u.avast.com/vpsnitroG
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: http://z4055813.vpsnitrotiny.u.avast.com/vpsnitrotiny
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_clean_your_compu
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_encrypt_email_ac
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_keep_your_childr
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_speed_up_your_in
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/run_packet_loss_test_ac
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/what_is_a_vpn_and_how_d
Source: chromecache_355.2.dr	String found in binary or memory: https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/what_is_aboutblank_in_c
Source: chromecache_436.2.dr	String found in binary or memory: https://admin.youtube.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics-stage.avcdn.net
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics-stage.avcdn.net/v4/receive/json/%d
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://analytics-stage.avcdn.net/v4/receive/json/%dhttps://analytics.avcdn.net/v4/receive/json/%d8
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics-stage.avcdn.net/v4/receive/json/%dnorton_account_idslicensehttps://analytics.avcdn
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics-stage.avcdn.nethttps://analytics.avcdn.net/v4/receive/json/67A1
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics.avcdn.net
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A75000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/%d
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/15
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/15;-90
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/15Error
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A94000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2523819682.0000013138AB4000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A94000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524335227.0000013138ABA000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/70
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A75000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524026047.000001313DB47000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/70.
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524026047.000001313DB47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/70.K
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524026047.000001313DB47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/70.W
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524026047.000001313DB47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/v4/receive/json/70.t
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.surfeasy.com/;https://
Source: chromecache_575.2.dr	String found in binary or memory: https://app.upsellit.com
Source: chromecache_355.2.dr	String found in binary or memory: https://apps.apple.com/us/app/google-chrome/id535886823
Source: chromecache_494.2.dr	String found in binary or memory: https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js
Source: chromecache_355.2.dr	String found in binary or memory: https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.min.js
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://bloatware.ff.avast.com/avast/ss/
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bloatware.ff.avast.com/avast/ss/2
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bloatware.ff.avast.com/avast/ss/pdmVBY3Rpdm
Source: chromecache_355.2.dr	String found in binary or memory: https://blog.avast.com
Source: chromecache_355.2.dr	String found in binary or memory: https://blog.avast.com/topic/business-security
Source: chromecache_355.2.dr	String found in binary or memory: https://blog.avast.com/topic/privacy
Source: chromecache_268.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exe?campaign_source=av_install_t
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exeJ
Source: Instup.exe, 0000000D.00000002.2581111934.00000161E8DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exeffer=0
Source: chromecache_355.2.dr	String found in binary or memory: https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js
Source: chromecache_355.2.dr	String found in binary or memory: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Source: chromecache_355.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/apexcharts/3.45.2/apexcharts.min.js
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chess24.com/;https://
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chromecache_355.2.dr	String found in binary or memory: https://decoded.avast.io/
Source: chromecache_288.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_436.2.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502767504.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502815056.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502715512.000001313B417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.microsoft.c
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502472913.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502589470.000001313B417000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2502628573.000001313B425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.microsoft.c%
Source: chromecache_355.2.dr	String found in binary or memory: https://f.hubspotusercontent40.net/hub/4650993/New_Avast_Academy/Computer%20Virus/Academy-Computer-V
Source: chromecache_355.2.dr	String found in binary or memory: https://f.hubspotusercontent40.net/hub/4650993/New_Avast_Academy/Hackers/Hacker-Thumb-a1.png?width=3
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://fallback.nos-avg.cz./servers.json
Source: chromecache_355.2.dr	String found in binary or memory: https://forum.avast.com/
Source: chromecache_288.2.dr, chromecache_436.2.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://hns-legacy.sb.avast.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exefg://FwSe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exent
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av//avast_premium_security_online_setup.exe/avast_omni_online_s
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av/release/avast_one_essential_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av/release/avast_one_essential_online_setup.exeE
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av/release/avast_one_essential_online_setup.exeg/Webma0n
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av/release/avast_one_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-av/release/avast_one_online_setup.exexea%Q
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exe1Webma
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeDumptn
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeU
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exeHeaderHDn
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exerotli
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579800495.00000161E8BD0000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release-one/avast_driver_updater_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release-one/avast_driver_updater_online_setup.exeov.br
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_o0
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_online_setup.exe//config/Stream
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_online_setup.exey
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579800495.00000161E8BD0000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-tu/release-one/avast_cleanup_online_setup.exe
Source: asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-tu/release/avast_cleanup_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-tu/release/avast_cleanup_online_setup.exeM32_$G
Source: asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exeD
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exesic
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exexe
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exexeM
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exexec
Source: chromecache_436.2.dr	String found in binary or memory: https://i.ytimg.com/vi/
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iavs9x.u.avcdn.net/iavs9x/avast_free_antivirus_setup_online_x64.exe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579400413.00000161E866F000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://id.avast.com
Source: chromecache_355.2.dr	String found in binary or memory: https://id.avast.com/?target=https%3A%2F%2Fbusiness.avast.com%3A443%2F#login
Source: chromecache_355.2.dr	String found in binary or memory: https://id.avast.com/en-us
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://id.avast.com/inAvastium
Source: Instup.exe, 0000000D.00000002.2579244354.00000161E8633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.avast.com/inAvastiumc
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.avast.com/inAvastiumhpam
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.avast.com/inAvastiumrC
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://id.avast.comI
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://identityprotection.avast.com
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://identityprotection.avast.comedG
Source: chromecache_355.2.dr	String found in binary or memory: https://idprotection.avast.com/app/doc/Summary%20SOC%20$2M%20SE%20RW%202023.pdf
Source: asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://ipm-provider.ff.avast.com/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/.com
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/bled
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/m
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/php
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/ps18
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/tiny
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2579400413.00000161E866F000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://ipm.avcdn.net/
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm.avcdn.net/1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm.avcdn.net/api/?action=2&p_elm=136
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm.avcdn.net/api/?action=2&p_elm=136h/c
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm.avcdn.net/api/?action=2&p_elm=137
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm.avcdn.net/api/?action=2&p_elm=137Itp
Source: chromecache_436.2.dr	String found in binary or memory: https://jnn-pa.googleapis.com
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lastpass.com/;https://
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.avast.
Source: asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://my.avast.com
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.avast.comm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outside-scanner-v6.ff.avast.com/v2
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://outside-scanner-v6.ff.avast.com/v2/inspection
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outside-scanner-v6.ff.avast.com/v2/inspectiona
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://outside-scanner.ff.avast.com/v2/inspection
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outside-scanner.ff.avast.com/v2/inspectionngesa
Source: chromecache_268.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_268.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://pair.ff.avast.com
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pair.ff.avast.comerver
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pair.ff.avast.comnSeconds
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pair.ff.avast.comvgup
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://pamcdn.avast.com/pamcdn/extensions/install/win/extension/index.html?p_pei=%token%&cn=%cn%&cs
Source: chromecache_355.2.dr	String found in binary or memory: https://partners.avast.com/s/login/
Source: chromecache_436.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_355.2.dr	String found in binary or memory: https://play.google.com/store/apps/details/Google_Chrome_Fast_Secure?id=com.android.chrome
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/contacts
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/en-us
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/events
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/media-materials
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/news
Source: chromecache_355.2.dr	String found in binary or memory: https://press.avast.com/privacy-listing/en/do-not-sell
Source: chromecache_575.2.dr	String found in binary or memory: https://prod.upsellit.com
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickbooksratable.api.intuit.com/;https://s-install.avcdn.net/;https://
Source: chromecache_436.2.dr	String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: chromecache_436.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers
Source: chromecache_436.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#middleware
Source: chromecache_436.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware
Source: chromecache_355.2.dr	String found in binary or memory: https://resources.digital-cloud.medallia.eu/wdceu/82320/onsite/embed.js
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9x
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9x-xp
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9x-xp9
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9x-xp~C
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9x.phprB
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-iavs9x.avcdn.net/iavs9xvps18
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527631024.000001313DB7B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BC4000.00000004.00000020.00020000.00000000.sdmp, asw1375e63c8da87c9a.tmp.new.13.dr	String found in binary or memory: https://s-nuistatic.avcdn.net/nui/avast/1.0.327/updatefile.json
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-vps18.avcdn.net/vps18
Source: Instup.exe, 0000000D.00000002.2581111934.00000161E8DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vps18.avcdn.net/vps18F
Source: Instup.exe, 0000000D.00000002.2581111934.00000161E8DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vps18.avcdn.net/vps18http
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-vps18tiny.avcdn.net/vps18tiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vps18tiny.avcdn.net/vps18tinyM
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vps18tiny.avcdn.net/vps18tinyPB
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-vpsnitro.avcdn.net/vpsnitro
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vpsnitro.avcdn.net/vpsnitro?
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://s-vpsnitrotiny.avcdn.net/vpsnitrotiny
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-vpsnitrotiny.avcdn.net/vpsnitrotiny/:
Source: chromecache_355.2.dr	String found in binary or memory: https://s.go-mpulse.net/boomerang/
Source: chromecache_355.2.dr	String found in binary or memory: https://s2.go-mpulse.net/boomerang/
Source: chromecache_355.2.dr	String found in binary or memory: https://static.avast.com/client.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/c/v3/avast.css
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/c/v3/avast/local/en-us/local.css
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/c/v3/avast/pages/index.css
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/_awards/av-test-best-protection-2022.png?height=
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/_awards/av-test-top-product-16-9.png?height=38
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/_awards/avc-top-rated-2022.png?height=72
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/gloweb-8096/family-protection-controls.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/gloweb-8096/viruses.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=448
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=508
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=580
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=628
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=664
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=688
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=448
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=508
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=580
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=628
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=664
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=688
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/avast-logos/avast-logo-default.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/avast-logos/avast-logo-inverse.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/gen-logos/gen-logo.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/browsers/chrome.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/160x96/junk-free-devices-
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/160x96/premium-security.s
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/160x96/protect-privacy--l
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/48x48/message/discount-1-
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_antitrack_w
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_avast-one.s
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_breachguard
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_cleanup-pre
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_driver-upda
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_free-antivi
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_online-priv
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_premium-sec
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secure-brow
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secure-iden
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secureline-
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/48/prodico-48_avast-one.s
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/seo/apple-touch-icon.png?v=1
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/seo/favicon.ico?v=1
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/seo/favicon.svg?v=1
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/icons/seo/open-graph-image.png
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/illustrations/dtyp-thumb-lg.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/i/v3/components/illustrations/dtyp-thumb-sm.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/avast.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/aa-helper.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/ab-download-ids.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/cmp-academy-carousel.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/cmp-countdown.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/cmp-sticky-bars.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/singleDL-primary.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/singleDL-secondary.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/components/userAgentDetect.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/pages/index.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/vendor/bootstrap-native-v5.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/vendor/cash.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/vendor/countUp-2.8.0.umd.min.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/vendor/tiny-slider-2.9.4.min.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/v3/vendor/trustpilot.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/j/vendor/one-trust.js
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/10003548/web/o/legal/Avast-Modern-Slavery-Statement-2022.pdf
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/web/i/v3/components/store-badge/app-store/app-store-badge.svg
Source: chromecache_355.2.dr	String found in binary or memory: https://static3.avast.com/web/i/v3/components/store-badge/google-play/google-play.svg
Source: chromecache_268.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_268.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stdl.qq.com/;https://
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://storage.cloud.google.com/;https://services.google.com/;https://lh
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stream-production.avcdn.net
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stream-production.avcdn.net$H
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://submit.sb.avast.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://submit.sb.avast.comhttps://hns-legacy.sb.avast.comContent-Type/V1/MDRequest
Source: chromecache_355.2.dr	String found in binary or memory: https://support.avast.com/en-us/index
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://support.avast.com/issue_detailstatus_imgtemplate
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/;https://accounts.google.com/;https://ssl.gstatic.com/;https://clients6.g
Source: chromecache_436.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: chromecache_436.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: chromecache_436.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: chromecache_436.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: chromecache_268.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_355.2.dr	String found in binary or memory: https://twitter.com/Avast
Source: chromecache_355.2.dr	String found in binary or memory: https://twitter.com/avast_antivirus
Source: chromecache_355.2.dr	String found in binary or memory: https://uk.trustpilot.com/review/www.avast.com
Source: chromecache_355.2.dr	String found in binary or memory: https://us.cloudcare.avg.com/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cg
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-b
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bi
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/i
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iaNk
Source: servers.def.12.dr	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi-107
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi0X
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi37:1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi37:1%
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi5
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi.cgi7:1m
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi/iavs5xh=
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi0)0X
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi254.23
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi4
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi54759.iavsh
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiCI6W3siZ3J
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiF9taWQifV1Xm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiFQwMDowMDo
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiFdfSx7ImV
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiM
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiP
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiSI6W3sidmF8m
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiWxtIn0seyJ
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiXNzZXEiOlt
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiXRfaW50ZXJ
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi_bopaos
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi_mcosit
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgia
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiabled2ZXA
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiabledhbWU
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiault
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgidd
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgidscmVhdGV
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiefM119LHsps
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiefcF9wcm8
Source: Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgifz
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgig
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgig=
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgihcm
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny-
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny37:1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny37:1E
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny37:1U
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny5
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiiny637:1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinyE
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinyNdfSx
Source: Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinyP
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinyU
Source: Instup.exe, 0000000D.00000002.2579163790.00000161E860A000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinya
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinye
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiinyp.exe8r
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgijoiaXBtLnB(m
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgijoicF9lbG0
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgijp7InBhcmF
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgikgrarXSw
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgimFyaWFibGU0m
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgimnid
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cginwt
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgioIPx=o
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiool.exes_
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgip_dnds
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgips9tiny.u.
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgir.cpp(153)
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgirationdate
Source: Instup.exe, 0000000D.00000002.2578427077.00000161E6BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgisting
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgit
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgitp://p9854P=
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgitp://sm00.
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiu.avast.co=
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgixpN
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiyJncmVhdGV
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.stats.avast.com/cgi-bin/iavs4stats.cgizvf
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7.sw
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DB68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DB68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/7
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A75000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/:
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi%
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi(
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi(=?
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2523819682.0000013138AB4000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575853746.0000013138ABC000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528175894.0000013138ABC000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2524335227.0000013138ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi.?P
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi0
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi14
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi2
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi37:1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi7:1
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi=
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiBlYXR
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiFyYW1pm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiIiOjMxm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiJ2YWx
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiNlbWVPm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiQiOltHm
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiRvSW5
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiV4cGl(r
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiZlQWN
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi_idu
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi_slvp0l
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528269820.0000013138A94000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgia
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgib7210
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgicZA
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgidusn
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgihPcHR
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575853746.0000013138AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgii
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgioiaXB
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgion
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgit7InZ
Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgitp
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiu
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DB68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/m
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2523819682.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527743523.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526743341.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com:443/cgi-bin/iavsevents.cgi/d
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575853746.0000013138AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com:443/cgi-bin/iavsevents.cgise
Source: chromecache_436.2.dr	String found in binary or memory: https://viacon.corp.google.com
Source: Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://viruslab-samples.sb.avast.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://winqual.sb.avast.com
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://winqual.sb.avast.comStreamback
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wow-upgrade.uc.cn/;ht
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wow-upgrade.uc.cn/;https://
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-academy
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-computer-virus
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-email-encryption
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-hacker
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-how-to-clean-your-computer-screen
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-how-to-keep-kids-safe-online
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-how-to-speed-up-internet-connection
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-packet-loss-test-guide
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-what-is-a-vpn
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/c-what-is-about-blank-and-is-it-safe
Source: chromecache_355.2.dr	String found in binary or memory: https://www.avast.com/en-us/index
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.avast.com/vendor
Source: Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.avast.com/vpn-territory
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.avg.com/license-retrievaloption:currentpage_titleinvalid_valuepopup
Source: chromecache_575.2.dr	String found in binary or memory: https://www.dpbolvw.net/click-2681135-13305660?url=
Source: chromecache_268.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_355.2.dr	String found in binary or memory: https://www.google.com/chrome/
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.google.com/intl/%s/chrome/browser/privacy/eula_text.htmlhttps://www.google.com/chrome/br
Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.google.com/intl/%s/policies/terms/p
Source: chromecache_436.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_268.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_436.2.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: chromecache_268.2.dr	String found in binary or memory: https://www.googlesyndication.com
Source: chromecache_268.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_355.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_355.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PZ48F8
Source: chromecache_436.2.dr	String found in binary or memory: https://www.gstatic.com/ytlr/img/sign_in_avatar_default.png?rn=
Source: chromecache_355.2.dr	String found in binary or memory: https://www.instagram.com/avast
Source: chromecache_355.2.dr	String found in binary or memory: https://www.linkedin.com/company/avast-software
Source: chromecache_268.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sharelatex.com/;https://
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found2=true
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found=true
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/hound/pixel.jsp?companyID=5568
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?aff_click=
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?avast_pixels=
Source: chromecache_575.2.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?pixel_found=
Source: chromecache_288.2.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_436.2.dr	String found in binary or memory: https://www.youtube.com/api/drm/fps?ek=
Source: chromecache_355.2.dr	String found in binary or memory: https://www.youtube.com/avast
Source: chromecache_436.2.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: chromecache_268.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_436.2.dr	String found in binary or memory: https://youtu.be/
Source: chromecache_436.2.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: chromecache_436.2.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: chromecache_436.2.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 50326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 50336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 50338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443

Source: unknown	HTTPS traffic detected: 184.29.132.67:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.29.132.67:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50336 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50338 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:50340 version: TLS 1.2

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FFDF8258AF0 OpenClipboard,GlobalAlloc,GlobalAlloc,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,SetClipboardData,SetClipboardData,CloseClipboard,

13_2_00007FFDF8258AF0

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8258AF0 OpenClipboard,GlobalAlloc,GlobalAlloc,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,SetClipboardData,SetClipboardData,CloseClipboard,		13_2_00007FFDF8258AF0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8258570 OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,RegisterClipboardFormatW,SetClipboardData,CloseClipboard,		13_2_00007FFDF8258570

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FFDF80BE890 KillTimer,GetAsyncKeyState,GetDoubleClickTime,SetTimer,GetAsyncKeyState,KillTimer,KillTimer,GetCursorPos,WindowFromPoint,ScreenToClient,KillTimer,KillTimer,GetCursorPos,ScreenToClient,GetAsyncKeyState,

13_2_00007FFDF80BE890

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FF7AC4F13C0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,

13_2_00007FF7AC4F13C0

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_0030A100: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,

10_2_0030A100

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_3716_1309213455

Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003052F0	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0030BB70	10_2_0030BB70
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0031C9D0	10_2_0031C9D0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0032126C	10_2_0032126C
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0030D340	10_2_0030D340
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0030EDE0	10_2_0030EDE0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_0031CE7E	10_2_0031CE7E
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003166E4	10_2_003166E4
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Code function: 12_2_00007FF751B71000	12_2_00007FF751B71000
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Code function: 12_2_00007FF751C51FC8	12_2_00007FF751C51FC8
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC508F90	13_2_00007FF7AC508F90
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A9980	13_2_00007FF7AC3A9980
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC507190	13_2_00007FF7AC507190
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC509550	13_2_00007FF7AC509550
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A5E30	13_2_00007FF7AC3A5E30
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC4FDF90	13_2_00007FF7AC4FDF90
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC57BF34	13_2_00007FF7AC57BF34
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3B97F0	13_2_00007FF7AC3B97F0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A1000	13_2_00007FF7AC3A1000
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A5890	13_2_00007FF7AC3A5890
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC57D068	13_2_00007FF7AC57D068
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC56D820	13_2_00007FF7AC56D820
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3B6850	13_2_00007FF7AC3B6850
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A5122	13_2_00007FF7AC3A5122
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3B6290	13_2_00007FF7AC3B6290
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A2310	13_2_00007FF7AC3A2310
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3A7AA0	13_2_00007FF7AC3A7AA0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC56FAB8	13_2_00007FF7AC56FAB8
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3B1380	13_2_00007FF7AC3B1380
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3AD390	13_2_00007FF7AC3AD390
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC580400	13_2_00007FF7AC580400
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC4F9C10	13_2_00007FF7AC4F9C10
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC56DBF4	13_2_00007FF7AC56DBF4
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC56D44C	13_2_00007FF7AC56D44C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81F1920	13_2_00007FFDF81F1920
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80BE890	13_2_00007FFDF80BE890
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EF890	13_2_00007FFDF80EF890
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF829E8C0	13_2_00007FFDF829E8C0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF818A8A0	13_2_00007FFDF818A8A0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80FB910	13_2_00007FFDF80FB910
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8361954	13_2_00007FFDF8361954
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80FF950	13_2_00007FFDF80FF950
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EA990	13_2_00007FFDF80EA990
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80F29D0	13_2_00007FFDF80F29D0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80E6A70	13_2_00007FFDF80E6A70
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8105A80	13_2_00007FFDF8105A80
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8143B00	13_2_00007FFDF8143B00
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8111AF0	13_2_00007FFDF8111AF0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80CAB00	13_2_00007FFDF80CAB00
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF832CAE0	13_2_00007FFDF832CAE0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF837FB1C	13_2_00007FFDF837FB1C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8360BA4	13_2_00007FFDF8360BA4
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8178BC0	13_2_00007FFDF8178BC0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8321B70	13_2_00007FFDF8321B70
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8362B84	13_2_00007FFDF8362B84
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80CDC00	13_2_00007FFDF80CDC00
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF836BCD0	13_2_00007FFDF836BCD0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80CDCD0	13_2_00007FFDF80CDCD0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8180D50	13_2_00007FFDF8180D50
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8145D30	13_2_00007FFDF8145D30
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF818BDC0	13_2_00007FFDF818BDC0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8106DB0	13_2_00007FFDF8106DB0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EADA0	13_2_00007FFDF80EADA0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8115E80	13_2_00007FFDF8115E80
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8362FB8	13_2_00007FFDF8362FB8
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF82A7F7C	13_2_00007FFDF82A7F7C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8114F70	13_2_00007FFDF8114F70
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80B6F8C	13_2_00007FFDF80B6F8C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF838EF60	13_2_00007FFDF838EF60
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EEFA0	13_2_00007FFDF80EEFA0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8333020	13_2_00007FFDF8333020
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF837EFEC	13_2_00007FFDF837EFEC
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80F3050	13_2_00007FFDF80F3050
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF838A01C	13_2_00007FFDF838A01C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8107040	13_2_00007FFDF8107040
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81F2070	13_2_00007FFDF81F2070
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8362070	13_2_00007FFDF8362070
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80FD0A0	13_2_00007FFDF80FD0A0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81120A0	13_2_00007FFDF81120A0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81060D0	13_2_00007FFDF81060D0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81F7160	13_2_00007FFDF81F7160
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80F0210	13_2_00007FFDF80F0210
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80E6210	13_2_00007FFDF80E6210
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8107200	13_2_00007FFDF8107200
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF83731F0	13_2_00007FFDF83731F0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF832A260	13_2_00007FFDF832A260
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81002C0	13_2_00007FFDF81002C0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81062C0	13_2_00007FFDF81062C0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80F12E0	13_2_00007FFDF80F12E0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80BB3A0	13_2_00007FFDF80BB3A0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8329420	13_2_00007FFDF8329420
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF83603FC	13_2_00007FFDF83603FC
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80FB490	13_2_00007FFDF80FB490
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF837F49C	13_2_00007FFDF837F49C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF815E4E0	13_2_00007FFDF815E4E0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF83844F0	13_2_00007FFDF83844F0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8105550	13_2_00007FFDF8105550
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80CD590	13_2_00007FFDF80CD590
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80E55C0	13_2_00007FFDF80E55C0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EE620	13_2_00007FFDF80EE620
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8258630	13_2_00007FFDF8258630
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF832A750	13_2_00007FFDF832A750
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF832C6F0	13_2_00007FFDF832C6F0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80F0720	13_2_00007FFDF80F0720
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF81CB730	13_2_00007FFDF81CB730
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80ED760	13_2_00007FFDF80ED760
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF83607D0	13_2_00007FFDF83607D0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF80EC810	13_2_00007FFDF80EC810
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8138830	13_2_00007FFDF8138830

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: String function: 00007FFDF831F6C0 appears 44 times
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: String function: 00007FFDF82996BC appears 32 times
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: String function: 00007FF7AC3A66D0 appears 114 times
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: String function: 00007FFDF835E900 appears 47 times
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: String function: 00007FFDF81F6E70 appears 31 times

Source: Instup.dll.12.dr	Static PE information: Resource name: FILE type: PE32 executable (console) Intel 80386, for MS Windows
Source: Instup.dll.12.dr	Static PE information: Resource name: FILE type: PE32+ executable (GUI) x86-64, for MS Windows
Source: Instup.dll.12.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: Instup.dll.12.dr	Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped
Source: Instup.dll.12.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS

Source: 51922015-367a-49cc-ab83-0c843030d492.tmp.0.dr

Static PE information: No import functions for PE file found

Source: 51922015-367a-49cc-ab83-0c843030d492.tmp.0.dr

Static PE information: Data appended to the last section found

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: instup.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Section loaded: winrnr.dll	Jump to behavior

Source: chromecache_261.2.dr	Binary string: @\\.\PhysicalDrive%u\\.\Scsi%u:SCSIDISKGetSystemFirmwareTable\Device\PhysicalMemoryNtOpenSection0123456789ABCDEF0123456789abcdef0123456789ABCDEFUnable to convert invalid hexadecimal string!Unable to convert invalid hexadecimal character!
Source: Instup.exe.12.dr	Binary string: install_guidproduct-info.xmlcookiepsh.productrunninggacidicarus_fwk-av-vpsCould not create testing volatile key {}Icarus_Volatile is NOT volatile!!!Icarus_Volatile is volatiletest-SOFTWARE\Icarus_Volatile\product-info/versionCould not delete non-volatile icarus keyEnclosureInformatonSNBoardInformationTAGBoardInformationSNSystemInformationSNDiskSN4DiskSN3DiskSN2DiskSN1PowerSupplyPNBatterySNMemoryTAGMemorySNMemoryPNProcessorTAGProcessorSNEnclosureInformatonTAG\\.\Scsi%u:DiskMajoritySNProcessorIDSystemUUIDPowerSupplyTAGPowerSupplySN%d/%d/%dNtOpenSection\Device\PhysicalMemoryGetSystemFirmwareTableSCSIDISK
Source: Instup.exe.12.dr	Binary string: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon AppDataUnable to retrieve a path of the known folder ({})!Unable to retrieve the path of the module!Unable to store the path of the module!Unable to get the path of the module!SOFTWARE\Microsoft\Windows\CurrentVersionProgramFilesDir%LOCALAPPDATA%%APPDATA%ProgramFilesCommonFilesDirCommonProgramFiles\\?\Unable to convert NT path '{}' to a volume GUID path!Unable to enumerate volumes!\Device\LanmanRedirector\Unable to retrieve volume paths for volume '{}'!\SystemRoot\\Device\Mup\WSL Process\\.\AVRSP\\.\NLLSP\\.\AVGSP_Open\\.\ASWSP_Open\\.\AVGSP\\.\ASWSP\\.\AVRSP_Open\\.\NLLSP_OpenRtlCaptureStackBackTracesettings.iniavast5.iniav-vpsavicarusduclearcctuvpnbsbgpapsq-pamatrksbfamilysuite-cc-icarus-family-suite-avInvalid product id!-du-bgAvastUnable to determine legacy product enumeration from product identifier!PlaceholderBrandShortNameAntivirus{}ToolsSvc.exeNortonPlaceholderBrandCompanyPlaceholderBrandAvast SoftwareaviranortonPiriformAviraAVGPrivaxprivaxpiriformavastavgAVG TechnologiespvxAvgPlaceholderBrandLongCompanyNamePlaceholderBrandShortCompanyNamePlaceholderBrandCapitalizedLongPrefixPlaceholderBrandPrefixavrprfnllNortonIcarusEnabled

Source: classification engine

Classification label: mal52.troj.evad.win@38/681@222/60

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_003052F0 InterlockedExchange,GetCurrentProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CreateMutexW,GetLastError,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CoInitializeEx,CoCreateInstance,CoUninitialize,InterlockedExchange,GetLastError,InterlockedExchange,MessageBoxExW,wsprintfW,wsprintfW,MessageBoxExW,InterlockedExchange,InterlockedExchange,CreateThread,FindCloseChangeNotification,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,wsprintfW,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,MoveFileExW,GetDiskFreeSpaceExW,InterlockedExchange,InterlockedExchange,MessageBoxExW,InterlockedExchange,GetLastError,InterlockedExchange,wsprintfW,wsprintfW,MessageBoxExW,CloseHandle,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,CreateProcessW,InterlockedExchange,GetLastError,InterlockedExchange,AllowSetForegroundWindow,ResumeThread,InterlockedExchange,GetLastError,InterlockedExchange,PostMessageW,WaitForSingleObject,GetExitCodeProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,CloseHandle,CloseHandle,CloseHandle,_wcsrchr,_wcsrchr,CreateHardLinkW,CopyFileW,ReleaseMutex,CloseHandle,___delayLoadHelper2@8,

10_2_003052F0

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_00301930 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GlobalFree,CoInitializeEx,CoCreateInstance,GetDC,CreateDIBSection,ReleaseDC,DeleteObject,

10_2_00301930

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_003038C0 CreateFileMappingW,GetLastError,MapViewOfFile,GetLastError,FindResourceW,LoadResource,wsprintfW,GetLastError,UnmapViewOfFile,CloseHandle,SetLastError,

10_2_003038C0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\51922015-367a-49cc-ab83-0c843030d492.tmp

Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Asw_ccc659d6ab8decd746143d4adc07a2c6
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

File created: C:\Windows\Temp\asw.5ce619ffd386e95f

Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: /silent	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: /cookie	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: /ppi_icd	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: /cust_ini	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: Enabled	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxyType	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: Port	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: User	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: Password	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: ProxySettings	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: Properties	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: /smbupd	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: enable	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: mirror	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: count	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: servers	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: urlpgm	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: server0	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: http://	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: https://	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: allow_fallback	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: mirror	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: installer.exe	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: {versionSwitch}	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: stable	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: %s\%s	10_2_003052F0
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Command line argument: X>2	10_2_003052F0

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

File read: C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.ini

Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Instup.exe	String found in binary or memory: <!--StartFragment-->
Source: Instup.exe	String found in binary or memory: animation-start!

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5712 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Process created: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe "C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe "C:\Windows\Temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5712 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Process created: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe "C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe "C:\Windows\Temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f	Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

File written: C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.ini

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\Sbr.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\InstCont.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmp, Instup.exe, 0000000D.00000000.2535888882.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmp, Instup.exe.12.dr
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxInst.pdbv source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\HTMLayout.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: MsiZap.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2599204086.00007FFDF9376000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxInst.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000000.2496123337.00007FF751C81000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\Instup.pdb source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000000.2471534604.0000000000323000.00000002.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_00308130 LoadLibraryA,GetProcAddress,FreeLibrary,

10_2_00308130

Source: 51922015-367a-49cc-ab83-0c843030d492.tmp.0.dr

Static PE information: real checksum: 0x45426 should be: 0xd686

Source: 51922015-367a-49cc-ab83-0c843030d492.tmp.0.dr	Static PE information: section name: .didat
Source: Unconfirmed 663905.crdownload.0.dr	Static PE information: section name: .didat
Source: chromecache_261.2.dr	Static PE information: section name: .didat
Source: avast_free_antivirus_setup_online_x64.exe.10.dr	Static PE information: section name: .didat
Source: avast_free_antivirus_setup_online_x64.exe.10.dr	Static PE information: section name: _RDATA
Source: Instup.exe.12.dr	Static PE information: section name: _RDATA
Source: HTMLayout.dll.12.dr	Static PE information: section name: _RDATA
Source: Instup.dll.12.dr	Static PE information: section name: .didat
Source: Instup.dll.12.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00311396 push ecx; ret		10_2_003113A9
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC3BFD47 push rax; retf 0019h		13_2_00007FF7AC3BFD4D

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u

10_2_0030A100

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe (copy)	Jump to dropped file
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll	Jump to dropped file
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	File created: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\51922015-367a-49cc-ab83-0c843030d492.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 261	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 663905.crdownload	Jump to dropped file

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll	Jump to dropped file
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	File created: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	File created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 261
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 261			Jump to dropped file

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

10_2_003052F0

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u

10_2_0030A100

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr

Jump to behavior

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	System information queried: FirmwareTableInformation	Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FF7AC508F90 rdtsc

13_2_00007FF7AC508F90

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Dropped PE file which has not been started: C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll

Jump to dropped file

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

API coverage: 5.7 %

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe TID: 6492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe TID: 6340	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe TID: 6992	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_0030792C VirtualQuery,GetSystemInfo,

10_2_0030792C

Source: Instup.exe, 0000000D.00000002.2585227969.00000161E9BB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.000000000502B000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2523819682.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527743523.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526743341.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2528137850.0000013138AA9000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575720163.0000013138AA9000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2575071949.0000013138A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Instup.exe, 0000000D.00000002.2578929191.00000161E8590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FF7AC508F90 rdtsc

13_2_00007FF7AC508F90

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FF7AC4F14D0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,LdrUnlockLoaderLock,GetCurrentThread,OpenThreadToken,GetLastError,ImpersonateSelf,GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetLastError,CloseHandle,RevertToSelf,CloseHandle,

13_2_00007FF7AC4F14D0

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_003110FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_003110FF

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Code function: 13_2_00007FF7AC55D66C GetLastError,IsDebuggerPresent,OutputDebugStringW,

13_2_00007FF7AC55D66C

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_00308130 LoadLibraryA,GetProcAddress,FreeLibrary,

10_2_00308130

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_00317C5A mov eax, dword ptr fs:[00000030h]

10_2_00317C5A

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_003027B0 GetLastError,GetLastError,GetLastError,GetFileSizeEx,wsprintfW,SetFilePointerEx,SetEndOfFile,GetLastError,InterlockedExchange,GetProcessHeap,RtlAllocateHeap,WriteFile,InterlockedExchangeAdd,GetLastError,SetFilePointerEx,SetEndOfFile,GetLastError,GetProcessHeap,RtlFreeHeap,GetLastError,SetLastError,

10_2_003027B0

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003110FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_003110FF
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00311292 SetUnhandledExceptionFilter,	10_2_00311292
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_003113AB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_003113AB
Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Code function: 10_2_00314476 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00314476
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Code function: 12_2_00007FF751C296DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF751C296DC
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Code function: 12_2_00007FF751C29214 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF751C29214
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Code function: 12_2_00007FF751C38770 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF751C38770
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC55CD3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF7AC55CD3C
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FF7AC571844 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FF7AC571844
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF8374B74 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FFDF8374B74
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: 13_2_00007FFDF83341F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FFDF83341F8

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe	Process created: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe "C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f			Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe "C:\Windows\Temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f			Jump to behavior

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe "c:\windows\temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:c:\windows\temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:c:\windows\temp\asw.5ce619ffd386e95f
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Process created: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe "c:\windows\temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:c:\windows\temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:c:\windows\temp\asw.5ce619ffd386e95f			Jump to behavior

Source: avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp

Binary or memory string: MonitorFromWindowUSER32.DLLWorkerWProgmanGetMonitorInfoW%s KERNEL32.DLL

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_0031153D cpuid

10_2_0031153D

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00007FF7AC589D64
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: GetLocaleInfoW,	13_2_00007FF7AC583DB0
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: EnumSystemLocalesW,	13_2_00007FF7AC589678
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: EnumSystemLocalesW,	13_2_00007FF7AC589748
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: EnumSystemLocalesW,	13_2_00007FF7AC5838D4
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_00007FF7AC589B88
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	13_2_00007FF7AC589328
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Code function: GetLocaleInfoA,LeaveCriticalSection,	13_2_00007FFDF80B7E67

Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Queries volume information: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Queries volume information: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Queries volume information: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Queries volume information: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	Queries volume information: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log VolumeInformation	Jump to behavior

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_003041B0 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetVersionExA,GetNativeSystemInfo,wsprintfA,wsprintfA,lstrcatA,lstrlenA,

10_2_003041B0

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Code function: 10_2_0030A100 GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,

10_2_0030A100

Source: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	13 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	31 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Bootkit	12 Process Injection	13 Virtualization/Sandbox Evasion	1 Network Sniffing	161 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	12 Process Injection	Security Account Manager	13 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bootkit	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Network Sniffing	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	56 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	0%	Virustotal		Browse
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Link
C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll	0%	ReversingLabs
C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll	0%	Virustotal	Browse
C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll	0%	ReversingLabs
C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll	0%	Virustotal	Browse
C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	0%	ReversingLabs
C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe	0%	Virustotal	Browse
C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	0%	ReversingLabs
C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
vc-live-cf.hotjar.io	0%	Virustotal	Browse
medallia2.map.fastly.net	0%	Virustotal	Browse
group43.sites.hscoscdn40.net	0%	Virustotal	Browse
spdc-global.pbp.gysm.yahoodns.net	0%	Virustotal	Browse
norton.com.ssl.sc.omtrdc.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
edge.gycpi.b.yahoodns.net	0%	Virustotal	Browse
173bf109.akstat.io	0%	Virustotal	Browse
s.go-mpulse.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://s2.go-mpulse.net/boomerang/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.avast.com0/	0%	URL Reputation	safe
about:blank	0%	Avira URL Cloud	safe
http://keys.backup.norton.comLO.3120accountkeysCCT	0%	Avira URL Cloud	safe
https://identityprotection.avast.comedG	0%	Avira URL Cloud	safe
https://stream-production.avcdn.net$H	0%	Avira URL Cloud	safe
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exe	0%	Avira URL Cloud	safe
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exe	0%	Virustotal		Browse
http://m0658849.iavs9x.u.ava	0%	Avira URL Cloud	safe
https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_encrypt_email_ac	0%	Avira URL Cloud	safe
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exeJ	0%	Avira URL Cloud	safe
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exeJ	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn2.hubspot.net	104.16.110.209	true	false		high
dart.l.doubleclick.net	142.251.40.102	true	false		high
vc-live-cf.hotjar.io	18.164.96.97	true	false	0%, Virustotal, Browse	unknown
i.ytimg.com	142.251.40.214	true	false		high
adservice.google.com	142.251.40.226	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
spdc-global.pbp.gysm.yahoodns.net	76.13.32.146	true	false	0%, Virustotal, Browse	unknown
stats.g.doubleclick.net	172.253.115.156	true	false		high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	3.225.167.6	true	false		high
www.upsellit.com	34.117.39.58	true	false		high
scontent.xx.fbcdn.net	157.240.241.1	true	false		high
script.hotjar.com	18.164.96.87	true	false		high
cdnjs.cloudflare.com	104.17.25.14	true	false		high
norton.com.ssl.sc.omtrdc.net	63.140.39.15	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.251.40.228	true	false		high
medallia2.map.fastly.net	199.232.37.230	true	false	0%, Virustotal, Browse	unknown
static-cdn.hotjar.com	108.138.106.49	true	false		high
star-mini.c10r.facebook.com	31.13.71.36	true	false		high
group43.sites.hscoscdn40.net	199.60.103.28	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false		high
accounts.google.com	172.253.122.84	true	false		high
ampcid.google.com	142.250.176.206	true	false		high
ad.doubleclick.net	142.251.32.102	true	false		high
analytics-prod-gcp.ff.avast.com	34.117.223.223	true	false		high
youtube-ui.l.google.com	142.251.40.238	true	false		high
shepherd-gcp.ff.avast.com	34.160.176.28	true	false		high
mstatic.avast.com	20.50.2.44	true	false		high
td.doubleclick.net	142.250.65.194	true	false		high
clients.l.google.com	142.250.80.110	true	false		high
widget.trustpilot.com	13.225.214.12	true	false		high
cdn.cookielaw.org	104.18.130.236	true	false		high
edge.gycpi.b.yahoodns.net	69.147.82.60	true	false	0%, Virustotal, Browse	unknown
geolocation.onetrust.com	104.18.32.137	true	false		high
cooladata.kampyle.com	35.241.45.82	true	false		high
www.avast.com	unknown	unknown	false		high
bits.avcdn.net	unknown	unknown	false		high
x5qohxqxjhzvuzoxhebq-f-3b19134bd-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
x5qohxqxjhzvuzoxhehq-f-42e1faec1-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
cm.everesttech.net	unknown	unknown	false		high
v7event.stats.avast.com	unknown	unknown	false		high
clients2.google.com	unknown	unknown	false		high
static.hotjar.com	unknown	unknown	false		high
oms.norton.com	unknown	unknown	false		high
trial-eum-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high
4711400.fls.doubleclick.net	unknown	unknown	false		high
b8003600.iavs9x.u.avast.com	unknown	unknown	false		high
x5qohxtiidpyczoxhekq-f-3f33cf437-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
assets.adobedtm.com	unknown	unknown	false		high
trial-eum-clienttons-s.akamaihd.net	unknown	unknown	false		high
connect.facebook.net	unknown	unknown	false		high
symantec.demdex.net	unknown	unknown	false		high
iavs9x.u.avcdn.net	unknown	unknown	false		high
s.yimg.com	unknown	unknown	false		high
n4291289.iavs9x.u.avast.com	unknown	unknown	false		high
www.youtube-nocookie.com	unknown	unknown	false		high
173bf109.akstat.io	unknown	unknown	false	0%, Virustotal, Browse	unknown
p1043812.iavs9x.u.avast.com	unknown	unknown	false		high
191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	unknown	unknown	false		high
sp.analytics.yahoo.com	unknown	unknown	false		high
x5qohxqxjhzvuzoxhefa-f-7c57ac479-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
s.go-mpulse.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
shepherd.ff.avast.com	unknown	unknown	false		high
static.avast.com	unknown	unknown	false		high
resources.digital-cloud.medallia.eu	unknown	unknown	false		high
vc.hotjar.io	unknown	unknown	false		unknown
udc-neb.kampyle.com	unknown	unknown	false		high
r9319236.iavs9x.u.avast.com	unknown	unknown	false		high
s-iavs9x.avcdn.net	unknown	unknown	false		high
www.nortonlifelock.com	unknown	unknown	false		unknown
dpm.demdex.net	unknown	unknown	false		high
analytics.avcdn.net	unknown	unknown	false		high
analytics.ff.avast.com	unknown	unknown	false		high
clients1.google.com	unknown	unknown	false		high
www.facebook.com	unknown	unknown	false		high
academy.avast.com	unknown	unknown	false		high
x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	unknown	unknown	false		high
y9830512.iavs9x.u.avast.com	unknown	unknown	false		high
c.go-mpulse.net	unknown	unknown	false		unknown
static3.avast.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://script.hotjar.com/modules.3ba69200791f16077ba8.js	false		high
https://4711400.fls.doubleclick.net/activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware?	false		high
https://www.avast.com/en-us/index	false		high
about:blank	false	Avira URL Cloud: safe	low
https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg	false		high
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/main.js	false		high
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775#cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true	false		high
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM	false		high
https://4711400.fls.doubleclick.net/activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex?	false		high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high
https://www.youtube-nocookie.com/s/player/2070f79f/www-embed-player.vflset/www-embed-player.js	false		high
https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://n8283613.ivps9x.u.avast.com/ivps9x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://geoip.avast.com/geoip/geoip.phpz	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://j0294597.ivps9x.u.avast.com/ivps9x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=628	chromecache_355.2.dr	false		high
http://p1043812.vps18.u.avcdn.net/vps18	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://s2.go-mpulse.net/boomerang/	chromecache_355.2.dr	false	URL Reputation: safe	unknown
https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1	chromecache_355.2.dr	false		high
http://s1843811.vpsnitrotiny.u.avast.com/vpsnitrotinyjEiLCJhm	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://h4444966.vps18.u.avcdn.net/vps18	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://m0658849.ivps9tiny.u.avast.com/ivps9tiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://sm00.avast.com/cgi-bin/iavsup2.cgi9tiny24:	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stream-production.avcdn.net$H	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiBlYXR	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sm00.avast.com/cgi-bin/iavsup2.cgi8tinyO	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://g1928587.vpsnitro.u.avast.com/vpsnitro1	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://keys.backup.norton.comLO.3120accountkeysCCT	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	low
http://s1843811.ivps9x.u.avast.com/ivps9x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://iavs9x.u.avcdn.net/iavs9x/avast_free_antivirus_setup_online_x64.exe	avast_free_antivirus_setup_online.exe, 0000000A.00000002.2574836243.0000000004F57000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoip.avast.com/geoip/geoip.phpY	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoip.avast.com/geoip/geoip.phpU	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgioiaXB	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://j0294597.iavs5x.u.avast.com/iavs5x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://geoip.avast.com/geoip/geoip.phpW	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://submit5.avast.com/cgi-bin/submit50.cgit_streamback	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.avast.com	chromecache_355.2.dr	false		high
https://static3.avast.com/10003548/web/j/v3/pages/index.js	chromecache_355.2.dr	false		high
http://geoip.avast.com/geoip/geoip.php_	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580212284.000001313C5F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://n4291289.vpsnitrotiny.u.avast.com/vpsnitrotiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://n4291289.vpsnitro.u.avast.com/vpsnitroU	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7event.stats.avast.com:443/cgi-bin/iavsevents.cgi/d	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2523819682.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527743523.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526743341.0000013138ADB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoip.avast.com/geoip/geoip.phpq	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://l7814800.vps18.u.avcdn.net/vps18e	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://submit5.avast.com/cgi-bin/submit50.cgi(	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoip.avast.com/geoip/geoip.phpm	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://y9830512.vpsnitrotiny.u.avast.com/vpsnitrotiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://n2833777.ivps9tiny.u.avast.com/ivps9tiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://www.youtube.com/generate_204?cpn=	chromecache_436.2.dr	false		high
http://g1928587.vpsnitrotiny.u.avast.com/vpsnitrotinycage	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://submit5.avast.com/cgi-bin/submit50.cgiz	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/intl/%s/toolbar/ie/partnereula.html	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	false		high
http://submit5.avast.com/cgi-bin/submit50.cgiy	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exe	asw1375e63c8da87c9a.tmp.new.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://submit5.avast.com/cgi-bin/submit50.cgiv	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://w5805295.iavs9x.u.avast.com/iavs9xa	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7.stats.avast.com/cgi-bin/iavs4stats.cgips9tiny.u.	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://us.cloudcare.avg.com/	chromecache_355.2.dr	false		high
http://s1843811.vpsnitrotiny.u.avast.com/vpsnitrotiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://n8283613.iavs5x.u.avast.com/iavs5x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exent	Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7.stats.avast.com/cgi-bin/iavs4stats.cgiu.avast.co=	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://submit5.avast.com/cgi-bin/submit50.cgiO	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://r4427608.vps18tiny.u.avcdn.net/vps18tiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://y8002308.vps18.u.avcdn.net/vps18	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://n8283613.vpsnitro.u.avast.com/vpsnitro	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://submit5.avast.com/cgi-bin/submit50.cgiU	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://d3176133.iavs5x.u.avast.com/iavs5xtro	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://doubleclick-proxy.ff.avast.com/v1/gclidu	Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sm00.avast.com/cgi-bin/iavsup2	Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7.stats.avast.com/cgi-bin/iavs4stats.cgi54759.iavsh	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://f3461309.ivps9x.u.avast.com/ivps9x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://id.avast.com/en-us	chromecache_355.2.dr	false		high
http://keys.backup.norton.com	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EA55000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2597180856.00007FFDF8EF5000.00000002.00000001.01000000.0000000E.sdmp	false		high
https://identityprotection.avast.comedG	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://m0658849.iavs9x.u.ava	Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://submit5.avast.com/cgi-bin/submit50.cgiy(	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/160x96/protect-privacy--l	chromecache_355.2.dr	false		high
http://www.avast.com0/	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526984379.000001313DC93000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2533697954.000001313EEFF000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2527338194.000001313F728000.00000004.00000020.00020000.00000000.sdmp, Instup.exe.12.dr	false	URL Reputation: safe	unknown
http://d3176133.ivps9tiny.u.avast.com/ivps9tiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000002.2580834228.000001313DBAD000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_288.2.dr	false		high
https://cdn-av-download.avastbrowser.com/avast_secure_browser_setup.exeJ	Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://p9854759.vps18.u.avcdn.net/vps18	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://sm00.avast.com/cgi-bin/iavsup2.cgi	Instup.exe, 0000000D.00000002.2590562461.00000161E9E1B000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://m0658849.iavs9x.u.avast.com/iavs9xcgi	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgib7210	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeDumptn	Instup.exe, 0000000D.00000002.2580381302.00000161E8C26000.00000004.00000020.00020000.00000000.sdmp	false		high
http://n2833777.ivps9x.u.avast.com/ivps9x	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://y9830512.ivps9tiny.u.avast.com/ivps9tiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://z4055813.vpsnitro.u.avast.com/vpsnitro	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
http://submit5.avast.com/cgi-bin/submit50.cgiyD&)	Instup.exe, 0000000D.00000002.2585227969.00000161E9B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://4650993.fs1.hubspotusercontent-na1.net/hub/4650993/New_Avast_Academy/how_to_encrypt_email_ac	chromecache_355.2.dr	false	Avira URL Cloud: safe	unknown
http://f3461309.vpsnitrotiny.u.avast.com/vpsnitrotiny	avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526165124.000001313DBA5000.00000004.00000020.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2516130366.000001313DB40000.00000004.00000800.00020000.00000000.sdmp, avast_free_antivirus_setup_online_x64.exe, 0000000C.00000003.2526369993.000001313DBA7000.00000004.00000020.00020000.00000000.sdmp, Instup.exe, 0000000D.00000002.2580381302.00000161E8C47000.00000004.00000020.00020000.00000000.sdmp, servers.def.12.dr	false		high
https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_online-priv	chromecache_355.2.dr	false		high
http://sm00.avast.com/cgi-bin/iavsup2.cgiContent526=0	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://v7.stats.avast.com/cgi-bin/iavs4stats.cgijoiaXBtLnB(m	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipm-provider.ff.avast.com/m	Instup.exe, 0000000D.00000002.2580381302.00000161E8CE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://n8283613.vps18.u.avcdn.net/vps18DC	Instup.exe, 0000000D.00000002.2585227969.00000161E9BE8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.110	clients.l.google.com	United States	15169	GOOGLEUS	false
13.225.214.29	unknown	United States	16509	AMAZON-02US	false
172.253.122.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.80.66	unknown	United States	15169	GOOGLEUS	false
157.240.241.35	unknown	United States	32934	FACEBOOKUS	false
142.251.40.134	unknown	United States	15169	GOOGLEUS	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
157.240.241.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.65.230	unknown	United States	15169	GOOGLEUS	false
63.140.39.150	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
142.250.80.36	unknown	United States	15169	GOOGLEUS	false
104.16.110.209	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
108.138.106.124	unknown	United States	16509	AMAZON-02US	false
20.50.2.44	mstatic.avast.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
76.13.32.146	spdc-global.pbp.gysm.yahoodns.net	United States	26101	YAHOO-3US	false
108.138.106.49	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
142.251.40.214	i.ytimg.com	United States	15169	GOOGLEUS	false
172.64.155.119	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.142	unknown	United States	15169	GOOGLEUS	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
172.253.63.154	unknown	United States	15169	GOOGLEUS	false
63.140.38.55	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
199.60.103.28	group43.sites.hscoscdn40.net	Canada	23181	QUICKSILVER1CA	false
18.164.96.87	script.hotjar.com	United States	3	MIT-GATEWAYSUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
199.232.37.230	medallia2.map.fastly.net	United States	54113	FASTLYUS	false
104.18.130.236	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
31.13.71.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
69.147.82.61	unknown	United States	14779	INKTOMI-LAWSONUS	false
69.147.82.60	edge.gycpi.b.yahoodns.net	United States	14779	INKTOMI-LAWSONUS	false
142.251.40.228	www.google.com	United States	15169	GOOGLEUS	false
3.225.167.6	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.176.206	ampcid.google.com	United States	15169	GOOGLEUS	false
142.251.40.102	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
142.251.40.226	adservice.google.com	United States	15169	GOOGLEUS	false
142.251.40.230	unknown	United States	15169	GOOGLEUS	false
3.219.97.208	unknown	United States	14618	AMAZON-AESUS	false
142.251.32.102	ad.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.64.70	unknown	United States	15169	GOOGLEUS	false
142.251.40.196	unknown	United States	15169	GOOGLEUS	false
34.117.39.58	www.upsellit.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
18.164.96.97	vc-live-cf.hotjar.io	United States	3	MIT-GATEWAYSUS	false
63.140.39.15	norton.com.ssl.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
13.225.214.12	widget.trustpilot.com	United States	16509	AMAZON-02US	false
63.140.38.138	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
142.250.65.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
142.251.40.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.251.40.118	unknown	United States	15169	GOOGLEUS	false
34.160.176.28	shepherd-gcp.ff.avast.com	United States	2686	ATGS-MMD-ASUS	false
34.117.223.223	analytics-prod-gcp.ff.avast.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.251.40.166	unknown	United States	15169	GOOGLEUS	false
35.241.45.82	cooladata.kampyle.com	United States	15169	GOOGLEUS	false
142.250.65.226	unknown	United States	15169	GOOGLEUS	false
34.224.119.52	unknown	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1396915
Start date and time:	2024-02-22 13:05:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.troj.evad.win@38/681@222/60
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Browse: https://www.avast.com/en-us/index Browse: https://www.avast.com/en-us/download-thank-you.php?product=FAV-ONLINE-361&locale=en-us&direct=1 Browse: https://www.avast.com/c-computer-virus Browse: https://www.avast.com/c-malware Browse: https://www.avast.com/en-us/eula Browse: https://www.avast.com/en-us/about

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.165.131, 34.104.35.123, 23.73.243.90, 23.44.208.8, 69.192.109.111, 23.56.162.167, 142.250.80.104, 23.216.136.171, 23.56.212.182, 44.207.70.222, 35.174.80.154, 3.211.157.243, 3.208.96.33, 18.235.191.213, 34.232.236.171, 13.107.21.200, 204.79.197.200, 142.251.32.110, 142.250.80.10, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.250.80.42, 142.251.40.106, 142.250.64.106, 142.251.35.170, 142.251.40.138, 142.251.40.234, 142.250.72.106, 142.250.64.74, 142.251.40.170, 142.251.41.10, 142.251.32.106, 216.239.36.178, 216.239.38.178, 216.239.32.178, 216.239.34.178, 184.87.173.10, 184.87.173.72, 23.55.235.226, 23.55.235.210, 104.126.112.180, 104.117.182.27, 104.117.182.50, 23.200.0.185, 23.200.0.189, 23.200.3.233, 23.200.3.229, 184.87.173.26, 184.87.173.11, 40.127.169.103, 72.21.81.240, 192.229.211.108, 20.3.187.198, 142.251.40.200, 23.62.113.28, 20.242.39.171, 20.114.59.183, 142.251.40.99, 104.64.223.129, 69.192.31.121, 23.37.123.248, 23.37.123.219,
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, cn-assets.adobedtm.com.edgekey.net, clientservices.googleapis.com, a1024.dscg.akamai.net, static3.avast.com.edgekey.net, e4682.dscd.akamaiedge.net, a248.b.akamai.net, ocsp.digicert.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, www.gstatic.com, www.google-analytics.com, ip46.go-mpulse.net.edgekey.net, fs.microsoft.com, content-autofill.googleapis.com, dual-a-0001.a-msedge.net, cm.everesttech.net.akadns.net, www.nortonlifelock.com.edgekey.net, www-alv.google-analytics.com, iavs9x4.u.avcdn.net.edgesuite.net, wildcard46.akstat.io.edgekey.net, edgedl.me.gvt1.com, wildcard46.go-mpulse.net.edgekey.net, www.avast.com-2.edgekey.net, e8647.dsca.akamaiedge.net, e13074.dsca.akamaiedge.net, wu.azureedge.net, fallbackupdates.avcdn.net.edgekey.net, www.googletagmanager.com, e4117.dsca.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bat.bing.com, sls
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:08:00	API Interceptor	2x Sleep call for process: avast_free_antivirus_setup_online.exe modified
13:08:03	API Interceptor	3x Sleep call for process: avast_free_antivirus_setup_online_x64.exe modified
13:08:06	API Interceptor	1x Sleep call for process: Instup.exe modified

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (503), with CRLF line terminators
Category:	modified
Size (bytes):	9216
Entropy (8bit):	5.111908671461176
Encrypted:	false
SSDEEP:	192:Ea/anCa94uZIbJfyexH035KleJpSSzb77qwksTNakTq0V00VQ4Vm009:tSH9hqtqe4jKkB3TjQ9
MD5:	7A1C0D7FF7CA93C8090B374575E5CB6F
SHA1:	754EE1E17FAB25FC40EA25A75D71197784A0022B
SHA-256:	D90277ABBBA8928C3572787E6EA90D6192DC704E2673D58C6384CA610B6FD70A
SHA-512:	180F64C9A65087781282C225EC86D0176825C096ED370DCD1ACF0EF6F9C62B043EEF6543C9376BEA57E35EB22A776231CFBB2B7B857F7E3E35F9CD5F40FB5416
Malicious:	false
Reputation:	low
Preview:	.[2024-02-22 12:08:00.845] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 957] --..[2024-02-22 12:08:00.845] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 958] START: Avast SFX stub executable..[2024-02-22 12:08:00.845] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 255] Entering SFX stub guarded code section...[2024-02-22 12:08:00.860] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 370] Running SFX 'C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe'..[2024-02-22 12:08:02.738] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 592] Moved extra data file 'ecoo.edat' to 'C:\Windows\Temp\asw.00abf38d93c5fa0f\cookie.bin'...[2024-02-22 12:08:02.740] [info ] [sfxinst ] [ 2848: 2416] [7361C5: 592] Moved extra data file 'eref.edat' to 'C:\Windows\Temp\asw.00abf38d93c5fa0f\eref.edat'...[2024-02-22 12:08:03.502] [notice ] [burger_rep ] [ 2848: 5740] [64A1D8: 66] The event '70.1' was successfully sent to burger: https://analytics.avcdn.net/v4/receive/json/70...[2

C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log

Download File

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.689779827005425
Encrypted:	false
SSDEEP:	3:rShF+Yew/B4bn54FJFkCvg3IKRHRoWnB6TewtAocv:S/Obn54Fg3IKw6B6Tjy3
MD5:	97B4F6FCCC97E0FCEB38991852A19584
SHA1:	1469BBF9386DF320C4D78D136BEA9882FC8B0469
SHA-256:	538C3F35A6A64854C522C3575E3E7697634874A6FE30352ED92253F6B07BFB9B
SHA-512:	FEA2673D13283EEC53B84E7C2710A4EBEE55E7EA6D614A86AD2658CAD95CC3F7E6CABF8A4FBF77C3DF0CFC51F3B8F25135FFDD3364A3CB372E160A0E89B7ACC3
Malicious:	false
Reputation:	low
Preview:	.[2024-02-22 12:08:38.053] [info ] [burger ] [ 1436: 1664] [7BF903: 55] Storage path was not set so neither stored events are read...

C:\Users\user\Downloads\51922015-367a-49cc-ab83-0c843030d492.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15641
Entropy (8bit):	6.281502850025551
Encrypted:	false
SSDEEP:	384:/iOTzB6WaiKhl1cVMw7VehjMrwX5BjsaUu0:KOTVRaiKhMrwdMryPej
MD5:	6EBDA9C6AEAAD11DD8A27C1338FED3E2
SHA1:	B6A7E92D122D4EF3D0438A57411E39FEE5C6A7FE
SHA-256:	5E16A866DD0FD2A031702CA4D442BF6D7A62860BB511648F282DB6D67B67C4E3
SHA-512:	A0C2C38EB1A65E78F201B27A389F435B09F30A0A719F5F27552368A2F9F942D34F521286D83B63D9A4B9CB7489C0C39BC79A70D951F43BD06AE5C2549481E2C8
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L...um6d.........."................. ........0....@..........................0......&T....@............................................0...........H...P)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\Downloads\Unconfirmed 663905.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264088
Entropy (8bit):	6.385403441351715
Encrypted:	false
SSDEEP:	3072:K2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhdn+Ts:K0KgGwHqwOOELha+sm2D2+UhnguWN
MD5:	21B56ABF76225D8337BD397FF6C75B51
SHA1:	8FC074BC44B8B71E38A5097D8FE77D2FF513880B
SHA-256:	E8C9A893CFA4FF1D39E6CD597D83797C12235DD750CF8C3DB2CC1F7F9E0A0FC3
SHA-512:	FD738B8E0A24D652F0C6CFDBAE3FAC02F0C9B82C38647E682818C3C71E4526A6039180145C80CC72697C0A42EAA0D6A92B1A6FA4E99D0DE7AA14661856A7733A
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L...um6d.........."................. ........0....@..........................0......&T....@............................................0...........H...P)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264088
Entropy (8bit):	6.385403441351715
Encrypted:	false
SSDEEP:	3072:K2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhdn+Ts:K0KgGwHqwOOELha+sm2D2+UhnguWN
MD5:	21B56ABF76225D8337BD397FF6C75B51
SHA1:	8FC074BC44B8B71E38A5097D8FE77D2FF513880B
SHA-256:	E8C9A893CFA4FF1D39E6CD597D83797C12235DD750CF8C3DB2CC1F7F9E0A0FC3
SHA-512:	FD738B8E0A24D652F0C6CFDBAE3FAC02F0C9B82C38647E682818C3C71E4526A6039180145C80CC72697C0A42EAA0D6A92B1A6FA4E99D0DE7AA14661856A7733A
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L...um6d.........."................. ........0....@..........................0......&T....@............................................0...........H...P)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4159384
Entropy (8bit):	6.48294011472113
Encrypted:	false
SSDEEP:	98304:sNJsXdVwQll/DRKIymdz69dbrqNeWRPxur:sYwQD/tKHKzUdbrqN
MD5:	99A02B6261B6466FEB3A3AA473E0FA39
SHA1:	C23FC6FDA665C7F972FD4D5E570D8CA0AD5FA939
SHA-256:	FF69D32DD0A916824BD7FFE4B340B08E425AB80FBD94883FCC94508E1366CC8D
SHA-512:	D76D175D56C67398DC4DA898E429FA39521BA4618666071B94D5047CFA3CB901AA1002CA581EE3790531E519E5F5A5BDDDDFA6BDEEC877003C34C2083D1B8739
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........RI.D3'.D3'.D3'..A"..3'.D3'.E3'.B...G3'.B."..3'.B.#.U3'.B.$.V3'..A$.Q3'..A#._3'..]#.R3'..A&.Y3'.D3&..2'......3'...'.E3'.....E3'.D3..F3'...%.E3'.RichD3'.........................PE..d...y..e.........." ...&..0..........G(.......................................?.......@...`A..........................................;.....D.;.,....p>.....`<.....HN?.P)...0?......6.......................6.(.....6.@.............0. ............................text.....0.......0................. ..`.rdata...r....0..t....0.............@..@.data........P;......6;.............@....pdata.......`<.......<.............@..@_RDATA.......`>.......>.............@..@.rsrc.......p>.......>.............@..@.reloc......0?.......>.............@..B........................................................................................................................................................

C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23594392
Entropy (8bit):	6.697133943906838
Encrypted:	false
SSDEEP:	393216:rc9+XCAdRqLdiDE3CZyabT+thSibmQuFb04vClrQUp81:rc9D3CHbSth78v
MD5:	D330849F66184BF95751ACBC18E7D464
SHA1:	E92AD95F6D3094D01BC35494D98C3C8600B70DB3
SHA-256:	E40CB7C9D56E8F6F38B930F9B329D875B3D83156EC14414B1ACCE316967B81AB
SHA-512:	DAA4975C2ED96DEA2245648FB042B624C6BCE750BFE16117E6E1A3FC6CEDD465CB01F49B32646225916FF6904F2AFDA97CFFAC1B67B2B96671F38710DDEBEC5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.......K.3...]...]...]...X...]...X..].......]...Y...]...^...]...Y.7.].......].Y.Y..]...[...]...Y...].Y.X.'.]...Y...]...X...]...]...]..^...]..Y...]...\.J.]...\..]...^...]...X..].e.T...].e.]...].e.....].......].e._...].Rich..].........PE..d....e.........." ...&.6............O.......................................i......h...`A.........................................4.......:.......0..h....p..\...H.g.P)....g...............................(...P..@............P...#..H........................text...-4.......6.................. ..`.rdata..^a-..P...b-..:..............@..@.data............0..................@....pdata..\....p......................@..@.didat.. ............V..............@....sdata...............\..............@..._RDATA....... .......`..............@..@.rsrc...h....0.......b..............@..@.reloc........g.......e.............@..B................

C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3889096
Entropy (8bit):	6.451773659527383
Encrypted:	false
SSDEEP:	49152:fj/wGH4Xvec/Cw60I9vxCJ5D7y+Y/PzaOKldYzPL7aTJL52uAsKAPgJ0FuG+bDZb:z9ICjg7Q1XLOT9MK
MD5:	CA4A5F3F1AADF421F89C19505055C7A9
SHA1:	B1307E49372EF34297A94EC3E76D529D6422F0CE
SHA-256:	5D894B08CD212B6DD092490AD8F2FB2644B18077695FE6E61D23363F920C975E
SHA-512:	0AB2175193AB9707F2F3C9D78ECCAEE707735A8F013CB52324AC7B08F1606039DA399B29244C282E76AFD120888666EFA88E6877A2E9CF78976D88D7FCC07C18
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......;..l.x.?.x.?.x.?...>.x.?y.y?{x.?y..>mx.?y..>.x.?y..>mx.?...>}x.?...>px.?...>_x.?v..?}x.?.x.?rx.?)..>{x.?...>~x.?...>bx.?.x.?.y.?...>iy.?...>~x.?..{?~x.?.x.?~x.?...>~x.?Rich.x.?........PE..d...~..e.........."....&..$......... ..........@..............................;......;...`...........................................1.......1.,.....;.H.....9.....x.;.P)....;..^....,.......................,.(...P.,.@.............$..............................text.....#.......$................. ..`.rdata........$.......$.............@..@.data...P.....2.. ....1.............@....pdata........9.......9.............@..@_RDATA.......p;.......:.............@..@.rsrc...H.....;.......:.............@..@.reloc...^....;..`....:.............@..B................................................................................................................................................

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.ini

Download File

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (572), with CRLF line terminators
Category:	dropped
Size (bytes):	806
Entropy (8bit):	5.150067842730043
Encrypted:	false
SSDEEP:	24:O1taG0R/qmPvw5uAT3Mcqet/lTKFaZrfwB/O:+taDHBop3t/lTKIZrfw9O
MD5:	840037866B603F9E7B6AD5DF83F49910
SHA1:	1F29E5858B4D1812AFCB154092F0F76008997F74
SHA-256:	3DF8BF7B6E8E3E1486F7ED79AEA7D6C58FFCFB0B5A02BBC53B71FED6B87865D7
SHA-512:	3596A6C9E67097C6337AEA107ED5D2A9520B6C3F58945B698CD75F9956CDB19BB99C0EE9BB317F948729B4B1E11A5F3D62A2D832ADB1CF67B1537E56D25696A7
Malicious:	false
Reputation:	low
Preview:	...[Shepherd]..ABTests=49afa038-20e4-4cff-b058-f7c69b5a850d:A,oa-7466-v0:b,oa-7675:a,oa-7794-fake:b..ConfigId=5..ConfigName=Avast-Windows-AV-Consumer_websocket-testing_ipm_6363_chrome_offer_setup_free_free_production-new-installs_version-18.6-and-higher_production_quic-sni-block-release-stage-2_v2017_hns-pre-scan-enabled-countries_noomnianda1_phone-support-tile_avast-18-r7-and-18-r8_fs-and-idp-integration_cef-settings-off_opening-browser-onboarding_old-smartscan_usa_ipm_6513_open_ui_a_test-akamai_test-pam-no-master-password_v18.5-and-higher_cleanup-premium-installation_release---iavs9x-only_version-19.1-and-older-00efc01802d47c827a25b91051dcba6a647e6b1e1da5eeb7b0ad527e0b44f2b6..ConfigVersion=4902..LastUpdate=1708603718..NextUpdate=1708698216..PostponeInterval=3600..TTL=86400..TTLSpread=43200..

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.tmp (copy)

Download File

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Generic INItialization configuration [BreachGuard]
Category:	dropped
Size (bytes):	29411
Entropy (8bit):	5.879702904802007
Encrypted:	false
SSDEEP:	384:D7r50hjbpPbNH3V2g0JigYwTTPUxoBDDYrn1OCsXhxvFr7qz9YMpmlfQXDAIvoq9:b5WZbwJiCMxSYr14xJcKMpyIvottti
MD5:	20130D9BF197CC0B0E6DF5C4EB04BF8D
SHA1:	7B9FCB7C8735861647971EAB789EEA3455C2E9AD
SHA-256:	F51964FC8527B61E582D13C2ADA27907B80FD56E03A908A33126F41E9A288D47
SHA-512:	4F71085BACA4517BC02BABAAC87D053233B3876965A31CFA62421BCD0064F7BF6874608148E22CF7DB859A9F051189083098AF3536B755D9736BA5F677065DA6
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[BreachGuard]..Enabled=0..[WebShield.WebSocket]..Enabled=1..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=0..[SecureBrowser]..UupdateInstall=0..[Symternals]..SubmitGeneration=2022-03-02..UnseenExesSubmit=2..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_cmp_sfzone=3..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATBlockQuic=0..ATInjectJavascript=0..ATSkipp

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.tmp.new

Download File

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Generic INItialization configuration [BreachGuard]
Category:	dropped
Size (bytes):	29411
Entropy (8bit):	5.879702904802007
Encrypted:	false
SSDEEP:	384:D7r50hjbpPbNH3V2g0JigYwTTPUxoBDDYrn1OCsXhxvFr7qz9YMpmlfQXDAIvoq9:b5WZbwJiCMxSYr14xJcKMpyIvottti
MD5:	20130D9BF197CC0B0E6DF5C4EB04BF8D
SHA1:	7B9FCB7C8735861647971EAB789EEA3455C2E9AD
SHA-256:	F51964FC8527B61E582D13C2ADA27907B80FD56E03A908A33126F41E9A288D47
SHA-512:	4F71085BACA4517BC02BABAAC87D053233B3876965A31CFA62421BCD0064F7BF6874608148E22CF7DB859A9F051189083098AF3536B755D9736BA5F677065DA6
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[BreachGuard]..Enabled=0..[WebShield.WebSocket]..Enabled=1..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=0..[SecureBrowser]..UupdateInstall=0..[Symternals]..SubmitGeneration=2022-03-02..UnseenExesSubmit=2..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_cmp_sfzone=3..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATBlockQuic=0..ATInjectJavascript=0..ATSkipp

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.def

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	Generic INItialization configuration [BreachGuard]
Category:	dropped
Size (bytes):	28892
Entropy (8bit):	5.879086158272582
Encrypted:	false
SSDEEP:	384:Dqi50hjbpPbNHRV2g0JigYwrTUoBDVQrZ1ONsXhxvFr7qz9rMmlfQXDSbvoqZtPU:H5WZbmJiQU2QrrbxJcdMEbvoktPU
MD5:	12774C43E92F60CC72545917CA226AA1
SHA1:	E9FA0CCB4ACFF049053F41FA017B00FBD36D4C6E
SHA-256:	DDD77710A67F3B37298429B1A4A0D9B952084AF42FF96454DF364F42F9B7DA60
SHA-512:	ECDA6377058C27A44DA5F32855AE449B5F8284AF1BAC6BF9C830E2D2495C3A05E4621AC70BACBD492AFAFC5DEBCC25974BD4CB8503BA1D014BA92F12D3B9B385
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[BreachGuard]..Enabled=0..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=0..[SecureBrowser]..UupdateInstall=0..[Symternals]..SubmitGeneration=2022-03-02..UnseenExesSubmit=2..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_bpc=0..ais_cmp_fw=2..ais_cmp_sfzone=0..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATBlockQuic=0..ATInjectJavascript=0..ATSkippedDomains=whatsapp.

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.def.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	9913
Entropy (8bit):	7.98351505927488
Encrypted:	false
SSDEEP:	192:QElGwRCEFiUE/cbjlObzCMrcSpnuq638XZdqLGRBpOA0O2NQqztahoYfzqO0i:QEYCCEFiUxwb7rVuH3ZLGBplmoh9bqZi
MD5:	65A94D643E10FFC9156EE8F1BAE43C25
SHA1:	A36D866CAC1009272855C0777D55A4A98468ABCE
SHA-256:	2C9559A99BB1859206D554D1C3984787E5B4F347C5C55E8C05D3C6350EBFB760
SHA-512:	AF1088A5D69ABE83C63E4585849729DF5C039F1270BA32A76932E3BEFBF1B2950B78F3DD089269078A97568E8688F4E90C3DCE06C7C6E45302D49A7DF694865D
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3.p..Y&..]..@..-.....D...5/\.(..v.D...<FG..;..`...\.J.)<{..Z.5...`_B....~.....{.......8.W...(...N.B........t..w.e.@....E.q.....q.v.[.V(2.S..v.. ..N...r...W.!......,.g...}:.M..5O:.....s...T..n.b.8.n.N>..8...^L...........,.1......d..)........6....d..Ox..wB....=eS.G..vo..i...57....0.......,h.\....,..6..2.u.. ........7.....n."G...?.>..2C..D...eL.@......}i......mL...c...zS....1.x..].<.".N..........0{n^`I.:.S...0.e..mn?1.+H.CF~.....t.>>....A.8...0.,.(.H!Ah..T.U.ER.U...t...7P.NX.....`....pE.C.;.c,....D#f^.R..".'@U.s.NR}..;h.!f.=..].......^.K..4.jE%..D..t.u.....!.):S./.7.....9.........HE...=..=Z.S:?D..t..-..Z6..T...4...F6..J4.E.\1m/......%..S....G..Q..Dk..."..p..._K.Z.F.)..Y6.iyN.r=\X..i\..i......{......I.dA.z..Q%>x.:IW.....].<...~;M.......DB....U.mn..7..T.i...[......;.g/7.3k...@<.0zU..+W...5o{.l...x.1..f......wJo...\.E!Q....H.f...js.]..,....{<...O.M........b`1D.<.wo..O....f..Z\|.uOe.L...5....r...+Y.8.&..$4~..{.k....y....K

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.ini (copy)

Download File

Process:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (572), with CRLF line terminators
Category:	dropped
Size (bytes):	806
Entropy (8bit):	5.150067842730043
Encrypted:	false
SSDEEP:	24:O1taG0R/qmPvw5uAT3Mcqet/lTKFaZrfwB/O:+taDHBop3t/lTKIZrfw9O
MD5:	840037866B603F9E7B6AD5DF83F49910
SHA1:	1F29E5858B4D1812AFCB154092F0F76008997F74
SHA-256:	3DF8BF7B6E8E3E1486F7ED79AEA7D6C58FFCFB0B5A02BBC53B71FED6B87865D7
SHA-512:	3596A6C9E67097C6337AEA107ED5D2A9520B6C3F58945B698CD75F9956CDB19BB99C0EE9BB317F948729B4B1E11A5F3D62A2D832ADB1CF67B1537E56D25696A7
Malicious:	false
Reputation:	low
Preview:	...[Shepherd]..ABTests=49afa038-20e4-4cff-b058-f7c69b5a850d:A,oa-7466-v0:b,oa-7675:a,oa-7794-fake:b..ConfigId=5..ConfigName=Avast-Windows-AV-Consumer_websocket-testing_ipm_6363_chrome_offer_setup_free_free_production-new-installs_version-18.6-and-higher_production_quic-sni-block-release-stage-2_v2017_hns-pre-scan-enabled-countries_noomnianda1_phone-support-tile_avast-18-r7-and-18-r8_fs-and-idp-integration_cef-settings-off_opening-browser-onboarding_old-smartscan_usa_ipm_6513_open_ui_a_test-akamai_test-pam-no-master-password_v18.5-and-higher_cleanup-premium-installation_release---iavs9x-only_version-19.1-and-older-00efc01802d47c827a25b91051dcba6a647e6b1e1da5eeb7b0ad527e0b44f2b6..ConfigVersion=4902..LastUpdate=1708603718..NextUpdate=1708698216..PostponeInterval=3600..TTL=86400..TTLSpread=43200..

C:\Windows\Temp\asw.00abf38d93c5fa0f\cookie.bin (copy)

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.1368637096073178
Encrypted:	false
SSDEEP:	3:1HqCqsjn:55Tn
MD5:	06112A52C5F2C27C04F4ABECC9CFA0F2
SHA1:	787FF30FB75D2018EBF3D9232EBFD9134B80CB69
SHA-256:	EA9DC97A05195E708728AF276DB0482436EC20F1F00A617CF43A86B025B48252
SHA-512:	31B4807705A0965DB2A99731B124652EA8C8793D2AF3D0FFCB52B55612AF083A21FF1B0ABEEE84835976D91DFA556527F5619C22682A2228DD947E209634C467
Malicious:	false
Reputation:	low
Preview:	mmm_ava_esg_000_361_m

C:\Windows\Temp\asw.00abf38d93c5fa0f\eref.edat (copy)

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.147942872131213
Encrypted:	false
SSDEEP:	3:N/hWCHLpxUqTVv5Un:P7rpxLZvKn
MD5:	8893534C8D77E1C7001EC38E93492A0C
SHA1:	49402F3143515D0386237FEAC2EDE755D39D1E14
SHA-256:	290D4AB98F63978C5BD7D42C3C03DF660E0A3CB7BF0E9D646C646E742CA0EEFE
SHA-512:	5F05CDD4104F13B3E9B0B0D012D90F815BDE7CCE4C4E571F7171BB7A30008C87F06429503345389C367A5F91D3B1BD26F84353BBC7C2B1D1613FF66B65C09A6D
Malicious:	false
Reputation:	low
Preview:	clid_1242318596.1708600963--seid_1708600963--senu_1

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-jrog2-132c.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	695
Entropy (8bit):	7.621740145739962
Encrypted:	false
SSDEEP:	12:UkHAgrRux8Ghb8bYZxU/tW8qHH4h9X3aFA1juhgVUHBdQTYRNulhJ00n:UIAgdo8Ghb8sZGk8qHWhgmOOYRcr1n
MD5:	F757934C2D28D322FCA999FFAFDB4584
SHA1:	EB06EB4E5669519B1A6405616BF78417B1963FFE
SHA-256:	09C79062FED78B3BB7BB1DA546014D812FE77904A3F161B4908DC5724FF86A12
SHA-512:	73F5CD98592A0FEE596B3860FF4E02CDF3D31F3C60E86346E0D8D673B76A9CF2C344C66A5F6E4CE6EFE444385C947224E70E86038306BAD75AE39E22E669D6B4
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFile....W...x.-..OTQ....R....{E.X.....1..r...cb..?..K.......]..z..`(3....b..M.o.......w.{mnz..lro....<..s.[...98..%.....{W....fE...J...(....".jp.k[8P...u..M..O.... .(qKv^./.q..9N.'.Y,[..g...,\(.e...d../Cr..e....g.\|.l.3y>C...WN..r....O...2&3.?Iv.t.O$_....&p.xr.#.X....J].&.'..(.K$w...x.F.\|..q.J:..gl._. ..6.....2..?..?.....2"........a...O.?..........o..C.k\|e.....9..F...=....O..D..c.?2v..9.....=c.......s...8._..[.Q.5...O..a...:.C.n...y!.dN....Ar.1.V....B.f.M.o$W.y..UG.Z..P_.w..\?..x^I...ZVH..A.uc..k...<...2y...l...G....\|.s.;+....g..ir.q.R.;E...F....p.........{.....a.."_!y..5...J... j$BE...xUR.:....o.......]1...y.26.N/...... ..^...h.*.3:.5.ASWSig2B

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-prg_ais-180117d3.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	75605
Entropy (8bit):	7.997413617604422
Encrypted:	true
SSDEEP:	1536:ITcR0hzC8d9LnSI8o+LmWgBL3BDfwbV+13RLbW04gY97hpKL1Lq4aSx4oDA:ITcyBCyhSI8pmWghBohSNbWbnPELq4Rq
MD5:	C9AB86327CC6D1B698906C6B42364040
SHA1:	A68E865E9C74CB891FF5040EFF2D0965F72D03E9
SHA-256:	918DFC9B513535FDA13A3A1F1BB3741728936BD9B355958288A395F68090B81F
SHA-512:	67ECEBCAC745588018479B39132ACEE1E6728171D01CB085C50B47B3A147CACA018E52C19DD6DC89836A85CA4CB870B227D2797AA3EBC04A74CCC4A491A80CF5
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3_&...&..]..@..(.Dx_x.F.....~..1.Pd....k...u3&iN.J...hk....q..n..O..I..E/.~.p.....y5...<........./..Hg.......#.-.........k..^....U..."..nXN.T..w..L.X2\|..C...-.'...A....V....I!u&h..x> .gp......$].,.r..@..i....d..........G.q....E3...9.....R..."..).0....N.?V...B9."A.4..YW}....4..~.(....;)....<.>x..lof;^n.l......."<a............p..d..%.1.vEv.,..N.z..[.5R._....[........4..].JiNa...tb.mK..OR.....D.a..I....9.-.K.....'.....G._.J....&c...P`.G...p".y..h.\1..$...3.Hbq....y{.!...f. .H..d.....N..'SLL......)..,...DH..Q.....0....tcb..rc...1.....57R.o...*..1.U8d.A.N/.~V@E6.T(.l..[.:.[.{zg@...9..J.h./....i.Jp...`<9,.X..]r3..0.2?./..F.......K..3...P....YN.X...(....d.....W.;G~.u..Y.}d.r.;....V.Q...............eb./.....Q...;.....q.....Wp..2......L.s].fS..K.Rp!7,....a.G..N{6T!YD.......e.m.k..R1bO.X....u...X.f(.....>.T..7.2..7G.]9.WQ.(.e#..9...m..#.B{v.ROOL..H.p...d..4..x....4E....WsS....%9......`.....(i.1..8a..'.hAE..F}.1 ..!././......41.G.

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-setup_ais-180117d3.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	4393
Entropy (8bit):	7.957130155343472
Encrypted:	false
SSDEEP:	96:ec8t7IrEYmofgeR8dntn5Z80kxMYaW+qhBF0526n:ec8po0i8dtPkKFoBtM
MD5:	72FEEE470E611C17FCB9494E9BF08B7D
SHA1:	44FD7ADB564DA898D9F6B9D27C8D4707512601E2
SHA-256:	DED1EDCAD352CB5236D924F34FEEDEE238DA2B510B36701DE35F1C001D3A5697
SHA-512:	3F3E16C001BD0D339F3A1D7314DF45FB50329525247070D94554E9E0FFB660E3DD5900F8A93012CFE3CA534C1437A2A16116BDF099DB2BFBEABE566AB213255A
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3?.......]..@..(.Dx_.l2......gz..k.+..).Ys..)tj..gT.\Q@w=.X...E...=v.\..S.R\|.n.".....#zN...?...>.S...pJ^......uY..../Ub#Y........Q!..e..9....\|..j{..JKK......\|....<.f.qM.....VN{.Y....Z.!'..M=V1;...Y=@.[..s;.y..&...>.4._"_V)...i...v..d...l...L.#?..@.....@..'.;...3.)....^{.G......5C...........]...l}..J.\....+.".C..z..(.!.a..rK.(......#.TBA.9_...c.c.P+.F....n+.'..X.,..wl.t....C2.q\.....jm....b.R%.y....O.^...-...x.......l....M4.{c.fKu...u..R..&D..p.........b....1..U.B..)...g....}\..i.UkU..."es.c.....td...u..B...^..@........?.r....E..M...X.d......3.4t=p..&.Y....3.~.u..c..L$..g.q...?J.1.G.K6.I'..G..P`..v.P-i...$v.i'.........;a.....!$..U.>z...bZ....:b...Rb....>\.../.~.R.Y.V.LkLd.2[}."r..3.e..o...4 ...h....RL..7..X...L=..!.......{i\4.(.,.....q.....<.D......CA5B.9+..=..k.......3.)..p4..(.w?.).Q...b......4.@..H.4qsc...L..U.A.y....(...q.h..;.g.C...m2.I/.OO...\|S.C!.1.......s.......]...\.l..........z........(e...<..vs..;l.R.$

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-vps_windows-24020600.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	11836
Entropy (8bit):	7.964933658641629
Encrypted:	false
SSDEEP:	192:WnTHmDXz+iwD27Xhivnw5lTQ8Ovu1HgZzMqvZiFdSb7tvQX5cCXLZ+UD8:WnrmDBwD27I6lOG1HGdsOd45v1+UI
MD5:	526AD86C7563D8E89C79034C6F50AD4B
SHA1:	445BDB18BC55AD3D067C3B84FBDAE320C73ADDAA
SHA-256:	EDEDF623E34555BAFD092BABA995CCBD410E44E81663F8AD5DDFD3393765958B
SHA-512:	274E9F343B81204E2BE3B440E825A51C5592D05E2429DEE7BB0843ABB7DEE71DD067D863E52E6CF2AF47FB1B3B37F923EDB9D9AAC02B3875EF7CA96F28727A87
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFileb>...-..x...y4V..7\|.h.N..)..2Kf.#c..!!.U.2.!S.L!2.Y.L)S.D.Jd..c...Z.........q..s..>.~]....%Mv......%."""...f.....f"....G{nu8...-...Z9.%_....YZz.X..q+..I...J%ERg)1.6O..t..l..Kj.0\:."y.....,.....Q..+...q....u.h.!..d....B...\|H...Z8.#y........d...o#....#y.Y7...$.#......?.u.._A..$/#.;.......$.C.yd.+.....DD.....?..)$O"..d.....:.."y.......H...C.:.<>..~$.!....".=H.F.{$w!k'.....HnGr..[...f$7!k#.....H.Gr..k....5H.F.d....H.Gr..K....%H.F.W.~...".......Gr..s....l$.@r..3......~...".)H~..d$'!k".......3d.C.c....H.Fr..#....p$.!9.YC..`$.!9...H~...H.G....".>H.F....!.Cd...=....wG...]..dgd.92..1..1..........0),....xT............'Xk.....4%..].S..n3Zj.....k.g=......`.6...f.<...b24..0....&..x.dW..`R...0./..LF...&......$X.....`2...T,..&..H...8,`..#.0.:K...`..L..b......IA.<`.K.......&.....Tf<`r.....Y..&..".LR.c..9...dS..`2i....\|..L:RS.&.i.....x.....I.q.`.....&.L..a..q&t.I.j.`.s..0.s..0...........ZJ.../.0.....Lk%.L.Z.....X.....0.7..L..e.L.....}..I...I.C.`r\...

C:\Windows\Temp\asw.00abf38d93c5fa0f\prod-pgm.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	573
Entropy (8bit):	7.622954949364455
Encrypted:	false
SSDEEP:	12:5oLFeDmO165zMuHHRcbWdsCv3xt/4NYHuV71pyn:IZu0DHxcbNYOUn
MD5:	48CADB7D59DAF8E3B51175F48554E58D
SHA1:	382379BDCB9444CEAD9037B62FAF72ECC4BD401B
SHA-256:	FA9CDCDDE4F1FB32E7F7BFF8CD5DF48EF4B3ECC29CEC6803E7DD3F7BB63A35A3
SHA-512:	1F3CE91F950B1DCFD7A876FDAA06446134EF73D82141E91BDC6EDA50B1083A3490A5557282695A99466700382673C6F3AF698696432B109C377250C90EA15269
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3F.......]..@..(.F...^.np....BFHeN...y.h....U'C.Em..s..\.8#k..;\|;...2...}m...(./...?...V.....}.5(.MyHP..2 ...gF.W..4!J...Lmd6....$..f)8......ai..z.Q.I..=.ea"._..t..9.y..wXM). .e$..!..\....]....Mt....i..Z..Sez%..lw.R..F#..}.!".eF.W....h....HA..\|.#p.\..!_.9"+......Y.. .).3..K.Q......am .j......w.S..uz`T^l..Uu...........L....3.=K.3+.R)o5.,.TK&z.O.g.u...J.w.r.....o..-.b..7.+.....@Hn.6.5..?.......r}........!.=..6.h..4.*..~.A..j......X.#^...tK...&.f.....F.>.......?...z..,.../,:.Z.H.uH.P......_n../.B.....!.DW.....n..ASWSig2B

C:\Windows\Temp\asw.00abf38d93c5fa0f\prod-vps.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.281609936035081
Encrypted:	false
SSDEEP:	6:DulAVt/J2prY4N6TLTjMsid7ivjhpLmR07lUxmQzLuzzKcD+zEj+9QKvVPlvdZyy:KlK/UrRwLMsoiLhplKc/iM+q6VPlvdMy
MD5:	7366BD32AA01DC9CA58F78F895D87EB4
SHA1:	80FBEEB979A1075F5A047338FE2EADBA0B1AD292
SHA-256:	CD07142FB15B5537BA82395C1420089D1A844D8F62F199FEE1D4FEBFA45270DC
SHA-512:	DA889B5F101450461076A1536D3FED4818423E8CDE6DDD630A36018D18B5B2330A0008E29E8A41D3987A22B1FA717F21A182D346CEA09B213F002543F254429F
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFile .......x..p..ic``...pe..YE..F~...N.kP0...#.......bog...=...l/...Y*N...OU..qY1..#./...O...c..r\|.]......q..=W...........j.....O_........]..u.3..+(...../..K.//.....I..".=..xN..}p...a..y..I.m.Y.S/.....}....Erq".u....4....-.;.J......lS}...].`.2....6.[.g..k.02.j8....D.....yJo"e.>3Q.PM...{....).K....}0.....5..]G.3..ASWSig2B

C:\Windows\Temp\asw.00abf38d93c5fa0f\servers.def

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	Generic INItialization configuration [server0]
Category:	dropped
Size (bytes):	30252
Entropy (8bit):	5.135271305809882
Encrypted:	false
SSDEEP:	768:qUF1L1K1v1u151i1p14191b1i1h1o151i1v1k1V1G1+1H1Y1J181V1u171G102:Z9otwD4X63hwryPIBWrMYhOv+n8Z4q2
MD5:	328DF5A6F079158F02FA851462750ACC
SHA1:	1BB7FD1E444084571D7654A684FF80C5C44A97F7
SHA-256:	89F57671B7CC33D68B04D22791ED81EB5AF888C22F54E0F0D2E933E62B2931B0
SHA-512:	6B240CD4ED4E89FCF22F65CAC8C944DF66DF7D7D19A85B5288C705E01CBD683F6448836C55C212ADD9EC4B4CAE6BBB4DE0771AE1330683594B5F0E9C8C3B4F40
Malicious:	false
Reputation:	low
Preview:	[servers]..count=29..RepoID=iavs9x..LatestProgramVersion=167968768..LatestBusinessVersion=167968768..SendStatsFilter=2..SendDropperFilter=8..SendDropperFilter2=8..SendCrashdumpFilter=32..WrcTrafficTo=0..ShepherdUrl=shepherd.ff.avast.com..ProgUpdateConcealHours=168..V6_ProgUpdateConcealHours=168..V7_ProgUpdateConcealHours=168..V8_ProgUpdateConcealHours=168..V9_ProgUpdateConcealHours=168..V10_ProgUpdateConcealHours=168..V5_UpdateScreenElementId_1=16..V6_UpdateScreenElementId_1=16..V7_UpdateScreenElementId_1=16..V8_UpdateScreenElementId_1=16..V9_UpdateScreenElementId_1=16..V10_UpdateScreenElementId_1=16..StrmUpdateCheck=256..DaysBeforeAutoRegister=10..CheckYellow_SoftTrial=15..CheckRed_SoftTrial=11..SoftTrialLength=20..ShowAndroidAd=0..ShowAndroidLanguage=1033,1040,1046,1034,3082,1036,1031,1049,1029,1045,2052,1038,1042,1043,1041..VpsOnlineToaster=1..UpdatesNearExpireToaster=1..ExpToasterTimingReg=30,24,0;29,24,0;28,24,0;27,24,0;26,24,0;25,24,0;24,24,0;23,24,0;22,24,0;21,24,0;20,24,0;19,24

C:\Windows\Temp\asw.00abf38d93c5fa0f\servers.def.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	7.912907483278095
Encrypted:	false
SSDEEP:	48:D31oBEs2XRm52nx5ivt4+qThjoZoGhjDh9yiHPkjOaNRoLQk38jFePCen:Bo/ORmknx5Mt4+Go6G1V9f6OQ+QPsn
MD5:	853F70DE2BD1D39E2B6D5AF57647974B
SHA1:	57D29A712F8666A92FF9F2AFC92C7EE7412EDE17
SHA-256:	2A0CA28C5F7AD60154D5A99B32CE14F9B77A8C5FF217627171CFCA20C5AC9CA2
SHA-512:	9DC2373E6C8448728AB2545E4BEE5EDAFE4ADCE28B7E01CDF9D9E9DC4C36DC6F9F74DBFD012EA53B41B26BBCA1702270E60CD5E1F9A29BC31F9835C858916E68
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3,v..5...]..@..-..VF.....e.q.`.\|.r+^.G.X..Zl...4Y......y..OXq9..G.g.s.....................s.k.<.......&.(....)..H..7`B.:=.-......g....sEg.8.X.o...q.L.Mu......?8.d........B[.\|..g...u.....^.>?...=.g.C...<q.y.k..=...y..kKi.C....1t.'....&.tN..,...>.l.......).E....._.v....{.yX....w...Xo..MY.[l.2..~....Q.v..Y.......e.o..j.=..l..<Q+F.....9\.>,........8D....y.j...q.\|=[-.[r.v.9...}7./..N...\..u.Ik....a..s>Z.fJc.9..5..I..N..$7..)._..'g..>;..M-(......H=...\/`6I{O...B.jX....U.sK.IQ...:W.\|\...v.}&.b.....XG<.../.M..;...r......'HuE.L.i\aY.;.(=-(.L........[i....."jR....+.K.Y.3. ...."q.../...q...C.rZg.ee...A.i....jq$F...H.....M...V...#..r.5..;.".)._(.p.v1S2fC..g.Z.z..u...;Q.-."...v...0....x....4.oc.#.m.\|fLz..C.+.?8.q...%....e.Y.^.i/.J.....7..Xy9..o..!..S.._V..).Z..y>~..5.....`...CAI.9.....h.6..?.W.,@D..:&Z.}..9......4.f..!.U).J..?.......<.$........\%.Y..F.M.......t..j.~%......q.[.3..I.Y..c+..,!n+..<.....,)....J]..u.`..=......{.. ....,.......

C:\Windows\Temp\asw.00abf38d93c5fa0f\uat.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	15783
Entropy (8bit):	7.988805087311179
Encrypted:	false
SSDEEP:	384:r4fgrWjbIqePl2UZI3iUUNfzU09EOwhLKHmz1iL+e1L7:Xr769ejXwhxznw7
MD5:	C408FB4BC7CE0E9C9E7DD18BF09619E8
SHA1:	29FC0890910C2AF96396008B3F2E4794E3136CE1
SHA-256:	FAB3B2329B602F9F443567CB75B2BDD57E91C50123390F4B3E36752E18997903
SHA-512:	5AB162D7C9C52C547C25DA71E8F1EDFF28674371CA063AC21BBE0DCEEF289B1FEB22FD59A5398AEA79E0FF3975ECF03D5A69CA425A7DBC529ACB42ADE71300CE
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3.k..G=..]..@..&..p.........../D.\|...).1...../Aq..k..Lx#..t.8..Kp...s.._.gr=N.`9....?.O.gp.0.7..yW....\.9f.F..\|\|".CUy.V..n../..}X!P[.^6.YB.......z..T.rK.0..l.J%.....$...H.?..?M.vW.....p..w....Y.9+.Uj.o.6..Sp.2.,.\..... ^. ....da..j../ ...74z.T].G..H..N.+....eJwc.SY..6........5N.@4%...n.':.i..Z.kd..3..:.\|.\...........(;J4.......K....(...{..r.PS.`..Gu.).......v..=D.A.]..,4...f..C.X{...O.....I...^L..Z..[..1..K.t). .+)../....!.mb..4........Y0[......l..'HV[.D.+f.T.~...e.._........u#...<.....c...E.TS..n.!5L..c....,6..sZ.G.....KT..+..s7...p..]...C.......W.......\.axO%u..V.d.M..gi.et...]qj?o..@...}.[.]..p'...M..f}W..4........s...fS....{.....[...n.\..X1d.`Jm._..g......4.........@.m.!..U....M.7.9...;.....Q..c.G.\|.5.........M.Yq^.;..>Ec..d<.......... .F...b@1..?..6.(.Z.W...4]x...b%\|.e..7.j...j.r6....\|..I.Y.H.5`.dQ...Uk..\L^5n.H.....\2.$.A8\|..p....#i....\F..W.D..#.5.4J.......?FD...N.\.U.._.I..8.....(..0._&.7..x.a.A...mFfw09..=

C:\Windows\Temp\asw.00abf38d93c5fa0f\uat64.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	16844
Entropy (8bit):	7.988893643135967
Encrypted:	false
SSDEEP:	384:8HRHoI5sdBLVmrBJFDLDbi0mrs1wbV3gXYE/QcfMJWomGK:GRHF5sDLVmNLDbiq2bFgp/QFJWoDK
MD5:	33B91876562EAB512A99946D2AB1B250
SHA1:	CF76738F6A32985A9E2A8304E88CCEF51699B373
SHA-256:	5B17357093F667242CAE0A263A6232C61BDA86E7B91034C566BD730C64633198
SHA-512:	50614F7D0FCCA2B2B0385C1BD685A509B5F14F80C8504C651B42078D82A4A3569F41D7166CB5B65912F171CD957206878833D400A9CF6E910E651C611704AD3A
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3.u..lA..]..@..&..p.........../D.\|.../._..z.-~A..\..~kHy54......<.....=......6......! o..- 6Y......Hdn.......l^.m......atrd."=..68...&z.dN.......H.u.a...`hjs.A.J..8....!..w........ .c.xOR$...j.C...+.h7N...A.Hv..H.h.[...@$[.O.b..5....:......2.#t.._...4...p .=2.Q........2.;Jx.8[.=6._.U...h..0...K).<...}.....:.qK..v...,.1_\|3N..M-.r;ul.c. w.....b..&P.j;#.....C...X...L.2n.c....x..QyC..5"........u.gue.X-...=..'..^.7.....A;...w...z....&.(_.Cl.V.O.(..X>\|y).........j.u.....z..I..E?.t.B.h...F..64u.../..D.L-..S.s...eD%s.z..p.\.../:..s..b.N.!5....EM...u:.E......_a.p...o.gg!0F.Ou.X.._.i3u...../<.`..c(]....m.zLGp){.Z..i#m.~..'G....i....B5......oXy......D.9i.k.qd8..=.o.A.....~...E....T.(.h).=\..o.-u...r(..,..C....'...k.PqL..0. i..{.....G.^.....k.>/.zi..m..k..z.\.n..... .l@..y.i.........=.D..).......ZF8.N..{...9.P@..A...8.6(/...=.X.ge.\|K6.".&..Ss....n..l...z....4.....t[.....b..Zim.....US..X..K.x.E....`f..FU.i..KH8..{~.q.,6...[...Npu..

C:\Windows\Temp\asw.00abf38d93c5fa0f\uata64.vpx

Download File

Process:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	10863
Entropy (8bit):	7.983283014638828
Encrypted:	false
SSDEEP:	192:VHMgQvf+d+K3kfguxLlk1lPM6EN6ZQ3aX5woR11ZYEzqINMqvYk+jbqq96MBYCFA:VMed+K3kfhu1DEkZQq5pv1Z/eINMSYkB
MD5:	5EFA1250A1D1E9541E46BAABC128D87F
SHA1:	FB04147A53C197EFA6E8279EBB1052AC22F57CBA
SHA-256:	CC42D6B9D209C6A3A87733C5A383CF56B5F5A019D5395725526A1DED711F8A04
SHA-512:	FA1AB6348F477A98C400913480341748E0B1EEA1AF9FA30E90E78C278D3303EA6F742CA2AEA410F923004115E7606139197E2E17C163964015F50B3423C02126
Malicious:	false
Reputation:	low
Preview:	ASWsetupFPkgFil3.K.....]..@..&..p.........../D.\|.../._..z.-~A..\..~kHy54......<.....=......6......! o..- 6Y.....6[b....-...q.v...Y...jKJ\y..t...x....Xp. ........Z..O..9....(CxG......D.l..p.!..y/..N#{...,....D..L>Fu0."I.....l.....3.5....uI..a.GaM;....v..q...R....G.=o..1.o...-M)3p..:...+b.}...x.N.]{....X..0.LS.l..o...L.......G....7..Xu.-.I.$X1S.A.../......E.m..cK.m......\|..o.....\|.\..........i.&V}.2...s..L.=.b.x..<....O.E.u..z.0...x."......8...L.5...Uw"ic.......yO...c<T.'....q.....S;...d.>P1...gl....S....'!/..`(....SC.....ss5.=..t$...N..m....gEZ.<.j'.N..X................_...^...i......X^..%....\|^....J.....k.b..5.....j......#........k.T.3.....c....u.........../...@Q..\|...T.....r k.x..)2O..O.VYA.,H.aL$!+z._<F[R...w.....M..aX$Tk8..oP6..........2RH.Y.......k...F6b..~h"..0].S...J.Vo..17.R"Y...VW.&._X.Fc....C...&F.iA.l.j]...'..~j....@..z...L....].Zu..&....[.K.-......./.............v@ ..7`.W.......0@ ..M;.D0.%Y3.r.QE...E..@...R..W.=.B/.>..

C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Download File

Process:	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10700528
Entropy (8bit):	7.9218623267691415
Encrypted:	false
SSDEEP:	196608:3rcevof5kXIYq9acNbbEPFN+amczNZezTAAZKnopC2MtSQbRo:bcevW5kYLaqmr+amMNZezTAAZKY
MD5:	3BA1265F701C2D4A6EDEC89270D18B2F
SHA1:	6E1039C659DE49EE6E47083EF3BA806FE65024F9
SHA-256:	A3CE0BDF5CC6463DA1CE8E35C882BB6022375B6CCC6177BDEAC90F7DB8B1985B
SHA-512:	8B955E90EC7DFC17E7B34A174AF66D2EBCBF7DE6189BDEA138C347C83B3051C8316EF7D8B8BAF6B4759C4DFF65FCBDBCA66E21C854847D066D32B22BBCEB280D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......H.......................q......q.....q.....q.x.........,....t..........Z..........................fq....fq....fq.......p....fq....Rich...................PE..d...2..e.........."....&.....4.................@.........................................`..........................................6.......6..d........x......X.......P)...`.......d.......................f..(....G..@................... "..@....................text...,........................... ..`.rdata...=.......>..................@..@.data........P...X...B..............@....pdata..X...........................@..@.didat..@............X..............@..._RDATA...............^..............@..@.rsrc....x.......x...`..............@..@.reloc.......`......................@..B........................................................................................

C:\Windows\Temp\asw.5ce619ffd386e95f\ecoo.edat

Download File

Process:	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.1368637096073178
Encrypted:	false
SSDEEP:	3:1HqCqsjn:55Tn
MD5:	06112A52C5F2C27C04F4ABECC9CFA0F2
SHA1:	787FF30FB75D2018EBF3D9232EBFD9134B80CB69
SHA-256:	EA9DC97A05195E708728AF276DB0482436EC20F1F00A617CF43A86B025B48252
SHA-512:	31B4807705A0965DB2A99731B124652EA8C8793D2AF3D0FFCB52B55612AF083A21FF1B0ABEEE84835976D91DFA556527F5619C22682A2228DD947E209634C467
Malicious:	false
Reputation:	low
Preview:	mmm_ava_esg_000_361_m

C:\Windows\Temp\asw.5ce619ffd386e95f\eref.edat

Download File

Process:	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.147942872131213
Encrypted:	false
SSDEEP:	3:N/hWCHLpxUqTVv5Un:P7rpxLZvKn
MD5:	8893534C8D77E1C7001EC38E93492A0C
SHA1:	49402F3143515D0386237FEAC2EDE755D39D1E14
SHA-256:	290D4AB98F63978C5BD7D42C3C03DF660E0A3CB7BF0E9D646C646E742CA0EEFE
SHA-512:	5F05CDD4104F13B3E9B0B0D012D90F815BDE7CCE4C4E571F7171BB7A30008C87F06429503345389C367A5F91D3B1BD26F84353BBC7C2B1D1613FF66B65C09A6D
Malicious:	false
Reputation:	low
Preview:	clid_1242318596.1708600963--seid_1708600963--senu_1

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.5
Encrypted:	false
SSDEEP:	3:x:x
MD5:	402E7A087747CB56C718BDE84651F96A
SHA1:	7CE01F6381463362CF6AEF2F843A59261E8F5587
SHA-256:	662EFAF46C617DDBCB8FF4A2A8F64CFFD3D93630F1003F8E66511F369B87730F
SHA-512:	5080D776D0B123F20E97D44472EF2343BC022105AA67FC802B71668BAEB74A81530355589D50B1142165D17EF995AEAC196B6C15136D518A1EC0ABFA13C91D10
Malicious:	false
Reputation:	low
Preview:	Success!

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15628)
Category:	downloaded
Size (bytes):	15661
Entropy (8bit):	5.252589972332973
Encrypted:	false
SSDEEP:	384:Wo0gawA6L564TFsyxult82P1NgNvNjNFNJNININXuL:Wo0Qblxul+U
MD5:	E83EC6654B1962B4EDA2154502BF500C
SHA1:	38617B9284C6CB6523B499D0B8AD75BB844C8FEB
SHA-256:	24D956B826FD0F854AB15CC1AA55D14DFD1C832C7F5BFE2629549F3E6A92F930
SHA-512:	2F33EA1913B31A42EF61F6D789E38C5D17EA82358D50A63981E08CB671F9287DFBBA0A90918DE023F54741B4E145770437B04F17BA4878EDB48C6F53DF657952
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/vendor/cash.js
Preview:	!function(){"use strict";function a(a,b){try{return a(b)}catch(c){return b}}function b(a,b){return a&&(i(b)\|\|j(b))?ra.test(a)?b.getElementsByClassName(a.slice(1)):ta.test(a)?b.getElementsByTagName(a):b.querySelectorAll(a):[]}function c(a){return a.replace(xa,function(a,b){return b.toUpperCase()})}function d(a,b,c){if(c){for(var d=a.length;d--;)if(!1===b.call(a[d],d,a[d]))return a}else for(var d=0,e=a.length;d<e;d++)if(!1===b.call(a[d],d,a[d]))return a;return a}function e(a){for(var b=[],c=1;c<arguments.length;c++)b[c-1]=arguments[c];var d=arguments.length;if(!d)return{};if(1===d)return e(wa,a);for(var f=1;f<d;f++)for(var g in arguments[f])a[g]=arguments[f][g];return a}function f(a,b){var c=a&&(a.matches\|\|a.webkitMatchesSelector\|\|a.msMatchesSelector);return!!c&&!!b&&c.call(a,b)}function g(a){return a instanceof ua}function h(a){return!!a&&a===a.window}function i(a){return!!a&&9===a.nodeType}function j(a){return!!a&&1===a.nodeType}function k(a){return"function"==typeof a}function l(a){re

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	452
Entropy (8bit):	4.831287070425481
Encrypted:	false
SSDEEP:	12:tr/kuItbLdk1uFTRXFktUmr0t80B9Yhll7:tzkus1d1fWUzTYhll7
MD5:	50F355DD3AFB228FCAB72C7AB365028C
SHA1:	D305E627CA3FE0F80E775198338DC9C971999B24
SHA-256:	1D317ADF5597D4C31C5924A95ADC3B93145DF8CBC7A4336DE82E9BFD1CA0FCA7
SHA-512:	1EE7F063C6873B8D3874C3B2BFDB38A87C999BCF471596F267B7F284CB185C0F2E3954DBCE540C610299FF125339A3AD7B33E44927898E48FD66D13271620D01
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.884 17.192v-2.284a4.122 4.122 0 018.244 0v2.284m-4.122 6.438v-2.435m-5.152-12.01c2.876-2.635 7.436-2.666 10.305 0M8.4 6.583c4.211-3.96 11.008-3.995 15.212 0M20.476 17.19h-8.94a2.4 2.4 0 00-2.4 2.4v5.61a2.4 2.4 0 002.4 2.4h8.94a2.4 2.4 0 002.4-2.4v-5.608a2.4 2.4 0 00-2.4-2.4z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	831
Entropy (8bit):	4.495902589061296
Encrypted:	false
SSDEEP:	24:tzkuqvUseRZYRoKyNyGOFhG6V1bMSA8NIOTYhll7:GeReRiNyGOjBV1OUo
MD5:	5C51D97C54C81DC0854B3BBDA79A4A70
SHA1:	3415410A991A453674E3C9D2DEEFD9B76B8D1F83
SHA-256:	769DB1B5B23B294FB8598B7561FC050C40338D501FEE7D0D8F9D2C15544AE6F5
SHA-512:	A691813E01BDF46460121675A031774257EB4188A388E1DA8CAB2DD5B0331368904577E4ED392DEE56C89A55547FC50764599C892FB9A2FD91061ED98EE8F4AE
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14.763 21.606v1.5c0 2.293-1.302 3.9-3.75 3.9-3.384 0-3.725-2.2-3.725-4.95 2.048-1.677 5.174-1.398 7.475-.45zm0 0a3.593 3.593 0 002.45 0m0 0v1.5c0 2.262 1.321 3.9 3.775 3.9 3.384 0 3.724-2.2 3.724-4.95-2.056-1.686-5.19-1.388-7.5-.45zm5.987-10.6c.7.133 1.37.271 2 .45 2.534.717 3.8 1.567 3.8 2.55 0 1-1.267 1.858-3.8 2.575-5.74 1.587-12.66 1.587-18.4 0-2.534-.717-3.8-1.575-3.8-2.575 0-.983 1.266-1.833 3.8-2.55.639-.18 1.3-.317 2-.45m14.4 0c.067.883.092 1.875.075 2.975m-.075-2.975c-.166-2.3-.583-3.967-1.25-5-.733-1.083-1.8-1.292-3.2-.625-2.229 1.061-3.27 1.049-5.5 0-1.417-.667-2.483-.458-3.2.625-.666 1.033-1.084 2.7-1.25 5m0 0a33.29 33.29 0 00-.075 2.975" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5953)
Category:	downloaded
Size (bytes):	6003
Entropy (8bit):	5.086603093080229
Encrypted:	false
SSDEEP:	96:VfkDfamZuSvqpeEDBu0A1Ht10m4ERd4VXykM26A9aNtGa5Xa9aNW:9G4SS0IA1HAm4UWvX6ttrrW
MD5:	281DC3EC4C999F1DA06748BB9E1D9414
SHA1:	690E1A6C6D219561FC9C8B4FF4F95CE08A98C1A7
SHA-256:	D4CEB92EC7B1ED80C6B7BBF262AA4189E30E30DBA0AA57A62A15816DD4564A9F
SHA-512:	6581DB10BC255CE9E50B23D4336624300CC78773B55950FB797B4F3328370C75C76ACCD647BF4F617902EC974C1D883319D0D0921D9BBEEEB7B2CC5430332F29
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/vendor/countUp-2.8.0.umd.min.js
Preview:	!function(a,b){"object"==typeof exports&&"undefined"!=typeof module?b(exports):"function"==typeof define&&define.amd?define(["exports"],b):b((a="undefined"!=typeof globalThis?globalThis:a\|\|self).countUp={})}(this,function(a){"use strict";var b=function(){return b=Object.assign\|\|function(a){for(var b,c=1,d=arguments.length;c<d;c++)for(var e in b=arguments[c])Object.prototype.hasOwnProperty.call(b,e)&&(a[e]=b[e]);return a},b.apply(this,arguments)},c=function(){function a(a,c,d){var e=this;this.endVal=c,this.options=d,this.version="2.8.0",this.defaults={startVal:0,decimalPlaces:0,duration:2,useEasing:!0,useGrouping:!0,useIndianSeparators:!1,smartEasingThreshold:999,smartEasingAmount:333,separator:",",decimal:".",prefix:"",suffix:"",enableScrollSpy:!1,scrollSpyDelay:200,scrollSpyOnce:!1},this.finalEndVal=null,this.useEasing=!0,this.countDown=!1,this.error="",this.startVal=0,this.paused=!0,this.once=!1,this.count=function(a){e.startTime\|\|(e.startTime=a);var b=a-e.startTime;e.remaining=e.dur

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5199
Entropy (8bit):	4.168854198111166
Encrypted:	false
SSDEEP:	96:DrBL+x5tA6F/PVmBlngTKwsZkujpqdcf1zepSFSJCVC8BQ80gkj8DHGWOK:J+byul+uTJ9szDFiC9BQ8s8iWOK
MD5:	98CEFB5FC432A6FB66254CE8D42DFD78
SHA1:	90D59BA066875499470332D1D713FDB9D8A5631F
SHA-256:	E4E7C1093DE3ED2783883A06CA497F13B007186767F92314E86B7BD9349008BD
SHA-512:	CFE7035592C4BABD683B22862EC63036C349891BAB020FA129C7054C6F4B513086F33BC8B6F503CE58430C1F35DCFC50ABF4B4E35D39BC125EA92591D32F30A4
Malicious:	false
Reputation:	low
Preview:	<svg width="244" height="72" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M234.963 72H9.037C4.067 72 0 67.95 0 63V9c0-4.95 4.067-9 9.037-9h225.926C239.933 0 244 4.05 244 9v54c0 4.95-4.067 9-9.037 9z" fill="#100F0D"/><path d="M234.963 0H9.037C4.067 0 0 4.05 0 9v54c0 4.95 4.067 9 9.037 9h225.926c4.97 0 9.037-4.05 9.037-9V9c0-4.95-4.067-9-9.037-9zm0 1.44c4.186 0 7.591 3.391 7.591 7.56v54c0 4.169-3.405 7.56-7.591 7.56H9.037c-4.186 0-7.59-3.391-7.59-7.56V9c0-4.169 3.404-7.56 7.59-7.56h225.926z" fill="#A2A2A1"/><path d="M193.278 54h3.372V31.497h-3.372V54zm30.378-14.397l-3.866 9.756h-.116l-4.013-9.756h-3.632l6.018 13.636-3.432 7.585h3.517l9.274-21.22h-3.75zm-19.128 11.841c-1.103 0-2.644-.55-2.644-1.911 0-1.737 1.919-2.403 3.575-2.403 1.482 0 2.181.318 3.082.753-.262 2.084-2.064 3.56-4.013 3.56v.001zm.408-12.333c-2.441 0-4.97 1.072-6.017 3.446l2.994 1.244c.639-1.244 1.831-1.65 3.081-1.65 1.744 0 3.518 1.042 3.546 2.895v.232c-.61-.348-1.919-.869-3.517-.869-3.228 0-6.512 1.766-6.512 5

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 21980
Category:	downloaded
Size (bytes):	6759
Entropy (8bit):	7.970766444142892
Encrypted:	false
SSDEEP:	192:4HB/Zow1k0DgHJTULAcyInTYrnqJPdu3o:anL1kygHJTUVyInUrqJVD
MD5:	15864CE88FA79A3E954417D0C3396798
SHA1:	FB9C3441942954B8EF8D637CDB307CBBAE25DA56
SHA-256:	97FDE46829E88416162D1CF2BA9C0BDC0A5C45D826ECF44095782AFD7417C500
SHA-512:	AC2B648224C8DD20F4BF5DAE9A4347C57B9902AE554E84FD3506F8B3B1E7759B33CB937B04D509E1DF06E4CBBF133C09D98A06E6FE8D30F639E4B8619E778697
Malicious:	false
Reputation:	low
URL:	https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Preview:	...........\.R.H..?Oa4.niI.....L.EO.Q.....,A.V.d...H.h.'...H..{N..%.zf"f#.....'..;'..?.....y>.....$E..%./...l.o.7.V=q..%):,.LS/....q......v..a.}......".0.t..`yf.2]&.....8........&y.Eg..3..<...M..}..A8.).....?~8..xy}.....{..Y.K.........%....n.Q.e>.u.1..a.zA./..oo.........CN....5.d.cX5R'{.u..{....3.O...nn.._....,e./..M.H"......R.l$.....:.aJ.L.S.g...>#...-/$.<.g..i..[....O.............^..?.6...........g.u...............w8.w..v.=...........qog.w@..n.....%Y,o....r....%5Q......\..%Y1......!..SZ$....yyz....%...\.o.'I.1......`B.........>.<X......E......#..^..eP.....,`...E...H.4..G.v.T.A.J.Y...,....x.......!.B&.6...~0.....9.\|....4.HB.K .......,..J....!.\5+p.......94O...Ar....?..+K...>L7R..s...&.v.=+.{I..M.....D..Q..\T..%..H.....Qt..P.X...L#.g.H......O.xlu<X.........pD.lJ......(..!...V..E%.4N...z.J-...o.".~...BC....T.Qf.@..p...fS.../.R.....;3.a2.e.~>.2`Z.A..R$.X.......KZ\|..y.ei.GrI..d..P...e..d......(..(gF>k.P.>.H~.Wt...dP.KY.*".....{C515... .v.

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4329)
Category:	downloaded
Size (bytes):	4373
Entropy (8bit):	5.3097826568099356
Encrypted:	false
SSDEEP:	96:o+swbsFloPntic+0cPVf5on/mluVvHz2Xuna:xsw4FUFT3a
MD5:	D5B79B5ECC02D1E1C7539005572B1FCE
SHA1:	EE2D390A8764FAF31D46ABD7B537FE28CC811FC0
SHA-256:	2BBE1473D9EA0290F1145E17B25DC37B3BDD6D2011CECCF12BB196689C28D1C4
SHA-512:	5405D5E0765165756227CE7D5EA435249D4CF3B0422D0303845C7F2CDD883B596792AF9538A0744A5268E1CBBBC76C4B37256A23859E99D524EA443F16D55EE7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/userAgentDetect.js
Preview:	window.avastGlobals=window.avastGlobals\|\|{},function(){"use strict";function a(){c.classList.remove("js-pc"),c.classList.remove("js-android"),c.classList.remove("js-ios"),c.classList.remove("js-mac")}function b(){d=window.location.hash.substring(1),h.includes(d)&&(a(),c.classList.add("js-"+d))}var c=document.documentElement,d=window.location.hash.substring(1),e=navigator.userAgent.toLowerCase(),f=navigator.language.toLowerCase(),g="pc",h=["android","ios","mac","pc"],i="",j="",k="",l="";if(navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0&&navigator.userAgentData.platform!==undefined){k=navigator.userAgentData.platform.toLowerCase(),/windows/.test(k)?k="Windows":/linux/.test(k)?k="Linux":/android/.test(k)?(g="android",k="Android"):/ios/.test(k)?(g="ios",k="IOS"):/macos/.test(k)&&(g="mac",k="Mac");var m=navigator.userAgentData.brands;for(var n in m){var o=m[n];/Chrome/.test(o.brand)?(i="Chrome",j=o.version):/Opera/.test(o.brand)?(i="Opera",j=o.version):/Edge/.t

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 144, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20766
Entropy (8bit):	7.983128650752489
Encrypted:	false
SSDEEP:	384:PSUeetQgZKXOzg1F9AvR3EHkpb8BB/bW7Pykmz7Dw9NsmwWbf5:PSEPLUXA1Es87bW7PykmzvGEK5
MD5:	464B78E45CD1D57D52990E5847288061
SHA1:	C5F2DA8A66E9F843E0B553E9F72451EDC6E96FC2
SHA-256:	267F19BE321396435377A71A75957F6131B2104D3414067DDE507E9A32EA4261
SHA-512:	9E2825F391125683EBA60F6B1B6EA8844F1529A05F7C6C98FD61E1CD8CB39FCE6D38A59CB68B0E9803DB08AE6D85A4005C28B3A09476739E8A1AEED1D1EE7B3B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............c......orNT..w...P.IDATx..w\|.......v..,.n.........!@B @..qG...#.r..&...q.@ri.H........w.-.w......1..3..j.%....O....y....F.i..F.i..F.i..F.i..F.i..F.g'.p....&K....~.....^..pO`.c9.f...s.27ee.=.4..>./....m..PeS....>.lWg])...)W...[.BXU.........U..z..P!.. ..c.EB.....cm....>...=V.8.a.s...0.'e....q..$.?i.G..%.B..F.t.. ..m..)(-..\...4.~..^.%.(.?\|......Z..$....v...#..D...4\H..b0..D.....@..$Q..\|..5t ..'i.I...)G..wo.o.gZ..m..N$.V.1.u...D.v.T-...PQ".Z..........~ .i5g.......U!..A..z...7.3.q..@Z/x.>.b....l.G..H....ZJ....A&....}...../.:.J.L.n8c...P.])...y9....\. .q.A...(...SOyc.l./.....g=).&}..y.....w>.....j.R[..}..'1.......b..k....W#...o.".a..".0.#~m..........+.l.....!.@.j...p[[[... ...W >h..2./PX...E.}!4z`.'.ea.=?E... X.x...P...cu........^...C.FG..c.......1.....!....N.1c..555...d..E.../.T..q...O.\^..BeL...K..7Q......}...N..K.9Q.0T..x..`....R....m..#..P..^...~...E.4.2H.q..q.D9.O..?.(.R....>.va.C.X..W.?e1...3.....z4[.

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4478
Entropy (8bit):	4.434482939817795
Encrypted:	false
SSDEEP:	96:jEmxEuUhZ1dwhSEP38TSGaS4PhioN4PhiXodhNV2UodhysKh:jELTwfmSDPhLCPhhdhNV2ldhyph
MD5:	84BB61A453E675247310728DEE1CE888
SHA1:	67F2AB9754F42FED3740AFEC1C00772DE966D465
SHA-256:	FFE164E0D9BDA881D0BAE30EE4042C35A149468EE9DC37C0C374DC2B1739FE1A
SHA-512:	D1F37F2E20C3D2C2D3606CD861A118A90FAA799F5DEC6B3460E7DB73C0B7BDEA37E42698DCBE9FFCF4EFA9D3027FE5929F882B91CC5C4A5241D9DA35299F99BF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/hero-a1/hero-illustration-shield-xl.svg
Preview:	<svg width="1360" height="304" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M505.936 52.968s41.802 5.632 64.883-5.768c13.269 22.836 49.475 40.731 49.475 40.731s-12.608 43.187-33.079 67.297c-22.389 26.368-58.608 26.146-58.608 26.146-15.262-8.958-31.29-30.27-33.968-54.449-2.934-26.502 11.297-73.957 11.297-73.957z" fill="#F7FAFC"/><path d="M539.807 136.042c13.157 11.013 24.87 2.941 35.724-10.025 10.854-12.966 7.138-20.894-6.019-31.907-13.156-11.013-26.877-11.218-37.731 1.748-14.248 17.021-5.13 29.171 8.026 40.184z" fill="#B7EB6E"/><path d="M566.667 109.315a3.022 3.022 0 10-2.84-5.334l-17.073 9.204-3.932-7.313a2.901 2.901 0 00-5.116 2.735l3.968 7.463a5.676 5.676 0 007.653 2.36l17.34-9.115z" fill="#fff"/><path d="M501.337 149.949c-1.939.027-17.728-1.742-17.33-11.062.547-12.796 24.546-1.938 29.494 1.687 20.919 15.327 27.353 31.904 59.687 37.161 19.083 3.103 30.752-8.825 16.07-24.736M570.819 47.2c-23.081 11.4-64.883 5.768-64.883 5.768s-14.231 47.455-11.297 73.957c2.678 24.179 18.70

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11123)
Category:	dropped
Size (bytes):	21595
Entropy (8bit):	4.996635198401547
Encrypted:	false
SSDEEP:	192:LIsia0zYw49vRn4l7cWQjRkmSxoVGD/4OIZZTg8l9Qonnq3WwmpUkG4HfeXiPcB7:HRc7fQZNGoFQlC2cXaivSYBQY2YpuMc
MD5:	487143B593B69C366E88F0D6F37A7521
SHA1:	24C38C758BD6EC62B838E5E9FB4A3D7A9E2ACB17
SHA-256:	8EDBD08B9BB87F815AD871E44AAE03AF609FC44B1961D608E94EFF3F4E010375
SHA-512:	531294B797609050BBA3CB476A478E653D177BC09643C1E4C78CA38AD6401F1C6646F727D73A612C6A2CDA2086D5E33D8118AFE97FB1459FFBF42AD748DC4D76
Malicious:	false
Reputation:	low
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	4.289945951414576
Encrypted:	false
SSDEEP:	96:YCsKv1sDlOdAwOYbOuQr9Nv1s7MMc5CY+Z5tjNQOAt/dV42GLQ:VvSpfwOYbOLfvS4WftjbQd+tLQ
MD5:	80DF532E02EAEC08EF491B4B4420AB14
SHA1:	5860F53B875350C2559F598A42A13E5B25045CE6
SHA-256:	6781CC289EF1A3359AC96F7D84A0EB0BEF8B8D001FAB80EE8B74C6CFB8B8C805
SHA-512:	C1271A569373BE2B8BA3E570B5BE90605B535FC541878C7E9ED1AE701B990A72E05FC581BFA32D9F41B48A89F1B82920E803DA670D1892BA9100B6F7FA1DB937
Malicious:	false
Reputation:	low
Preview:	<svg width="200" height="146" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M.584 48.47c.859.984 1.846.505 2.83-.354.983-.859 1.59-1.773.73-2.756a2.364 2.364 0 00-3.56 3.11z" fill="#0070F6"/><path d="M29.272 75.75c-1.874-.915-3.03.4-3.946 2.274-.916 1.873-.249 2.706 1.624 3.621 1.874.916 3.14 1.028 4.056-.845a3.775 3.775 0 00-1.734-5.05z" fill="#21455C"/><path d="M114.424 33.25c1.375 1.713 3.068.978 4.782-.398 1.713-1.375 1.451-2.468.076-4.18-1.376-1.714-2.533-2.39-4.246-1.014a3.978 3.978 0 00-.612 5.592z" fill="#D93511"/><path d="M20.526 132a3.158 3.158 0 100-6.316 3.158 3.158 0 000 6.316z" fill="#21455C"/><path opacity=".8" d="M154.737 100.948a2.103 2.103 0 01-2.105 2.105 2.103 2.103 0 01-2.106-2.105c0-1.165.941-2.106 2.106-2.106 1.119 0 2.105.94 2.105 2.106z" fill="#0070F6"/><path opacity=".64" d="M83.161 127.374c2.047 5.696 10.983 3.982 10.983 3.982s6.564-3.285 4.517-8.981c-2.046-5.697-1.606-7.957-10.136-6.658-5.984.911-7.41 5.961-5.364 11.657z" fill="#9AE437

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4740
Entropy (8bit):	4.125690883199848
Encrypted:	false
SSDEEP:	96:jrpDczmboPWKGMUgEY2pYYtD/RUEOcLLkUBcb/7EmDlLk4OYtcHRUyKWc4LKgPKg:/pQaU+RMrIYYtD/6wyXEmptOYtcH6yOe
MD5:	7F66FC5E3A9918651007A95CAC6F6C16
SHA1:	6884415E530A725E957FFC9B23DC457376A21487
SHA-256:	EBD65E90FF5AB91E3C327867A28C9729FDF1C312E75C56E05A3F4BC861D47556
SHA-512:	8389C055A75579F93F711AC27130F13513CAB59E7C063D10324D053B94161861979F4ABECBF2095B36608E577F13C9773E57C2D36B3E7B876C580DCE9C79362B
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/feature-icons/48x48/fireworks-2b.svg
Preview:	<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M38.44 14.855l-1.174 2.512-2.725.345 1.995 1.885-.516 2.69 2.42-1.32 2.42 1.32-.515-2.69 1.995-1.885-2.724-.345-1.175-2.512zM7.352 35.322a1.39 1.39 0 102.778 0 1.39 1.39 0 00-2.778 0zm2.66-24.526a1.39 1.39 0 102.779 0 1.39 1.39 0 00-2.78 0z" stroke="#FFD900" stroke-width="1.5" stroke-linejoin="round"/><path d="M11.897 24.769a.75.75 0 10-1.27.797l1.27-.797zm6.761 17.63a.75.75 0 001.423-.476l-1.423.475zm3.714-33.082l.094.744a.75.75 0 00.585-.426l-.68-.318zm1.627-3.477l.679-.318a.75.75 0 00-1.359 0l.68.318zm-2.637 6.564l.736.142a.75.75 0 00-.221-.687l-.515.545zm-2.763-2.61l-.095-.744a.75.75 0 00-.42 1.29l.515-.546zm5.4 4.508l.359-.658a.75.75 0 00-.718 0l.359.658zm-3.351 1.828l-.737-.141a.75.75 0 001.096.8l-.36-.66zm4.978-6.813l-.68.318a.75.75 0 00.585.426l.095-.744zm1.01 3.087l-.515-.545a.75.75 0 00-.222.687l.737-.142zm2.763-2.61l.515.546a.75.75 0 00-.421-1.29l-.094.744zm-2.05 6.336l-.359.658a.75.75 0 001.

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	834
Entropy (8bit):	4.406522236567162
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDJ0BDf4j/r6Tuw4Oi/yoSPa/RjT:Ofvt6lf4j/OTPi/yYZ
MD5:	76FD9CE18484179D9D4EE16EE1D7C825
SHA1:	D875233BF31DDA90016DC8FF8D1F90DF936BC983
SHA-256:	66CDE9481ACAAD1E2F792DEB093BC067C6865F566BDD2787F384B15E71117B3C
SHA-512:	733B78D5969E0E7B785E246949CE4582EBE1902C791CF0AB23153CD30F743ED46F406132979F3E3C9B42C3234229D2964621E68A669DF33D5E1A148F4E8545A2
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_avast-one.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#fff"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.734 12.734 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.732 12.732 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FF7800"/></svg>

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	238
Entropy (8bit):	5.033553988277396
Encrypted:	false
SSDEEP:	6:tI9mc4slzcvUY7SQRtsKMw9jI6mqZlllZHzA:t4CvnuCxMwB9hlllpU
MD5:	621D00062D3EDB4F262DD755A8E4821A
SHA1:	916C4522663F76666881761DB7402C299C1C83C0
SHA-256:	83D7832C75D2DF965E48245ACC123F0BB031EBF021B89D6C5A9DE7C178D30647
SHA-512:	151CEE873C3D7BFC9F9D51E877FEF634E87068E9533B178E8F2B311E86B617D7949947AC91B5C8D5335B8B141F5A2303D7FE7B9CCD876E7FF2BC77F116C31888
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/check.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">.. <path fill="none" fill-rule="evenodd" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2 8l4.125 4L14 4"/>..</svg>..

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14612)
Category:	downloaded
Size (bytes):	14615
Entropy (8bit):	5.045789399077018
Encrypted:	false
SSDEEP:	384:zfV8DTx7evudfcX0RqBrwrVoSYM10cm+fFHhKDI0:LVsx7evnX0RqB85oq06FK
MD5:	26BAF8A457DCE1DC1BD0D6B945F4C44A
SHA1:	F0EA8780F288D4A644AB4554A4D6385DBEFA869F
SHA-256:	FAFC1A4C4FDCF86A1F539D79735D868F37E53A490E680A44DAC209716E9E5A7E
SHA-512:	7C7B280ADC23EC5A18434566BE202A1ADA1279CBC92D6531B2543285FD3DB40689E7850FFAABD568BE4022DA39D9F633066B8EA28ED0E443BCE00E810DD61F7D
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hs/hsstatic/content_shared_assets/static-1.4092/css/public_common.css
Preview:	@charset "UTF-8";@keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-moz-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-ms-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-o-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-webkit-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-moz-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-ms-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-o-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@keyframes vex-rotation{0%{transform:rotate(0deg);-webkit-transform:rotate(0deg);-moz-transform:rotate(0deg);-ms-transform:rotate(0deg);-o-transform:rotate(0deg)}100%{transform:rotate(359deg);-webkit-transform:rotate(359deg);-moz-transform:rotate(359deg);-ms-transform:rotate(359deg);-o-transform:rotate(359deg)}}@-webkit-keyframes vex-rotation{0%{transform:rotate(0deg);-webkit-transform:rotate(0deg);-moz-transform:rotate(0deg

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	4.165436375230474
Encrypted:	false
SSDEEP:	192:ypmpVQxhGVV5/XomxNNpffFilOFkIplHUvRHMPvRYu:ypmpqzsVjN/UyCu
MD5:	A97FE84F0BC1F01FEF99D5FFA64CC08D
SHA1:	4045C03BB4FCB779947FF54676E48E06DB986093
SHA-256:	4E31C241E2961A79E33C55DCCF1F36F844FF603F6C4BF5025D73A9EDF81FB148
SHA-512:	66C5305199DEEF43F032E1261D75E6F7C51F8AA15FC2596EEF54BA1BEB035A2BC65BDA737780BFAE68AA723303599814CC0C5391503095392041461A62AD860F
Malicious:	false
Reputation:	low
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M58.871 68.438l7.403 1.386A3.147 3.147 0 0070 66.731V53.61a3.147 3.147 0 00-3.737-3.092l-7.392 1.41-5.674 1.055a3.147 3.147 0 00-2.572 3.094v8.185a3.147 3.147 0 002.558 3.092l5.688 1.084z" fill="#FFDDBF"/><path d="M100.319 68H105a5 5 0 005-5v-1.773c-.193-1.872-3.152-4.677-6.22-5.575-2.896-.856-6.592-.873-9.505-.03-3.1.94-6.125 3.666-6.275 5.605V63c0 2.761 2.249 5 5.01 5h7.309z" fill="#D5F2A5"/><path d="M77.41 38.678c-1.476.588-2.848.681-4.083-.46-3.492-3.25-5.768-9.666-3.273-14.116 1.584-2.651 4.538-3.67 7.355-2.532 1.562.606 2.161.493 3.735-.077 2.61-1.013 5.546-.497 7.278 1.842-1.752.785-2.734 2.794-2.734 4.641.034 2.01 1.3 4.186 3.312 4.795-.517 2.017-1.784 4.025-3.312 5.447-1.272 1.126-2.621 1.02-4.12.46-1.406-.654-2.758-.674-4.159 0z" fill="#D4E7FF"/><path d="M143.048 67.606c.673 3.194 4.63 3.64 6.598 3.227 5.206-1.096 3.788-9-1.5-9-2.052 0-5.77 2.58-5.098 5.773z" fill="#FFBF00"/><path d="M25.85 3

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	4.112283361727405
Encrypted:	false
SSDEEP:	48:zHkiUw9JEj9uDniegT1AxpdOIz3bZX958RuvOcPeLQYadETAb9ToUxWrRGjZXUwx:rkiUwr6aUTiOUrP58koLQmTuTo3kNx
MD5:	3762B9725281D979BEFBE26627F548A4
SHA1:	A4197369F6CDAAC10A5F2FCD37A99C2AB0F84EBD
SHA-256:	C564C654D2E8B15D5687FA376A014792B26B1A308395381D133D3BDBFFFEC487
SHA-512:	DD12F126808A0D8DBC7341A635139473465FF1D403263038D148FF9E237AFF66DD30A77E1BA0F3F3092BAE438809B759B6EB7F5A775534042F782E69FB6DC04E
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.18 18.496l-.577.16.578-.16zm-.63-4.862l.6.004-.6-.004zm9.022 13.862l-.292.524.292-.524zm11.247-9l.578.16-.578-.16zm.631-4.862l-.6.004.6-.004zm-9.022 13.862l.293.524-.293-.524zM7.819 6.334l.172.575-.172-.575zm6.827-2.007l.168.575-.168-.575zM5.554 9.388l.6-.001-.6.001zm20.892 0l.6.002-.6-.002zm-2.265-3.054l.171-.575-.171.575zm-6.827-2.007l-.168.575.168-.575zm-5.406 15.547l.592.093-.592-.093zm8.302 0l-.593.091v.002l.593-.093zm-6.981-3.242l.26-.54a.6.6 0 00-.733.17l.473.37zm5.617 0l.464-.38a.6.6 0 00-.723-.161l.26.541zM6.76 18.335a17.416 17.416 0 01-.61-4.697l-1.2-.008a18.615 18.615 0 00.653 5.028l1.156-.322zm8.105 8.637c-3.61-2.015-7.028-4.77-8.105-8.637l-1.156.322c1.212 4.352 5.004 7.313 8.677 9.363l.584-1.048zm11.533-8.315c.398-1.43.667-3.19.653-5.028l-1.2.01c.013 1.72-.24 3.369-.609 4.696l1.156.322zm-8.676 9.363c3.672-2.05 7.464-5.011 8.676-9.363l-1.156-.322c-1.077 3.867-4.496 6.622-8.105 8.637l.585

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2562
Entropy (8bit):	5.114548114833202
Encrypted:	false
SSDEEP:	24:2d/EMBEEa5M9jj2/xRhykCLhlllE94dga4KXqveJnJl7HGqLhlllfHlbjLhlllht:c/dEBKcUtffX6e/l/Z6P6CczZSWKn8T
MD5:	18715D69DDD4017FCA484C62932EE2D8
SHA1:	010E59351D7E5EE67C726885BAF92E79C7F21B4E
SHA-256:	A3D7AF88825B7F1DDCA196D9D839ACF5BD7E58F29FFDD66208EF348859B99910
SHA-512:	107F7D6F2713DCE320BDCA1E8C5000AB98819AE1B421A2E9550A5FE659F8D22BAF8FC8E06F4A355656E157B939BEBCF6322F076B1B90663F4776638337FF195F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <path d="m7.3905,8.8375h16.8121c1.4122,0,2.5586,1.1465,2.5586,2.5586v11.8278H4.8319v-11.8278c0-1.4122,1.1465-2.5586,2.5586-2.5586Z" fill="#fff"/>. <g>. <path d="m6.6665,8.691c-1.2184.0004-1.8279.6117-1.8279,1.8349v12.1698m22.0022,0v-12.1698c0-1.2231-.6222-1.8344-1.8667-1.8349" fill="#fff" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. <g>. <path d="m23.1856,13.1459v-5.1334c0-.6023-.3703-.7946-.8944-.9569l-5.6196-1.6397c-.6686-.1971-1.0846-.2087-1.75,0l-5.6196,1.6397c-.5334.1649-.8751.3511-.8751.9569v5.153c0,4.0023,3.4114,7.0368,6.7095,8.8388.3978.2174.8793.2093,1.2729-.0156,3.3906-1.9374,6.7763-4.7746,6.7763-8.8428Z" fill="#ff5833" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. <path d="m14.3382,15.6641c.4278.2475,1.0046.3513,1.4584.3513

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31960)
Category:	downloaded
Size (bytes):	55787
Entropy (8bit):	5.289184378335385
Encrypted:	false
SSDEEP:	768:mK0DELADAYCokxFO7magkB3IVz3+j5ilK30fC3660D+OmL60bf1VrSp1mDNGqSd4:mTY7PO7ykBmRp1EsbY
MD5:	4F574BAB096B06BD612006A11D6BAEA2
SHA1:	F46EA84D3170F21951E605C8CB79A567378D7A66
SHA-256:	2702368CAEEC5D741DC5709F3BB2BFB390D17DB699EA7B472DA172526050C310
SHA-512:	DCF900E15CC47ABF6A113E7FE462E2992EB1CF7D181E786AE1C7D4B14CC5137CF5D420FF7DF280C4ACF23FE58403F60C3335CCFC8E2351F57E99AD3ADB626409
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/avast.js
Preview:	function loadEmailForm(a){var b="/"+avastGlobals.web.locale;switch(avastGlobals.web.locale){case"en-ww":case"ja-jp":case"ru-ru":case"uk-ua":b=""}fetch("https://"+avastGlobals.web.domain+b+"/email-capture-form-content",{headers:{Accept:"application/json","X-Requested-With":"XMLHttpRequest"}}).then(function(a){return a.text()}).then(function(b){var c=document.querySelector("#email-capture .modal-body");c.innerHTML=b,c.querySelector("#thank-page").classList.add("d-none"),c.querySelector("#session-note").classList.add("d-none"),c.querySelector("#frm-captcha")&&c.querySelector("#frm-captcha").setAttribute("placeholder",c.querySelector("#form-body").getAttribute("data-code")),a!==undefined&&c.querySelector("#frm-captcha").setAttribute("message",a),initAvastForm()})["catch"](function(a){/captcha/.test(a)&&(document.querySelector("#email-capture #form-body").classList.add("d-none"),document.querySelector("#email-capture #thank-page").classList.add("d-none"),document.querySelector("#email-captu

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1349
Entropy (8bit):	4.201219141408615
Encrypted:	false
SSDEEP:	24:t5Iu2eFA8C+w7Li+OMgJbuPogg9+5ZhUqT9VEujfWQofRn3DAx3OvvCIsyAKmq:ae/Ca+9gBqTgU9Jj+NpTAx3+vXsycq
MD5:	17D244683C9737C01686C384F87145E2
SHA1:	44AACB11ECF74D8594C95AF08D9787C654A7D248
SHA-256:	77B31D0E25FFE381DCD42AA468F074882CB5CB0F0B8BF26FA913308CD4D2772C
SHA-512:	AD80BB26C37BC2B8418DBAA31A3E4B3465D00FB5C5481C5E6BD4CF4746ECC103465DAA83137195729E33F7849DCF4B15D9F489F00C7858F3A566C40EA1A7EECF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/logos/gen-logos/gen-logo.svg
Preview:	<svg width="38" height="18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.947 14.895c2.198 0 4.003-.765 5.18-2.57v2.158h2.414V9.047c0-1.275-.687-1.824-1.982-1.824H7.77V8.32c0 .942.51 1.315 1.373 1.315h1.746c-.274 1.452-1.608 2.53-3.454 2.53-2.237 0-4.022-1.824-4.022-4.709 0-2.57 1.55-4.63 4.297-4.63.588 0 1.06.097 1.491.274.55.216.824.471 1.237.863.352.353.627.608 1.314.608h2.434C13.697 1.688 10.733 0 7.672 0 3.159 0 0 3.454 0 7.79c0 4.378 3.473 7.105 6.947 7.105zm18.966-5.69c0-3.1-2.12-5.121-5.063-5.121-2.963 0-5.376 2.276-5.376 5.514 0 3.277 2.315 5.298 5.317 5.298 1.904 0 3.729-.863 4.611-2.393a6.478 6.478 0 00-.568-.432c-.334-.236-.628-.373-1.02-.373-.373 0-.707.216-1.119.491-.451.294-1.04.452-1.589.452-1.295 0-2.511-.766-2.708-2.335h7.436c.059-.219.079-.807.079-1.101zm-2.944-.843h-4.533c.216-1.315 1.118-2.139 2.354-2.139s2.179.844 2.179 2.12v.019zm3.895 6.121h2.924V9.224c0-1.707.843-2.766 2.257-2.766 1.139 0 1.923.568 1.923 2.001v4.65c0 .883.413 1.394 1.394 1.373h1.53

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	4.495902589061296
Encrypted:	false
SSDEEP:	24:tzkuqvUseRZYRoKyNyGOFhG6V1bMSA8NIOTYhll7:GeReRiNyGOjBV1OUo
MD5:	5C51D97C54C81DC0854B3BBDA79A4A70
SHA1:	3415410A991A453674E3C9D2DEEFD9B76B8D1F83
SHA-256:	769DB1B5B23B294FB8598B7561FC050C40338D501FEE7D0D8F9D2C15544AE6F5
SHA-512:	A691813E01BDF46460121675A031774257EB4188A388E1DA8CAB2DD5B0331368904577E4ED392DEE56C89A55547FC50764599C892FB9A2FD91061ED98EE8F4AE
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_antitrack_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14.763 21.606v1.5c0 2.293-1.302 3.9-3.75 3.9-3.384 0-3.725-2.2-3.725-4.95 2.048-1.677 5.174-1.398 7.475-.45zm0 0a3.593 3.593 0 002.45 0m0 0v1.5c0 2.262 1.321 3.9 3.775 3.9 3.384 0 3.724-2.2 3.724-4.95-2.056-1.686-5.19-1.388-7.5-.45zm5.987-10.6c.7.133 1.37.271 2 .45 2.534.717 3.8 1.567 3.8 2.55 0 1-1.267 1.858-3.8 2.575-5.74 1.587-12.66 1.587-18.4 0-2.534-.717-3.8-1.575-3.8-2.575 0-.983 1.266-1.833 3.8-2.55.639-.18 1.3-.317 2-.45m14.4 0c.067.883.092 1.875.075 2.975m-.075-2.975c-.166-2.3-.583-3.967-1.25-5-.733-1.083-1.8-1.292-3.2-.625-2.229 1.061-3.27 1.049-5.5 0-1.417-.667-2.483-.458-3.2.625-.666 1.033-1.084 2.7-1.25 5m0 0a33.29 33.29 0 00-.075 2.975" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	264088
Entropy (8bit):	6.385403441351715
Encrypted:	false
SSDEEP:	3072:K2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhdn+Ts:K0KgGwHqwOOELha+sm2D2+UhnguWN
MD5:	21B56ABF76225D8337BD397FF6C75B51
SHA1:	8FC074BC44B8B71E38A5097D8FE77D2FF513880B
SHA-256:	E8C9A893CFA4FF1D39E6CD597D83797C12235DD750CF8C3DB2CC1F7F9E0A0FC3
SHA-512:	FD738B8E0A24D652F0C6CFDBAE3FAC02F0C9B82C38647E682818C3C71E4526A6039180145C80CC72697C0A42EAA0D6A92B1A6FA4E99D0DE7AA14661856A7733A
Malicious:	false
Reputation:	low
URL:	https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build_RELEASE/cookie_mmm_ava_esg_000_361_m
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L...um6d.........."................. ........0....@..........................0......&T....@............................................0...........H...P)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/icons/sprites/icons-16.svg?v3
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	4.846938898698586
Encrypted:	false
SSDEEP:	24:tXiuroMbH+bIAsHNshtFn+KV2gBIuStPcylm9E3q4nHchlliDFYmaCdCraDRZC6l:7orbIVsV+U3BoOWvXDtXDRs6l
MD5:	4831F26973D930A3ECE79D6DCB1F4601
SHA1:	AF45D0AC3E4BA1E0FBF0106A0342F786C893F338
SHA-256:	1F4935921513AC24D611B6C3D9BA026618740925DCEB41C0DEF10FDAF421FE03
SHA-512:	1F8C5CA150759C8E912665B0AD588B00A7703618FAA4637C1B8B8B9BABED9986E1A1234C0EC856DE60CB245B7B1B64DBCDD21B4D4F7B9E0B6ABEFDFDCDA27BE4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/pages/about/160/safe-browsing-and-emailing.svg
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M68.218 64.48V42.186c0-2.544 2.969-3.934 4.922-2.303l27.918 23.295c2.154 1.797.883 5.304-1.922 5.304H72.218a4 4 0 01-4-4z" fill="#D4E7FF"/><path d="M4.46 50.758c.673 3.193 4.63 3.64 6.599 3.226 5.205-1.096 3.788-9-1.5-9-2.053 0-5.77 2.58-5.098 5.773z" fill="#FFDDBF"/><path d="M128.302 19.216c-.78 2.882 1.383 4.152 4.265 4.931 2.881.78 3.871-.383 4.651-3.264.779-2.882.594-4.693-2.287-5.472a5.405 5.405 0 00-6.629 3.805z" fill="#7BB5FB"/><path d="M26.878 70.332c-2.824-.966-4.233 1.109-5.2 3.933-.967 2.824.128 3.888 2.952 4.855 2.824.967 4.644.9 5.61-1.923a5.405 5.405 0 00-3.362-6.865z" fill="#B7EB6E"/><path d="M14 53.651a4 4 0 100-8 4 4 0 000 8zm124.789-.453v6m0 6v6m-3-9h-6m18 0h-6M30 10v4m0 6v4m-3-7h-4m14 0h-4" stroke="#071D2B" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M102.831 31.313v-1.68a6 6 0 00-6-6h-45a6 6 0 00-6 6v4.68m0 6.784v20.45a6 6 0 006

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	545
Entropy (8bit):	4.754128613009515
Encrypted:	false
SSDEEP:	12:tr/kuINyGdOU2zhjZmfJsXjMl0UVSzIDh1tiq5Mb0u/Xm/B9Yhll7:tzkuHyj2zpZmjl0Up5iA7e2/TYhll7
MD5:	90847F1EA9446C6C882BCE55658B729F
SHA1:	F4B3EAD41C56B796AE2DB5CE210E9BFAE675D677
SHA-256:	E1A666F4C9298EE14EBF790E41A103BBA3299B145A90E1FE5E124D692F40D211
SHA-512:	6F0F0A083D7F15FCF4A29C66103796326261B96186B198C0AA396452A5114CC8B89643A7FD85A96320907790873AC1B5A2BC0D116B30FB1EB6AC237485EF96F9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_free-antivirus_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	375389
Entropy (8bit):	5.206520278265445
Encrypted:	false
SSDEEP:	1536:s9i8ZHMCbS/SgV9U4CILJPptpJKztM6oyi+MOn4y2Ox5juDEnXrDJc7MsByZ54c3:s9i8ZiSgg47SoyJufmJ3cUIoNN
MD5:	58293891FF4C898BE0EADEE27499F069
SHA1:	DA5BF91B374CF2D897223E3F938460D2273CC62B
SHA-256:	C2712347073AD51D00C891FB5F584A2CAFD9D8297138FEF5FDA158305A22193C
SHA-512:	B0190D6A91AB7E4D8E516945D6F70ACBA99A695DBB6AD2F4A7B3DC5AD8160229AA134F99D78FC10E9429B3EAAA4E8FE7C6A138207F5E5EBFA3C8CF5C3A7E2C9F
Malicious:	false
Reputation:	low
URL:	https://www.youtube-nocookie.com/s/player/2070f79f/www-player.css
Preview:	@charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none;forced-color-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transition:color .1s cubic-bezier(.4,0,1,1)}.ytp-probably-keyboard-focus a:focus{-webkit-box-shadow:inset 0 0 0 2px rgba(27,1

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	13336
Entropy (8bit):	7.960916300267995
Encrypted:	false
SSDEEP:	192:nqTEApjf8OwePGuj4XOi+YuUILC/3di0WNy3ObmrVXQvC3QDISRWLspzukJuM:qTNfD7TYuUILCfs0HO84Dtqkj
MD5:	814343D6864D151215B3CFFC4D470932
SHA1:	E2A6C56D0B2D43CA420623121BF09B0D2272EA2D
SHA-256:	12BD013C1F570041D162D7799D995E3EA3F7B4A8DC5F1BE5105B51BEBB04872F
SHA-512:	541B0C5B9D1CCCDC0E76F805871E4C92A9799DA73623431F1408783AB1780FE6738778FC6468998E7020D79BEC51EA1F4704F920EDCBCBF685019639FBC36B44
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/Academy-Computer-Virus.png?width=1320&name=Academy-Computer-Virus.png
Preview:	RIFF.4..WEBPVP8L.4../'....a..#..w=...;"&..7.S..2.LN.f..(.N...[\Gv....b!L6.Tjz .%.........Ov/..........i8..}.....I.._..@8..D.G:g:P..<.9......r0.C0...&2...H.t.k...J.........u..T'..Aa....................qP.IR.^z\|2...R....xiW...U.}...-.:..m..qG.m.6..8.O'@.....Z.H.{...{..5m....%...{Cy...{i......+3.k..Pt3F....A...Q.AE........=.2..T...B.%w.5... e&.d..y.IE..#...N(/.....H......dN....)....J6..& o8..A.'....=.....-.9.L..y3.p.....'..F..t$.6...g.Q.....d.H.(....`...(...4.j....t...(]2.n.c[.m..m.."...m...zN....,.i[..ql.^......l.6.m.l...?.v......t.]..........#....fv......0...\|%..?^_...\<...`..;....n..@G....8wk......`.)5....U....[...0....G:.D.3sh...f...J-pH...".k..H@...\|....D........&K.&2....Cv.......;q.YX...?..roL...I............?..^KC.^...>...w..H.^.B.^MF..K...69......i.cI.IoW.I.&y.teI.s.X.;uhR.IS..J..tr,Ih.&.h.&9..h.&.I.&y..X.&miR.I.&.Y..$.I.&Mi.&9.$4iF.64..$..M..H.<M....cIB."M..=Mr,Ih.&.h.&9..h.&mh..IW.tq,iK."M..=K:9.$4)..MZ.$..n.....=..y

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	268675
Entropy (8bit):	5.570885980820649
Encrypted:	false
SSDEEP:	3072:VbuyyayyE+B8ysrcwWimS8/CYTkvJpgWgiN1sJ/EnO3G8Ibb9Emmtqt3h+rBwo73:5KqBdsr2UYyJ5N1sJcnOWBbrtR+rBp
MD5:	0A604758549CBDFE03B6557C95F68C39
SHA1:	2376068BE4547B7E1BA6275427D1F2BD0FB8C962
SHA-256:	57AD3DFC922A2359B84A25574072D3FCDA38DA4FD449959F00A1D2BC3DC70427
SHA-512:	5D5274B3C52E7BE4D49E081E3285EA3102BA59452C8BD1132284B28A38F8FC08E933D58291B492B7DF474BD950AAD019051D0CA2478805A503B482A0D2378523
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-WZQ6MQ6RF3&l=sdl
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_auto_events","priority":23,"vtp_enableScroll":false,"vtp_enableOutboundClick":true,"vtp_enableDownload":false,"vtp_enableHistoryEvents":false,"vtp_enableForm":true,"vtp_enableVideo":true,"vtp_enablePageView":true,"tag_id":9},{"function":"__ogt_cross_domain","priority":23,"vtp_rules":["list","avast\\.co\\.jp","avast\\.ua","avast\\.ru"],"tag_id":11},{"function":"__ogt_1p_data_v2","priority":13,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionT

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (698), with no line terminators
Category:	downloaded
Size (bytes):	698
Entropy (8bit):	5.596546343251813
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHq9/B4Z4rehqnxOQGMcX2LTW5daDBMKTiUMGT2IWSBWrc3:hMiRO9pdBwhQBTpLTW5d8t8G9xu8
MD5:	F90E9FB1C6D8CC4FF29831A58C6A3225
SHA1:	89564F72ED811EA7508555141E2F782806A35D49
SHA-256:	C02060E0D2D2A1F6FE716AD61489F990981017245309E63AD583F9677D9EB8F5
SHA-512:	E9A2BEC1606CF506FC7F6F94C34967164EFCFBEFB46A4D506E34285EB7F3FE93BF17808991F32153E2CAF749D44194ED4735E7DE1B7E538141B4D10A8356FAEF
Malicious:	false
Reputation:	low
URL:	https://4711400.fls.doubleclick.net/activityi;dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware"/></body></html>

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2399
Entropy (8bit):	3.9638823518918755
Encrypted:	false
SSDEEP:	48:CCYWGxek1sprEaPu1UHdrEO9WFmbiZwiREv/XZfdSWpbFSNDH:3YWGxek1sAaPuiaaZfdN5FSNDH
MD5:	E48F1562B2FF1CEEEFD7322A1BA4E230
SHA1:	95DC95C6D284EAD06EC107EFB28A8EC8456551E4
SHA-256:	7765991A7B59FF69FD88865D83E268A8C9F7EF7690CEC18EE9D5084C47628C16
SHA-512:	D2E5C50FC7827A02D3B44A59B218BA4D24E655733F72B6861758561971D375E15F7EA8DE468C112B34B1E00E0A9401B268942C116F55E4A5549489521164D7F7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10001944/web/i/logo/avast-logo-default.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 643.4 200"><path d="M635.5 89.1c4.4 0 8-3.6 8-8v-9.8h-24.8V49.7H605c-4.4 0-8 3.6-8 8v13.7h-4c-4.4 0-8 3.6-8 8v9.8h12v31.7c0 5.1.1 9.8.2 13.8.1 4.1 1.2 8.1 3.3 12 2.3 4.2 5.7 7.2 10.2 9.1 4.5 1.9 9.6 2.9 15.3 3 5.7.1 11.5-.4 17.5-1.5V148c0-4.5-3.7-8.1-8.2-8-2 .1-3.9 0-5.7-.1-4.2-.3-7.2-1.9-9.2-4.9-1-1.6-1.6-3.7-1.6-6.4-.1-2.7-.1-5.7-.1-9V89.1h16.8zM296.7 42.8h-23l-41.3 114.5H250c3.3 0 6.3-2.1 7.5-5.2l6.9-18.7h51.1l6.9 18.7c1.2 3.1 4.1 5.2 7.5 5.2h17.5L309.2 51.6c-1.9-5.2-6.9-8.8-12.5-8.8m-25 71l18.2-49.1 18.2 49.1h-36.4zm189.7-44.6c-18.2 0-29.9 8.1-36 23.9l13.1 4.6c3.1 1.1 6.7.1 8.8-2.5 2.8-3.5 6-6.4 13.9-6.4 9.9 0 14 3.5 14.8 12.9l-26.5 4.6c-24.5 4-27.5 19.1-27.5 27.4 0 8.3 6.3 26.1 30 26.1 12 0 20.6-4.4 26.2-9.8.3 4.1 3.7 7.4 7.9 7.4H497V102c0-23.1-14.6-32.8-35.6-32.8m-6.1 73.5c-8.3 0-12.4-2.8-12.4-8.1s3.9-10.9 17.2-13.2c7.3-1.3 13.1-2.4 16.9-3.1v5.4c0 11.2-11.1 19-21.7 19m-49.5-71.2c-3.3 0-6.3 2.1-7.5 5.2l-19.5 52.9-19.5-52.9c-1.2-

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1175)
Category:	downloaded
Size (bytes):	1213
Entropy (8bit):	5.1334936450386435
Encrypted:	false
SSDEEP:	24:cjDOCpmoCBT7e4bdPX1f3vZHusyk+zVovPEFJ:OOCpEBXe8dv1HQoXEn
MD5:	0963B5DD69155E206375AFB3A2F035C4
SHA1:	C4B4DF6E4E577B8BDE559A5B89356286DC578130
SHA-256:	311F8CBEF6826ECFFACDB56E30CAEC7AA890D6A5D7D9848273CC17A654CF8F04
SHA-512:	3D10F7F9538B59C727AFB94D8FAD2B6FF026CAABB4F2D3AF578170CA688BBD8B840E532FDAC43B636F7DEF68FBE51121660CF4E30580AD9BB43307CBA9A615B8
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/cmp-modal.js
Preview:	!function(){"use strict";for(var a=avm.require("cash"),b=document.querySelectorAll(".modal"),c=document.querySelectorAll(".modal iframe"),d=0;d<b.length;d++)b[d].addEventListener("hide.bs.modal",function(){var b=a(this).find(".modal-content"),c=b.find("iframe"),d=b.find("video")[0];0!==c.length?c[0].contentWindow.postMessage('{ "event":"command", "func":"pauseVideo", "args":"" }',""):d&&d.load()});for(var d=0;d<c.length;d++){var e=c[d];if(null!==e.getAttribute("link")&&/youtube-nocookie/.test(e.getAttribute("link")))if(/MSIE\|Trident\//.test(window.navigator.userAgent)){var f=e.parentNode,g=e.getAttribute("link"),h=e.getAttribute("height"),i=e.getAttribute("width"),j=document.createElement("iframe");f.removeChild(e),j.setAttribute("src",g),j.setAttribute("width",i),j.setAttribute("height",h),f.appendChild(j)}else for(var k=document.querySelectorAll("[data-target="+e.closest('[data-cmp-name="cmp-modal"]').getAttribute("id")+"]"),d=0;d<k.length;d++)!function(a){function b(){document.que

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	12372
Entropy (8bit):	5.0485583079357355
Encrypted:	false
SSDEEP:	192:eLDZ4zrvjOPxhCf+hnp6+hukN3W8qLpBVh1LzPgwAJe1C5J7BQGz7PIPeETmA1Na:ePZwrvKphCOpNqL31Lz+ZKWL8baCA
MD5:	15C1BE962685D0633C97480DB5356965
SHA1:	CCD6C24766330632EAFD181E65DDFD9B06CEAFC8
SHA-256:	2443673ACEB4E09F5EEC4DA7081D1C461EA0EFDEA4AEEDFE0429C2111DFB177B
SHA-512:	5B0DA7F0C2D173BEEE9704D5571D9A350CE69FC32D7D446A51F7B36A2A6616461BD189EE62CCFD45A91F3D750CD0264C4D9EDE8ECBBD6557985B5D8713E0EF76
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secure-browser-pro-color.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (7046)
Category:	downloaded
Size (bytes):	704764
Entropy (8bit):	4.820647082016162
Encrypted:	false
SSDEEP:	3072:Ib8vLoM8XJ8PWDJQPZMd1DBmFslimGNojQCfNiG6PXrq2ukGVkQml9eiN3WKhjsn:Z2mYislU9uKhdKhIqxkPWHUfq
MD5:	9FCFA7F5AF4249B71F211C93CD4AE7C9
SHA1:	C0D7BA8EAA1486AE9B846BC6C09FA0A80D2F5CDD
SHA-256:	AE279514B94C9CDB8C03222DC6AA248528A127A514308A6E5B4CA3ACBB9787DC
SHA-512:	E7CE9A12146934D54DBC00E37C00AC3661894CCDC9B2330CE09A4D9543248EDE3CA8E0AC770C5083D28E95A05F296BF4CB13D2C538684D79833EBE4D9AD6AA33
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/c-computer-virus
Preview:	AB Testing variants--><!doctype html><html lang="en"><head>. . . . .. .. . Avast Cookie Bar -->.<link href="https://static3.avast.com/1/web/c/v2/vendor/onetrust/onetrust-avast-floating-center.css?t=13" media="all" rel="stylesheet">.. <script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js"></script>. <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486"></script>. <script type="text/javascript" src="https://static3.avast.com/1/web/j/vendor/one-trust.js?t=13">//</script>. /Avast Cookie Bar -->.. Google Tag Manager -->.<script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':. new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],. j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=tru

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (501)
Category:	downloaded
Size (bytes):	993
Entropy (8bit):	5.2974193154288125
Encrypted:	false
SSDEEP:	24:E15uzXIbtEHvIYWwmqAK/HJ2cNAXzk5vuHM8aJLtMCRWZ4FhQ:E15wXmtEPT6cLAXzk5kaJL+CwYhQ
MD5:	3B5801CD2DBBF755DE6E72F58E98DA16
SHA1:	0A9A6BDCFC47E6C06B7913D5391BF4C491BFCADF
SHA-256:	D964B94E67E887DF8DD073BB9FF63A20A118F2C03ED78042E08159E63D6159AA
SHA-512:	3E73E79CC971FC158266D9EF504FC575B5CA80333433A7F1050655DC34FB1B773AE32C174CD5F7ADD599B632068675FC3BD1E867BA0CE681966CD774357C1E6E
Malicious:	false
Reputation:	low
URL:	https://www.youtube.com/iframe_api
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/2070f79f\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;var i=0;for(;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){var k;for(k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",.n)}var b=document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.406522236567162
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDJ0BDf4j/r6Tuw4Oi/yoSPa/RjT:Ofvt6lf4j/OTPi/yYZ
MD5:	76FD9CE18484179D9D4EE16EE1D7C825
SHA1:	D875233BF31DDA90016DC8FF8D1F90DF936BC983
SHA-256:	66CDE9481ACAAD1E2F792DEB093BC067C6865F566BDD2787F384B15E71117B3C
SHA-512:	733B78D5969E0E7B785E246949CE4582EBE1902C791CF0AB23153CD30F743ED46F406132979F3E3C9B42C3234229D2964621E68A669DF33D5E1A148F4E8545A2
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#fff"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.734 12.734 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.732 12.732 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FF7800"/></svg>

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	5.2727801090429285
Encrypted:	false
SSDEEP:	24:hY6svD+6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z8x/S8f:3qD+2+pUAew85zsaA
MD5:	78FD7C1A980B9162702E6F984A25B7A6
SHA1:	E832ABE897CDAA5E36131733AF619F174AD0F9C5
SHA-256:	1C5A3539A6FBE5420A519540FF6662EFEACB0BB1B9B8314C74064694A0D52C0B
SHA-512:	06B0C9A98D1F6B5BCF81D81574258B7D479579CD80FC51105C58B99263D802EFD64ECF6B5A9A3105C1046FB7EE3F776547E1593436AFC3E6C0820D149C0913BA
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4429
Entropy (8bit):	4.319292533127892
Encrypted:	false
SSDEEP:	96:vUgpLMM2H2kW1YD2lOOdRg0W3cK9E0Vu1UrgxMUuzFJkZYt8PQt:7u2kW1YD2lOO3g0ecK9E0VfzFqZk5
MD5:	C7D92B27504C8D1A7D867BB4191D0611
SHA1:	8F21EF8CA9AFDC2DB183D8EDB2CFA8EB3A35E80B
SHA-256:	8A9C2ACCCFCEBE7A67872A51F9CC08E985DBEA93FD0280637A0F71D74D5B1A56
SHA-512:	51759241852734BDA8D21981D8C2432BFEF4A0D18002F1B007F6E7031FC341F8CA3601501885E72DFAA71D606F521D83E22678E4C400FD68646873A2EB6F9564
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/sprites/social-32.svg?v1
Preview:	<svg width="416" height="33" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M17.597 11.722v2.188h3.067l-.509 3.273h-2.558v7.824h-3.542v-7.824h-2.862V13.91h2.862v-2.988c0-.542.113-1.069.339-1.581.227-.512.541-.95.942-1.312 1.18-1.027 3.004-1.27 5.47-.728v2.767h-1.501c-.549.009-.97.158-1.265.45-.291.284-.439.685-.443 1.204z" fill="#071D2B"/><path fill-rule="evenodd" clip-rule="evenodd" d="M58.398 5.143c1.447-.22 3.29-.243 5.622-.243s4.174.023 5.62.243c1.474.225 2.66.67 3.599 1.604l.019.02c.933.937 1.38 2.122 1.606 3.596.222 1.447.246 3.289.246 5.622 0 2.333-.024 4.175-.246 5.622-.226 1.474-.673 2.66-1.606 3.597l-.02.019c-.938.934-2.124 1.38-3.597 1.604-1.447.22-3.289.243-5.621.243-2.333 0-4.175-.023-5.621-.243-1.474-.225-2.66-.67-3.598-1.604l-.02-.02c-.931-.936-1.381-2.12-1.61-3.594-.225-1.448-.251-3.29-.251-5.624 0-2.334.026-4.176.25-5.624.23-1.474.68-2.658 1.612-3.595l.019-.019c.938-.934 2.124-1.38 3.597-1.604zM58.7 7.12c-1.242.19-1.963.522-2.488 1.045l-.013.012c-.524.527-.86

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3101)
Category:	downloaded
Size (bytes):	96450
Entropy (8bit):	5.093692282666776
Encrypted:	false
SSDEEP:	1536:y7vDrsKaEUGCMp0FMEo5O/tTQNn+bjo20MLOVv9j22WRJUUOGVPUkSiG2AgcGgL1:y7LXaF/0qikQAqvtsUbJxf
MD5:	4E6D5E78C82DD8FC534D27E9385A3DEE
SHA1:	E11E752AAF7E0034780992CD174E00E68D605E48
SHA-256:	9D65D1E103204BE0ED47AFFBFF320DBA35144C516F26A728550804A90542323F
SHA-512:	F87290B436717F9F5E84EE58A257454BBA615D44A71201EEF773A5AB938BCF3A7D27E0D6D103E18F964DC0A08947B04899718AB2D4E366388300CD5CDE477746
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/en-us/about
Preview:	<!DOCTYPE html>.<html lang="en-us" class="no-js">..<head>...<meta charset="utf-8">.....<script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js" ></script>.<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486" ></script>.<script type="text/javascript" src="https://static3.avast.com/10003548/web/j/vendor/one-trust.js"></script>.....<script>. /! Declare GTM dataLayer /. window.dataLayer = window.dataLayer \|\| [];..window.sdl = window.sdl \|\| [];. . /! Dimensions to dataLayer /. (function(){. var dataObj = {. 'contentLocale': 'en-us',. 'pageName': 'en-us \| en-us/about',. 'pageId': '742e41b588da066266b6c27b38c84ba7'. };. var contentGroup = 'Others';. if (contentGroup != '') {. dataObj.contentGroup

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	4.495902589061296
Encrypted:	false
SSDEEP:	24:tzkuqvUseRZYRoKyNyGOFhG6V1bMSA8NIOTYhll7:GeReRiNyGOjBV1OUo
MD5:	5C51D97C54C81DC0854B3BBDA79A4A70
SHA1:	3415410A991A453674E3C9D2DEEFD9B76B8D1F83
SHA-256:	769DB1B5B23B294FB8598B7561FC050C40338D501FEE7D0D8F9D2C15544AE6F5
SHA-512:	A691813E01BDF46460121675A031774257EB4188A388E1DA8CAB2DD5B0331368904577E4ED392DEE56C89A55547FC50764599C892FB9A2FD91061ED98EE8F4AE
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-antitrack_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14.763 21.606v1.5c0 2.293-1.302 3.9-3.75 3.9-3.384 0-3.725-2.2-3.725-4.95 2.048-1.677 5.174-1.398 7.475-.45zm0 0a3.593 3.593 0 002.45 0m0 0v1.5c0 2.262 1.321 3.9 3.775 3.9 3.384 0 3.724-2.2 3.724-4.95-2.056-1.686-5.19-1.388-7.5-.45zm5.987-10.6c.7.133 1.37.271 2 .45 2.534.717 3.8 1.567 3.8 2.55 0 1-1.267 1.858-3.8 2.575-5.74 1.587-12.66 1.587-18.4 0-2.534-.717-3.8-1.575-3.8-2.575 0-.983 1.266-1.833 3.8-2.55.639-.18 1.3-.317 2-.45m14.4 0c.067.883.092 1.875.075 2.975m-.075-2.975c-.166-2.3-.583-3.967-1.25-5-.733-1.083-1.8-1.292-3.2-.625-2.229 1.061-3.27 1.049-5.5 0-1.417-.667-2.483-.458-3.2.625-.666 1.033-1.084 2.7-1.25 5m0 0a33.29 33.29 0 00-.075 2.975" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4722
Entropy (8bit):	5.1559029520257456
Encrypted:	false
SSDEEP:	96:nMn8C7ysrOysO7sres0j2VmC9XilbJeVBiTPLW+3:nM8CxrOdOArp0j2VmC9XilPb3
MD5:	3F23A8E563994C8A0457722C09BC6BDD
SHA1:	86114675A511D847AB020FCA58F48688340DFAE2
SHA-256:	B78232A7D603C203865577DE4FB8698799E1CEE22AED2ACA58746B2797DAE0BB
SHA-512:	585DBA9830EEF85FE2D931E81D9EF6BCFC11B252FF24DFECC94F11757D74498E209D77E40767C08A519246B3FC79570A3ADCDFE3D82F6FDF57CF2FB778511EEB
Malicious:	false
Reputation:	low
URL:	"https://c.go-mpulse.net/api/config.json?key=9K3EU-JY7U6-TD3RC-2KCEC-AH4A8&d=www.avast.com&t=5695345&v=1.766.0&if=&sl=0&si=4ac761bf-c09c-48e0-b3dc-f36efd9565d2-s99az4&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=208113"
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603605089,"h.cr":"ebc89692f989a95155f1b838d0f86700966c2482-d71e44c7-f3212ea","session_id":"fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240","site_domain":"avast.com","beacon_url":"//173bf109.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10001979/web/i/favicon.ico?v=2
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	26798
Entropy (8bit):	4.329178043120524
Encrypted:	false
SSDEEP:	768:ypszszJqcvO19mQXOP1xEWvpZqpzBcftJ:yyzszXymQXOPfZ1fT
MD5:	4F9AA794D351AB075B5A5F807694061E
SHA1:	AB88ED1DAD41E92970D60A3394C94041BBEE2BD1
SHA-256:	BA6A509DB0F516222159DFEA4333B02D892238D7055EF287F3EEEBC2311FE17A
SHA-512:	D8861794A51142C75A1A3198C592295172D363E5AD8303C16FFEE1E417E77C07105D8E2518F57B521B3E0C35AAC7D58091AC59C029395DAC6E6A00E3C0D53E77
Malicious:	false
Reputation:	low
Preview:	<svg width="624" height="184" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.614 12.045h18.749m0 0l-6.511-5.737m6.511 5.737l-6.511 5.737M332 96.4v-5.2m0-2.5v-1.1m9 4.4c0-4.936-4.055-9-9-9-4.91 0-9 4.095-9 9 0 4.9 4.1 9 9 9 4.936 0 9-4.069 9-9z" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M369.398 128.259l-.307.515 1.03.615.307-.515-1.03-.615zm3.044 7.395a.6.6 0 00-1.2 0h1.2zm-1.2.874a.6.6 0 101.2 0h-1.2zm1.911-4.989l-.351-.487.351.487zm.334-1.823c0 .55-.269 1.036-.685 1.336l.702.974a2.844 2.844 0 001.183-2.31h-1.2zm-1.645-1.644c.908 0 1.645.736 1.645 1.644h1.2a2.844 2.844 0 00-2.845-2.844v1.2zm-.6 5.289v.4h1.2v-.4h-1.2zm-.814-4.487a1.645 1.645 0 011.414-.802v-1.2c-1.04 0-1.948.557-2.444 1.387l1.03.615zm.814 6.78v.874h1.2v-.874h-1.2zM372 123.6c4.613 0 8.4 3.795 8.4 8.4h1.2c0-5.267-4.323-9.6-9.6-9.6v1.2zm8.4 8.4c0 4.6-3.796 8.4-8.4 8.4v1.2c5.267 0 9.6-4.337 9.6-9.6h-1.2zm-8.4 8.4c-4.569 0-8.4-3.831-8.4-8.4h-1.2c0 5.232 4.368 9.

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
Reputation:	low
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A06%3A54%20GMT&n=-1&b=Avast%20%7C%20Download%20Free%20Antivirus%20%26%20VPN%20%7C%20100%25%20Free%20%26%20Easy&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.332122219703909
Encrypted:	false
SSDEEP:	24:tzkuAQqDntULTc9Tq0tRAP9qF3ONH4Uof1kbES7PsQ9q7P2rQdYhll7:vctULTiGpNHySvEQ47OV
MD5:	3E0CF241495509C989A9C3E058E3521A
SHA1:	6490806ABCC74D49776D47EFB1FCCE4965A74694
SHA-256:	F8A299341DE7D91A5C330C6F501B4CE4FE535AD4B0BD5CB8F08C4E9F4CEF4EC3
SHA-512:	4D9979037B4EC05FEB6AB6F81738A79B186652BA273A3C8E0976CD9600F7694506BA795DB9A86303BA5990B89AFA78923C0BDD9DAB3D62D860233D028D58F939
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.255 12.862c0-1.956 1.462-3.968 3.439-4.274.206-.464.71-.739 1.204-.739.691 0 1.283.596 1.283 1.283 1.12.75 1.749 2.38 1.749 3.73m-7.675 0c1.985-.244 4.057-1.06 4.702-3.147.302 1.772 1.254 2.574 2.973 3.147m-7.675 0c-.878.394-1.05 1.971.33 2.332.49 1.51 1.859 2.759 3.497 2.759 1.702 0 2.94-1.268 3.537-2.76 1.305-.396 1.243-2.02.31-2.33m-10.317-2.08l-.077-.583c-.31-2.507-2.148-5.052-4.877-5.052-2.726 0-4.636 2.518-4.897 5.052v.486m9.851.097c1.08.817.912 2.533-.427 2.895-.713 1.928-2.376 3.556-4.527 3.556-2.181 0-3.827-1.611-4.547-3.556-1.594-.29-1.608-2.581-.35-2.992m9.851.097c-1.61-.396-3.098-1.013-4.313-2.195-1.024-.985-1.963-1.341-2.818-1.07-.997.325-1.904 1.38-2.72 3.168m16.464 14.068h5.59c.794 0 1.293-.448 1.165-1.263l-.33-2.313c-.257-1.427-1.185-2.393-2.785-2.9M7.08 17.723c-2.608.711-4.12 1.974-4.536 3.787-.376 1.619-.557 2.934-.544 3.944 0 .777.653 1.399 1.418 1.399h16.419c.758 0 1.457-.626 1.4

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.275801237602774
Encrypted:	false
SSDEEP:	24:t4dlu7laoBLQVnDBLlFZxBLy9dprGKwJRHxsGbGEvq9HxsG7G1bU05HxsGEG68CH:KKaaLQVdLlFZzLy7pUTH9iWaH9C+SH9y
MD5:	6A04E8861C9EE16F79F09D7D5F414BB7
SHA1:	529AFD9F8D68E495EEEFEC4056677DCC142A1E23
SHA-256:	BE615DA0C96133A9D7CE2242DB668D15D9BDC62F8F4A40AB6FC218D3604D3BC7
SHA-512:	3BDBFADF5909B47FD8CAA5E5B0B089F5F3C1EC9E09016083A4515D363B515AA9241B373F7E83B58F0C3196B4AF36FC3ADFB730813B3640BDD0D2089D74AEE438
Malicious:	false
Reputation:	low
Preview:	<svg width="64" height="64" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_18418_27150)"><path d="M59.706 16a32 32 0 00-55.424 0l1.92 34.56L59.706 16z" fill="url(#paint0_linear_18418_27150)"/><path d="M18.144 40L4.288 16A32 32 0 0032 64l31.36-32-45.216 8z" fill="url(#paint1_linear_18418_27150)"/><path d="M45.856 40L32 64a32 32 0 0027.706-48H32l13.856 24z" fill="url(#paint2_linear_18418_27150)"/><path d="M32 48a16.001 16.001 0 0011.314-27.314A16 16 0 1032 48z" fill="#fff"/><path d="M32 44.672a12.673 12.673 0 100-25.346 12.673 12.673 0 000 25.346z" fill="#1A73E8"/></g><defs><linearGradient id="paint0_linear_18418_27150" x1="4.288" y1="20" x2="59.706" y2="20" gradientUnits="userSpaceOnUse"><stop stop-color="#D93025"/><stop offset="1" stop-color="#EA4335"/></linearGradient><linearGradient id="paint1_linear_18418_27150" x1="35.462" y1="61.997" x2="7.75" y2="13.997" gradientUnits="userSpaceOnUse"><stop stop-color="#1E8E3E"/><stop offset="1" stop-color="#34A853"/></li

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.527724704590433
Encrypted:	false
SSDEEP:	24:tzkumufVNUTJeFDNgkqgS2d9auZ2NccLe6uXsTYhll7:Eu+EgPgS2dEuZ2ucLe6uXj
MD5:	7E10871E86B329BEA808518CFA6B01A4
SHA1:	F6863681EABFED7D7157AA771126D6E2FF86E058
SHA-256:	98078A8C5CEC64A268E3E09A99A8FD0C5220050EDB2B55E8DF3D8CD2D3244230
SHA-512:	D058EC0BD1E4671C3A1DAFF92E7E98F1B6375F14B065FE0FE1E0D4F2FC5A1B81C31AA94B6D7F6FAB7415278759AFDCD009B706A8401CC7006BDEBB18AE7EE22A
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M23.843 22.088v5.387m-2.67-2.694h5.34M7.416 22.025l-2.192 2.178m7.632-1.235l3.079-1.416a59.386 59.386 0 001.987-.952m-5.066 2.368l1.82 4.217a.48.48 0 00.781.149l1.787-1.793a2.4 2.4 0 00.7-1.71l-.022-3.231m-5.066 2.368l-4.064-3.94m1.088 5.337l-.917.897m2.299-11.253a78.004 78.004 0 00-1.008 2.003m1.008-2.003l-1.008 2.003m1.008-2.003l-3.366.023a2.4 2.4 0 00-1.683.706L4.424 16.53a.48.48 0 00.16.784l4.208 1.713m2.47-5.02c1.25-2.598 2.77-5.367 5.375-6.794 2.713-1.485 6.01-2.134 9.098-1.8.34.037.613.3.658.64.408 3.046-.235 6.35-1.724 9.016-1.46 2.613-4.19 4.163-6.747 5.53m-7.668-4.588l-1.462 3.016m2.262-3.816l5.68 5.54m.9-10.178c.978-.983 2.637-1.02 3.623-.025a2.58 2.58 0 01.025 3.582c-.97.973-2.642.984-3.624.026-.96-.967-.948-2.593-.025-3.583z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (530)
Category:	downloaded
Size (bytes):	220988
Entropy (8bit):	5.61642447128444
Encrypted:	false
SSDEEP:	3072:bFjO/yHzlijfpetXp+VtYnzCiHn47JYfbr:TwfpetgVriHnYa
MD5:	A1175A315D71F0CAC8610845C451D0E3
SHA1:	4A31B64D4EA984ED2AD47AFBBF973DCA45EDBF36
SHA-256:	70558A2C8E7C705FD142FC56878177A8233A1C522A432A556CF5DF1710FA203D
SHA-512:	E5335B3D0D901F4A1F727B6684C532007195BA64193A7B1424A2A652E8E6F367D3596FFD495E4B0375EEF88238CF1314B6BE62092026C63EA67C88B080F48AA3
Malicious:	false
Reputation:	low
URL:	https://www.youtube.com/s/player/2070f79f/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){'use strict';var r;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var da=ca(this);function v(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.v("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,va

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	4.846938898698586
Encrypted:	false
SSDEEP:	24:tXiuroMbH+bIAsHNshtFn+KV2gBIuStPcylm9E3q4nHchlliDFYmaCdCraDRZC6l:7orbIVsV+U3BoOWvXDtXDRs6l
MD5:	4831F26973D930A3ECE79D6DCB1F4601
SHA1:	AF45D0AC3E4BA1E0FBF0106A0342F786C893F338
SHA-256:	1F4935921513AC24D611B6C3D9BA026618740925DCEB41C0DEF10FDAF421FE03
SHA-512:	1F8C5CA150759C8E912665B0AD588B00A7703618FAA4637C1B8B8B9BABED9986E1A1234C0EC856DE60CB245B7B1B64DBCDD21B4D4F7B9E0B6ABEFDFDCDA27BE4
Malicious:	false
Reputation:	low
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M68.218 64.48V42.186c0-2.544 2.969-3.934 4.922-2.303l27.918 23.295c2.154 1.797.883 5.304-1.922 5.304H72.218a4 4 0 01-4-4z" fill="#D4E7FF"/><path d="M4.46 50.758c.673 3.193 4.63 3.64 6.599 3.226 5.205-1.096 3.788-9-1.5-9-2.053 0-5.77 2.58-5.098 5.773z" fill="#FFDDBF"/><path d="M128.302 19.216c-.78 2.882 1.383 4.152 4.265 4.931 2.881.78 3.871-.383 4.651-3.264.779-2.882.594-4.693-2.287-5.472a5.405 5.405 0 00-6.629 3.805z" fill="#7BB5FB"/><path d="M26.878 70.332c-2.824-.966-4.233 1.109-5.2 3.933-.967 2.824.128 3.888 2.952 4.855 2.824.967 4.644.9 5.61-1.923a5.405 5.405 0 00-3.362-6.865z" fill="#B7EB6E"/><path d="M14 53.651a4 4 0 100-8 4 4 0 000 8zm124.789-.453v6m0 6v6m-3-9h-6m18 0h-6M30 10v4m0 6v4m-3-7h-4m14 0h-4" stroke="#071D2B" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M102.831 31.313v-1.68a6 6 0 00-6-6h-45a6 6 0 00-6 6v4.68m0 6.784v20.45a6 6 0 006

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.660791464285325
Encrypted:	false
SSDEEP:	24:tzkuHyj2zpZmjl0Up5iA7e2IKiTYhll+wIbU3favg8HhQdYhll7:9S6pZmB14wuUSgk
MD5:	945B6233DADFEB4446D51BF931490F0D
SHA1:	10DB331A389EE3C42A42EA716F854526D4DC3214
SHA-256:	72395798A29BC168B956D804D038DF8790B9C2BE39E4CE91269A52E76678BFF1
SHA-512:	8CE590D422BD6B85D9109E31CA41C9E2ADB01665B24555A2FEF2048500905FD90E7E5A65BBEF4BC59413357D9F3DCEFAF74CFCFD3446BEC9E75FE664A793D2FB
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M18.277 15.077l2.238-1.644c.1-.076.046-.247-.081-.247h-2.747c-.333 0-.474-.117-.57-.432l-.855-2.65c-.052-.105-.292-.132-.326 0l-.854 2.65c-.114.299-.242.432-.57.432h-2.748c-.144 0-.197.16-.081.247l2.218 1.644c.247.174.322.37.204.657l-.855 2.651c-.025.126.109.252.224.165l2.239-1.644c.263-.17.495-.182.752 0l2.26 1.644c.103.104.249-.047.203-.165l-.855-2.65c-.096-.293-.05-.48.204-.658z" stroke="#FF7800" stroke-width="1.2" stroke-linecap="ro

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	479
Entropy (8bit):	4.496879253868425
Encrypted:	false
SSDEEP:	12:trF9XjuILVEPKI7UpXQx7maRVRo9AuGY8nwVUOHw:th9zuwEPKI7V7maFCAa80VHw
MD5:	797EF4096036ABE507C6C1A433FE3B25
SHA1:	E155D7270D10C5B6174B0D293AA034ECF6C63DC6
SHA-256:	29B3B9D1066A398DB5E6E6FFDECCE7C9E5BB739DC8C57E1DBB33277EFD6AAA92
SHA-512:	D7BA02C3E01C82C53FC2528A8759DBA3299B6BBA5653132B345D828A661DA825C811BA4735455D4BA2CA4E340A17F84E15326C0E21E55A4A8FA78C51F8DFD755
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/illustrations/brush.svg
Preview:	<svg width="212" height="44" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M13.603 8.405l.068-.018C63.851.25 91.728-.565 141.111.248c49.383.814 62.623 10.168 67.703 17.088C211.204 20.59 212 24.659 212 27.1c0 2.44-2.205 1.63-3.986 1.628-2.386-.001-3.183 1.626-6.372 1.628-3.189.001-54.162.814-54.162.814-28.143.813-84.422 3.253-111.507 8.95-21.95 4.618-27.88 5.698-31.063 0C1.727 34.424.837 30.355.129 23.847-1.141 12.171 7.24 10.03 13.603 8.405z" fill="#D4E7FF"/></svg>

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	4.831287070425481
Encrypted:	false
SSDEEP:	12:tr/kuItbLdk1uFTRXFktUmr0t80B9Yhll7:tzkus1d1fWUzTYhll7
MD5:	50F355DD3AFB228FCAB72C7AB365028C
SHA1:	D305E627CA3FE0F80E775198338DC9C971999B24
SHA-256:	1D317ADF5597D4C31C5924A95ADC3B93145DF8CBC7A4336DE82E9BFD1CA0FCA7
SHA-512:	1EE7F063C6873B8D3874C3B2BFDB38A87C999BCF471596F267B7F284CB185C0F2E3954DBCE540C610299FF125339A3AD7B33E44927898E48FD66D13271620D01
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-vpn_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.884 17.192v-2.284a4.122 4.122 0 018.244 0v2.284m-4.122 6.438v-2.435m-5.152-12.01c2.876-2.635 7.436-2.666 10.305 0M8.4 6.583c4.211-3.96 11.008-3.995 15.212 0M20.476 17.19h-8.94a2.4 2.4 0 00-2.4 2.4v5.61a2.4 2.4 0 002.4 2.4h8.94a2.4 2.4 0 002.4-2.4v-5.608a2.4 2.4 0 00-2.4-2.4z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	5.119473265837788
Encrypted:	false
SSDEEP:	24:2dAAfgl4U5rkb4JRk3eNLCMjMGEBxMwLhlllonWkk3eNLxMwLhlllWrltxMwxhl+:cZ84ErkseoJWLoj2lC
MD5:	66A0FA5DC355B1AF8A02C5B6B15440DC
SHA1:	E1E8D298479481DC2FED3FFA6DAF42A6BEE64D7C
SHA-256:	879D774FA50276E7EFA5F3E2C58A713C247618165526604BBE39C2F5A0D41495
SHA-512:	D94B92AA6FCE97D6CF5D24C00AFE9140553C5C1ADEFD2D963E6E298912BB244C476DE584FE22E26898DFCEA2D8922B746F378A362AD79AC2761C243D82E04E05
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <g>. <path d="M2.2032,10.2924V28.2603c0,1.0488,.5515,1.5735,1.656,1.5735h29.8907c1.0479,0,1.5735-.5248,1.5735-1.5735V7.2287c0-1.1037-.5256-1.656-1.5735-1.656H3.8593c-1.1046,0-1.656,.5523-1.656,1.656v3.0638" fill="#ffddbf" fill-rule="evenodd"/>. <path d="M38.2572,13.1775l-12.5867,10.2676c-1.2129,.883-2.5665,1.3245-4.0559,1.3245-1.3811,0-2.6781-.4415-3.8926-1.3245L5.137,13.1775" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M38.2572,26.5089V10.1137c0-1.1037-.5256-1.656-1.5735-1.656H6.793c-1.1046,0-1.656,.5523-1.656,1.656v3.0638" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M5.137,13.1775V31.1454c0,1.0488,.5515,1.5735,1.656,1.5735H31.5507" fill="none" fill-rule=

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	506
Entropy (8bit):	4.6475821195383835
Encrypted:	false
SSDEEP:	12:trF9XjugPLVEPKI7UpXQx7maRVRo9AuGY8nwVUO8:th9zugJEPKI7V7maFCAa80V8
MD5:	1BF2FF2A2381F6721BA20A466919AEA7
SHA1:	1B66A4002AB76CB687E9FF14EC5B77A4B793295B
SHA-256:	2152E6A6BC3A49C946098BE8212921581EA021F8222653E952E55F4316193C0D
SHA-512:	65D7810BD4C997FEF7A957E2992ADE99E19579F10C1F60BE7A3E307FA0F506482F04C49CFDC522E87057455B759217938BC9C2151FBB813090E43642689C5F41
Malicious:	false
Reputation:	low
Preview:	<svg width="212" height="44" fill="none" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="none"><path d="M13.603 8.405l.068-.018C63.851.25 91.728-.565 141.111.248c49.383.814 62.623 10.168 67.703 17.088C211.204 20.59 212 24.659 212 27.1c0 2.44-2.205 1.63-3.986 1.628-2.386-.001-3.183 1.626-6.372 1.628-3.189.001-54.162.814-54.162.814-28.143.813-84.422 3.253-111.507 8.95-21.95 4.618-27.88 5.698-31.063 0C1.727 34.424.837 30.355.129 23.847-1.141 12.171 7.24 10.03 13.603 8.405z" fill="#FFDDBF"/></svg>

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.9466765885296295
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9fDlWRFAmYHZAAbBAA8ckHeE0:tI9mc4slzcWER9j9fhWR6mqZlllH
MD5:	A3700FCEADB2AB0EA5D6165EFAF02F22
SHA1:	551763DD62816F00B6D42C44892637077128C2A7
SHA-256:	015F2F037FCBED958E69C050DB47D7C844DDA675FDB1B964DF281193BC93FD5C
SHA-512:	515E5CF1B7F7DD0044A51AB750B8B723450A978FA60EDA73FC65D9E0E456EC094363DBC8613C65EB72B477288CA1CF01FE61494148031A77CFD6B7B8D4085BA5
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M10 2L4 8l6 6"/></svg>

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36803)
Category:	downloaded
Size (bytes):	36855
Entropy (8bit):	5.035210614140456
Encrypted:	false
SSDEEP:	768:1836t6DoRqTtGS3jSAAMztt24Gk9WlPAYeh4tPxeLHvKm7rdY1CmIjzbI+K3y7xN:y6t6DoRqTtGS3jSAAMztt24Gk9OAzh4u
MD5:	651BF60AFA5DD762B8AF41B0F71EED8C
SHA1:	C1A1C008C8E180A6107E649C74963A54A9DB6211
SHA-256:	FA99A1299BC665A35B76C0E29A330D0ED74A9053859F996CCF12177C9D3B7B63
SHA-512:	45329503EC04B9342E65794320CFD0C963E44F835232F272A8D4A3712A135ED7BBC073C876D72E6136B5EBE8D2FD0F730916C0B1171492B36FCE7B7B84A2E08A
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/2000673/web/c/style-guide/components/navigation-oo-19798.css
Preview:	@media only screen and (min-width: 1056px){body:before{content:'navigation-desktop' !important;display:none !important}}@media only screen and (min-width: 1056px){.first-menu-for-home .for-home,.first-menu-for-business .for-business,.first-menu-for-partners .for-partners,.first-menu-about-us .about-us,.first-menu-regions .item.region{color:#FF7800 !important}.second-menu .isActive[data-second-menu] .subcategory:after{content:url('../../../i/navigation/arrow-active.svg')}.second-menu .isActive .subcategory{color:#FF7800 !important}.second-menu .isActive .isActive .name{color:#FF7800}.first-menu-for-business .second-menu .isActive .isActive a{color:#FF7800}.second-menu-security .subcategory.security,.second-menu-privacy .subcategory.privacy,.second-menu-performance .subcategory.performance,.second-menu-family .subcategory.family,.second-menu-bundles .subcategory.bundles,.second-menu-products .subcategory.products,.second-menu-business-partners .subcategory.business-partners,.second-menu-

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.033553988277396
Encrypted:	false
SSDEEP:	6:tI9mc4slzcvUY7SQRtsKMw9jI6mqZlllZHzA:t4CvnuCxMwB9hlllpU
MD5:	621D00062D3EDB4F262DD755A8E4821A
SHA1:	916C4522663F76666881761DB7402C299C1C83C0
SHA-256:	83D7832C75D2DF965E48245ACC123F0BB031EBF021B89D6C5A9DE7C178D30647
SHA-512:	151CEE873C3D7BFC9F9D51E877FEF634E87068E9533B178E8F2B311E86B617D7949947AC91B5C8D5335B8B141F5A2303D7FE7B9CCD876E7FF2BC77F116C31888
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">.. <path fill="none" fill-rule="evenodd" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2 8l4.125 4L14 4"/>..</svg>..

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.33221219626569
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8HopHW4OE9HsuXU9WyRHfHyI:x2pHD5YEl5k9zyI
MD5:	1AE6B27EBA211F4CFCD99B904DA88BB7
SHA1:	53CA38F083C4A21F2EDA633EC304CB4582EDEDA2
SHA-256:	961635B4E9661208EC118D285B3AC1DBF9F3CC96CDDC97F30E55CD2C6566448C
SHA-512:	7DD325AB05B1A419614C2C39224C11E1388F09BCA5EA0F56811E6842B4FB243BCB53AA2BDDE00A94FBC324222B47924152C183337EB390F58C59AC80E89593B6
Malicious:	false
Reputation:	low
Preview:	jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21099)
Category:	downloaded
Size (bytes):	21100
Entropy (8bit):	5.307475695141851
Encrypted:	false
SSDEEP:	384:TRFZ2wWtdbD5ABwXwLrekrff8eTr+xITxMcvn9LuJPvV/:T8wAD5ABwXw+krfflyxUx3n96/
MD5:	F18B357811C039616EB24F0BAA46360E
SHA1:	7EF528148C7FA2DF751BAA512F8EA24C84A7C19A
SHA-256:	5BE2DFA172D505ACB197760B55C4731347CC239A7A046013C251948BB8214DBC
SHA-512:	F9498E8904AB5F3BD1D4FF6506007ACCE1E0A0EC989E3CAB9801CB5A3020A0BC3504260B0A97BC90B4EA1F07E66D58916070C5EC0CDCEA23D36BA17FC5277284
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(m=g=g\|\|{})[m.Days=1]="Days",m[m.Weeks=7]="Weeks",m[m.Months=30]="Months",m[m.Years=365]="Years",(m=i=i\|\|{}).Name="OTGPPConsent",m[m.ChunkSize=4e3]="ChunkSize

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1996
Entropy (8bit):	5.1017749108455925
Encrypted:	false
SSDEEP:	24:2d/EMBMM/WrcLqtjanGwNKe0WnRUN5UzDjLhlllpak0wxMwLhlllW07GLxMwLhlA:c/dtWrcMwNKzqi4n6GrBxSMwZm
MD5:	9CB7C6DBEADCBEB59C505FD42D45D12A
SHA1:	810BD844DEB53660378786B6432E44FAA3DDBFB7
SHA-256:	445F7B1D360D78F807FBC03E97F9612D6952A6A63673E23A89A44D89A5180783
SHA-512:	CBF477E0301918E9DDE80ECF8E2E40BDAA7A8F7D44D2C34933CF747A0529B0D89C56C73B0177F8A5D96EE4F3DFF6594DE20B4206112DDC16277E54B9EC1A2325
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <path d="m28.2855,25.2368H3.7145c-.8296,0-1.5022-1.0555-1.5022-2.3575h0s10.083,0,10.083,0h17.4923c0,1.302-.6725,2.3575-1.5022,2.3575Z" fill="#ffddbf"/>. <path d="m7.3835,6.7632h17.2329c1.2108,0,2.1938.983,2.1938,2.1938H5.1898c0-1.2108.983-2.1938,2.1938-2.1938Z" fill="#ffddbf"/>. <polygon points="26.8845 22.8939 19.633 22.8939 12.2953 22.8939 5.137 22.8939 5.137 8.957 26.8845 8.957 26.8845 22.8939" fill="#fff"/>. <path d="m26.8845,20.7994v-11.859c0-1.2023-.9747-2.177-2.177-2.177H7.314c-1.2023-.0001-2.177.9746-2.177,2.1769v11.8591m2.0838-11.6142h17.5801M3.7145,25.2368c-.794-.0001-1.5022-1.0903-1.5022-2.3575h27.5753c0,1.2672-.7081,2.3574-1.5022,2.3575H3.7145Z" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <polyline points="17.3418 12.3881 18.6837 13.

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex?
Preview:	<html></html>

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.794653473544342
Encrypted:	false
SSDEEP:	3:77PGN5/B:7riB
MD5:	89C8719F84C5374EE14A57E3976DAFDF
SHA1:	8B8BC2E313CF7FF26627008CD1C7150F1393C060
SHA-256:	5EC60C925D45D25DDD1C440B128F8D16B16E95B251209741EB174F31BB9B7607
SHA-512:	AD31D4631B97B6605F0847B248E2050CD167C80CBE43542EA89D690C2A83FEA728F04FD34C31B00DE94E4A4D0D2AE2CE7EF5BA75F0314A9E78AAD6CA3384BFEA
Malicious:	false
Reputation:	low
Preview:	No URL match found

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	545
Entropy (8bit):	4.754128613009515
Encrypted:	false
SSDEEP:	12:tr/kuINyGdOU2zhjZmfJsXjMl0UVSzIDh1tiq5Mb0u/Xm/B9Yhll7:tzkuHyj2zpZmjl0Up5iA7e2/TYhll7
MD5:	90847F1EA9446C6C882BCE55658B729F
SHA1:	F4B3EAD41C56B796AE2DB5CE210E9BFAE675D677
SHA-256:	E1A666F4C9298EE14EBF790E41A103BBA3299B145A90E1FE5E124D692F40D211
SHA-512:	6F0F0A083D7F15FCF4A29C66103796326261B96186B198C0AA396452A5114CC8B89643A7FD85A96320907790873AC1B5A2BC0D116B30FB1EB6AC237485EF96F9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-free_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	5.006398475488967
Encrypted:	false
SSDEEP:	192:R5RfgJQh1mbzK6Blc739RCPqQMQvNBXl+CxeAPS:RHY21izc81BcZ
MD5:	632367D2CAE2D0EA46F388F51EBA3B40
SHA1:	D1434F7160CAB1B999B1DFF910DEC884402F3BE0
SHA-256:	9B8614DDF9652358793B25BBBF0E3B664AE6FA7A08AAC6E04307D2BFCAA71702
SHA-512:	037AE8929B0D29E80EE5CAA3D7FC3D27AF79B10A6E2491E2EDDBB5316AF6B592B0A72D55E5C6F2A4CFB7A824F9DDBE5FACB2672FA600485ACA0B6A26662CCA13
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M16.004 27.903c6.574 0 11.9-5.326 11.9-11.9 0-6.575-5.326-11.9-11.9-11.9-6.575 0-11.9 5.325-11.9 11.9 0 6.564 5.325 11.9 11.9 11.9z" fill="#fff"/><path d="M8.303 12.94c-.072 5.244 3.133 9.699 7.64 11.798 4.444-2.007 7.66-6.41 7.71-11.623 0-.471-.02-.942-.071-1.413a12.83 12.83 0 00-15.197-.01v.04c-.052.4-.082.8-.082 1.209zm.962-.573c2.397-1.68 4.67-2.068 5.838-2.14h.02c.4-.03.686-.03.789-.03h.092c.102 0 .389 0 .788.03h.01c1.168.082 3.431.471 5.838 2.14a12.134 12.134 0 01-.45 4.158 10.765 10.765 0 01-1.998 3.84c-1.075 1.342-2.509 2.438-4.24 3.288-1.72-.84-3.143-1.925-4.219-3.257a10.88 10.88 0 01-1.997-3.81 11.772 11.772 0 01-.47-4.219z" fill="url(#paint0_linear_6188_3051)"/><path d="M8.302 12.94c.01-.41.031-.819.072-1.218v-.041c0-.01 0-.03.01-.051.01-.103.02-.215.041-.318a12.49 12.49 0 01.799-2.98 13.02 13.02 0 013.205-4.639l-.04.02-.134.041a12.796 12.796 0 00-8.704 9.289A12.81 12.81 0 007.135 25.26c.256.

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2011)
Category:	downloaded
Size (bytes):	2056
Entropy (8bit):	5.177967735841463
Encrypted:	false
SSDEEP:	24:cBPVbhXRkj3e5vXRkIPmhOu4ryACRLQgKItF7xLpItF7ZQMKi3vnUYjY43zRcSKY:mPNQJmI7kgKYqZKCvnUYJzRF4lg8V5Sz
MD5:	90865656692C8FA0844B1988A461D626
SHA1:	4D4EC2B15FC8D7F3A41639696D8982292ADF91D7
SHA-256:	CF4323A2DC075A0DA624C09F8DA96F5867D3DBDF73A83CE1937EC9C94A0938EB
SHA-512:	B500A58E6D17602A64E72FD8266A1DE8F6AD5B5AD8008497DB6349FB58D9B8E9FF8FF0531FEF88EC5242D51E97234BDFB2AFAAF6A6C1A255FB00CB45319F3524
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/singleDL-primary.js
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{/OptanonConsent=.?(consentId=(.?)(?=&))/.test(document.cookie)&&sdl.push({client:{cmpId:document.cookie.match(/OptanonConsent=.?(consentId=(.?)(?=&))/)[2]}}),/(?:NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/.test(document.cookie)&&sdl.push({consentGroups:document.cookie.match(/(?:NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/)[0].replace(/NotLandingPage&groups=\|groups=/,"").replace(/%3A/g,":").replace(/%/g,",").replace(/2C/g," ")}),sdl.push({session:{countryCode:sdlObj.session.countryCode,secChUa:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.brands:[]}(),platform:window.avastGlobals.detect.os.name,mobile:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.mobile:"-"}()},server:{provider:"CMS",platform:"WEB",env:window.location.host.startsWith("web-preview")?"dev":"prod",dataCenter:"-",sdlVersi

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (814)
Category:	downloaded
Size (bytes):	848
Entropy (8bit):	5.030039757565012
Encrypted:	false
SSDEEP:	24:+tZsZTq01dsZwaWgSFE9q0xlDVPyTzWsXtt:+LeTq0/sOm9q0xBW
MD5:	3A8226DE4A681C0E36272A2542692C06
SHA1:	415F97CA9CD739AB6C4BEEFEEB7A8F7A96989E0F
SHA-256:	E34685976677C50FD031359DD6B5FDC8CD73C5C79E18398537E3E5525E642534
SHA-512:	6CD3EAC0DE99D64FFA866F03F787E08353F328CA37398735965054B90A19171341F971BD91808E1F5B1C5BB3914D1D83A203AE96A2599FE751342E946E21E557
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/pages/about.js
Preview:	var sliderInfFeatSecLar=tns({container:".slider-sliderInfFeatSecLar",controlsContainer:".slider-sliderInfFeatSecLar-controls",preventScrollOnTouch:"force",controlsPosition:"bottom",controls:!1,navPosition:"bottom",mouseDrag:!0,speed:400,fixedWidth:288,gutter:32,center:!0,autoheight:!0,nav:!1,responsive:{576:{autoheight:!0,center:!0,items:1,swipeAngle:!1,nav:!1},768:{items:1,slideBy:1,center:!1,nav:!0},1280:{controls:!0,fixedWidth:664,center:!0,nav:!0}}}),sliderLeadershipTeam=tns({container:".slider-leadership-team",controlsContainer:".slider-leadership-team-controls",preventScrollOnTouch:"force",controlsPosition:"bottom",controls:!1,navPosition:"bottom",mouseDrag:!0,speed:400,fixedWidth:264,gutter:32,center:!0,responsive:{576:{center:!0},768:{items:3,slideBy:3,center:!0},1280:{controls:!0,center:!0}}});.//# sourceMappingURL=about.js.map

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware?
Preview:	<html></html>

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	4.880816344429822
Encrypted:	false
SSDEEP:	6:tnr/kumc4slmFU3jSSpDXlFUXFW9qMHpF2JGcTcW69jI6Ymq8:tr/kuIFUTSYL+MhJSGE6B9YU
MD5:	295D7E3E94320E81A0420D0151AA372E
SHA1:	F3C0537B08EFA4D6EFECAE6FAC5D2B82C57794B2
SHA-256:	C4618A8390B9D1910CFF91745B34EE142E8561F59C73E046E5CA544E66CB8DD8
SHA-512:	C8AE413A749AC2CC0C549F89063D662663F3926B150641D60F181CD98A33AA784AF9762E89E95E2F06684827238330941BAAD30A06087FB5933A68CFCF0BA93F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-smb-home-office_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M24.384 16.541v6.636a1.57 1.57 0 01-1.57 1.57h-4.672v-5.634a1.02 1.02 0 00-1.02-1.02h-2.245a1.02 1.02 0 00-1.02 1.02v5.633H9.186a1.57 1.57 0 01-1.57-1.57v-6.635M5.8 14.64l8.235-8.235a2.746 2.746 0 013.884 0l8.281 8.282" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	82612
Entropy (8bit):	5.195720484658254
Encrypted:	false
SSDEEP:	384:N6VJ70gGjhiJgnjhtTO/xi7FavgIjrijI+pg+jyQ8g5jCing6jRKjIzKeg1jxIc9:Ng+f0Khb6wbY4kGJXRRsuM5
MD5:	8C66D79DB4FF5D2EF4664CEE20AD1E23
SHA1:	8C6EAC58A6EB1ADF6AFA32B2AE31F4812CC36D7E
SHA-256:	84CB6C08CD598CEAB07E6ED9DD2AEF5E5E4CB05DD1D4C73D6B47B516D912E0D8
SHA-512:	98957498E9A7FEC13FE6B26516EDB8F32BCA4C66FD06FBC645D4D9C13CFE16CE64EB9C64E5D3D1D2EA028E28C8FA04EE73E8EBB58FFECF24D81B8CFC9E28EE00
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. <svg xmlns="http://www.w3.org/2000/svg" width="25" height="1224" viewBox="0 0 25 1224">.<style type="text/css">...st0{fill:none;stroke:#AAABB6;}...st1{fill:#D3D4DE;}...st2{filter:url(#Adobe_OpacityMaskFilter);}...st3{fill-rule:evenodd;clip-rule:evenodd;fill:#FFFFFF;}...st4{mask:url(#mask-2_1_);fill:#0052B4;}...st5{filter:url(#Adobe_OpacityMaskFilter_1_);}...st6{mask:url(#mask-4_1_);fill:#F0F0F0;}...st7{filter:url(#Adobe_OpacityMaskFilter_2_);}...st8{mask:url(#mask-6_1_);}...st9{fill:#00A651;}...st10{fill:#F0F0F0;}...st11{filter:url(#Adobe_OpacityMaskFilter_3_);}...st12{mask:url(#mask-8_1_);fill:#F0F0F0;}...st13{filter:url(#Adobe_OpacityMaskFilter_4_);}...st14{mask:url(#mask-10_1_);fill:#00A9FF;}...st15{filter:url(#Adobe_OpacityMaskFilter_5_);}...st16{mask:url(#mask-12_1_);}...st17{fill:#6DA544;}...st18{filter:url(#Adobe_OpacityMaskFilter_6_);}...st19{mask:url(#mask-14_1_);}...st20{fill:#007859;}...st21{fill:#FEFEFE;}...st22{fill:#FFFFFF;}...st23

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	343588
Entropy (8bit):	5.340863684621744
Encrypted:	false
SSDEEP:	3072:emsbeE0lAMq0uwW6cx2vxbBD0sTpEEH9n81KoyxFNMJJaPAiJ+2UBAv47h9C8:bAMvu/6cx2vxbBDDTrHG1hkMJcb+VBAo
MD5:	656A4FD9013F905080DEBDD038F06B94
SHA1:	6843484EA4BE1A3415EA554BB8B7AAA6E311554A
SHA-256:	0152531ECE5B19AA743208C31FD9F9284282BC97A2EC666DE5CF770A9AEEE0FA
SHA-512:	B88FC90663AB1457ECCB18717AA6B1A9A4F5FB64C0C58A93D4B3DD62D0AC007176571719DB8BD999E679AFFC8F4105E581F983E0ECDF6A94A48B20D7600218F0
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/6.33.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v6.33.0. * by OneTrust LLC. * Copyright 2022 . */.!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var v,e,r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function l(s,i,a,l){return new(a=a\|\|Promise)(function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(s,i\|\|[])).next())})}function h(o,n){var r,s,i,e,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t){

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x441, components 3
Category:	dropped
Size (bytes):	66711
Entropy (8bit):	7.986260294484849
Encrypted:	false
SSDEEP:	1536:fD183TVEC6YdAMV/LMNk4OXgxenmdfwYyY04q16C41X1:fDajO56rV/LH+MnQwdPpG1X1
MD5:	29E47B4F9539BBF709917B6B9EBFE7DE
SHA1:	E5B17FDFB7D6F6275F85F7AF9FF10EA3A94BAABE
SHA-256:	22696CA4A5390C5D775AA349FB81A069A0ADD4F06CD2DCCA7E165C4667038289
SHA-512:	BE042D5976767798DA3BFDCECAE0BA4A663A8C86C9A86E76AB00DB53F622FF7DB652C1EFFF95B95433E02B92C016E188E720D18D49D4B9856E2A0BC5B9AD697B
Malicious:	false
Reputation:	low
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."..........7....................................................................tk.&..Q.].\fc.4g.7Oc]u.fu.....c).`.ym.+e..M...M{{.z.%..1..{...b........I...N\.../=..WDZ..q.v...!.]%...q..,...]...Z..)c...h4...^,~Z....<.+..61j...bf..@.XVp.6".q...r.U......Z. ..ZW.o_.b...5......6........{.]ll...Y..d[..o...w.Ige.\..w4l....._a......{....{....{....{....{....{......-...Oz..H6.r.h!.I.....Pk.<...w.....n......b...Y.g.q..Cb.G......9.....&#.\|4l..\|xlS.5Nu...%..Npf.f...++...H.uV@6.K..0]q.".W..oA..............e...]...4.o...].[.O...=Q........M..y.^.AJ.V.....5..o.DiX.&..X...=.....h.n..V.F.[...d..&c..D.....&3..a\p.....}(..8...1....xi.u.$..<...9.w.E..G>..S..J.i..&..4...&.l6.zMZ.....v.c.f..I.{....{....{.....k$R.._{.......>c.\|..B...}I.=..K.H.V..,.u...;.K...+qw.6..VC..$W...2...I``?.d.F.8w.8.XN..Q 4.2..

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	8257
Entropy (8bit):	4.0183790841915
Encrypted:	false
SSDEEP:	192:YQxpzWpLKoKO3KVjOmuv2cIq1oQn3egTzqSVIivZ40dKV3y1cjpH/F:FxpzWpLKoT3KVjOhu0oQn3rHrzvFdU3N
MD5:	023D27A99B036BA05BC0090AF307E284
SHA1:	FE2FD3D0AE0A00C8D23F7CA6A0D37B05CBD57887
SHA-256:	58E7742AF659DF5C5AE62DCB5B60279FDED66DA6E54C13B9B2EC7D97BAE1BDA0
SHA-512:	AD3E03E587BB2EA980310D7BF6DF14C1CF982C6E467AAB785281B27806FB1403B58AB6FEAF2B2EC8E34F98C9B0E35AA7D963413CB8F7A18937BDB09B7E8B04E5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/sprites/platforms-16.svg?v1
Preview:	<svg width="272" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M7 2.768L15 1.5v6H7V2.768zM1 3.72V7.5h5V2.932L1 3.72zm0 8.576V8.5h5v4.582l-5-.786zm6 .927V8.5h8v6l-8-1.277zM41.814.387a3.26 3.26 0 00-1.03.918c-.233.326-.43.727-.594 1.203a3.558 3.558 0 00-.174 1.488c.419.027.826-.075 1.222-.306.395-.231.721-.537.977-.917.256-.381.46-.81.611-1.285.152-.475.204-.972.158-1.488-.373.027-.763.156-1.17.387zm2.162 14.051a6.85 6.85 0 00.986-1.242c.346-.522.6-.982.761-1.38.162-.397.254-.618.277-.663-.092 0-.427-.222-1.004-.664-.576-.443-.91-1.209-1.003-2.298.07-.908.329-1.589.779-2.043.45-.454.72-.692.813-.715-.462-.613-.958-1.004-1.488-1.174-.53-.17-.923-.256-1.177-.256a3.719 3.719 0 00-1.643.29c-.496.215-.894.334-1.194.357-.3-.023-.658-.125-1.073-.306a3.78 3.78 0 00-1.35-.307c-.622 0-1.199.165-1.73.494a4.13 4.13 0 00-1.314 1.31c-.6 1.181-.762 2.458-.485 3.83.277 1.374.75 2.537 1.419 3.49.3.477.64.903 1.02 1.277.381.375.814.562 1.298.56

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2800
Entropy (8bit):	4.438018402648471
Encrypted:	false
SSDEEP:	48:+nufOxD9/vSqYMbIVsV+U3BoOWv8s3tgdB/lbCbHLX0m64vKSus:gufOxtIMbIVkh3BvV9D4HLXZTgs
MD5:	67F7FA125B62D65B6847CAB461FAB4AA
SHA1:	1B88072AC4B46706F2949F34E54E44B5A8F62B49
SHA-256:	287947719CC9F762112173012BC6915E533E308D1C1DD8990DDB05DF37C22BE3
SHA-512:	871E4E75D42FF4F8E6C0428765D21F32ADA95ECE1F8B3AB1C3FB5BD3FCEB99809E3C871B6BABAAA419E439D0854914BBD785DD0F274F0B8668F94F9A070056F7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/pages/about/160/layers-of-security.svg
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M65 39.106c.021-2.828 0-6.835 0-6.868 0-2.368 1.432-4.162 3.52-4.71 1.382-.362 10.656-3.157 10.656-3.157 1.698-.504 2.945-.486 4.648 0 0 0 9.274 2.795 10.656 3.158 2.088.547 3.52 2.341 3.52 4.709 0 .033-.021 4.04 0 6.868 0 12.08-6.295 17.675-15.371 22.629a2.535 2.535 0 01-2.258 0C71.295 56.78 65 51.186 65 39.106z" fill="#FFDDBF"/><path d="M87.67 61.578l4.96 5.017V49.227c.129-1.28 1.133-2.367 2.457-2.367 1.311 0 2.346 1.076 2.41 2.367v9.89c.064-1.31 1.093-2.319 2.409-2.319 1.316 0 2.345 1.01 2.409 2.319.065-1.31 1.094-2.319 2.41-2.319s2.345 1.01 2.409 2.32v2.223c.061-1.294 1.092-2.366 2.41-2.366 1.257 0 2.456 1.072 2.456 2.36v7.01c0 5.398-5.21 9.749-10.393 9.749-2.677 0-5.008-.9-6.992-2.699l-10.347-10.41c-.901-.967-.843-2.408.047-3.359.937-.938 2.38-.904 3.355-.048z" fill="#fff"/><path d="M4.46 50.758c.673 3.193 4.63 3.64 6.599 3.226 5.205-1.096 3.788-9-1.5-9-2.053 0-5.77 2.58-5.098 5.773z" fill="#FFDDB

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4565
Entropy (8bit):	5.14537364458942
Encrypted:	false
SSDEEP:	96:nMzQA67ysrOysO7sres0j2VmC9XilbJeVBiTP0:nMzUxrOdOArp0j2VmC9XilPg
MD5:	4E0A4884B8BFC85C01F1F1E0B4BE65F6
SHA1:	5CD2870C127075B15C475CF7CECCD8BDBBCBD33D
SHA-256:	7E2EED8B5C79C2C570D327841F34931FBDCD7916FA282ED461C2225AC9DFA614
SHA-512:	3A08516ADF06E79373E655D29194244EEE14063588E3AA798F978F00115274E77B397357A403E9675A1E6287EE34971D6F4200E6EF9DDF06BDCE4A9EBAF1E4D1
Malicious:	false
Reputation:	low
URL:	"https://c.go-mpulse.net/api/config.json?key=9K3EU-JY7U6-TD3RC-2KCEC-AH4A8&d=www.avast.com&t=5695346&v=1.766.0&if=&sl=1&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240-s99az4&bcn=%2F%2F173bf109.akstat.io%2F&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=208113"
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603653695,"h.cr":"bec32534585dc56b4e4ea17b1288398f40675d1f-d71e44c7-f3212ea","session_id":"1c43d0e9-5aca-40e8-ba1b-90bfb3be2991","site_domain":"avast.com","beacon_url":"//173bf109.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (868)
Category:	downloaded
Size (bytes):	907
Entropy (8bit):	5.141172262392172
Encrypted:	false
SSDEEP:	24:s0YAprqB0Apr70YPB0/0YEB03VhU2ZKPxJ:sRCrqqCr7RPq/REq3Vh2xJ
MD5:	C2C5664B901FFFF97EB8947C31A48F25
SHA1:	2839377375905B6A5F0F694FE03BBF28C97BA616
SHA-256:	B0EF0E27A5C95C2F0B31ED806A81D3832BF6EDD849DE628C400C7009F4F03022
SHA-512:	270B9BB8B8281913F73F569E1D7DF6B9F2C698591121976AF13D058746DA412F7E455A992C3E31C155DA128BD45DBC6CF3CC6F88B750B12DEA4D07F99FA676E7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v2/avast/local/en-us/local.css
Preview:	@font-face{font-family:"MierB03";src:url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff2") format("woff2"),url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff") format("woff");font-style:normal;font-weight:400;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff2") format("woff2"),url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff") format("woff");font-style:normal;font-weight:700;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff2") format("woff2"),url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff") format("woff");font-style:normal;font-weight:800;font-display:swap}body{font-family:"MierB03", "Helvetica", "Arial", sans-serif}img[width="1"][height="1"].optanon-category-C0004{position:absolute;left:-100vw}../# sourceMappingURL=local.css.map /

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus?
Preview:	<html></html>

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2910
Entropy (8bit):	7.91120695469023
Encrypted:	false
SSDEEP:	48:PjuqZteo4QcVjgQmCqiXKwD2eNYgSkAhH0awTcZ0TF8uPqwlMW69Q1H0rVCAd3xN:LuqzeScNgQQiXrVNYgwBjP0JqweW621o
MD5:	5300BF33CB9FFCC202EEE49B5FD0420A
SHA1:	8F2A65692E6B5BBDD12B55816656383CFA3084D8
SHA-256:	BA8FAE70A69DC88E6DEAE698398E2FD8DB49EB372511626807A5E7FB579A458C
SHA-512:	5D917D3BC68A204B2648B5C0FDB1D6DC88A645E906E97E44DE77F19ED951C191A411FF956C1450799398897939028E3FECFE28A564E03A8EB9FE3D05ABCC70D4
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png
Preview:	RIFFV...WEBPVP8LI.../o@..U...m..?....1....T......Q..2..F.@.R..(.LF U..:.B!..r..........Z.0.c......\...C..n`..Y.........)9..mY..%.;.,3.....Q..=R]..........n.F....{......MK..m.?6...+.m.&.....5.t.._m+.\wwwwww..............9..@C..GV..C....FD.'.V.,..k &.CH.P.=...P.C.v{.3dkNtCBw.<...o.w.V.d..{..Sr.x.7.3...H]cwwi...w@.r2b..H7.g..,w.._Bz..fv.....2'%#e ..@..m..m.m.m.-......v..`.?....qD.i......,H.S.d.....T..+..q..@.Y.n.jC..{.G+R.$...t...,eF.v..."2.N...........?w..q(.V9.I.r...../......`9.,O..j.Z.Q[..a..:..e....N^..j..1.M.R0-.`..w.:.R.$i04D.?........r....m.b.{=....D....J.+..YmL..ZE....6g../..E@...!FS..2-.&..Q....\`Tn$.\...y>.\.\..s.....:c...<...s._.B..xQU....V.Y..........b+p.#..Y.x.`..-.../....\../Fn...ZG.....qx...8.N.Rn...w.......K...Z..........E..%....+.1V..u.:5y%..r.i'=l..SU:....K`.F...Q.6.y..d....Z...m.Q....WC.z..b.$.LF$.5G..}FFe3..,.f.G.G.,~=X....@..p.m.V.a.{......}.-aq\|...Z...F.>.v2.:.\......IsP.E+.]o.in......!...^m....Q.\|..#i.D.0....

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	12372
Entropy (8bit):	5.0485583079357355
Encrypted:	false
SSDEEP:	192:eLDZ4zrvjOPxhCf+hnp6+hukN3W8qLpBVh1LzPgwAJe1C5J7BQGz7PIPeETmA1Na:ePZwrvKphCOpNqL31Lz+ZKWL8baCA
MD5:	15C1BE962685D0633C97480DB5356965
SHA1:	CCD6C24766330632EAFD181E65DDFD9B06CEAFC8
SHA-256:	2443673ACEB4E09F5EEC4DA7081D1C461EA0EFDEA4AEEDFE0429C2111DFB177B
SHA-512:	5B0DA7F0C2D173BEEE9704D5571D9A350CE69FC32D7D446A51F7B36A2A6616461BD189EE62CCFD45A91F3D750CD0264C4D9EDE8ECBBD6557985B5D8713E0EF76
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 56x56, segment length 16, progressive, precision 8, 1200x674, components 3
Category:	dropped
Size (bytes):	30064
Entropy (8bit):	7.862344219222876
Encrypted:	false
SSDEEP:	768:k4029Nr6mrItc+BgTcRBheILWETUZP1QjuPozQ3WB:kmTWcSscRfbLWqsKaPyQGB
MD5:	888D7D6D804022F074E791944B58745E
SHA1:	48653F36FE8A2004A4B39ED76F259D4397A5A18D
SHA-256:	17CB3BE1C158A39B5B85881B5DE47AE6267A3FF21A4F551E6F269153B1C7261E
SHA-512:	F0288FDAEFBC59D1A313EFFF6DB9B14A971898F988ACB4AE196DC817BE4C1B377FFBFE50638372CE99BF7A58C0C192724A871709169295FFC0161F159AC932AA
Malicious:	false
Reputation:	low
Preview:	......JFIF.....8.8..................................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F............................................,..."..."...,.B.).0.).).0.).B.;.G.:.6.:.G.;.i.S.I.I.S.i.z.f.a.f.z...................F..........."..........1..............................................................o....<. L.b@ .$........F2....."&..B`q2qw}.........................:.s<......s...."`...z@...&NV.UgB.*..3.s....5W....(......m..:. ........................ ........&.;....`........HH.]..U.b$..............].R.J{.NfDH...........................z....J$...D.H....I...<.N....I..0...................`L......(..(..(..(..(..(...`J..J..J..J..J..J..gL..\|..(..(..(..(.....P&..(...L.......+;.ED.H...v............ ...L.D................qV...8........<....<.....f$......4..`.L.=.4........................tH.........H...{..........nz<..N....c.z......g..H.HL..........................%.\...Qg....{.Ug>.A(........."./....f.J..S.

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19904, version 1.66
Category:	downloaded
Size (bytes):	19904
Entropy (8bit):	7.989010547565687
Encrypted:	false
SSDEEP:	384:+JP+KrRK/mXs4I8MfZpN+TtqZy6BOeh64S2V4ovdsaXd1hd4nTcpvKpP7:gPkIAR7ZNIeh64/VFVsaXT8TEvyT
MD5:	AF5C33B17DD160151CF4166481946F10
SHA1:	5D41CC5B986A09533C1E418477B817F0569F917C
SHA-256:	799E9084D1F231ABBE69886993284F40A3ADA1C0744A17B524F1408F70696A18
SHA-512:	817A159912B067F71666674E670D95623D2533A034E89529686AF1CB863AB3B8D7CB58531747943B0AFA9B671E13EC1F2F238F3111722B2C796496C446073D75
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/o/f/400/MierB03-SubsetEng-Regular.woff2
Preview:	wOF2......M..........M\...B......................\..L..(.`..4..v........x..\|.6.$........ ..J. ..z....6.z.........6......v.V.(..OHNd.....i.vR....gQ.C.$.....i.......V.T...)....}.3.7{.w[U...........m.9l6...j.O]......bW....M.b.j,e...eeX.5k....!x...9.....?..k.?....4...R..B.C.m..B."FS..N.V..5.B.._Lc.......{..... .....J#.4z......:........Z...i..Y........A...."..PH..p..A...R..%...$MRs.H.X.....!.39S......L...K.C.....w...r..S..."F.)..q../~D~...@..zD..E..'.q.......%M.Q.U...,nX.....Na..Tx./.\..K:..~Q.97..fm..?...I..%[&.!N....M.....f.j.kf....H.l.%.]......_..h..[O...b.';oX6.T.._0.f.r....(.$.....(.Vu......"..CC.[..Y.^M,(...P........}....Rq.E.=..Y8...n.....A.-._]...V..X.0X...y...!z&....SK:_....../Oi...4u...o.tc.k...5G.K.{{.dV^?..QZE..6VQ.....MXX.4...`. .@`..T..o!.........('.*:....W..]T.._`w...]....M....@.:F.. ...p)....IHVHG:S...T.\T.....)V...~.......h'......e....?....K)ND....D$H(....gy(n.K7.+#M.by...U.u.".........A.5..^aBq... 2ZD......D...P.H.p$R4baAz."...

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	326071
Entropy (8bit):	5.588076539754745
Encrypted:	false
SSDEEP:	3072:p0D8N8xdjQukZtkPNY59aAaOCCiok1A4WlzQC6QbvaV/26A1tvTqK:Z8zcbkPNYjaAacioki4WaC6Qbvak1hp
MD5:	B809CD923651F7EF80815A441D4A76C6
SHA1:	6653A1D0CC28D77277CD7ECB96902C55A3B10943
SHA-256:	EE0234939CFBB6A0F08529FAF6F7C659D1E1135BD0C51497BF31F633CB789CAD
SHA-512:	8376FFEF9BFEDED96A54E408F9E96CEE69ED14A7C33BAF8CA54EE9CFD8DCA64288396903C70CD39BB7432BCFC500C3FB43D547A1529867B03205C5EEB1350A45
Malicious:	false
Reputation:	low
URL:	https://www.youtube-nocookie.com/s/player/2070f79f/www-embed-player.vflset/www-embed-player.js
Preview:	(function(){'use strict';var m;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ha=da(this);function u(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.u("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,g){this.h=f;ca(this,"description",{configurable:!0,writable:!0,va

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	11485
Entropy (8bit):	7.97040374415306
Encrypted:	false
SSDEEP:	192:rGfkm5pgb9VboXl/YsADdE7hFj8oergZnrKfLURPUCpqQN8pVPkr4ofeF1algUFN:rcHIVKl/YsMZovZrKfLUR8ICMfeilT1d
MD5:	B860C8CA0A3EA1CB8C80090A275BA8FB
SHA1:	6A08B95E9593C5364E7B6A4632BCB4F490106FB2
SHA-256:	B4C0B56B326691C0ADFEEADACE6CDEB1E1A46F0773D5545D405D9F4C02D333CA
SHA-512:	D32995FB5640780831009C3FD578795209849EFCF536F3A88D9140D0A99AF640E89DD782B71628E8C00E54E8DC8184AA18A4A6CE5F2BA82179848570F2E91254
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/aim/img/about/hero-image-video-new.jpg?width=1128
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................+....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma.................+.mdat.....je}C.....2.WD....@P....^..f.A.....I.1s..j...V.w..4L9C.3.Y....,..f.#.s......i.....2.M..pk....._..]...6.................~f...@..o.@..R.q......U..c.2.&Y.......;..g.\G..3.M;y<..#.l.V..T..+.r..M..;.Y.y..<#....f&d..]N.tv.3.9..O.H...9. .C...Jf.....%.TN7..V,.....v...QZ.....'.h..Y..)u._....g@E..8........n...&..l...TC..4GfR.z.W..g.K:.}T..[l...@a.:7B.E.T.M....=y...B..Q1...p.:)br..n7...:}A.rP.^,.1...#.pa.P..`.Y._(......o....,.\......p......YA[....$W.7........y.v.q...(b..#Pp..,>\.hf.<.;.<...;.....l.".V.em...}...~..D.J....fvd{.I.fY..1@.h.K...Jr.l3.b.r.2.Z..g[L...}....n..kS}.Q..p...K8NB..{..-.k\..g..O1..N.l...(`...C....N{}.\|.\ ....Z.g.Y.d9.c....9t...%..)...z...GA.C63.U.D.DIzS..*.[...Q./p.

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1453
Entropy (8bit):	5.119473265837788
Encrypted:	false
SSDEEP:	24:2dAAfgl4U5rkb4JRk3eNLCMjMGEBxMwLhlllonWkk3eNLxMwLhlllWrltxMwxhl+:cZ84ErkseoJWLoj2lC
MD5:	66A0FA5DC355B1AF8A02C5B6B15440DC
SHA1:	E1E8D298479481DC2FED3FFA6DAF42A6BEE64D7C
SHA-256:	879D774FA50276E7EFA5F3E2C58A713C247618165526604BBE39C2F5A0D41495
SHA-512:	D94B92AA6FCE97D6CF5D24C00AFE9140553C5C1ADEFD2D963E6E298912BB244C476DE584FE22E26898DFCEA2D8922B746F378A362AD79AC2761C243D82E04E05
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/what_is_a_computer_virus_academy_refresh/icon-01.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <g>. <path d="M2.2032,10.2924V28.2603c0,1.0488,.5515,1.5735,1.656,1.5735h29.8907c1.0479,0,1.5735-.5248,1.5735-1.5735V7.2287c0-1.1037-.5256-1.656-1.5735-1.656H3.8593c-1.1046,0-1.656,.5523-1.656,1.656v3.0638" fill="#ffddbf" fill-rule="evenodd"/>. <path d="M38.2572,13.1775l-12.5867,10.2676c-1.2129,.883-2.5665,1.3245-4.0559,1.3245-1.3811,0-2.6781-.4415-3.8926-1.3245L5.137,13.1775" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M38.2572,26.5089V10.1137c0-1.1037-.5256-1.656-1.5735-1.656H6.793c-1.1046,0-1.656,.5523-1.656,1.656v3.0638" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M5.137,13.1775V31.1454c0,1.0488,.5515,1.5735,1.656,1.5735H31.5507" fill="none" fill-rule=

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	8257
Entropy (8bit):	4.0183790841915
Encrypted:	false
SSDEEP:	192:YQxpzWpLKoKO3KVjOmuv2cIq1oQn3egTzqSVIivZ40dKV3y1cjpH/F:FxpzWpLKoT3KVjOhu0oQn3rHrzvFdU3N
MD5:	023D27A99B036BA05BC0090AF307E284
SHA1:	FE2FD3D0AE0A00C8D23F7CA6A0D37B05CBD57887
SHA-256:	58E7742AF659DF5C5AE62DCB5B60279FDED66DA6E54C13B9B2EC7D97BAE1BDA0
SHA-512:	AD3E03E587BB2EA980310D7BF6DF14C1CF982C6E467AAB785281B27806FB1403B58AB6FEAF2B2EC8E34F98C9B0E35AA7D963413CB8F7A18937BDB09B7E8B04E5
Malicious:	false
Reputation:	low
Preview:	<svg width="272" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M7 2.768L15 1.5v6H7V2.768zM1 3.72V7.5h5V2.932L1 3.72zm0 8.576V8.5h5v4.582l-5-.786zm6 .927V8.5h8v6l-8-1.277zM41.814.387a3.26 3.26 0 00-1.03.918c-.233.326-.43.727-.594 1.203a3.558 3.558 0 00-.174 1.488c.419.027.826-.075 1.222-.306.395-.231.721-.537.977-.917.256-.381.46-.81.611-1.285.152-.475.204-.972.158-1.488-.373.027-.763.156-1.17.387zm2.162 14.051a6.85 6.85 0 00.986-1.242c.346-.522.6-.982.761-1.38.162-.397.254-.618.277-.663-.092 0-.427-.222-1.004-.664-.576-.443-.91-1.209-1.003-2.298.07-.908.329-1.589.779-2.043.45-.454.72-.692.813-.715-.462-.613-.958-1.004-1.488-1.174-.53-.17-.923-.256-1.177-.256a3.719 3.719 0 00-1.643.29c-.496.215-.894.334-1.194.357-.3-.023-.658-.125-1.073-.306a3.78 3.78 0 00-1.35-.307c-.622 0-1.199.165-1.73.494a4.13 4.13 0 00-1.314 1.31c-.6 1.181-.762 2.458-.485 3.83.277 1.374.75 2.537 1.419 3.49.3.477.64.903 1.02 1.277.381.375.814.562 1.298.56

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1219
Entropy (8bit):	4.593498476722124
Encrypted:	false
SSDEEP:	24:tzkuOU6joxiRnG7TYhllBjdlUcd3y5DPHAXvzRRcHV7/pjXBDpTYhll7:QU60M5G+WcNbLRC7xrBDA
MD5:	C526F0A4834C12DCDDAB62927102F8B8
SHA1:	BD2E83E856A38B1A5EE1548B741A9C197F97130B
SHA-256:	DD886A8A6D218329AE63D319D5FEB0459FFD3869F2570D312386935B53399868
SHA-512:	6551553FD2708D9C90E39BD5CDBA3DFCE28111AC53BF3D6EFDDFC6968425453818665752267CCAD89DC62F94982029968AF64FFD032048F1E00E0A6D836C531A
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_breachguard_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.525 20.717a.734.734 0 00.725-.843c-.2-1.3-.685-2.414-1.364-3.242-1.893.907-3.68.907-5.574 0-.679.828-1.165 1.941-1.364 3.242-.07.44.276.843.725.843h6.852zM16.098 9.4c1.422 0 2.576 1.165 2.576 2.6 0 1.437-1.154 2.6-2.576 2.6-1.422 0-2.574-1.163-2.574-2.6 0-1.434 1.152-2.6 2.574-2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path clip-rule="evenodd" d="M6.18 18.496a18.016 18.016 0 01-.63-4.862c.01-1.415.008-2.83.004-4.246A3.176 3.176 0 017.82 6.334c2.273-.678 4.55-1.34 6.827-2.007a4.819 4.819 0 012.708 0c2.276.666 4.554 1.329 6.827 2.007a3.176 3.176 0 012.265 3.054c-.004 1.415-.007 2.83.004 4.246a18.02 18.02 0 01-.63 4.862c-1.145 4.109-4.75 6.967-8.392 9a2.929 2.929 0 01-2.856 0c-3.641-2.033-7.247-4.891-8.391-9zm14.07 1.378a.734.734 0 01-.725.843h-6.852a.734.734 0 01-.725-.843c.2-1.3.685-2.414 1.364-3.242 1.894.907 3.68.907 5.574 0 .679.828 1.165 1.941 1.364 3.

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	272
Entropy (8bit):	5.1625695992699665
Encrypted:	false
SSDEEP:	6:tnr3rpqULyKumc4sl7vrERIykdgZmiAELbHsR69/KlW6YmqZllv:tr3rpq6juJlJeZoELbHs4OYhllv
MD5:	5AD7A6AA7F2D255641479F2F3FD8A213
SHA1:	48F120A75EEF107EB1C3A510414921D1871C9E2B
SHA-256:	D41F8873EA314FBD365E50B1B8484E925064AC5250F22660AC06D89C6014F5DD
SHA-512:	7255E92DD22074B6D7AECEF7457A5ED69D873EB346FD2CEE4F075EF72079343820CA6F34FA6981400326015EAB5F0AF7819E64758E406CA104101A73FB6C53C8
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/arrow-blue.svg
Preview:	<svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#0070F6" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7147)
Category:	downloaded
Size (bytes):	7194
Entropy (8bit):	5.16321471517977
Encrypted:	false
SSDEEP:	192:iolclWB7AMSMpCppfpiplpSpYpJp0O13WjwYCiwWyX1alsG+:ulWB7AMSMpqpfpiplpSpYpJp0s3WjwYg
MD5:	55690C5556B4F286DC687E63CD28BACF
SHA1:	CF0CFF37D63BBE5C28F3B9E3A33C9A8BFC0118FD
SHA-256:	4228CF7DD47C06CDF2DAA137B4680C91DAC22E9A2B9664FD664C34FDE1B6D4BA
SHA-512:	C173A571E853E5001A0C12A225A92C0B0E4954E6CD295B886B817257AACBAB4D203A5CCB3FF6BFB60D5217ADD7785DD8C3233165B96A0B2CB5CD2146A0B2A119
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/singleDL-secondary.js
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{var a={buttons:function(){document.addEventListener("click",function(b){if(b.target.closest('a[data-role="download-link"]')){var c=b.target.closest('a[data-role="download-link"]');if(c&&sdl.push({user:{download:{products:[{campaign:a.checkAttribute(c,"data-campaign"),campaignMarker:a.checkAttribute(c,"data-campaign-marker"),sku:a.checkAttribute(c,"data-download-name"),maintenance:0,seats:1,quantity:1,currencyCode:"USD",category:"Consumer",price:0,tax:0,brand:"Avast",link:a.removeUnwantedParamsFromLink(c.href),offerType:"download",localPrice:0,localTax:0}]}},event:"user.download.products"}),document.querySelector('[data-behavior="downloadPopup"]')!==undefined){var d=document.querySelector('[data-behavior="downloadPopup"]');sdl.push({system:{modal:{id:d.id,component:a.checkAttribute(d,"data-cmp-name"),path:"/"+sdlObj.screen.locale+"/"+a.checkAttribute(d,"data-cmp-name")}},event:"system.modal"});var e=new URLSearchParams(window.locati

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/logos/avast-logos/avast-logo-inverse.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1120
Entropy (8bit):	5.291343419005958
Encrypted:	false
SSDEEP:	24:t4SbFAnufHxl+9bsXISsgA1tBLeI2N39mx6ABL5HxsGkMGAcgKPHxsGkMGUe:THaCRY/LmrmxdL5H9mlgKPH9mUe
MD5:	FB7EE1A4FDAB0CF17A6C928A001F0C0E
SHA1:	37AA3DF5DC67A77ED318144DB514774E7DDFDB92
SHA-256:	41723D2B8A63B2EB0F7B37267EE28B30937B041280B86B408EF6FBA712DAB9EC
SHA-512:	25B05525B4E710CAEFDA1BED1CD9979D6734800F8BE3EB5B80D1B7E45A9BE2F20120A555F1B32639ED6B2F651555A16E0454FC932B4D1A5B3BABE4445D2732CE
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/bg/bg-blade-dark.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="488" fill="none"><path fill="#071D2B" d="M0 0h1600v488H0z"/><mask id="a" maskUnits="userSpaceOnUse" x="0" y="0" width="1600" height="488"><path d="M1600 0H0v488h1600V0z" fill="#FFF"/></mask><g mask="url(#a)"><path opacity=".22" d="M1215.39 567.616c143.1 221.991 53.73 519.384-188.01 625.614L-1423 2270 568.183 480.912c196.441-176.499 504.107-135.286 647.207 86.704z" fill="url(#paint0_linear)"/><path opacity=".22" d="M551.718-172.449C757.065-6.328 765.102 304.147 568.619 480.67L-1423 2270-90.304-52.378C41.174-281.492 346.37-338.57 551.718-172.449z" fill="url(#paint1_linear)"/></g><defs><linearGradient id="paint0_linear" x1="574.5" y1="412" x2="969.05" y2="855.778" gradientUnits="userSpaceOnUse"><stop stop-color="#071D2B" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity=".48"/></linearGradient><linearGradient id="paint1_linear" x1="-8.5" y1="-52" x2="572.162" y2="505.332" gradientUnits="userSpaceOnUse"><stop stop

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x441, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	50560
Entropy (8bit):	7.996348655247143
Encrypted:	true
SSDEEP:	1536:im1xOrcXsjz8h+CZjznt37dJuwooOZp/sDQ:2cXK6+CZ357dgwooMsDQ
MD5:	E2436949F9FBC0724573CD9E20EC3978
SHA1:	CEDB45AA00376BB84211D922A81316F942FB95E7
SHA-256:	ECE444E5F620D1DBFF33EEACA8E97D080A448DAA85D6E0FC963CAD80B991ED19
SHA-512:	2FD0C8953CCEDEBCEBF9E331EB8FD3CB0981C60CCF88DF2BE281491F7FF1B2DA788C74DCCE520F83D4E4BC046854AA7289CB7214954E76B0B334D70A63A774C2
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/New_Avast_Academy/Computer%20Virus/Academy-Computer-Virus-Hero.jpg?width=1200&name=Academy-Computer-Virus-Hero.jpg
Preview:	RIFFx...WEBPVP8 l....e.......>I..E".#%'.{...dm.CM.Y\|+K#.....S`~.......3.k...........M.9/.v..........?..s.......b~........?n~i.......}.{.y....?............_.....].........B....?..........?.o.....?r....?..........E./.G.....>.}l?....B..........._..............=.#._......@........k......-V~....~....G......W.=...y%.....3./.......=s.....~..6...;.W.<.:?.........Z...&.8.......&.2f..Aa^b.u...$.....skW..y..g.......}.OQ........u.H.`pa..n/..".Hl..$.FI..(W}.e..\|....6........F....j..`.J.I..G.>.........Y.J&.v........9...7.................2.%.B.T.. ....N7.l...U.."v.q.mG,.<&.....X..Zj.......,.....j-...I.j.]..Dz.{+.P.HB..Z\....}\|rv?....~...:.*.xuI2.Z.W....R!ne.i2.8..'..i.m...U...U....7...0..b.!L.%0U.KA..mG....:W.>.d]..GK.8.U.0......pW.>...a...0.E}b..=....Td..V.lVY.'...9'wej...~U..UU........x..xCw...Tc?....._.x>.r..R. .pT-.D.n...mAc..{&...~...{UU.K.Sc_N#....DZrV.C...2~.d.....(.. o....}p_...9U...9....-.q..8.0..\|y.i.....~..GZ...#..............v.V..nr.B~..W....=U.

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3099)
Category:	downloaded
Size (bytes):	172907
Entropy (8bit):	5.0956346113217625
Encrypted:	false
SSDEEP:	3072:y7Fa95Hq8FyB2GKT+otQw5xg3naUudlYYConqvtsIbu:2a9zIPKTgXdmqvtsV
MD5:	06572905E9C3B5F005F20A151AE0A612
SHA1:	A86890AB5FA1383DB57ADC18E381A0FFBB261C24
SHA-256:	355D9136772DF75CAF1AE1A1A0A544E5CDC93E31E4F3F973CE7F58B2D9FDB5C7
SHA-512:	74B1F3024D41849745CF9B4301880C432C1662FD5F13F1F8623945B1AACF765331D799D1BBCA5FD15129D264B91B17B746E532939A8AABC6F062D39F11F5308B
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/en-us/eula
Preview:	<!DOCTYPE html>.<html lang="en-us" class="no-js">..<head>...<meta charset="utf-8">.....<script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js" ></script>.<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486" ></script>.<script type="text/javascript" src="https://static3.avast.com/10003548/web/j/vendor/one-trust.js"></script>....<style type="text/css">...#onetrust-banner-sdk, .onetrust-pc-dark-filter {....display: none!important;...}...body {....overflow: scroll!important;...}..</style>.....<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">...<meta name="apple-mobile-web-app-capable" content="yes">...<meta name="apple-mobile-web-app-status-bar-style" content="black">.........<meta name="google-site-verification" content="yuuaBgRMbmDWxp2V7VtQB4P1d

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/avast-logos/avast-logo-inverse.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x441, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	64968
Entropy (8bit):	7.99640235846894
Encrypted:	true
SSDEEP:	1536:ky4cnYyJb8Hjh26iSP0Oic8P+k3Qk9tOaqvXHzK/U33fuoMs/jMQR:+QYKYDJvP0hc8mlvzK/O37MstR
MD5:	2F909C0DC55BD32A66984851212EEE57
SHA1:	66756D3297CDED893FD7B7F3F903AD508D68A5BE
SHA-256:	C4794303AF05048709E2EDDF275B0BBA03933707DF54F449A829370DAB61D2E3
SHA-512:	757EE4D59ED6A83E2E874438B679445B8FB7C18C7DDC98D787A0CEA99597647BB625F5F5C71FCB07B3D7B1A8F592E5758D23FFFA31AB670F546672345B3A8703
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/New_Avast_Academy/What%20is%20Malware/What_Is_Malware-Hero.png?width=1200&name=What_Is_Malware-Hero.png
Preview:	RIFF....WEBPVP8 ....04.......>I".E".!..E.(......n.........K.o....~Y......>e...%g...q......=...#.F[........p.....};......\|../......!.?..........g.O...?.\|............/......v.'.g.7.w...OP?.?......T.3...W.....>..F..........@.......O.K...g...o.o....~......G............._.~R.........Y.../.....>.?.z........?..m.....?....}._..............?#.......?.................o.7.....~K.#...?............_...?.?........d.]..........C......~..l.....o.......{........@?..2.....k.....?V......./........f...k...../.?..-.....a.y......?.~V..~....?.=.#.dCC.Q..z.VXg~...tB...n.e......'7...[....m.........W..JB...r.^.........>..2\|..w..AO/..11g.k`.^..Ya.f,.../.....c..:..hO.....>.xnf.Qj...........~........\|..j\....p...V.L.G..%.3...^g4.r.-KV..v.!)e..<._2......!.F[........`I..,...j.....O..=....;x..6.vW.....k.y2.....+V..`...x...^CL.n....,....2.....I.@...&.......)%..PA.l{F....N..5F^.....W..t....-G.K~s..aP...x../.4E..K\..................s..~wH...fQ.E....JZ.r..9..l&G..%g.K.ql..

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	5.144241822818499
Encrypted:	false
SSDEEP:	96:nM0C7ysrOysO7sres0j2VmC9XilbJeVBiTP0:nM0CxrOdOArp0j2VmC9XilPg
MD5:	89B54A6131B9B080087B951FA9AFC91D
SHA1:	086E6D37A082085923572BB948D66C5BE4A3FD53
SHA-256:	F6966C54C356349A3C1E15208BB4993C1CBEF4146BD7D90B6F3D1746BC305F15
SHA-512:	E10F459A6990C2DF0F14917589584E1F41A6D6305AA9E89B6219C1EF1930CB38284AB32BF34F1526CA6ED14AF458C12554E6CB630C1598E14177650901E292FA
Malicious:	false
Reputation:	low
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603654940,"h.cr":"22e2ddb94f951f23dbc9e1a5c5d7b7a559d4268d-d71e44c7-f3212ea","session_id":"f6c7e927-317e-4700-94de-c47ac6b82e2d","site_domain":"avast.com","beacon_url":"//173bf109.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	5.147380311628361
Encrypted:	false
SSDEEP:	96:nMqfysrOysO7sres0j2VmC9XilbJeVBiTP0:nMqVrOdOArp0j2VmC9XilPg
MD5:	16674D77F70FD54893A742812119350C
SHA1:	88ADC1AD15736DF8CD93E0222B55B5A2B0580175
SHA-256:	BF8CBB9CC829B625F206BE57C19F28E71788A4F51202F44CEE3D6C0B050AE203
SHA-512:	E59F6726178F2E6AF9CE51B27E2F947136325828B159123A7BF7E3E5C9846228C3B25B8B4710479F1B8E035B5F2E0F77710A173DA70859B225848CC05FE531ED
Malicious:	false
Reputation:	low
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603616742,"h.cr":"727954f5ad8e481ef75574d811dfe6aabc692a6f-d71e44c7-f3212ea","session_id":"52d65580-9121-466c-9a88-7014c395c5d0","site_domain":"avast.com","beacon_url":"//173bf10e.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	5.338465464683756
Encrypted:	false
SSDEEP:	24:hY6svD+6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z8xDbvxL1US8f:3qD+2+pUAew85zsDbJL1LA
MD5:	8B2690ECF96B153D031D31C75F5C9F5B
SHA1:	91737C987F5EC480BCBD4968566D97757FBBB09C
SHA-256:	22C6358B31973F1F34FD4630A96BAAD42393D23806AFC973D93A8C15973E74F0
SHA-512:	2D3F306F3D12092FFFC3864F7F9ADC304B2C3B20649A09AE4F1DFAF4B47E7468968301E8BC4E1A9ACE825E374226B1795E80E9E99B04C145CD767AE9E98F5E9A
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15628)
Category:	downloaded
Size (bytes):	15661
Entropy (8bit):	5.252589972332973
Encrypted:	false
SSDEEP:	384:Wo0gawA6L564TFsyxult82P1NgNvNjNFNJNININXuL:Wo0Qblxul+U
MD5:	E83EC6654B1962B4EDA2154502BF500C
SHA1:	38617B9284C6CB6523B499D0B8AD75BB844C8FEB
SHA-256:	24D956B826FD0F854AB15CC1AA55D14DFD1C832C7F5BFE2629549F3E6A92F930
SHA-512:	2F33EA1913B31A42EF61F6D789E38C5D17EA82358D50A63981E08CB671F9287DFBBA0A90918DE023F54741B4E145770437B04F17BA4878EDB48C6F53DF657952
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/vendor/cash.js
Preview:	!function(){"use strict";function a(a,b){try{return a(b)}catch(c){return b}}function b(a,b){return a&&(i(b)\|\|j(b))?ra.test(a)?b.getElementsByClassName(a.slice(1)):ta.test(a)?b.getElementsByTagName(a):b.querySelectorAll(a):[]}function c(a){return a.replace(xa,function(a,b){return b.toUpperCase()})}function d(a,b,c){if(c){for(var d=a.length;d--;)if(!1===b.call(a[d],d,a[d]))return a}else for(var d=0,e=a.length;d<e;d++)if(!1===b.call(a[d],d,a[d]))return a;return a}function e(a){for(var b=[],c=1;c<arguments.length;c++)b[c-1]=arguments[c];var d=arguments.length;if(!d)return{};if(1===d)return e(wa,a);for(var f=1;f<d;f++)for(var g in arguments[f])a[g]=arguments[f][g];return a}function f(a,b){var c=a&&(a.matches\|\|a.webkitMatchesSelector\|\|a.msMatchesSelector);return!!c&&!!b&&c.call(a,b)}function g(a){return a instanceof ua}function h(a){return!!a&&a===a.window}function i(a){return!!a&&9===a.nodeType}function j(a){return!!a&&1===a.nodeType}function k(a){return"function"==typeof a}function l(a){re

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
Reputation:	low
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A32%20GMT&n=-1&b=What%20Is%20a%20Computer%20Virus%3F%20%7C%20Computer%20Virus%20Definition%20%7C%20Avast&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&enc=UTF-8&yv=1.15.1&tagmgr=gtm
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5442
Entropy (8bit):	5.204459140492936
Encrypted:	false
SSDEEP:	48:+RKw8X9A6gw2+Jt9A6gwB7EenOKG2BVp9wmBYRm5mF4WMwm7IBh51uTIfcERm2Ym:+GFNJ33PomvbTnIm2YkTVp68F
MD5:	6B7C4C8E38B7114D0DAD03B1B890E232
SHA1:	376C87269D06A8643539AAC7604EA0146A67151D
SHA-256:	2238EB87612F8A90FF9FD69C29AEFD1C63272B0608C5724259C4A18CAA0F746B
SHA-512:	4858D5391C90E0232D4CDFE9665E9933416043811D1D4A76148E6A1CB79730B57C58F62C6908516EF13ADF3B880BB6431F2BD69249E7E611AC18D65B711FC196
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="64" height="64"><defs><radialGradient id="j" cx="-4.847%" cy="-.239%" r="401.337%" fx="-4.847%" fy="-.239%" gradientTransform="matrix(.26722 0 0 1 -.036 0)"><stop offset="0%" stop-color="#3E2723" stop-opacity=".2"/><stop offset="100%" stop-color="#3E2723" stop-opacity="0"/></radialGradient><radialGradient id="m" cx="-.122%" cy=".104%" r="136.314%" fx="-.122%" fy=".104%" gradientTransform="scale(1 .84752)"><stop offset="0%" stop-color="#3E2723" stop-opacity=".2"/><stop offset="100%" stop-color="#3E2723" stop-opacity="0"/></radialGradient><radialGradient id="n" cx="10.227%" cy="-12.225%" r="226.352%" fx="10.227%" fy="-12.225%" gradientTransform="matrix(1 0 0 .49642 0 -.062)"><stop offset="0%" stop-color="#263238" stop-opacity=".2"/><stop offset="100%" stop-color="#263238" stop-opacity="0"/></radialGradient><linearGradient id="c" x1="4.549%" x2="36.95%" y1="55.356%" y2="42.739%"><stop offset="0%" sto

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5194
Entropy (8bit):	3.976628767895142
Encrypted:	false
SSDEEP:	96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV
MD5:	63E737D3544164D2B7F4FBCA416AC807
SHA1:	030370AA38715E4C41589633F69D0BFE8255D46C
SHA-256:	5FA00D047ACD959697B9D7772C31DCD37BEC33C70C6FBF80AB8316205D1D286D
SHA-512:	31EE1BB536C0E50F5568A415EA3308367BFCFD11D2A6F7DFF1C8E3A982F7BE790C240A603CD4C6E187672824B8E5D07646049A28C6A88A7B001EB9A0142F312B
Malicious:	false
Reputation:	low
Preview:	<svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83 0 01.74.77 2.25 2.25 0 01.25 1.07 2.26 2.26 0 01-.25 1.08 1.77 1.77 0 01-.74.77 2.55 2.55 0 01-1.28.29H.66v-.72h1.59a1.81 1.81 0 00.87-.19 1.1 1.1 0 00.48-.5 1.73 1.73 0 00.15-.73A1.66 1.66 0 003.6 7a1.1 1.1 0 00-.48-.5 1.86 1.86 0 00-.88-.18H.81v6zm7.74.1a2.29 2.29 0 01-1.2-.32 2.29 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.6 0 00.5-.69 2.9 2.9 0 00.16-.94 2.85 2.85 0 00-.16-.94 1.67 1.67 0 00-.5-.71 1.37 1.37 0 00-.85-.26 1.35 1.35 0 00-.85.26 1.67 1.67 0 00-.5.71 2.85 2.85 0 00-.16.94 2.9 2.9 0 00.16.94 1.6 1.6 0 00.5.69 1.29 1.29 0 00.85.27zm4.43.59l-1.54-5h.82l1.08 3

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6510
Entropy (8bit):	4.872303848698837
Encrypted:	false
SSDEEP:	192:FIpp+DNDeOapp+DUZkp+D0X+W1pCZpY6vep+DoQLWdcPW:yWFezWUUW0u+0ZpzoWoCWdce
MD5:	50BCB5BABCD79578C8EBACDC424246C1
SHA1:	01F1808E548649B8CF73C22EE1E52E219DB0CD5C
SHA-256:	F69073C0F0C5143545BDC8861AD97105307947B53B1FD8CD2FCB73C5600FD161
SHA-512:	8C4406211491686B099271B63AB1CAA1D288DD2CFBA0D71DC9F5EB2D4CFF312EF35E85EECD7C94B59F9CB5EF6982F97F8F215143B40F9449342870E533919DE6
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8-3d45-4e4a-998f-7d05f89e4486","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil . All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"BannerPushesDown":false,"Default":false,"Global":false,"

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.267838660635414
Encrypted:	false
SSDEEP:	24:hY6svD+6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z8xZS8f:3qD+2+pUAew85zssA
MD5:	5EDBA73F30F0D3A342CECCB3A34BFE45
SHA1:	3F39E4C8EF00408D327260F5328162AB3E5D3CAF
SHA-256:	F768529B209DB7EDF38AA0DA2A69C1C1DBE5A760D457FE74080D3AD76F14A0C2
SHA-512:	C302E3CCC2D9F2E12133ED07082A78260613F1B8C756D9EB2CF0A7AF63C425D4A8956B01EAE3FC3DFAB506DACF6416B0B53929D535CFA2AD81951183A6526FE7
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	7838
Entropy (8bit):	7.951817545153348
Encrypted:	false
SSDEEP:	192:rGpulu9KTMKUYkNA50IPwBHGKZlDzs/AIsD+I2CWH:rLluITGYkNA50CWJ02+IU
MD5:	D8C8411116C17058BE86AFCB2A7F3839
SHA1:	D9914EB4644E800358361A99BE5F54AFB99BB605
SHA-256:	CDE51731D0784D940F9C4E3A27441166BC8E9593596F1F2C19893E13B6E19C09
SHA-512:	C5BDA156DE52113DB4D458206E01642AA1C319DD4E011FCB5A073FCBDF5FA848B36F490AA0EA0BD9F3738ACDF076ABCD81A7CF9C5D77E7992172E24B8E1C7EF7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=1280&fcwidth=2560&fcheight=2000
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@.......................#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................mdat.....g.......2.:D..e.XP.2p..Y...h..e...g.=...p..q.:..'.......>.R.9.,.Q\|h.>._.K....c..p.....(..A...?)...6...7.).2.Z.Y..n...._&.bI...Jyv.T....6..i..........^.{7M..L.C.N...\....K......}tGl...q...x..l...TP\|.C...C.q......GX!....(....e."Z...=.E.273T.:.,3..S.M...6.n......0."].....qW.../.. ..X.$f.Pc.......5...l ..u..P %.#.t.7........T`.p..g.......1.Z.Y-`g1Qru..F.....\|..~........]....1.mh :Q'/\|.'e!x..H.. y{....?........'<.0.[.)N...R.wb..)....\.\|...d7.......?..\|r5..<..\|.<.....Px.......h.....p!".{i......fQ..o....I>.,.dA.w=.Y.>.........!.N....<...&.\|........VL.Z...]E..;..4 ..m..x=Z..;.(.<u.".+....g=.6.?;P...C8k.8.......1h..o0.P.....2.H^`.j.kE...b#.....k..>.B.Z.+".:...O.ap..-......>.....]<6.r9C...m$.&

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2961
Entropy (8bit):	4.952945362592522
Encrypted:	false
SSDEEP:	48:cZ84hAWbJxQjXQtVbsTbJxQjRljL6JqIzgrGRpG+:c8B7eGKL6JTckG+
MD5:	567C783CB00B7E353776C56F873D3213
SHA1:	06E47E36A7054C3B5E10A6729276170D5E8593D0
SHA-256:	3FC870549063F9AC69339D0BB33E5755ED774F7DE57801B32B7826E019488B3E
SHA-512:	737A093A9D1B86C9771AF430844AFCB608F880A8A82E8DBA18198B6D4B1C0F414478AC78C1E25DED584B44962FA8A0CD52BBDA5B8D0C5BA30C4F3D2C1B98595D
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/what_is_a_computer_virus_academy_refresh/icon-04.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <path d="M16.0042,38.1651c-2.5402-2.5161-3.8103-5.6248-3.8103-9.3266,0-3.6041,1.2701-6.7134,3.8103-9.3259,2.6132-2.5402,5.7219-3.8103,9.3266-3.8103,3.653,0,6.7496,1.2701,9.2898,3.8103,2.5884,2.6125,3.8826,5.7219,3.8826,9.3259,0,3.7019-1.2942,6.8105-3.8826,9.3266-.5564,.5564-1.1248,1.0518-1.7053,1.4877-2.2021,1.5728-4.7296,2.3588-7.5845,2.3588-2.8067,0-5.3349-.786-7.5845-2.3588-.6046-.4359-1.1858-.9313-1.7422-1.4877Z" fill="#ff5833" fill-rule="evenodd"/>. <g>. <path d="M6.0924,3.1374H38.9076c1.3891,0,2.5168,1.1277,2.5168,2.5168v4.3021H3.5756V5.6542c0-1.3891,1.1277-2.5168,2.5168-2.5168Z" fill="#fff" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M31.7717,6.1821v.6535m8.5279-3.5927c-.3147-.1694-.7137-.2545-1.1978-.2545H5.9705c-.5805,0-1.0164,.061-1.3063,.1814-.7258,.3147-1.0887,1

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20416, version 1.131
Category:	downloaded
Size (bytes):	20416
Entropy (8bit):	7.989516884943251
Encrypted:	false
SSDEEP:	384:BRJK3c0mJKhKo+duIKBTNKK4ColM4uGHytooZ3XfQh3f/2ufx:aNmAKpdZmTNKneBGHyGwXoVzfx
MD5:	79D199915C35744618487C2B40CA73A4
SHA1:	6F7A94C3FB9B704EE2FDA196B345C35953AC9770
SHA-256:	0D822CCDFEC5D11AA33B42BB3904A22474DC2CC3C6B3E0FC8F4FA5523C43A85E
SHA-512:	84E5BDE017A0D08E7905D475DCAAC80097EF110FE0C0BE82049BF63575D255EB1F8BA722BCAA1D96A9B59202B17C1137EBC0D657C4A6CF8F97FCC336E5E8143B
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/o/f/400/MierB03-SubsetEng-Regular.woff2
Preview:	wOF2......O........$..O\..........................h...R..(.`..D..v........H..}.6.$..$..... ..\. ..z. .'...Hw......x...8,hX..h.....K...?%......4.^?..S\|.g...0...V.....C.C+i'.k ..{......Y.s.u........eJe..j.C........... .I,......eo+[......,..Z.....\|e.9.$...#......K....._.8.t`K,......R.$T..&........9y...{.Y]..a...N4N{.....,..,.K.. .x.......J..l...Ax...dP\...{....N....Z......W..}.....G.A<.O....Y.(.@.X..\.c.....:{.........@....S..l.0. .EZ.MGS.@v.....m......q".[a.....`.....].E5O...;..q.....i".(.......t.....@.&!...^{..2._.?/f....oJ.nK....o...(.. +r.2......2.A..Z.>...m..( .F....n......w}E}E......._......MM..K4.jH......x.l....+0..7.M.%...t....e{..;.].n.Z.jYU.=..@ic...,g.T../......A.6....=.^.)...I.i...M.sf...V.....#.2.6.K...........R.....@9...#Yt<Y............]......H....@..P..w.. .H.y........./..S.s.\T.].n..+.....~.s.6[.......W.D.?w.....7.rfC..lk.'..&m{S..@..UU...!tUr....`...5.#....3..?rR.F=.c<.H..".._O.....Yh..&..~\|uO....`.~3UUQQQQQQ1....?-4A..]

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 56x56, segment length 16, progressive, precision 8, 1280x1000, components 3
Category:	dropped
Size (bytes):	26670
Entropy (8bit):	7.877248354195684
Encrypted:	false
SSDEEP:	384:PZ+hmAieir/hpL9UUyrpfMu5W7TwXjOEAqvZxV0Noms+h7Egkd8EwTqq1xC:RIIr/hplyrpfeAXjqqv2oNq7Wd8EwtxC
MD5:	4DD0760D4449920408B2687D944F39BF
SHA1:	3E3797E799EA5DD06E74F0B8FE30336A6018FD5E
SHA-256:	DBE05D4F440F8F379E1A19D73D45D5CDAD138013B6DAE80E4D07034FB62C2020
SHA-512:	9E4B079CCCB76C497594129B5286DD6EF2A7BB0AAF322E129786CCF65878A9D6F2DFCCC1A1638737B8D9985E2841B3E803669BFC50950441F4589B0A585B01BE
Malicious:	false
Reputation:	low
Preview:	......JFIF.....8.8......................................&.#. . .#.&.:..-..-..:.X.7.@.7.7.@.7.X.N._.M.H.M._.N...n.b.b.n...........................C.C..................................&.#. . .#.&.:..-..-..:.X.7.@.7.7.@.7.X.N._.M.H.M._.N...n.b.b.n...........................C.C............."........../.............................................................."..,&u...Y,.9.l.7..,.YMo...k..e..K...R..u.gyLgy.+...Y.nnp,.LoJ+.z.5.....:..mC3T..9N..9.0.".B.J$.....#.....R".!`..V.....P..............>..A.$H..L...f....,.YK..kz......RMB...4),3..3..15,.Y\..Y(.vY..]...9.]e,.gc.{f....u#.;......E...:.S.9:.m.+...K.".M...-B(.".....P.............tK........f.$.....UU.]k6kz.w6Z....B..9.LMD..j..\..e.t5e......^{..yh....`x.....gS..,........#L.24..4.,.,$....9:.c.p.(.."..."....%...........,.,3.d.u.9.l.u..,...U.X.\.w.U..R.R.i,&u.gYL.Y..S.[.9..#S~.?...H..+".".S.0..;9...s"g..3.O.}........Fl..$........24.,..3c....9:..p.P....B.....P...*%.>..t....D&u...l.w..,..f....`..W4..f.JK

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	26798
Entropy (8bit):	4.329178043120524
Encrypted:	false
SSDEEP:	768:ypszszJqcvO19mQXOP1xEWvpZqpzBcftJ:yyzszXymQXOPfZ1fT
MD5:	4F9AA794D351AB075B5A5F807694061E
SHA1:	AB88ED1DAD41E92970D60A3394C94041BBEE2BD1
SHA-256:	BA6A509DB0F516222159DFEA4333B02D892238D7055EF287F3EEEBC2311FE17A
SHA-512:	D8861794A51142C75A1A3198C592295172D363E5AD8303C16FFEE1E417E77C07105D8E2518F57B521B3E0C35AAC7D58091AC59C029395DAC6E6A00E3C0D53E77
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/sprites/icons-24.svg?v1
Preview:	<svg width="624" height="184" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.614 12.045h18.749m0 0l-6.511-5.737m6.511 5.737l-6.511 5.737M332 96.4v-5.2m0-2.5v-1.1m9 4.4c0-4.936-4.055-9-9-9-4.91 0-9 4.095-9 9 0 4.9 4.1 9 9 9 4.936 0 9-4.069 9-9z" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M369.398 128.259l-.307.515 1.03.615.307-.515-1.03-.615zm3.044 7.395a.6.6 0 00-1.2 0h1.2zm-1.2.874a.6.6 0 101.2 0h-1.2zm1.911-4.989l-.351-.487.351.487zm.334-1.823c0 .55-.269 1.036-.685 1.336l.702.974a2.844 2.844 0 001.183-2.31h-1.2zm-1.645-1.644c.908 0 1.645.736 1.645 1.644h1.2a2.844 2.844 0 00-2.845-2.844v1.2zm-.6 5.289v.4h1.2v-.4h-1.2zm-.814-4.487a1.645 1.645 0 011.414-.802v-1.2c-1.04 0-1.948.557-2.444 1.387l1.03.615zm.814 6.78v.874h1.2v-.874h-1.2zM372 123.6c4.613 0 8.4 3.795 8.4 8.4h1.2c0-5.267-4.323-9.6-9.6-9.6v1.2zm8.4 8.4c0 4.6-3.796 8.4-8.4 8.4v1.2c5.267 0 9.6-4.337 9.6-9.6h-1.2zm-8.4 8.4c-4.569 0-8.4-3.831-8.4-8.4h-1.2c0 5.232 4.368 9.

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23531), with no line terminators
Category:	downloaded
Size (bytes):	23531
Entropy (8bit):	5.194335119524617
Encrypted:	false
SSDEEP:	384:yD1loacJsORd6a20ct3b373nUPA9LO93jRX9/4yd/0X2EbV1CIklSqp2mk+TpNk:XRdlbD0XVbVwSqp2mkSbk
MD5:	A0A2958DB926B2069CF68EC0F9A7DA84
SHA1:	AC748CAE4E69386A861035DEEE040D0015EB6397
SHA-256:	56A199DA748B9FE261EE24B3170D3BAA2D62145AE24EFECF21316DA53C9AD2F4
SHA-512:	E718107E559ADDED7BE218E2C08F1D1A70FEE8595402609F7DCA992161B874E2B0D863BFE88BE83926A744A4EA8D24B769E1A6E13AC54E3131F72328E7377DDF
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/js/main.min.js
Preview:	/! @app Avast JS library (main.js). Hash: e3abfffb1cfbaa6ef51b /!function(o){var s={};function a(e){if(s[e])return s[e].exports;var t=s[e]={i:e,l:!1,exports:{}};return o[e].call(t.exports,t,t.exports,a),t.l=!0,t.exports}a.m=o,a.c=s,a.d=function(e,t,o){a.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:o})},a.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},a.t=function(t,e){if(1&e&&(t=a(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var o=Object.create(null);if(a.r(o),Object.defineProperty(o,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var s in t)a.d(o,s,function(e){return t[e]}.bind(null,s));return o},a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,"a",t),t},a.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},a.p="",a(a.s=0)}([function(e,t,o){e.expo

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	69
Entropy (8bit):	4.057426088150192
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8HopHW4OE9HsuXU9WyRHfHyY:YGKed2pHD5YEl5k9zyY
MD5:	B04CD3F8043EF04F417D4B0E4BCBBC03
SHA1:	88F259A4AE3045409B3657E7D7A791D321BA9DCE
SHA-256:	59E58524340CD7AD353BE010374B124C242FDDE10A0ED41047FE2FD4BB9E5A2E
SHA-512:	A285C493B939D2A165D80F87FC830F5D02AFCC7A8EA1C5CAF9CAA87ABD286F1C98598FFD83023044BDB23D344C60EEF6A6C4BFEDEDD42A4297A0AC09E22FA5B2
Malicious:	false
Reputation:	low
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3099)
Category:	downloaded
Size (bytes):	137315
Entropy (8bit):	5.144897352249232
Encrypted:	false
SSDEEP:	3072:E7I1IV0McPY8xhPHT3Tcq6cMTct6G/qya89tZZgtZZwtZZ2moMZNQWGLWmoaBfDf:zIV0MchPHT3Tcq6cMTct6G/qya89tZZ0
MD5:	F887CF89224F1D800A737457DEDB7471
SHA1:	BFFD5CDFE6219BD234752ECD1061E5CC463BFFB9
SHA-256:	AF60E972C383A9123EFCB9417CCCB8ACF50B4302C4DCA11B5FBF38DF82F3CB9C
SHA-512:	C8E0CA09B7563775DA8C149F65D2CD1DB9B6F21FD570850001512A389EE89605DD80073F64680DF20F9CD1F5098113C498BDD4E8742D411587462852E65DB00D
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/en-us/index
Preview:	<!DOCTYPE html>..<html lang="en-us" dir="ltr" class="no-js">..<head>...<meta charset="utf-8">....<script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js" ></script>.<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486" ></script>.<script type="text/javascript" src="https://static3.avast.com/10003548/web/j/vendor/one-trust.js"></script>...<script>. /! Declare GTM dataLayer /. window.dataLayer = window.dataLayer \|\| [];..window.sdl = window.sdl \|\| [];. . /! Dimensions to dataLayer /. (function(){. var dataObj = {. 'contentLocale': 'en-us',. 'pageName': 'en-us \| en-us/index-t1',. 'pageId': 'b714cb39bfb8fa237d21e29ba17e1b28'.. ...,'akamaiExperimentVariant': "index-t1". };. var contentGroup = 'Consumer';. i

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6510
Entropy (8bit):	4.872303848698837
Encrypted:	false
SSDEEP:	192:FIpp+DNDeOapp+DUZkp+D0X+W1pCZpY6vep+DoQLWdcPW:yWFezWUUW0u+0ZpzoWoCWdce
MD5:	50BCB5BABCD79578C8EBACDC424246C1
SHA1:	01F1808E548649B8CF73C22EE1E52E219DB0CD5C
SHA-256:	F69073C0F0C5143545BDC8861AD97105307947B53B1FD8CD2FCB73C5600FD161
SHA-512:	8C4406211491686B099271B63AB1CAA1D288DD2CFBA0D71DC9F5EB2D4CFF312EF35E85EECD7C94B59F9CB5EF6982F97F8F215143B40F9449342870E533919DE6
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8-3d45-4e4a-998f-7d05f89e4486","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil . All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"BannerPushesDown":false,"Default":false,"Global":false,"

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	6630
Entropy (8bit):	5.006398475488967
Encrypted:	false
SSDEEP:	192:R5RfgJQh1mbzK6Blc739RCPqQMQvNBXl+CxeAPS:RHY21izc81BcZ
MD5:	632367D2CAE2D0EA46F388F51EBA3B40
SHA1:	D1434F7160CAB1B999B1DFF910DEC884402F3BE0
SHA-256:	9B8614DDF9652358793B25BBBF0E3B664AE6FA7A08AAC6E04307D2BFCAA71702
SHA-512:	037AE8929B0D29E80EE5CAA3D7FC3D27AF79B10A6E2491E2EDDBB5316AF6B592B0A72D55E5C6F2A4CFB7A824F9DDBE5FACB2672FA600485ACA0B6A26662CCA13
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-secure-browser-pro-color.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M16.004 27.903c6.574 0 11.9-5.326 11.9-11.9 0-6.575-5.326-11.9-11.9-11.9-6.575 0-11.9 5.325-11.9 11.9 0 6.564 5.325 11.9 11.9 11.9z" fill="#fff"/><path d="M8.303 12.94c-.072 5.244 3.133 9.699 7.64 11.798 4.444-2.007 7.66-6.41 7.71-11.623 0-.471-.02-.942-.071-1.413a12.83 12.83 0 00-15.197-.01v.04c-.052.4-.082.8-.082 1.209zm.962-.573c2.397-1.68 4.67-2.068 5.838-2.14h.02c.4-.03.686-.03.789-.03h.092c.102 0 .389 0 .788.03h.01c1.168.082 3.431.471 5.838 2.14a12.134 12.134 0 01-.45 4.158 10.765 10.765 0 01-1.998 3.84c-1.075 1.342-2.509 2.438-4.24 3.288-1.72-.84-3.143-1.925-4.219-3.257a10.88 10.88 0 01-1.997-3.81 11.772 11.772 0 01-.47-4.219z" fill="url(#paint0_linear_6188_3051)"/><path d="M8.302 12.94c.01-.41.031-.819.072-1.218v-.041c0-.01 0-.03.01-.051.01-.103.02-.215.041-.318a12.49 12.49 0 01.799-2.98 13.02 13.02 0 013.205-4.639l-.04.02-.134.041a12.796 12.796 0 00-8.704 9.289A12.81 12.81 0 007.135 25.26c.256.

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31305
Entropy (8bit):	4.385799751453472
Encrypted:	false
SSDEEP:	384:ZZee7VAeCPUeCkOuBuctBrSXnNRm5I4j3jQgIzLq7M2oxGXXPLabnfT7mOuC2tKQ:zqzszGucrO9RoCp1xGXXPwf/aCQKQ
MD5:	DED03AA6F0840D4688249276F3574286
SHA1:	A340C02876210ADB246763F7F3D8D172BA6AED82
SHA-256:	8999989CD61F70B3D2D85CFE1BD182BAFE69C341CD9165CA9F8BB8AAFB7DCD4B
SHA-512:	2E7603A35E2F587BDB387E615A525A0304B9F44A526F0EEAE76F226C711B7A4D0802D27DE9338267522F637B075156FBD31F21F9A2CDA769C8B5836186554D59
Malicious:	false
Reputation:	low
Preview:	<svg width="624" height="264" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.614 12.045h18.749m0 0l-6.511-5.737m6.511 5.737l-6.511 5.737M332 96.4v-5.2m0-2.5v-1.1m9 4.4c0-4.936-4.055-9-9-9-4.91 0-9 4.095-9 9 0 4.9 4.1 9 9 9 4.936 0 9-4.069 9-9z" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M369.398 128.259l-.307.515 1.03.615.307-.515-1.03-.615zm3.044 7.395a.6.6 0 00-1.2 0h1.2zm-1.2.874a.6.6 0 101.2 0h-1.2zm1.911-4.989l-.351-.487.351.487zm.334-1.823c0 .55-.269 1.036-.685 1.336l.702.974a2.844 2.844 0 001.183-2.31h-1.2zm-1.645-1.644c.908 0 1.645.736 1.645 1.644h1.2a2.844 2.844 0 00-2.845-2.844v1.2zm-.6 5.289v.4h1.2v-.4h-1.2zm-.814-4.487a1.645 1.645 0 011.414-.802v-1.2c-1.04 0-1.948.557-2.444 1.387l1.03.615zm.814 6.78v.874h1.2v-.874h-1.2zM372 123.6c4.613 0 8.4 3.795 8.4 8.4h1.2c0-5.267-4.323-9.6-9.6-9.6v1.2zm8.4 8.4c0 4.6-3.796 8.4-8.4 8.4v1.2c5.267 0 9.6-4.337 9.6-9.6h-1.2zm-8.4 8.4c-4.569 0-8.4-3.831-8.4-8.4h-1.2c0 5.232 4.368 9.6 9

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1968)
Category:	downloaded
Size (bytes):	2013
Entropy (8bit):	5.180361711570539
Encrypted:	false
SSDEEP:	24:cBPVbhXRkj355vXRkISmh4ryACRLQgKItF7xLpItF7ZQMKi3vnUYjY43zRcSKVe9:mPNQm+7kgKYqZKCvnUYJzRF4lg8V5Sz
MD5:	A1885F85B5342067CA5148C5D70E8D07
SHA1:	B053248C8B377349DB8EDED17532DC286D8045C5
SHA-256:	42163EDC17D2941C9887CCC5F9A3793DE4E5E723DAFB391C8DE32605CA649393
SHA-512:	F7C364C96A39A870540B17F69E655A7A4F8F2A09640127275B37C1EFDB35D25CB20F8B056E3D91E3EFC5644DEE3B94F3E08175C4B4FFB5EF7D1F13501C636D24
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/singleDL-primary.js
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{/OptanonConsent=.?(consentId=(.?)(?=&))/.test(document.cookie)&&sdl.push({client:{cmpId:document.cookie.match(/OptanonConsent=.?(consentId=(.?)(?=&))/)[2]}}),/(?<=NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/.test(document.cookie)&&sdl.push({consentGroups:document.cookie.match(/(?<=NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/)[0].replace(/%3A/g,":").replace(/%/g,",").replace(/2C/g," ")}),sdl.push({session:{countryCode:sdlObj.session.countryCode,secChUa:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.brands:[]}(),platform:window.avastGlobals.detect.os.name,mobile:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.mobile:"-"}()},server:{provider:"CMS",platform:"WEB",env:window.location.host.startsWith("web-preview")?"dev":"prod",dataCenter:"-",sdlVersion:"2021-05-05/v1"}});var a=new URLSearchPa

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31453
Entropy (8bit):	4.371102091920534
Encrypted:	false
SSDEEP:	768:VACkgQcLStkn/ut190+ixFqw13aBJFTWBvMqHP:tkgQiG4ur90PxjVUqt5P
MD5:	CA31E9A22214D4435F9B4CF273D5E97F
SHA1:	18BFCA5C384D4519509A3E4794EB4A4D8A33FA4E
SHA-256:	8201E5EB56D7B84CDF89140158E030384263EE9AB70C7C6379F8F5179F6045CB
SHA-512:	31D8738B061D23E4B808A01C36FFD6EC0EFD964847FCFC194AA94A0B84248453894F6B2B1EC2800E53FDBB151FF49B1D444E0BE924BAD4786CD8860F731C7237
Malicious:	false
Reputation:	low
Preview:	<svg width="752" height="320" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.521 15.98h25m0 0l-8.683-7.65m8.682 7.65l-8.681 7.65m56.64-7.61h-25m0 0l8.682 7.65m-8.681-7.65l8.681-7.65M160.021 5v22m0 0l7.649-8.682M160.021 27l-7.65-8.682M112.021 27V5m0 0l7.649 8.682M112.021 5l-7.65 8.682" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M57.5 121.6c-.7 0-1.234-.217-1.6-.65-.4-.4-.6-.917-.6-1.55 0-1.2.783-2.533 2.35-4 1.666-1.567 3.766-2.35 6.3-2.35 2.533 0 4.616.783 6.25 2.35 1.6 1.467 2.4 2.8 2.4 4 0 .6-.183 1.083-.55 1.45-.334.467-.8.717-1.4.75H57.5zm6.45-11.5c1.2 0 2.233-.433 3.1-1.3.833-.833 1.25-1.833 1.25-3 0-1.2-.417-2.217-1.25-3.05-.867-.9-1.9-1.35-3.1-1.35-1.2 0-2.234.45-3.1 1.35-.834.833-1.25 1.85-1.25 3.05 0 1.167.416 2.167 1.25 3 .866.867 1.9 1.3 3.1 1.3z" stroke="#000" stroke-width="1.2"/><path d="M25.05 112.1v7.55a1.8 1.8 0 01-1.8 1.8h-4.9v-7.55h-4.6v7.55h-4.9a1.8 1.8 0 01-1.8-1.8v-7.55m-1.95-1.5l9.087-9.087a2.6 2.6 0 013.6

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64347)
Category:	downloaded
Size (bytes):	219515
Entropy (8bit):	5.455302043125117
Encrypted:	false
SSDEEP:	3072:9K4F6tZfFFncVuh90bteuvQ+AMPpgArl0xYu5G5nYt9:9KQGZtOK90bvQQGArHu5G5nYz
MD5:	C9893A1B94F50E820983FC282F989A10
SHA1:	8E9832465171164D449B1D78803D98CC2AAFE732
SHA-256:	0E04153B5F73BFA7866948F2A9870593D69BFDE14E77A1A06AF5F567096E5A09
SHA-512:	ECF5439801ACB395BD9E162C387EC286D84E8EED59687DD9B2E90C6443420EFACDBDE56A3ECB0AE4B818F3C11180A37992F7C738AB87021BCF2DE77C5458A65B
Malicious:	false
Reputation:	low
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12519)
Category:	downloaded
Size (bytes):	367898
Entropy (8bit):	5.583970204013057
Encrypted:	false
SSDEEP:	6144:jFHWaTggLeZGMNL7zmgd07s7jiX/ZL+R8UnWVCR:jF1TgdZ1NL7z50DX/ZL+Rp
MD5:	F84EEC5E0086474E06FAFA81E736EABC
SHA1:	984CC969AE1DB8BF5C6B2C0AA72219806A4DA791
SHA-256:	45E6C80A7B8D5F161569BD08680B27D210E7CB69C4BC919E6516D209BC08F1AE
SHA-512:	7520DD7A9EA0CF9E63242F52D3D3C4C890E008DEBB575D29742E8ADC6D074594D506F7A8BAF59139AC7DB9B27A1421EA6B7E62D0EFF61D20118A9AB0B822FAB4
Malicious:	false
Reputation:	low
URL:	https://resources.digital-cloud.medallia.eu/wdceu/82320/onsite/generic1691916888878.js
Preview:	.(function(window){window.MDIGITAL=window.MDIGITAL\|\|{};window.MDIGITAL.version='2.52.0';})(window);window.KAMPYLE_CONSTANT={PLACEHOLDERS:{URL_PREFIX:'https://resources.digital-cloud.medallia.eu/',USERSNAP_CDN_URL:'//screencaptue-cdn.kampyle.com/',USERSNAP_HOST_PREFIX:'//screencapture.kampyle.com/',COOLADATA_SRC_PREFIX:'https://resources.digital-cloud.medallia.eu/',COOLDATA_API_HOST:'udc-neb.kampyle.com/',USERSNAP_V4_HOST_PREFIX:'//scp.kampyle.com',USERSNAP_ONPREM_HOST_PREFIX:'https://md-scp.kampyle.com/',USER_AGENT_CLIENT_HINTS_LIST:'["brands", "mobile", "platform", "architecture", "model", "bitness", "platformVersion", "fullVersionList", "wow64", "uaFullVersion"]'},SRC:{OPEN_SANS:'resources/form/FormBuilder/vendor/fonts-googleapis/css/open-sans-v14.css',COOLADATA:'resources/onsite/js/cool-2.1.15.min.js',OOPS:'resources/onsite/images/oops.svg'},FORM_HEIGHT:'450',FORM_WIDTH:'450',COOKIE_EXPIRATION:365,DEVICES:{DESKTOP:'desktop',MOBILE:'mobile',TABLET:'tablet',},FEATURE_VERSIONS:{MOBILE_

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3537)
Category:	downloaded
Size (bytes):	52603
Entropy (8bit):	5.316331138717284
Encrypted:	false
SSDEEP:	1536:yYrF+dXpn0e+99D7FPUzHhbtjFnmFRbdwWRI32nB7PXAlnuhPisfq3ECoe5EzpGS:yYrF+d5n0e+99DJPUzHhbtjFnmFRbdwM
MD5:	F0A9F2F65F95B61810777606051EE17D
SHA1:	872BF131CB4BEFD0242339F072F2F9B9FBF8019F
SHA-256:	9CDF2602AC04F7E2BED582D4299C73D464FC4AB069E3AD5A20EE2B6635A015B8
SHA-512:	6823914507BA31E0F61B95CC53F09543C3C14E5530E9EF1B00338FBBD7C25D2E398F5F628DF4ED25D6FF88E0F8BEE506EFE62BA704778BA7CFF09AEC9579D9F0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/eureka/clank/117/cast_sender.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var f,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},h="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&h(c,a,{configurable:!0,writable:!0,value:b})}};.da("Symbol",function(a){if(a)return a;var b=function(g,k){this.g=g;h(this,"description",{configurable:!0,writable:!0,value:k})};b.prototype.toStri

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1501
Entropy (8bit):	4.236121657737995
Encrypted:	false
SSDEEP:	24:tCbaAuc7Fsxis7cWK9BDQYywdOEnbLrbgcW2tn9SgpdBxliEID32rTcVuVX3QdnJ:EFYis7HcFQYywdOELbgZKn9SgpdBxliJ
MD5:	202BD8895C79A450E6C53AB68620783A
SHA1:	5A5C371C82F1DF4B6C367B8ACCF8AF4EF3FC4B0E
SHA-256:	5718C42DAA9F2388854D67760E2BABC8E6CE20800FD199AB0E00B6BFEBBB3370
SHA-512:	EDBFF8024CBA39FF9FF6D8B9DF3DE8A7DEE5034B3355726C05BA141D78ABF3409C114B9EF76887394DE1565C737AA83848F31EFC6C5F9E96E48BB6D89390A12C
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/feature-icons/48x48/message/discount-1-mono.svg
Preview:	<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M15.973 34.247l-2.98 7.008a.6.6 0 00.768.794l3.213-1.24a1 1 0 011.284.55l1.374 3.322a.6.6 0 001.106.006l2.597-6.083a.723.723 0 01.665-.44v0c.29 0 .552.173.665.44l2.597 6.083a.6.6 0 001.106-.006l1.374-3.321a1 1 0 011.284-.55l3.195 1.232a.6.6 0 00.766-.8l-3.056-6.995M15.023 19.435h2.817m2.927 4.778l9.364-9.364m-22.184 4.3c0-1.203 1.61-2.626 2.293-3.536.867-1.156 1.186-2.258 1.529-3.63.31-1.242-.114-3.214.956-4.3 1.07-1.088 2.756-.778 3.917-.956 1.651-.254 2.481-.667 3.823-1.625C21.362 4.462 22.77 3 24 3s2.639 1.461 3.536 2.102c1.341.958 2.17 1.37 3.822 1.625 1.16.178 2.848-.132 3.918.955 1.07 1.087.645 3.06.955 4.3.343 1.373.662 2.475 1.53 3.631.681.91 2.292 2.333 2.292 3.536 0 1.203-1.61 2.626-2.293 3.535-.867 1.156-1.186 2.259-1.529 3.632-.31 1.24.115 3.213-.955 4.3-1.07 1.086-2.757.776-3.918.955-1.651.254-2.481.666-3.822 1.625-.897.64-2.306 2.102-3.536 2.102s-2.638-1.462-3.535-2.102c-1.342-.959-2.172-1

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 112 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.924439585828252
Encrypted:	false
SSDEEP:	96:MlnTKjOUNGK09OcP4Uv5WajJyJGCoQ1a7z:MlneKw0dgUv1oGC4/
MD5:	8F741A2ED88CE67984A1251B15C97AFF
SHA1:	4D0F48CA7EF1C59927114CF45BB2894F80069D0B
SHA-256:	598E7BCC9DCF174549997CE87C8FB4C29962C6D866DA90F9E93447200F07EB3B
SHA-512:	7A3DDF615DCE4D4F2032986752534CD0BF32BB9255A1CCED2A1FC52E8321DE5FC8B7183E902C2263E8C99118A3261AA184C9CD1DB05F221E4206311F550E0C97
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...p...&......7....."IDATx..[wtTu.fw....gw..]M.$...zB.5.P.J............4...R.....".."H....L..\|{~.%.i..(p6s..c.{....n..}..4...W....j..""...(}.];.=&.X.F.(..).......'I[F..L.{."9...8.b..:..(.X..$e......z..i".ki..)2.t.L".[-..~O.X.ttyj:..GC....QN.V@...c'...9..x......U....& .d..J........ib..4..4q..j....X?......e5.:an.......,........5..0..$.k....0..\|.....u2q.4..Y.$e...X.+]..`..\|9.5.7@).........A..D.....2I....?...>...,.%k^.....u.....g.^...1..X.zn.y...k4..\|.\|8>.$bM.7.@7h(\|fs.>...b.(VD.....0..z..#V.vr..Ii.'.k..p....~;Y&.'....@....R....... ...2b.u..(S2.:.>b.~ta..&.`\...m..d;.m......C.....O.A.U..j....m0....)J7o...J4=.V.m...o.C..3p.;.......?.....t...d.......{2L)......{X...M...:.p\|..l..\|...........1...:.:..t......D7i;xP._b..~.;..S..tiz.....>....ZM@W..W.7...0...,....hD...8.q.....-...*=%%...r.<oa..2....$..+..1..e.\N....t...]i...}........\V......P.o mW5k.............2..].r...G..u........_^......i....h.....rJZcz.....v.I........

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	49150
Entropy (8bit):	5.523809476276692
Encrypted:	false
SSDEEP:	384:sXusESRaiLBhTbSsEFL/Rvqu41wFQrpagwXt7bRApQoe/4TfCS3HH2Orv5ZKibT0:s+tbcBZj1paRZlzoj7HHfP4F
MD5:	CD46DA23147D575E2E1C368FF7432446
SHA1:	763FB3A733E8A5A721B2CCB6867B4E7E224D8D5F
SHA-256:	AE45F042DB0F3B2D2FFE2BC7F5193A9713B4095048EFE83EB847FD8E0FF70920
SHA-512:	9C7B442B7E4C589DA28F9DEEAE61AAC3EC70AC853696032FB6DBF9B3AA9D9DF11176EEF67AB9B6516D3C9BC870C301F806103CEF29F94C6BBF74DEF6099AE27E
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/v2/otPcPanel.json
Preview:	. {. "name": "otPcPanel",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMgSGVhZGVyIC0tPjxkaXYgY2xhc3M9Im90LXBjLWhlYWRlciI+PGRpdiBjbGFzcz0ib3QtcGMtbG9nbyIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDb21wYW55IExvZ28iPjwvZGl2PjxidXR0b24gaWQ9ImNsb3NlLXBjLWJ0bi1oYW5kbGVyIiBjbGFzcz0ib3QtY2xvc2UtaWNvbiIgYXJpYS1sYWJlbD0iQ2xvc2UiPjwvYnV0dG9uPjwvZGl2PjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGktdGl0bGUiPkxlZ2l0LiB

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	8
Entropy (8bit):	2.5
Encrypted:	false
SSDEEP:	3:x:x
MD5:	402E7A087747CB56C718BDE84651F96A
SHA1:	7CE01F6381463362CF6AEF2F843A59261E8F5587
SHA-256:	662EFAF46C617DDBCB8FF4A2A8F64CFFD3D93630F1003F8E66511F369B87730F
SHA-512:	5080D776D0B123F20E97D44472EF2343BC022105AA67FC802B71668BAEB74A81530355589D50B1142165D17EF995AEAC196B6C15136D518A1EC0ABFA13C91D10
Malicious:	false
Reputation:	low
URL:	https://191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net/eum/results.txt
Preview:	Success!

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20864, version 1.66
Category:	downloaded
Size (bytes):	20864
Entropy (8bit):	7.98937869305251
Encrypted:	false
SSDEEP:	384:W2Nx58UdEEG9PIRtTUesdFgeknrSql9G4p56JcCUryFy4VbN0x7:WjUa1deekntR5lCF7VbyZ
MD5:	E1B16CB4A3FED5DBFB5B2088F768B391
SHA1:	F78AE5903773484770BF343BBE3498DE5F9931BD
SHA-256:	9DBF00504E46F5D23EC5B6CF7F9E0BC4B42A0D19219D6FC6369EDC942C4E26EC
SHA-512:	51FB73E98E758CACDF13A1F4AB64FF4D8FCD042A5C2302AC57644667F2014825202544BECDD1DA74FB81484EAB94BCFC298BEDB7E265AB41A3FD109958501DC7
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/o/f/700/MierB03-SubsetEng-Bold.woff2
Preview:	wOF2......Q..........Q....B......................\..F..(.`..4..v.............6.$........ ..D. ..z...7...E.........8..6l.l........L.t...........yU+......\..J..f6>G.]:..e..u....Fc.T...a.....i..A...owi......E...9..D=..o.g<...i....")..R..po....0.a..d.{...4,.IDU].;[../b.3L%j.....JE8._...1.Y.v.r.C&.<u.......<....5..).(...K8.....".............o..(.nz.....=...s.....Y..hl..lV..S.A.R+.O..<..?.....5...O...k.]F."C...^....s......q..#.'.a.u...a...S:5k..{W..7...A..."9=+n.P.R@NX.J...}.a.b.}..Gs.....Y.Sv...`...?@.l...0p6.6%-Q.qD.}"..&....`...:.s.....{.........9......%..d.>I..5...M...m..5.....rW.,w..C..~...8IJ@..j.FT.7.?....H...N..(p%.Z>.._....mzR.....t:3.0.f.r..Ew..y@wf.TJ.<.....e......].n...........I.e..:.b...^._.k.j..7.*..[..CM.[XC...r...R.....u..o....i.RC.....!(iDq.... @i!7.k.')3.4N..v.Io..E.....fg........./H..<9...`.v.%. ...u....L.j..N...@H....#..?FE...I.Wh..h...4#y.19..t.1....x.\.z.Y'.n.O.%........D...W.N..o...].>.._...QQ#..qD.1...~...$...a[. .g?.".....D.....

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.409319333898914
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDjySBDfqR/r6Tuw4Oi/yoSPa/R+:OfvtzlfU/OTPi/yY0
MD5:	02C597F73361768A78F7B1B15B078CE1
SHA1:	99AE4542DE5CCA8B87238EB7D85B83886D389513
SHA-256:	CCC80A96969AB96114B8BA7998F891671FF9A683CF0180104938B9A7A904BD20
SHA-512:	D8B5771929711A8F1F8ACA2394316DDD37E9F501C4AF1D3EE8A75728406FD27C3FD7BD09F0C919231285EB6B7BB44ADA51B79E3D0CC429A63EF5ED716D3FB353
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#FF7800"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.733 12.733 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.73 12.73 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FFF"/></svg>

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	39677
Entropy (8bit):	4.943865445231978
Encrypted:	false
SSDEEP:	384:IKET7QDchsn26tF/lXGSONRgfZ7s3EAkcrPJI/Nrazqj33a5bo6Zd+Oo3iJMqkRL:M0Ihs2DMFnCdJvSojK5InKV
MD5:	2AD9B8CF20FCFE7F44364C847D6E3E9A
SHA1:	C3FAACF9CBAF9E78ED35AE8A3D4F76860914E054
SHA-256:	A09B570D4112E3BAB40E4D28A03441C5102591BA3B5BF0FF7206D7F86F998A33
SHA-512:	5D114E748534D6C6F4145FEEDC6FBD838B8EF738FBE4D2095444D376CC2C250E5214C47927E83425E2BABA1CE5B97082112FDD24F193CF733EE2DC70C0B3243C
Malicious:	false
Reputation:	low
Preview:	<svg width="24" height="1224" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="a" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="384" width="24" height="24"><circle cx="12" cy="396" r="12" fill="#fff"/></mask><g mask="url(#a)"><circle cx="12" cy="396" r="11.5" fill="#F8F9FA" stroke="#E5E8EA"/><path d="M11.478 396H24a12.01 12.01 0 00-.413-3.13H11.478V396zm0-6.261h10.76a12.052 12.052 0 00-2.768-3.13h-7.992v3.13zM12 408c2.824 0 5.42-.976 7.47-2.609H4.53A11.946 11.946 0 0012 408zm-10.239-5.739H22.24a11.915 11.915 0 001.348-3.131H.413a11.949 11.949 0 001.348 3.131z" fill="#D80027"/><path fill-rule="evenodd" clip-rule="evenodd" d="M6.652 385.874H5.56A11.946 11.946 0 0112 384v12H0c0-.507.032-1.006.093-1.496l.609-.443 1.017.739-.388-1.196 1.017-.739H1.09l-.341-1.048c.118-.317.249-.628.392-.932l.577.419-.309-.951c.093-.174.19-.345.29-.513l.648-.47h-.35a12.063 12.063 0 012.327-2.594l-.336 1.033 1.017-.739 1.018.739-.389-1.196 1.017-.739zm-1.646 8.187l1.018.739-.389-1.196 1.0

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2414
Entropy (8bit):	4.212450020453697
Encrypted:	false
SSDEEP:	48:ccYG3XJAjCXx8U2xVKjDHN8V97gPINlW34noKyh9NBrEp8uUClJK0h97bS9w:VF7zHN8VaPqwA/pNC9w
MD5:	27DF154AA257ABD1CB7BED2A04A4C6BD
SHA1:	63460F677D8499B64DC1206A4B77D5D7018BE6FE
SHA-256:	8919E04CC8C411083D4F27EE23CE39AA225FB1B9B24BC5F754765D66107AFA8A
SHA-512:	864DA5F6602B9F7A1C451570ED21D404E1F73978D081D25B7797F4D9C92ECE5697B0E25AB8CF2329C7E9C3ABB4FDB17521E536EE77C17F468EB28ED4C9B51E15
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-driver-updater_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.28 28.388a.6.6 0 001.2 0h-1.2zm-11.744 0a.6.6 0 001.2 0h-1.2zM3.6 9.544a.6.6 0 000 1.2v-1.2zm0 11.727a.6.6 0 100 1.2v-1.2zm-.002-5.864a.6.6 0 00.004 1.2l-.004-1.2zm7.138-11.795a.6.6 0 00-1.2 0h1.2zM28.4 10.744a.6.6 0 000-1.2v1.2zm0 11.727a.6.6 0 000-1.2v1.2zm-5.92-18.86a.6.6 0 10-1.2 0h1.2zM9.362 16.375l.285-.528-.933-.504.048 1.06.6-.028zm3.303 2.466a.6.6 0 10.57-1.055l-.57 1.055zm9.974-3.2l-.287.528.934.509-.048-1.063-.6.027zm-3.302-2.481a.6.6 0 00-.574 1.054l.574-1.054zM16.6 3.612a.6.6 0 10-1.2 0h1.2zm11.8 12.987a.6.6 0 000-1.2v1.2zm-13 11.789a.6.6 0 001.2 0h-1.2zM9.516 12.724a.6.6 0 101.068.548l-1.068-.548zm12.973 6.55a.6.6 0 00-1.07-.545l1.07.545zM5.836 15.399l-2.238.008.004 1.2 2.239-.008-.005-1.2zm3.24 1.503l3.589 1.938.57-1.055-3.588-1.94-.57 1.057zm13.85-1.788l-3.59-1.955-.573 1.054 3.588 1.955.575-1.054zM16 22.046c-3.168 0-5.895-2.54-6.04-5.7l-1.198.055c.174 3.82 3.447 6.845 7.238 6.845v-1

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/icons/sprites/icons-16.svg?v4
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	220
Entropy (8bit):	5.120838366800474
Encrypted:	false
SSDEEP:	6:tnrhRcQ9tumc4sl7vrERIxkAl9jS04/qmqZllv:trhy4uJlBlBSdShllv
MD5:	E05C250261453D8437F2C957A7423B1B
SHA1:	F9D5873206EB92AA4840D3A888FBB0461F91CD89
SHA-256:	7B71172BCB0341F29607766E9AE2E2ECF698D9ED72EBC393C933318741A14C2D
SHA-512:	D68BCEE9E3F633F04548281D2F2E4BF741030D799FA1734119B7EF9A8BCD34E15588B37CBE8B39CF777AE1CC79922B7DD73B0AE8137BC385AF505ACD28D28E07
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/infobox_corner.svg
Preview:	<svg width="52" height="51" viewBox="0 0 52 51" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M2 49.501V1.50098H50" stroke="#FF7800" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	4.688805772371818
Encrypted:	false
SSDEEP:	48:8IcJ7VLLRHBNwIMweFBrKAhm4QQCAfROUuMN:m7RdHfwIMh5KgmQzSMN
MD5:	C97F97E8C32797DD5FE80FDC4006F5F2
SHA1:	6FDB61BBF5A528833B60A4BFB826E2C20C91AE97
SHA-256:	740A98390EB5122E695895C0BA780027C8D0A890B468140F4F5BF3A63B842177
SHA-512:	16B70279E44E8A0E86D492F0C206EC740F6B13E421B85BDB10149F12280348D7052323466755BBABB8DF8D0A5FA0850A8E2076EC088294B8605E875769364DCF
Malicious:	false
Reputation:	low
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M81.921 30.517c5.708-5.708 12.803-7.255 18.063-7.485 4.584-.2 8.184 3.4 7.984 7.984-.23 5.26-1.777 12.355-7.485 18.063-5.845 5.845-12.418 9.509-17.071 11.602-3.701 1.664-7.903.548-10.772-2.321-2.87-2.87-3.985-7.07-2.32-10.772 2.092-4.653 5.756-11.226 11.602-17.07z" fill="#D4E7FF"/><path d="M87.66 39.342a6.009 6.009 0 108.497-8.498 6.009 6.009 0 00-8.498 8.498z" fill="#fff"/><path d="M138.048 57.606c.673 3.194 4.63 3.64 6.598 3.227 5.206-1.096 3.788-9-1.5-9-2.052 0-5.77 2.58-5.098 5.773z" fill="#B7EB6E"/><path d="M130.45 80.772c1.022 2.804 3.522 2.596 6.327 1.574 2.804-1.022 2.944-2.543 1.921-5.348-1.022-2.804-2.217-4.178-5.021-3.156a5.405 5.405 0 00-3.227 6.93z" fill="#FFBF00"/><path d="M18.378 28.181c-2.824-.967-4.233 1.108-5.2 3.932-.967 2.824.128 3.889 2.952 4.856 2.824.967 4.644.9 5.61-1.924a5.405 5.405 0 00-3.362-6.864z" fill="#7BB5FB"/><path d="M146.588 58.5a4 4 0 100-8 4 4 0 000 8zM21 65v5.333m0

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5667
Entropy (8bit):	5.097553602115559
Encrypted:	false
SSDEEP:	96:eKa3EeRvdIflrvaOdJmDY7Yy0luY7Yx0y21P8qQ91ZBwVLRCM:eKterYrvaO+0cy0zc+kr0dj
MD5:	7675713BCAC0BC7CF2379F1A7EB1A17C
SHA1:	EEAB0E556692A206962D3AF265FEBBC2F6FACD21
SHA-256:	F043FF16359C98E32CE144800BD2502C5BD111479BEEC7BD282DCCDD38B013F4
SHA-512:	456EEAC916739ED4694FB4F9FAD9BB974F10D298DAD663DC5D3F57487902062995AF229EF958C9FF25D6E81BF7DE7828A10E58261C7E4AF02CEBE6C2B30CEAFA
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.836-3.145-1.93-4.224-3.255a10.892 10.892 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.065 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145.095 1.4-.06 2.807-.454 4.155a10.9 10.9 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.157a1.86 1.86 0 00-1.72 1.674v-.003a1.857 1.857 0 001.127 1.89v2.104c0 .142.114.256.255.256h.949a.256.256 0 00.256-.256v-2.102a1.86 1.86 0 00-.867-3.563z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.407-.042 5.214-3.265 9.618-7.707 11.626zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.467 4.

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4463)
Category:	downloaded
Size (bytes):	4507
Entropy (8bit):	5.3108949664389815
Encrypted:	false
SSDEEP:	96:o+s+bsFloPntic+0cPVf5on/mlZVvHz2EugEka:xs+4FUUTTJa
MD5:	65F6BA39F31CE728D5C279C304790EF1
SHA1:	681A2E099CBDA036E38FB2F45A729C7EEF3A1A3F
SHA-256:	F2C5DF9953D607FEA3E8ABC06C7E6D24682B5C35D5FD0DF704658AEFE9B5D585
SHA-512:	D5B84A2C0CBE50C0B3E7EB3BC1AEA2A4468CE609528FA3BB778B9CCD14C6E50E92C4BF095CB0E845523F5E884CB4CD736CF7C66FAB94CA4B327D814AE15E8E40
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/userAgentDetect.js
Preview:	window.avastGlobals=window.avastGlobals\|\|{},function(){"use strict";function a(){c.classList.remove("js-pc"),c.classList.remove("js-android"),c.classList.remove("js-ios"),c.classList.remove("js-mac")}function b(){d=window.location.hash.substring(1),h.includes(d)&&(a(),c.classList.add("js-"+d))}var c=document.documentElement,d=window.location.hash.substring(1),e=navigator.userAgent.toLowerCase(),f=navigator.language.toLowerCase(),g="pc",h=["android","ios","mac","pc"],i="Chrome",j="",k="",l="";if(navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0&&navigator.userAgentData.platform!==undefined){k=navigator.userAgentData.platform.toLowerCase(),/windows/.test(k)?k="Windows":/linux/.test(k)?k="Linux":/android/.test(k)?(g="android",k="Android"):/ios/.test(k)?(g="ios",k="IOS"):/macos/.test(k)&&(g="mac",k="Mac");var m=navigator.userAgentData.brands;for(var n in m){var o=m[n];/Chrome/.test(o.brand)?(i="Chrome",j=o.version):/Opera/.test(o.brand)?(i="Opera",j=o.version):/E

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	814
Entropy (8bit):	4.262051022846105
Encrypted:	false
SSDEEP:	24:t41PiSeuqeQurCKV/SeuPpwQudk1IUeoUAt3Cc9YP:CKSfltSfPpd+tAt37i
MD5:	E89108D4006B6921D46EE4FE285E9A30
SHA1:	25CC22FDBFA2776D3231D7AD4159F44BDD6AFB45
SHA-256:	3EA97497C219F5C1E06DE12EF9270DFA57C9E6D52F3486272E3F16CEE0FFE14B
SHA-512:	F2F5B051F2ECAE30764F1290F2BE1B7353B6CEAF9507A4C949CD15259A94FCDEB1F86F1ADAD264444A39DF7FF5E97A5DD3D2228266426490841464C8229BC0BF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/seo/favicon.svg?v=1
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M181.2 158.3c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6 2.9 4.1 6.1 7.9 9.6 11.6 18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4 1.4-1.7 2.7-3.5 4-5.3z" fill="#fff"/><path d="M85.8 24.9c12.8-8.8 30.4-4 37.1 10l58.4 123.4c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6l2.3-.5 38.1-8.4c1.1-.2 1.6 1.2.7 1.8l-31.5 18.7c18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4L81.7 63.1C71.1 51.9 73 33.7 85.8 24.9zm17.9 113.4l-61.4 5.3c-6.7.6-12.2-4.9-11.8-11.6.5-6.7 6.8-11.3 13.3-9.8l60 14.1c1.1.4 1 1.9-.1 2zm-28.4-54l74.5 60.3c.9.7.1 2-.9 1.7l-89.6-34c-9.4-3.6-13.4-14.7-8.4-23.4 4.9-8.8 16.5-10.9 24.4-4.6z" fill="#ff7800"/></svg>

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64511)
Category:	downloaded
Size (bytes):	74120
Entropy (8bit):	5.520421884516039
Encrypted:	false
SSDEEP:	1536:e6U9QHv0ExMTU0nQ7Ty9butW5qyM57dVkjC1HzksNaRYE:msvyRYE
MD5:	897FBC0DCE23DE62B64428F0A899E64E
SHA1:	C37354409EA9147176D91D550B14D51EF539FB46
SHA-256:	3DE319AFC4CDE15B775270AC3836C5EB8AA8FFE3DE96340F52DF0D81EEE9E49A
SHA-512:	35A125B531F0153E5CA6580C0E959E16B0A2078126D46E4006B133FED13A192E9EB4098284D6A373B57AF06F60556CD7F57A7AABD7CE1A82B73E19B20A84457F
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js
Preview:	!function(){function n(d){for(var f,a,g,b,c=[],e=0;e<x.length;e++){var h=x[e];if(h.Tag===d){c=h.CategoryId;break}var l=(f=h.Tag,b=g=a=void 0,a=-1!==(b=f).indexOf("http:")?b.replace("http:",""):b.replace("https:",""),-1!==(g=a.indexOf("?"))?a.replace(a.substring(g),""):a);if(d&&(-1!==d.indexOf(l)\|\|-1!==h.Tag.indexOf(d))){c=h.CategoryId;break}}if(!c.length&&z){var r=function(k){var v=document.createElement("a");v.href=k;k=v.hostname.split(".");return-1!==k.indexOf("www")\|\|2<k.length?k.slice(1).join("."):.v.hostname}(d);A.some(function(k){return k===r})&&(c=["C0004"])}return c}function m(d){return d&&window.OptanonActiveGroups&&d.every(function(f){return-1!==window.OptanonActiveGroups.indexOf(f)})}function p(d){return-1!==(d.getAttribute("class")\|\|"").indexOf("optanon-category")}function q(d){return d.hasAttribute("data-ot-ignore")}function t(d,f){d=d.join("-");var a=f.getAttribute("class")\|\|"";-1===a.indexOf("optanon-category-"+d)&&(d=w(d,a),f.setAttribute("class",d))}function w(d,f){ret

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	272
Entropy (8bit):	5.176412743225632
Encrypted:	false
SSDEEP:	6:tnr3rpqULyKumc4sl7vrERIykdgZmiAELbHsR69k4YmqZllv:tr3rpq6juJlJeZoELbHs4q4Yhllv
MD5:	72B10EA8B9BE2E07F04BFE67CEA21E99
SHA1:	27330D448B1A76081776CFCA69F7959FF7069BDB
SHA-256:	FED5F96D993DCF84D9FA314DC9956A5044FF59842E8B2B65409C795804F3F5A0
SHA-512:	C1FD7FB839F076A4CBC30BF05A606483E208BD899B6742B441190D4C45489C3E76AEF1FD9F1F4F94A61470F6AE43E0B4B8F126C0B4F781827F6DD8E1426F3270
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/arrow.svg
Preview:	<svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31812)
Category:	downloaded
Size (bytes):	31856
Entropy (8bit):	5.516338864835805
Encrypted:	false
SSDEEP:	768:81+WY+hFa+v5+wTBtcd5acyuSItODQHAWx0D5aqMd:81ffhhv5HBtcucyWtOyqs
MD5:	6C80EFF210D5FA8B5189F192A6BD3ABB
SHA1:	85A61747CA3F82053D9F33B942FFB631960A9BE8
SHA-256:	C268D494A500AB53D4235FDCD04C7AEB0F0E84ECDC61D343173565F73EE13318
SHA-512:	4EE464AFF96D0F980C5FCB9C30E82ED251DFF8EE92D3DF12C19A9E5A4AE9E7A02FF7E6B777B85E207C82F6B36CCABFF784561D5EB2517C7168A020E464DF0EA9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/vendor/tiny-slider.min.js
Preview:	var tns=function(){function a(){for(var a,b,c,d=arguments[0]\|\|{},e=1,f=arguments.length;e<f;e++)if(null!==(a=arguments[e]))for(b in a)d!==(c=a[b])&&void 0!==c&&(d[b]=c);return d}function b(a){return 0<=["true","false"].indexOf(a)?JSON.parse(a):a}function c(a,b,c,d){if(d)try{a.setItem(b,c)}catch(a){}return c}function d(){var a=document,b=a.body;return b\|\|((b=a.createElement("body")).fake=!0),b}function e(a){var b="";return a.fake&&(b=B.style.overflow,a.style.background="",a.style.overflow=B.style.overflow="hidden",B.appendChild(a)),b}function f(a,b){a.fake&&(a.remove(),B.style.overflow=b,B.offsetHeight)}function g(a,b,c,d){"insertRule"in a?a.insertRule(b+"{"+c+"}",d):a.addRule(b,c,d)}function h(a){return("insertRule"in a?a.cssRules:a.rules).length}function i(a,b,c){for(var d=0,e=a.length;d<e;d++)b.call(c,a[d],d)}function j(a,b){return a.hasAttribute(b)}function k(a,b){return a.getAttribute(b)}function l(a){return void 0!==a.item}function m(a,b){if(a=l(a)\|\|a instanceof Array?a:[a],"[obje

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5199
Entropy (8bit):	4.168854198111166
Encrypted:	false
SSDEEP:	96:DrBL+x5tA6F/PVmBlngTKwsZkujpqdcf1zepSFSJCVC8BQ80gkj8DHGWOK:J+byul+uTJ9szDFiC9BQ8s8iWOK
MD5:	98CEFB5FC432A6FB66254CE8D42DFD78
SHA1:	90D59BA066875499470332D1D713FDB9D8A5631F
SHA-256:	E4E7C1093DE3ED2783883A06CA497F13B007186767F92314E86B7BD9349008BD
SHA-512:	CFE7035592C4BABD683B22862EC63036C349891BAB020FA129C7054C6F4B513086F33BC8B6F503CE58430C1F35DCFC50ABF4B4E35D39BC125EA92591D32F30A4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/store-badge/google-play/google-play.svg
Preview:	<svg width="244" height="72" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M234.963 72H9.037C4.067 72 0 67.95 0 63V9c0-4.95 4.067-9 9.037-9h225.926C239.933 0 244 4.05 244 9v54c0 4.95-4.067 9-9.037 9z" fill="#100F0D"/><path d="M234.963 0H9.037C4.067 0 0 4.05 0 9v54c0 4.95 4.067 9 9.037 9h225.926c4.97 0 9.037-4.05 9.037-9V9c0-4.95-4.067-9-9.037-9zm0 1.44c4.186 0 7.591 3.391 7.591 7.56v54c0 4.169-3.405 7.56-7.591 7.56H9.037c-4.186 0-7.59-3.391-7.59-7.56V9c0-4.169 3.404-7.56 7.59-7.56h225.926z" fill="#A2A2A1"/><path d="M193.278 54h3.372V31.497h-3.372V54zm30.378-14.397l-3.866 9.756h-.116l-4.013-9.756h-3.632l6.018 13.636-3.432 7.585h3.517l9.274-21.22h-3.75zm-19.128 11.841c-1.103 0-2.644-.55-2.644-1.911 0-1.737 1.919-2.403 3.575-2.403 1.482 0 2.181.318 3.082.753-.262 2.084-2.064 3.56-4.013 3.56v.001zm.408-12.333c-2.441 0-4.97 1.072-6.017 3.446l2.994 1.244c.639-1.244 1.831-1.65 3.081-1.65 1.744 0 3.518 1.042 3.546 2.895v.232c-.61-.348-1.919-.869-3.517-.869-3.228 0-6.512 1.766-6.512 5

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	4.201219141408615
Encrypted:	false
SSDEEP:	24:t5Iu2eFA8C+w7Li+OMgJbuPogg9+5ZhUqT9VEujfWQofRn3DAx3OvvCIsyAKmq:ae/Ca+9gBqTgU9Jj+NpTAx3+vXsycq
MD5:	17D244683C9737C01686C384F87145E2
SHA1:	44AACB11ECF74D8594C95AF08D9787C654A7D248
SHA-256:	77B31D0E25FFE381DCD42AA468F074882CB5CB0F0B8BF26FA913308CD4D2772C
SHA-512:	AD80BB26C37BC2B8418DBAA31A3E4B3465D00FB5C5481C5E6BD4CF4746ECC103465DAA83137195729E33F7849DCF4B15D9F489F00C7858F3A566C40EA1A7EECF
Malicious:	false
Reputation:	low
Preview:	<svg width="38" height="18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.947 14.895c2.198 0 4.003-.765 5.18-2.57v2.158h2.414V9.047c0-1.275-.687-1.824-1.982-1.824H7.77V8.32c0 .942.51 1.315 1.373 1.315h1.746c-.274 1.452-1.608 2.53-3.454 2.53-2.237 0-4.022-1.824-4.022-4.709 0-2.57 1.55-4.63 4.297-4.63.588 0 1.06.097 1.491.274.55.216.824.471 1.237.863.352.353.627.608 1.314.608h2.434C13.697 1.688 10.733 0 7.672 0 3.159 0 0 3.454 0 7.79c0 4.378 3.473 7.105 6.947 7.105zm18.966-5.69c0-3.1-2.12-5.121-5.063-5.121-2.963 0-5.376 2.276-5.376 5.514 0 3.277 2.315 5.298 5.317 5.298 1.904 0 3.729-.863 4.611-2.393a6.478 6.478 0 00-.568-.432c-.334-.236-.628-.373-1.02-.373-.373 0-.707.216-1.119.491-.451.294-1.04.452-1.589.452-1.295 0-2.511-.766-2.708-2.335h7.436c.059-.219.079-.807.079-1.101zm-2.944-.843h-4.533c.216-1.315 1.118-2.139 2.354-2.139s2.179.844 2.179 2.12v.019zm3.895 6.121h2.924V9.224c0-1.707.843-2.766 2.257-2.766 1.139 0 1.923.568 1.923 2.001v4.65c0 .883.413 1.394 1.394 1.373h1.53

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	227
Entropy (8bit):	6.102232552150733
Encrypted:	false
SSDEEP:	6:6v/lhPIAR+VR7osCLladlUimQlmtGn9BZTw/hq1xXs9SAIw/2up:6v/7A0eUsCsmQ5y/h85AJ/7
MD5:	545CFE95F47D4884C5677808561E8FD6
SHA1:	87A3256D65F13F913742E9B9B35199BD12074C42
SHA-256:	8C3A8895DF17CFB6075D4D24611587825D33EC98149AD554798A1832E6E8D5AC
SHA-512:	72038CADBAAF0295F4157446868E3D96A643B82191F62C674EEF677BEEE44DE1B1CB849A100EAB753CD41AAC62C8C4C2DF7B5CC9F3621EB56EFD1A4C4992174C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0......,.....sRGB........PLTE......,.p( l.y.&.j'.k.x..x.&.j'.k.y..x.&.j$.......tRNS..)@vx......_....OIDATx.c`..`...UB.....$\|.9.M...3....wQ.b..=g......q....v.t.N..N0...>b...J,.........IEND.B`.

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	831
Entropy (8bit):	4.495902589061296
Encrypted:	false
SSDEEP:	24:tzkuqvUseRZYRoKyNyGOFhG6V1bMSA8NIOTYhll7:GeReRiNyGOjBV1OUo
MD5:	5C51D97C54C81DC0854B3BBDA79A4A70
SHA1:	3415410A991A453674E3C9D2DEEFD9B76B8D1F83
SHA-256:	769DB1B5B23B294FB8598B7561FC050C40338D501FEE7D0D8F9D2C15544AE6F5
SHA-512:	A691813E01BDF46460121675A031774257EB4188A388E1DA8CAB2DD5B0331368904577E4ED392DEE56C89A55547FC50764599C892FB9A2FD91061ED98EE8F4AE
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14.763 21.606v1.5c0 2.293-1.302 3.9-3.75 3.9-3.384 0-3.725-2.2-3.725-4.95 2.048-1.677 5.174-1.398 7.475-.45zm0 0a3.593 3.593 0 002.45 0m0 0v1.5c0 2.262 1.321 3.9 3.775 3.9 3.384 0 3.724-2.2 3.724-4.95-2.056-1.686-5.19-1.388-7.5-.45zm5.987-10.6c.7.133 1.37.271 2 .45 2.534.717 3.8 1.567 3.8 2.55 0 1-1.267 1.858-3.8 2.575-5.74 1.587-12.66 1.587-18.4 0-2.534-.717-3.8-1.575-3.8-2.575 0-.983 1.266-1.833 3.8-2.55.639-.18 1.3-.317 2-.45m14.4 0c.067.883.092 1.875.075 2.975m-.075-2.975c-.166-2.3-.583-3.967-1.25-5-.733-1.083-1.8-1.292-3.2-.625-2.229 1.061-3.27 1.049-5.5 0-1.417-.667-2.483-.458-3.2.625-.666 1.033-1.084 2.7-1.25 5m0 0a33.29 33.29 0 00-.075 2.975" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (537)
Category:	downloaded
Size (bytes):	120235
Entropy (8bit):	5.491368359298883
Encrypted:	false
SSDEEP:	3072:xRuBeIAZOdKF/uMJ2G+cb1ZNuUAZdkiBJZuje490UPtb:SkI4OdKFmMb+cb1ZNuUAZdkiBJZuje4z
MD5:	194D92E5F10A0C2A57B898BA220F241B
SHA1:	BA8AA90E1A2F573183B9BA96822EBB3C5DCED3EB
SHA-256:	737A6EBC1E7EFF7BE86ECB6359FA3336A212C3439C1DD53B4C8B67E01D0A9D20
SHA-512:	A0D7C572973B573B38855882D61BD0C0694B2534A9D3644952E32FC119ED59C7DEFF358D7A3DE5A31837BCB85F778004727B7A79247298BEBD6B5927AB81285D
Malicious:	false
Reputation:	low
URL:	https://www.youtube-nocookie.com/s/player/2070f79f/player_ias.vflset/en_US/remote.js
Preview:	(function(g){var window=this;'use strict';var a8=function(a){g.Ho(a,"zx",Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())^g.nb()).toString(36));return a},b8=function(a,b,c){Array.isArray(c)\|\|(c=[String(c)]);.g.Iga(a.B,b,c)},Xyb=function(a){if(a instanceof g.jt)return a;.if("function"==typeof a.Kk)return a.Kk(!1);if(g.bb(a)){var b=0,c=new g.jt;c.next=function(){for(;;){if(b>=a.length)return g.K2;if(b in a)return g.kt(a[b++]);b++}};.return c}throw Error("Not implemented");},Yyb=function(a,b,c){if(g.bb(a))g.bc(a,b,c);.else for(a=Xyb(a);;){var d=a.next();if(d.done)break;b.call(c,d.value,void 0,a)}},Zyb=function(a,b){var c=[];.Yyb(b,function(d){try{var e=g.Cv.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e?c.push(d):g.yla(e)&&c.push(d)},a);.return c},$yb=function(a,b){Zyb(a,b).forEach(function(c){g.Cv.prototype.remove.call(this,c)},a)},azb=function(a){if(a.ma){if(a.ma.locationOverri

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.527724704590433
Encrypted:	false
SSDEEP:	24:tzkumufVNUTJeFDNgkqgS2d9auZ2NccLe6uXsTYhll7:Eu+EgPgS2dEuZ2ucLe6uXj
MD5:	7E10871E86B329BEA808518CFA6B01A4
SHA1:	F6863681EABFED7D7157AA771126D6E2FF86E058
SHA-256:	98078A8C5CEC64A268E3E09A99A8FD0C5220050EDB2B55E8DF3D8CD2D3244230
SHA-512:	D058EC0BD1E4671C3A1DAFF92E7E98F1B6375F14B065FE0FE1E0D4F2FC5A1B81C31AA94B6D7F6FAB7415278759AFDCD009B706A8401CC7006BDEBB18AE7EE22A
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M23.843 22.088v5.387m-2.67-2.694h5.34M7.416 22.025l-2.192 2.178m7.632-1.235l3.079-1.416a59.386 59.386 0 001.987-.952m-5.066 2.368l1.82 4.217a.48.48 0 00.781.149l1.787-1.793a2.4 2.4 0 00.7-1.71l-.022-3.231m-5.066 2.368l-4.064-3.94m1.088 5.337l-.917.897m2.299-11.253a78.004 78.004 0 00-1.008 2.003m1.008-2.003l-1.008 2.003m1.008-2.003l-3.366.023a2.4 2.4 0 00-1.683.706L4.424 16.53a.48.48 0 00.16.784l4.208 1.713m2.47-5.02c1.25-2.598 2.77-5.367 5.375-6.794 2.713-1.485 6.01-2.134 9.098-1.8.34.037.613.3.658.64.408 3.046-.235 6.35-1.724 9.016-1.46 2.613-4.19 4.163-6.747 5.53m-7.668-4.588l-1.462 3.016m2.262-3.816l5.68 5.54m.9-10.178c.978-.983 2.637-1.02 3.623-.025a2.58 2.58 0 01.025 3.582c-.97.973-2.642.984-3.624.026-.96-.967-.948-2.593-.025-3.583z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32067)
Category:	downloaded
Size (bytes):	81498
Entropy (8bit):	5.419516878705438
Encrypted:	false
SSDEEP:	1536:MZVMbRJN4CoVUTM2ua1OM7CfsGmIZQx5pgLo+oNbH:MaJMYOMuLZQ2LOr
MD5:	A06719DB9D1EF730D55A917FBA5C529D
SHA1:	C9F0C3FFED5225AF8270D096DB66CE6A885CC372
SHA-256:	0919C44FF88E6C03D3C0E89B7EFA6934005D1418103052036E6322A3EDFCBA5D
SHA-512:	67D21371E946DBA17ECB8FC7666466D6F7AFE2E3CF648E2F90362D7CC6B64BAA28229EBB42F20C9C182F8AB4C344A195FA0DF8B9B33931DB0A76209025ACA83F
Malicious:	false
Reputation:	low
URL:	https://www.nortonlifelock.com/content/dam/norton-adobe-analytics/prod/s_code_norton_min.js
Preview:	/! Norton - v1.0.2 - 2024-02-06 /function s_doPlugins(a){var b=a.linkURL;if(void 0!==typeof a.linkType&&"d"==a.linkType&&"string"==typeof b){a.events="event1";var c=b.split("/"),d=c[c.length-1],e=d.substr(d.lastIndexOf(".")+1).toLowerCase();a.eVar1="D=c33",a.prop33=b,a.prop46=e,a.prop47="download",a.prop48=d,a.eVar49="D=c48",a.linkTrackVars="events,prop2,prop33,prop41,prop46,prop47,prop48,prop49,prop59,eVar1,eVar18,eVar27,eVar41,eVar48,eVar49,eVar59",a.linkTrackEvents="event1"}else void 0!==typeof a.linkType&&"e"==a.linkType&&(a.linkTrackVars="None",a.linkTrackEvents="None");a.eVar47="s_code_norton "+s_code_file_modified_date,a.prop21=a.getQueryParam("inid"),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"inid")&&(a.prop21=nortonAnalytics.inid),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"store_inid")&&(a.prop21=nortonAnalytics.store_inid),a.eVar21="D=c21",a.prop35="D=pageName",a.prop21&&(a.prop35="> "+a.prop21+" "+a.pageName),a.prop22=a.getQueryParam("om_em_cid"),a.prop

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1019)
Category:	downloaded
Size (bytes):	1061
Entropy (8bit):	5.384389292681368
Encrypted:	false
SSDEEP:	24:cbb/NVuu3IlHuOouMUR42vTtH3PeeZGLyHokIdxBSiTmGfi3z:9u+Hu1uMu42vTuLXkIdxBk3z
MD5:	18AB4E638089535994D5FC6677D94541
SHA1:	AF016C9F525B6182CF777D12096A15B87472C444
SHA-256:	F6FE93867A88131B7454C262C76F8CC06E9F6A96DA2B801D15C0014B18CAB69F
SHA-512:	4075BB249227255885F7EC7D58D7D24B5813F7A384489F48A0692F7C48C025864DBF2810FD7F6ACA0EBEE3F145A843171A76BFBA0BEC5383AF67C2C55585C2B4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/cmp-countdown.js
Preview:	!function(){"use strict";try{if(document.querySelector(".cmp-countdown")){var a=document.querySelector(".cmp-countdown"),b=a.dataset.expiration,c=new Date(b).getTime(),d=a.querySelector(".days .numbers"),e=a.querySelector(".hrs .numbers"),f=a.querySelector(".mins .numbers"),g=a.querySelector(".sec .numbers"),h="";const i=new URLSearchParams(window.location.search),j=i.get("today");if(j){const k=j.split("--");if(2===k.length){const l=k[0],m=k[1],n=l.replace(/-/g," ")+" "+m.replace(/-/g,":")+" GMT+0000",o=new Date(n);h=o.getTime()}}isNaN(c)&&(c=(new Date).getTime());var p=setInterval(function(){var b=h?h+=1e3:(new Date).getTime(),i=c-b,j=Math.floor(i/864e5),k=Math.floor(i%864e5/36e5),l=Math.floor(i%36e5/6e4),m=Math.floor(i%6e4/1e3);d.innerHTML=j<10?"0"+j:j,e.innerHTML=k<10?"0"+k:k,f.innerHTML=l<10?"0"+l:l,g.innerHTML=m<10?"0"+m:m,i<0&&(clearInterval(p),a.remove())},1e3)}}catch(q){"undefined"!=typeof sdl&&(console.error(q),sdl.push({system:{error:{type:q.name,message:q.message}},event:"sy

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	143395
Entropy (8bit):	5.194177982842232
Encrypted:	false
SSDEEP:	1536:g/AS/PCczkJeTNV8NLl+oXtKp0w+kx4k2BBp3Sxufjd5gxJgk8k1+4Cdi4u1SlY7:MAICiN6k8kCzY9L7B
MD5:	42BA75D6C9A4B568FC269E4BBEB7E41F
SHA1:	87CB0939D42D0EB1BD1F1939A72FC89E0F1552CE
SHA-256:	6BB6CE004CA90C4C5DE76DD02D965E41CDD3C0171CD6CC34BB1EB319E4DC64C9
SHA-512:	7667E38D2145F6DEABA30A5CCE293ECC26C2A54DFE7CF56A2F2507223524D6F1476A376D71A1722F6CBDD17D389FEB7926E969753B525B22932AE85DA676DE4D
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy preference center","MainInfoText":"By clicking \"Accept all\" you allow cookies that improve your experience on our site, help us analyze site performance and usage, and enable us to show relevant marketing content. You can manage cookie settings below. By clicking .Confirm selection. you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.avast.com/cookies-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"OK\" you allow cookies that improve your experience on ou

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	4.66588451764713
Encrypted:	false
SSDEEP:	48:c/dSXFQqVFQqpFQWVFZ8gpZYrF9jwPH2jwJdl/hM4JJstvmca/zA:aIXSqVSqpS6Z8gpqR9kPH2kJJ1Umc3
MD5:	7C914298239CF721327DE260C143DA58
SHA1:	BB9DE79C53AC59D9F0A3E5AF3069B53FEE00406A
SHA-256:	988EE93F1B6F8364860F4B6CC1EFFAB15F814F3D634B57B5438D949EB0E16E02
SHA-512:	2F8D4A3AD47F13BFBC438C0458AE78668A147AFF4FADC57058E727EC2A30DA87E0D814A87C77EBF0944A1DA47A506606CAE668CF4AA0AAE3434C222C4A3D96EB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <circle cx="9.8841" cy="26.3888" r="1.3988" fill="#fff"/>. <circle cx="17.4378" cy="26.3888" r="1.3988" fill="#fff"/>. <circle cx="24.9911" cy="26.3888" r="1.3988" fill="#fff"/>. </g>. <path d="m25.3189,25.2371l-2.4841.0777-1.7401-6.1321h-6.8891l-2.1605,6.1321h-2.7107v-13.7049l-2.7305,1.9857h-1.4856l-.284-6.5385-1.2016-.0348c0-1.5519,1.2581-2.81,2.81-2.81h2.1717s2.929.7447,4.2601,2.5448c1.3312,1.8001,1.62,5.0401,1.62,5.0401l12.2428-.0633c.9974.4875,1.63,1.5007,1.63,2.6109v5.052h-3.0484v5.8402Z" fill="#fff"/>. <path d="m14.1909,11.4194h6.6904v3.2777c0,.9758-.7922,1.768-1.768,1.768h-3.1543c-.9758,0-1.768-.7922-1.768-1.768v-3.2777h0Z" fill="#ff5833"/>. <path d="m18.7014,25.3148c.1798.2597.2701.5646.2701.9154,0,.8466-.6931,1.5574-1.5435,1.5574-.8351,0-1.5435-.7263-1.5435-1.5574,0-.3508.0965-.6557.2894-.9154m-5.026,0c

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2024
Entropy (8bit):	4.8193527284808075
Encrypted:	false
SSDEEP:	24:2dsMBMEPfxWoFY+pf0m6CMU0ELmLU0PLuuxMwLhlllpaMB+u2/nQkpVjWgWeq1oh:cV/oIf/SXLU0zu0jkQkSg5qqjkQkk
MD5:	51730E5547DB617F6F3517E9D2E11458
SHA1:	6E08A11F465E3401BC218B95E5A9ED37632A814D
SHA-256:	BDBA0FC116C604CA6824068397EFBC91159E5275B180F501B9E9C477E1A5E2C1
SHA-512:	AA92A95A8BC5699920657DBCF2EFD50353E0EA90632B8203D780765588BA9CFEBFA8FBBBA0CC76A3124E5B64D142DAB74B733935A8466448AB8094FFF5EDC440
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-06.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_6" data-name="Layer 6" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <rect x="2.3516" y="7.5324" width="27.2967" height="17.3842" rx="2.0398" ry="2.0398" fill="#fff"/>. <path d="m2.3516,8.9824v-2.8663c.0227-1.2056.6258-1.8197,1.8087-1.8427h23.6114c.6824.023,1.1489.1936,1.3988.5118.3186.3412.4778.7851.4778,1.3309v2.8663H2.3516Z" fill="#ffddbf" fill-rule="evenodd"/>. <path d="m6.5557,24.9166h-2.3954c-1.1829,0-1.786-.6028-1.8087-1.8083V6.1161c.0227-1.2056.6258-1.8197,1.8087-1.8427h23.6114c.6824.023,1.1489.1936,1.3988.5118.3186.3412.4778.7851.4778,1.3309v16.9922c-.0227.6371-.1819,1.0806-.4778,1.3309-.3412.3186-.807.4775-1.3988.4775h-2.2769M7.9476,6.6619h-3.4121m25.1129,2.3205H2.3516" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <path d="m8.8476,18.376v4.9504c0,.4885.1943.9569.54,1.3019l3.498,3.491c.34

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	5.291343419005958
Encrypted:	false
SSDEEP:	24:t4SbFAnufHxl+9bsXISsgA1tBLeI2N39mx6ABL5HxsGkMGAcgKPHxsGkMGUe:THaCRY/LmrmxdL5H9mlgKPH9mUe
MD5:	FB7EE1A4FDAB0CF17A6C928A001F0C0E
SHA1:	37AA3DF5DC67A77ED318144DB514774E7DDFDB92
SHA-256:	41723D2B8A63B2EB0F7B37267EE28B30937B041280B86B408EF6FBA712DAB9EC
SHA-512:	25B05525B4E710CAEFDA1BED1CD9979D6734800F8BE3EB5B80D1B7E45A9BE2F20120A555F1B32639ED6B2F651555A16E0454FC932B4D1A5B3BABE4445D2732CE
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="488" fill="none"><path fill="#071D2B" d="M0 0h1600v488H0z"/><mask id="a" maskUnits="userSpaceOnUse" x="0" y="0" width="1600" height="488"><path d="M1600 0H0v488h1600V0z" fill="#FFF"/></mask><g mask="url(#a)"><path opacity=".22" d="M1215.39 567.616c143.1 221.991 53.73 519.384-188.01 625.614L-1423 2270 568.183 480.912c196.441-176.499 504.107-135.286 647.207 86.704z" fill="url(#paint0_linear)"/><path opacity=".22" d="M551.718-172.449C757.065-6.328 765.102 304.147 568.619 480.67L-1423 2270-90.304-52.378C41.174-281.492 346.37-338.57 551.718-172.449z" fill="url(#paint1_linear)"/></g><defs><linearGradient id="paint0_linear" x1="574.5" y1="412" x2="969.05" y2="855.778" gradientUnits="userSpaceOnUse"><stop stop-color="#071D2B" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity=".48"/></linearGradient><linearGradient id="paint1_linear" x1="-8.5" y1="-52" x2="572.162" y2="505.332" gradientUnits="userSpaceOnUse"><stop stop

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2415
Entropy (8bit):	4.212491397865705
Encrypted:	false
SSDEEP:	48:cJ8G3HAjCXx8i+2f+KjDHN8V97gPINlW34noKyh9NBrEp8uUClJK0h97bS9w:IBlPHN8VaPqwA/pNC9w
MD5:	3CD7B3CD682B8FA2DCB46F16B59C3CD7
SHA1:	CB26256C73D5A087C82181FC0130018A7F4879CB
SHA-256:	F4D132ACE5766F7D219BAF8A4FD575B048AB64B0CB1ED107D91C4FFF3BF8383E
SHA-512:	47327E5BCC1063FCB1EC387E284AD8287DAA97DCC45EBA9712609ED3488AD2676375B810DC7C776B8E217554342C861C725634CA7098611D076975C47E247CBC
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_driver-updater_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.28 28.388a.6.6 0 101.2 0h-1.2zm-11.744 0a.6.6 0 101.2 0h-1.2zM3.6 9.544a.6.6 0 100 1.2v-1.2zm0 11.727a.6.6 0 000 1.2v-1.2zm-.002-5.864a.6.6 0 10.004 1.2l-.004-1.2zm7.138-11.795a.6.6 0 00-1.2 0h1.2zM28.4 10.744a.6.6 0 000-1.2v1.2zm0 11.727a.6.6 0 000-1.2v1.2zM22.48 3.612a.6.6 0 10-1.2 0h1.2zM9.362 16.374l.285-.528-.933-.504.048 1.06.6-.028zm3.303 2.466a.6.6 0 10.57-1.055l-.57 1.055zm9.974-3.2l-.287.528.934.509-.048-1.063-.6.027zm-3.302-2.481a.6.6 0 00-.574 1.054l.574-1.054zM16.6 3.612a.6.6 0 10-1.2 0h1.2zm11.8 12.987a.6.6 0 000-1.2v1.2zm-13 11.789a.6.6 0 001.2 0h-1.2zM9.516 12.724a.6.6 0 001.068.548l-1.068-.548zm12.973 6.55a.6.6 0 00-1.07-.545l1.07.545zM5.836 15.399l-2.238.008.004 1.2 2.239-.008-.005-1.2zm3.24 1.503l3.589 1.938.57-1.055-3.588-1.939-.57 1.056zm13.85-1.788l-3.59-1.955-.573 1.054 3.588 1.955.575-1.054zM16 22.046c-3.168 0-5.895-2.54-6.04-5.7l-1.198.055c.174 3.82 3.447 6.845 7.238 6.845v-

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	735
Entropy (8bit):	4.590926442269083
Encrypted:	false
SSDEEP:	12:tr/kuIcStgLwxswImmnHJM/z2gR2LhSakbitKkJZqPFnRFiX/arn5lB9Yhll7:tzkuU1/I/Wz2U08akbiWFnRQv2n5lTYJ
MD5:	0B065678380A5E9010F7354D610B4810
SHA1:	853545E07075056A3EB68F36C4944808814D3F13
SHA-256:	9DD8FED29647D327F106AFC9E329F2D2619ABF65E1DDFE6062900EE131CE4CA3
SHA-512:	7E4C9CFA09797061CA43FC58C39505D132038F3058070455650F107FF851592EEB8151215E8B5D541E1F435E7A48BB9F9F285EA378339E550DF175B69D031E40
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-secureid_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.808 11.417V8.756a5.192 5.192 0 0110.384 0v2.66m-8.509 16.078c2.125.83 4.509.83 6.634 0M6.769 19.205C6.765 14.19 10.966 9.98 16 9.975c5.034.004 9.235 4.215 9.231 9.23.002 2.685-1.201 5.14-3.092 6.842-.325.292-.828.116-.97-.297-.568-1.646-1.42-2.952-1.93-3.646-.244-.333-.687-.42-1.07-.267-1.534.608-2.804.608-4.337 0-.384-.153-.827-.066-1.072.267-.51.694-1.36 2-1.928 3.646-.142.413-.646.59-.97.297-1.892-1.702-3.095-4.157-3.093-6.842zm9.231.319c-1.422 0-2.574-1.164-2.574-2.6 0-1.435 1.152-2.601 2.574-2.601s2.575 1.165 2.575 2.6c0 1.437-1.153 2.6-2.575 2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.880816344429822
Encrypted:	false
SSDEEP:	6:tnr/kumc4slmFU3jSSpDXlFUXFW9qMHpF2JGcTcW69jI6Ymq8:tr/kuIFUTSYL+MhJSGE6B9YU
MD5:	295D7E3E94320E81A0420D0151AA372E
SHA1:	F3C0537B08EFA4D6EFECAE6FAC5D2B82C57794B2
SHA-256:	C4618A8390B9D1910CFF91745B34EE142E8561F59C73E046E5CA544E66CB8DD8
SHA-512:	C8AE413A749AC2CC0C549F89063D662663F3926B150641D60F181CD98A33AA784AF9762E89E95E2F06684827238330941BAAD30A06087FB5933A68CFCF0BA93F
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M24.384 16.541v6.636a1.57 1.57 0 01-1.57 1.57h-4.672v-5.634a1.02 1.02 0 00-1.02-1.02h-2.245a1.02 1.02 0 00-1.02 1.02v5.633H9.186a1.57 1.57 0 01-1.57-1.57v-6.635M5.8 14.64l8.235-8.235a2.746 2.746 0 013.884 0l8.281 8.282" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65310)
Category:	downloaded
Size (bytes):	1040233
Entropy (8bit):	5.08202793444542
Encrypted:	false
SSDEEP:	6144:r1I95EoMUdQ863muCfQNk6hNO6gwS338hFWktK70I1/rCIX658+mEeooaA:pS8hFWktK70I1/rCIX658F
MD5:	2F8D38A6DFD521125A788B0DC7D44128
SHA1:	2F2C96490BCA5BF71F66595062578A0AC84911BC
SHA-256:	62AE135E666426619173DEE2EB15AB6365886A01D282675A2576B8F12FF7AC6A
SHA-512:	BC8D82DE2327ACA797C8EF945CA9D6E90E3425BC46621684107C0BDC78563DEBDAE55710DAB243D438C3ACFAB9C45F52414186C5D5E32D3356709AA80057486F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v2/avast.css
Preview:	/!.=========================================================. Avast styles.=========================================================.* Include only global stuff here.=========================================================.*/.tns-outer{padding:0 !important}.tns-outer [hidden]{display:none !important}.tns-outer [aria-controls],.tns-outer [data-action]{cursor:pointer}.tns-slider{-webkit-transition:all 0s;-moz-transition:all 0s;transition:all 0s}.tns-slider>.tns-item{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.tns-horizontal.tns-subpixel{white-space:nowrap}.tns-horizontal.tns-subpixel>.tns-item{display:inline-block;vertical-align:top;white-space:normal}.tns-horizontal.tns-no-subpixel:after{content:'';display:table;clear:both}.tns-horizontal.tns-no-subpixel>.tns-item{float:left}.tns-horizontal.tns-carousel.tns-no-subpixel>.tns-item{margin-right:-100%}.tns-no-calc{position:relative;left:0}.tns-gallery{position:relative;left:0;min-height:1px}.tns-galler

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.109952293136637
Encrypted:	false
SSDEEP:	24:2dAAfgl4z7OWWqXsuqtCNRMx2K5GY7OWWqXCuqt89WxMwLhllld9mGZNMjLhlllR:cZ84zyWWPuqikkWWfuq6/GZNw
MD5:	CD19091C7015ABBB49BB204D76711ECA
SHA1:	EB9A50F7AC2F6280D532B0A786CE88C510857A89
SHA-256:	F138B5DA80CD45CF44CD64418F425BF2804E0BA945D18BD7C08EE77E591AB659
SHA-512:	610871598DAD710F3D8795AABBD0A2F2CF4780133DE71AB5144EF1893A86ACF4393914B9C3CCE7C958BEC4417CEB4FA22AF432C0B80FA7BB755DAE37776E9B8F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <path d="M9.8296,16.7702l6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.0711-.337,1.4773-1.0714,1.2199-2.2015l-6.9903-26.1788c-.3376-1.1103-1.0616-1.5368-2.1719-1.2794L13.3106,10.7909" fill="#ff5833" fill-rule="evenodd"/>. <g>. <path d="M9.7508,11.332c.2777,1.1103-.1487,1.825-1.2788,2.1423l-3.0051,.803,6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.0711-.337,1.4773-1.0714,1.2199-2.2015L28.1052,5.0255c-.3376-1.1103-1.0616-1.5368-2.1719-1.2794L8.9478,8.2979l.803,3.0341Zm-.803-3.0341l-3.481,5.9794" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <g>. <path d="M14.8444,24.0796l5.8282,3.3377c.6316,.3617,1.4367,.1473,1.8049-.4806l3.4093-5.8146" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.496879253868425
Encrypted:	false
SSDEEP:	12:trF9XjuILVEPKI7UpXQx7maRVRo9AuGY8nwVUOHw:th9zuwEPKI7V7maFCAa80VHw
MD5:	797EF4096036ABE507C6C1A433FE3B25
SHA1:	E155D7270D10C5B6174B0D293AA034ECF6C63DC6
SHA-256:	29B3B9D1066A398DB5E6E6FFDECCE7C9E5BB739DC8C57E1DBB33277EFD6AAA92
SHA-512:	D7BA02C3E01C82C53FC2528A8759DBA3299B6BBA5653132B345D828A661DA825C811BA4735455D4BA2CA4E340A17F84E15326C0E21E55A4A8FA78C51F8DFD755
Malicious:	false
Reputation:	low
Preview:	<svg width="212" height="44" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M13.603 8.405l.068-.018C63.851.25 91.728-.565 141.111.248c49.383.814 62.623 10.168 67.703 17.088C211.204 20.59 212 24.659 212 27.1c0 2.44-2.205 1.63-3.986 1.628-2.386-.001-3.183 1.626-6.372 1.628-3.189.001-54.162.814-54.162.814-28.143.813-84.422 3.253-111.507 8.95-21.95 4.618-27.88 5.698-31.063 0C1.727 34.424.837 30.355.129 23.847-1.141 12.171 7.24 10.03 13.603 8.405z" fill="#D4E7FF"/></svg>

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (972)
Category:	downloaded
Size (bytes):	1010
Entropy (8bit):	5.013859345459063
Encrypted:	false
SSDEEP:	24:bRRpKGkIgdOyMVRF6yGRRpWORR19hrIbXZyXLd:btcdrMVjPGtt/lIb0B
MD5:	2C31476E4A42056CE5898EA8B4FB6D18
SHA1:	4447ED0AAD40E9F79A73EA6D5B49FB9C692C26F4
SHA-256:	4AB1F474E4841BB4F871A578F69D0F19F97BEB7E7FEAC50A7A28ED5113428894
SHA-512:	92A3CB693FEC9BADEC591BDA7B176399EA519997DF9B88EF83776EF03BA5F7E4F20B228C0D8D6447AAA0D8939F97AF6C1D3F85169B9625C284EAAC15AA505F7C
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/1/web/j/vendor/one-trust.js?t=13
Preview:	function OptanonWrapper(){var a=document.getElementById("onetrust-consent-sdk");document.body.prepend(a),function(a){var b="; "+document.cookie,c=b.split("; "+a+"=");if(2==c.length)return c.pop().split(";").shift()}("OptanonAlertBoxClosed")\|\|($(".ot-accordion-layout button").attr("aria-expanded","true"),$(".ot-pc-footer .ot-pc-refuse-all-handler").length>0&&$(".ot-pc-footer .ot-pc-refuse-all-handler").insertAfter("#accept-recommended-btn-handler"));const b=navigator.globalPrivacyControl;if(b){document.getElementById("onetrust-consent-sdk").classList.toggle("gpc-detected")}var c=document.querySelector(".gpc-on"),d=document.getElementById("cookieGPCControlButton"),e=document.querySelector(".banner-actions-container");c&&(e.appendChild(d),b?d.addEventListener("click",function(){OneTrust.Close(),document.body.classList.remove("ot-overflow-hidden")}):d.addEventListener("click",function(){OneTrust.AllowAll(),document.body.classList.remove("ot-overflow-hidden")}))}.//# sourceMappingURL=one-tr

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.896987120741646
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9jvwaOAmYHZAAbBAA8ckHRXkJTS0:tI9mc4slzcWER9j9jI6mqZlllXd7
MD5:	E5CDE96BF911F2A4EB6552BADEDF39BB
SHA1:	065E6EE982EE624A34B3C33C22E3DF3149262E76
SHA-256:	C85394445D0546C858FF180139E56DE5628546521C6EBDE1A1901CEF07868358
SHA-512:	7E9AC0DDA09AAD594F1495D7C2404E6193AA7FD53BCBAE9A3AADF8C4E1B90225BBABCF94D739991776648390BB1DEBC1B7C6D367818784BD9F8A8F739D353762
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M6 2l6 6-6 6"/></svg>

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (788)
Category:	downloaded
Size (bytes):	827
Entropy (8bit):	5.079894361738113
Encrypted:	false
SSDEEP:	12:s+3oTW+AHJrqB0AHJrGuNV0DiD+3oTW+xBB0x3uNiD+3oTW+bSRTB0bSRFuYp03n:s0YAprqB0Apr70YPB0/0YEB0g2VJ
MD5:	1E6F5D88860066D6C32149FA68E33AB3
SHA1:	625B31784A9D536241606E09E0302A275225B44B
SHA-256:	D8E25E09B60F2CE43780F3B43594E2BF8F4316EE379DBA926A2B142F5E11DCDB
SHA-512:	47DA66C65671C356A21C8CD3030DB7FA96521F37EAB4D757DE2D9C03A392608266DEEDB5CDFEDFAAAA1FD4B9811D487B346F5D2060FFD542114590B26E1DB437
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v3/avast/local/en-us/local.css
Preview:	@font-face{font-family:"MierB03";src:url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff2") format("woff2"),url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff") format("woff");font-style:normal;font-weight:400;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff2") format("woff2"),url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff") format("woff");font-style:normal;font-weight:700;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff2") format("woff2"),url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff") format("woff");font-style:normal;font-weight:750;font-display:swap}body{font-family:"MierB03", "Helvetica", "Arial", sans-serif}../# sourceMappingURL=local.css.map /

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46103), with no line terminators
Category:	downloaded
Size (bytes):	46104
Entropy (8bit):	5.3053668132686145
Encrypted:	false
SSDEEP:	768:OaOFhhRDUHahpROfRys3LzQRo4TYYyDMFWPKQ:OaOFnRrRURtzQy4ISWiQ
MD5:	7F75F159026F3A2C8CCCDA487B43157B
SHA1:	021CF5C854DB063CD79BF0394C24EB994E095640
SHA-256:	5E319852607809336B2534FFEB96F6933F26994DD040F535302C84F59CC0A214
SHA-512:	88276152EE25891D16E7B3B28A9B42CBD48D97E1A7D94C1BF5354612603868D5D537D2BA01A4E2F184E6DC6A492B67619D6A7C02DA992AD604F7D0ABEF27A7A1
Malicious:	false
Reputation:	low
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/logos/avast-logos/seo/favicon.ico?v=2
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	4858
Entropy (8bit):	7.8438534892887155
Encrypted:	false
SSDEEP:	96:rGgJIbbjrTyf2K6CAfkZdXILIcMVCYCBCSy3VnyHCZ8CfzG+CG0/:rGgyXC9c8Zdc7YCBC58CqhGC
MD5:	4F3E0ACBAC795136F2330CC87B89B259
SHA1:	9FF86071E2A3DB87C5D5E08B3F32A8C0890AABF1
SHA-256:	35782A70132DE5B0EF25FC81F9DF9E6801BD2D3316DA3D006ADD9048AAB7A4F5
SHA-512:	40506BC77C573A894B9C7820B120870E7ED4510677484BD2B3C3DCA74535D78F7042B0F74D72BA8D074698F942E0E57EC964FDA5239A9C6786F94286265488B8
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/aim/img/lp-safe-emailing/att@2x.png?width=568
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...........................j.............8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......X........pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......X........pixi............ipma..........................iref........auxl.........Fmdat.....f%\|{..2...`.@P.?^j.W[.o.d....b.(.'...%..t.P...C...lO./Z.J~...W..lI....$.1...Bi......e.\`.[..:.;Jn....@....G(.6..c[j...?....5.G.dhR}O....y,n.....=....E.B...M.0.......+.C....)fr#d....:.x.....n`6e......._.QX_]>..n...m#...%h..G.O..u.6,]u....0;&-..w...\.~.[ .......&;.d....P..E.."\..@....(..6...$.E.......,.r.5..]..oj.J.S5.:.Sm\|t.&.-E.....a....I.R............D9/...g...6.{.8...)U3R.T..(e..>..\8....O..\R....5..C..m..O.h.\-.a......x.....s.........5.q......<........u.U.P..}a)~.;.TtT..y.....dwc/.@,i.......;.....K%,u;.#....X..

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4118
Entropy (8bit):	5.050536106767674
Encrypted:	false
SSDEEP:	96:aeLtCRkK4YD5q0izZ70Ulby9hY4n4TEAby24iEDBzEuBJcEkg:autCRkKF5VaFzMaw4TtbszlmQ
MD5:	2D20353CF7AB34148CEA8990568F1752
SHA1:	463F8D7143A8E6C29B0F437E2EB2AD9D69C68D40
SHA-256:	BB227C43B5FCFCAC106013853C5EA41258588515EA64DB30C773490DF51D8D2E
SHA-512:	5B1416D49346F461E478321D25E62D1CBD639D8B3779FAAE8B0E76AC4B1724793B885F8F410FA5D140352859A2E265A12C93D0E0F798DBEC04C9EFFE41AFFA74
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-05.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <rect x="2.7453" y="9.1411" width="26.5094" height="16.8828" rx="3.8379" ry="3.8379" fill="#fff"/>. <path d="m2.7453,10.5493v-2.7836c.022-1.1708.6077-1.7672,1.7565-1.7895h22.9303c.6627.0223,1.1158.188,1.3585.4971.3094.3314.464.7624.464,1.2925v2.7836H2.7453Z" fill="#ff5833" fill-rule="evenodd"/>. <path d="m9.5235,26.0239h-5.0216c-1.1488,0-1.7345-.5854-1.7565-1.7562V7.7657c.022-1.1708.6077-1.7672,1.7565-1.7895h22.9303c.6627.0223,1.1158.188,1.3585.4971.3094.3314.464.7624.464,1.2925v16.502c-.022.6187-.1767,1.0494-.464,1.2925-.3314.3094-.7837.4637-1.3585.4637H9.5235Zm-2.1399-17.7281h-1.689m23.5601,2.2536H2.7453" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <path d="m15.5741,12.8749c-2.7224,0-4.9293,2.2069-4.9293,4.9293l2.9353.082c0-1.

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10594643/web/i/v2/components/store-badge/google-play/google-play-badge.svg
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (707), with no line terminators
Category:	downloaded
Size (bytes):	707
Entropy (8bit):	5.578035704284187
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHmHhFBY4Z4re+drHnxOQGMu0/LTW5dnFBMKTiUMGT2IWSBV:hMiRO9FPCwWHBTJ/LTW5dnXt8G9xuJq
MD5:	4BD2201B839C800D2C77B06C2653F29D
SHA1:	74EEB62180521518B7C771D6E0657B014EEBC608
SHA-256:	DC8685D0E9C16F6289E36B179591A65AF757EC930C0264246ADB1B218D18A067
SHA-512:	857C4024ABDC29D7AF2E0905D76E0B3B11BA61655BFB41176DE20D5BA04F635EDBF1DF35275EB688894DBC2146C8395FB4613A8EA3FCD088CAA2313FC9F1E5A9
Malicious:	false
Reputation:	low
URL:	https://4711400.fls.doubleclick.net/activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex"/></body></html>

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	920
Entropy (8bit):	4.527724704590433
Encrypted:	false
SSDEEP:	24:tzkumufVNUTJeFDNgkqgS2d9auZ2NccLe6uXsTYhll7:Eu+EgPgS2dEuZ2ucLe6uXj
MD5:	7E10871E86B329BEA808518CFA6B01A4
SHA1:	F6863681EABFED7D7157AA771126D6E2FF86E058
SHA-256:	98078A8C5CEC64A268E3E09A99A8FD0C5220050EDB2B55E8DF3D8CD2D3244230
SHA-512:	D058EC0BD1E4671C3A1DAFF92E7E98F1B6375F14B065FE0FE1E0D4F2FC5A1B81C31AA94B6D7F6FAB7415278759AFDCD009B706A8401CC7006BDEBB18AE7EE22A
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_cleanup-premium_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M23.843 22.088v5.387m-2.67-2.694h5.34M7.416 22.025l-2.192 2.178m7.632-1.235l3.079-1.416a59.386 59.386 0 001.987-.952m-5.066 2.368l1.82 4.217a.48.48 0 00.781.149l1.787-1.793a2.4 2.4 0 00.7-1.71l-.022-3.231m-5.066 2.368l-4.064-3.94m1.088 5.337l-.917.897m2.299-11.253a78.004 78.004 0 00-1.008 2.003m1.008-2.003l-1.008 2.003m1.008-2.003l-3.366.023a2.4 2.4 0 00-1.683.706L4.424 16.53a.48.48 0 00.16.784l4.208 1.713m2.47-5.02c1.25-2.598 2.77-5.367 5.375-6.794 2.713-1.485 6.01-2.134 9.098-1.8.34.037.613.3.658.64.408 3.046-.235 6.35-1.724 9.016-1.46 2.613-4.19 4.163-6.747 5.53m-7.668-4.588l-1.462 3.016m2.262-3.816l5.68 5.54m.9-10.178c.978-.983 2.637-1.02 3.623-.025a2.58 2.58 0 01.025 3.582c-.97.973-2.642.984-3.624.026-.96-.967-.948-2.593-.025-3.583z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	920
Entropy (8bit):	4.527724704590433
Encrypted:	false
SSDEEP:	24:tzkumufVNUTJeFDNgkqgS2d9auZ2NccLe6uXsTYhll7:Eu+EgPgS2dEuZ2ucLe6uXj
MD5:	7E10871E86B329BEA808518CFA6B01A4
SHA1:	F6863681EABFED7D7157AA771126D6E2FF86E058
SHA-256:	98078A8C5CEC64A268E3E09A99A8FD0C5220050EDB2B55E8DF3D8CD2D3244230
SHA-512:	D058EC0BD1E4671C3A1DAFF92E7E98F1B6375F14B065FE0FE1E0D4F2FC5A1B81C31AA94B6D7F6FAB7415278759AFDCD009B706A8401CC7006BDEBB18AE7EE22A
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-cleanup-premium_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M23.843 22.088v5.387m-2.67-2.694h5.34M7.416 22.025l-2.192 2.178m7.632-1.235l3.079-1.416a59.386 59.386 0 001.987-.952m-5.066 2.368l1.82 4.217a.48.48 0 00.781.149l1.787-1.793a2.4 2.4 0 00.7-1.71l-.022-3.231m-5.066 2.368l-4.064-3.94m1.088 5.337l-.917.897m2.299-11.253a78.004 78.004 0 00-1.008 2.003m1.008-2.003l-1.008 2.003m1.008-2.003l-3.366.023a2.4 2.4 0 00-1.683.706L4.424 16.53a.48.48 0 00.16.784l4.208 1.713m2.47-5.02c1.25-2.598 2.77-5.367 5.375-6.794 2.713-1.485 6.01-2.134 9.098-1.8.34.037.613.3.658.64.408 3.046-.235 6.35-1.724 9.016-1.46 2.613-4.19 4.163-6.747 5.53m-7.668-4.588l-1.462 3.016m2.262-3.816l5.68 5.54m.9-10.178c.978-.983 2.637-1.02 3.623-.025a2.58 2.58 0 01.025 3.582c-.97.973-2.642.984-3.624.026-.96-.967-.948-2.593-.025-3.583z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23654), with no line terminators
Category:	downloaded
Size (bytes):	23654
Entropy (8bit):	5.280059026283656
Encrypted:	false
SSDEEP:	384:xXgaVDetxLcKQaqkQE6UyJWj//jlzu+5UV1BQBLhRtV8QIBhdcRaiAxykaLwYwa2:xXgaVjtUYWq2Jchq0xykaLwYwaOliU
MD5:	0735C0D8548CA4ED5FA324BE613D0B5F
SHA1:	5A0B52AA5EB9B8D96D475941EAF21EDB93D0D120
SHA-256:	737D02BB9ADB19C1219C1E5DF5CBEE8E77AC8F11A705BEFE25E8976C3FBE9458
SHA-512:	FCB9B194211C0BFC23F48D4361FC38EF8430DF2ED2A8AE5E2B1B712918BF91A96D1C0E6597FC41E4BBC7E654FCF5DD6BC9E0F5BD72E26885D19DBD197D0AE983
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/_global/assets/js/prebuild/hubspot.min.js
Preview:	/! @app Avast Hubspot JS library. Hash: 7f31a1e002bb45ebce0b /!function(t){var e={};function o(a){if(e[a])return e[a].exports;var n=e[a]={i:a,l:!1,exports:{}};return t[a].call(n.exports,n,n.exports,o),n.l=!0,n.exports}o.m=t,o.c=e,o.d=function(t,e,a){o.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:a})},o.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},o.t=function(t,e){if(1&e&&(t=o(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var a=Object.create(null);if(o.r(a),Object.defineProperty(a,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var n in t)o.d(a,n,function(e){return t[e]}.bind(null,n));return a},o.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return o.d(e,"a",e),e},o.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},o.p="",o(o.s=0)}([function(t,e,o){t.export

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1560
Entropy (8bit):	7.858369841664141
Encrypted:	false
SSDEEP:	48:S8SfmmuJAe5o1l6F7GelerFX6b1WasxHqpB:SdmbJfu1lqmkKNqv
MD5:	5A814F54AB9FB2173B37FBD568196C25
SHA1:	F4B3B8954B5A35B1087D321B4EAA98E3C1E70574
SHA-256:	E22709D09FD79339EAF0C247DE42D89A32734CB0531311D188438464AE6B85F8
SHA-512:	4BD4033DF01C53087CA6DD9930CDBD142EA19328CE817E17A67BB93F2F19C910B199DF7DEC0E99734120DAB2FB79313C02824FF24953F30015CF78D793CFF19E
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png
Preview:	RIFF....WEBPVP8L..../U@..'. .$E.>..o..g.m8n$I...a.{.......$ER.1-.o...~.A$[A..<.\|..(h##..N..{.o....%P\|N.....fe..q.F.....t..B./...!..!}....;Fz/P..I....P^..@1..]..Gc...[c...6...^..A..6 .R.")Io..A .kJ.....h_.....i.S.]i6i...Ol...c.fW..\|....i..=..@q.......8.4.Bb.@.......#A...~...a..H.K...A.......Fby..q....}0.A..^.S...xD!A..:.k<Y6...xb.....&b.E...V......`...P.w._.K....A#.tGvK.......n.F.=...M..}.5GN3.\..=s.7..=.a..x.v.....U.Z..K.H......\|;.........i..i..r.......~q=....(.g...$3.9~../....Q."v^\...&..:...n.9,.R.).2.^Ud.y.J:.....E.!g$.u.2.\\|^.?G.~'F%tA.@.y.q.....5.'..D -F..y...([c]......dlA).K...\.+.$p./.!+.s...w....QV..A1glY.V..K..b.0..v..f9.H.,._...9/.nYv=(\|)...}......}J....U..UK ......sD.[..}p.........M*.4..9....X...... ...(...%..i.b..w....Xl.n.....nDF.,....G..C...a\|.d..)...'P.P...N0Z...(.. ..>...c.S9>..p..T.a...P...r.`..b.W..V..J..Zj.}...,4.].}..........J.}.x....b!..fF...C{.....u....S.hB.".{.=....E..i.....I.Q...t.u.W.:Z....#..-...HW.Op.....5...`=..

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	560
Entropy (8bit):	5.013745794906588
Encrypted:	false
SSDEEP:	12:cwltFGSF949XuDhPg4n1gaSF949XuDhUXAXS/:cw1l949Xu1Pg4nA949Xu1UQXq
MD5:	461562BD94A1F7A5082C6D0BE671839A
SHA1:	2D8C49D1DF6CB9B296371D7900B954E68CE0BCF1
SHA-256:	0758A0F5B7FEC4E8A57359EFBE094C4E8222E8DA7DEAAAE88EA2B560F511AF10
SHA-512:	CA8E1D664EC2E3EE972D95690A607CD1EC3DC952AE7EE9D56AD57F20A3259F3A4E866179BFEC7582DDDCF7145C551D486FAE34614FDD234B17744E44C98BF7B9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/aa-helper.js
Preview:	!function(){"use scrict";function a(a,b){"function"==typeof trackCustomDownload&&trackCustomDownload(a,b,"")}document.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})}),window.addEventListener("actionbox-updated",function(b){b.detail.element.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})})})}();.//# sourceMappingURL=aa-helper.js.map

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1312
Entropy (8bit):	5.275801237602774
Encrypted:	false
SSDEEP:	24:t4dlu7laoBLQVnDBLlFZxBLy9dprGKwJRHxsGbGEvq9HxsG7G1bU05HxsGEG68CH:KKaaLQVdLlFZzLy7pUTH9iWaH9C+SH9y
MD5:	6A04E8861C9EE16F79F09D7D5F414BB7
SHA1:	529AFD9F8D68E495EEEFEC4056677DCC142A1E23
SHA-256:	BE615DA0C96133A9D7CE2242DB668D15D9BDC62F8F4A40AB6FC218D3604D3BC7
SHA-512:	3BDBFADF5909B47FD8CAA5E5B0B089F5F3C1EC9E09016083A4515D363B515AA9241B373F7E83B58F0C3196B4AF36FC3ADFB730813B3640BDD0D2089D74AEE438
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/browsers/chrome.svg
Preview:	<svg width="64" height="64" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_18418_27150)"><path d="M59.706 16a32 32 0 00-55.424 0l1.92 34.56L59.706 16z" fill="url(#paint0_linear_18418_27150)"/><path d="M18.144 40L4.288 16A32 32 0 0032 64l31.36-32-45.216 8z" fill="url(#paint1_linear_18418_27150)"/><path d="M45.856 40L32 64a32 32 0 0027.706-48H32l13.856 24z" fill="url(#paint2_linear_18418_27150)"/><path d="M32 48a16.001 16.001 0 0011.314-27.314A16 16 0 1032 48z" fill="#fff"/><path d="M32 44.672a12.673 12.673 0 100-25.346 12.673 12.673 0 000 25.346z" fill="#1A73E8"/></g><defs><linearGradient id="paint0_linear_18418_27150" x1="4.288" y1="20" x2="59.706" y2="20" gradientUnits="userSpaceOnUse"><stop stop-color="#D93025"/><stop offset="1" stop-color="#EA4335"/></linearGradient><linearGradient id="paint1_linear_18418_27150" x1="35.462" y1="61.997" x2="7.75" y2="13.997" gradientUnits="userSpaceOnUse"><stop stop-color="#1E8E3E"/><stop offset="1" stop-color="#34A853"/></li

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	761
Entropy (8bit):	5.0806940132201035
Encrypted:	false
SSDEEP:	12:UYZFGDWjHJrZsHJrv7SO6ZRoMqyFGDWS0VU7SO6ZN0qyFGDW+SRm/SR+7SO6Zdh1:U0hjpr+prjSOY7DheSOYN0DhGSOYdh1
MD5:	8C9694BE9F1DE5FC67043560F34AD558
SHA1:	5FFAB401C2D92CD2276178ED9C4A2D0468737E24
SHA-256:	C9ED7A1E73E195BCE766B22ADE58056C3168BC3B4985D556E6F291AF5996B240
SHA-512:	671015093C4C7E50DE2034D650E6C95E016F023A2C9AC490D6FA700B444E6EC918486FD9D959E7EA1CFCFB8436B53F81F0E8C84ADD0660E2FC977FBC8BA61322
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.css
Preview:	body {. font-family: "Mier B";.}.@font-face {. font-family: "Mier B";. src: url('../o/f/400/MierB03-SubsetEng-Regular.woff2') format('woff2'), url('../o/f/400/MierB03-SubsetEng-Regular.woff') format('woff');. font-style: normal;. font-weight: 400;. font-display: swap;.}.@font-face {. font-family: "Mier B";. src: url('../o/f/700/MierB03-SubsetEng-Bold.woff2') format('woff2'), url('../o/f/700/MierB03-SubsetEng-Bold.woff') format('woff');. font-style: normal;. font-weight: 700;. font-display: swap;.}.@font-face {. font-family: "Mier B";. src: url('../o/f/800/MierB03-SubsetEng-ExtraBold.woff2') format('woff2'), url('../o/f/800/MierB03-SubsetEng-ExtraBold.woff') format('woff');. font-style: normal;. font-weight: 800;. font-display: swap;.}.

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/34029159/web/i/v2/components/store-badge/app-store/app-store-badge.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16443)
Category:	downloaded
Size (bytes):	16482
Entropy (8bit):	5.132922450856558
Encrypted:	false
SSDEEP:	384:HF7T7qpkM4WayHsCBIlENwRLoNK45/B5g3oj+hZxbTBvxo5CIQHO0Q:Hp5M47oH
MD5:	963FEC614EF82D2A40C0C52BF571BBE6
SHA1:	09535F98A60549889B5F829EA1535E08732676FD
SHA-256:	890E34631776CA23A88BF9AD8DD0D77703140AB794583539E8BD13EA4F101BCC
SHA-512:	F16EC2866964DB12E8BDF26B48D6091E4F5596E8D9FA6C08F9813BAB9D074B8E1E4D896D2A78ED064A7012BC2A64C01F65BA799E901D17B177BFA8A823655BF7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v3/avast/pages/index.css
Preview:	.hero .hero-text a{text-decoration:dotted underline 1px}.hero .hero-note a{font-weight:700}.hero .hero-awards-wrap{gap:.75rem .75rem;flex-direction:row}@media (min-width: 576px){.hero .hero-awards-wrap{gap:1.5rem 1.5rem}}@media (max-width: 991.98px){.hero .hero-awards-wrap{justify-content:center}}@media (max-width: 575.98px){.hero .hero-awards-wrap .award-badges-wrap{flex-direction:row;align-items:center;gap:.75rem}.hero .hero-awards-wrap .award-badges-wrap .award-badge{flex-direction:column}.hero .hero-awards-wrap .award-badges-wrap .award-badge .badge-text{text-align:center}}.features-section{padding-top:4rem}@media (min-width: 992px){.features-section{padding-top:5rem}}.awards-section{padding:3rem 0 5rem}@media (min-width: 992px){.awards-section{padding:2.5rem 0 7rem}}@media (max-width: 575.98px){.awards-section .award-badges-wrap.centered{align-items:flex-start}}@media (max-width: 767.98px){.awards-section .award-badges-wrap.size-lg .badge-text{max-width:236px}}.hero.custom-a1{padd

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2167
Entropy (8bit):	4.66588451764713
Encrypted:	false
SSDEEP:	48:c/dSXFQqVFQqpFQWVFZ8gpZYrF9jwPH2jwJdl/hM4JJstvmca/zA:aIXSqVSqpS6Z8gpqR9kPH2kJJ1Umc3
MD5:	7C914298239CF721327DE260C143DA58
SHA1:	BB9DE79C53AC59D9F0A3E5AF3069B53FEE00406A
SHA-256:	988EE93F1B6F8364860F4B6CC1EFFAB15F814F3D634B57B5438D949EB0E16E02
SHA-512:	2F8D4A3AD47F13BFBC438C0458AE78668A147AFF4FADC57058E727EC2A30DA87E0D814A87C77EBF0944A1DA47A506606CAE668CF4AA0AAE3434C222C4A3D96EB
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <circle cx="9.8841" cy="26.3888" r="1.3988" fill="#fff"/>. <circle cx="17.4378" cy="26.3888" r="1.3988" fill="#fff"/>. <circle cx="24.9911" cy="26.3888" r="1.3988" fill="#fff"/>. </g>. <path d="m25.3189,25.2371l-2.4841.0777-1.7401-6.1321h-6.8891l-2.1605,6.1321h-2.7107v-13.7049l-2.7305,1.9857h-1.4856l-.284-6.5385-1.2016-.0348c0-1.5519,1.2581-2.81,2.81-2.81h2.1717s2.929.7447,4.2601,2.5448c1.3312,1.8001,1.62,5.0401,1.62,5.0401l12.2428-.0633c.9974.4875,1.63,1.5007,1.63,2.6109v5.052h-3.0484v5.8402Z" fill="#fff"/>. <path d="m14.1909,11.4194h6.6904v3.2777c0,.9758-.7922,1.768-1.768,1.768h-3.1543c-.9758,0-1.768-.7922-1.768-1.768v-3.2777h0Z" fill="#ff5833"/>. <path d="m18.7014,25.3148c.1798.2597.2701.5646.2701.9154,0,.8466-.6931,1.5574-1.5435,1.5574-.8351,0-1.5435-.7263-1.5435-1.5574,0-.3508.0965-.6557.2894-.9154m-5.026,0c

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4287
Entropy (8bit):	4.3546531859688065
Encrypted:	false
SSDEEP:	48:ZyIATAo26sVkgb6/YeR2+Ox9uV2KwG0HSjxafBFt7SPFlaNXNHdAXtgm7YfyIhXm:YTgm5LOWcsxaHN9HJfdhJK4ccbOb
MD5:	EEEDCF9760A2CC6E0F2713E69C2DC787
SHA1:	68FD0715CEF1890539D613805148BDB84058E38D
SHA-256:	8258BFF5A1B2BCEF837103F05B401398829FDE13CF2E0E10D3FC001DAFBF328D
SHA-512:	A54A48C5F807187C6D521947600BEFE942F539D15600411AE5DA393D3EAE9104B6CE8BEC92E4F03C098EBDE61D478A01D29B5A6328F4AACFEAAC460BB8175713
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/illustrations/dtyp-thumb-lg.svg
Preview:	<svg width="380" height="276" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M1.109 91.293c1.632 1.868 3.508.96 5.376-.672 1.869-1.632 3.022-3.37 1.39-5.238a4.492 4.492 0 10-6.766 5.91z" fill="#0070F6"/><path d="M55.617 143.125c-3.56-1.74-5.758.76-7.498 4.32-1.74 3.559-.472 5.141 3.087 6.881 3.56 1.739 5.966 1.952 7.705-1.607a7.173 7.173 0 00-3.294-9.594z" fill="#21455C"/><path d="M217.405 62.374c2.613 3.255 5.83 1.858 9.085-.755 3.256-2.612 2.758-4.69.145-7.944-2.613-3.255-4.812-4.538-8.067-1.926a7.558 7.558 0 00-1.163 10.625z" fill="#D93511"/><path d="M39 250a6 6 0 100-12 6 6 0 000 12z" fill="#21455C"/><path opacity=".8" d="M294 191c0 2.213-1.787 4-4 4s-4-1.787-4-4 1.787-4 4-4c2.128 0 4 1.787 4 4z" fill="#0070F6"/><path opacity=".64" d="M158.007 241.21c3.888 10.823 20.867 7.566 20.867 7.566s12.471-6.242 8.582-17.065c-3.888-10.823-3.052-15.118-19.259-12.649-11.369 1.732-14.079 11.325-10.19 22.148z" fill="#9AE437"/><path opacity=".64" d="M101.902 79.9a8 8 0 01-8 8

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1143)
Category:	downloaded
Size (bytes):	4272
Entropy (8bit):	5.407649241930215
Encrypted:	false
SSDEEP:	96:bVcC0LhyRs71268NYZOAx/rfuNfnAZe5PwGNHW:B3qhpRByNPx54GN2
MD5:	B427175FA1078775EB792756E7B6D1E7
SHA1:	4C55C0233D3D9002B3449C025F97821F8BB8900D
SHA-256:	EE147E859AD0F09AA50367974E38AB53E7C7054C4A51D400A7F45B0EB251454F
SHA-512:	AF8D384188363378BC99C2E51523E74E1D18BA77D51BFF7647A377A117499421F9E94477E09907925E46DAD0A908B799A616D0B4855FFFF064BA6350815063D3
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var l=function(){var a=h,b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},m=this\|\|self,n=/^[\w+/_-]+[=]{0,2}$/,p=null,q=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&n.test(a)?a:""},r=function(a,b){function e(){}e.prototype=b.prototype;a.i=b.prototype;a.prototype=new e;a.prototype.constructor=a;a.h=function(c,g,k){for(var f=Array(arguments.length-2),d=2;d<arguments.length;d++)f[d-2]=arguments[d];.return b.prototype[g].apply(c,f)}},t=function(a){return a};function u(a){if(Error.captureStackTrace)Error.captureStackTrace(this,u);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}r(u,Error);u.prototype.name="CustomError";var v=function(a,b){a=a.split("%s");for(var e="",c=a.length-1,g=0;g<c;g++)e+=a[g]+(g<b.length?b[g]:"%s");u.call(this,e+a[c])};r(v,u);v.prototype.name="Asse

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/sprites/icons-16.svg?v3
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (706), with no line terminators
Category:	downloaded
Size (bytes):	706
Entropy (8bit):	5.586050499731656
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEHBE4Z4reYmHnxOQGMuM4jLTW5dt3BMKTiUMGT2IWSBWruM5:hMiRO9JwYqBTf4jLTW5djt8G9xuf5
MD5:	AC63193EF4774DE931783C6B26DD1ED1
SHA1:	78C782AF95B71AB9657C61DA06C638ABACF47C08
SHA-256:	4B2A67441051486CF438BE4E207FEEAE95733334B1BCA08EB79FAE21274374D9
SHA-512:	81CF9F686AB8326E2BE5706F18ADDC34DCCA481B09FFF7DDEF97F3939F720F87F5DFF6B73FC71E2DB131C2E7C1BEE32F737A08B198F5119A22AA45A8CB3FCB46
Malicious:	false
Reputation:	low
URL:	https://4711400.fls.doubleclick.net/activityi;dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout"/></body></html>

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (585)
Category:	downloaded
Size (bytes):	1098
Entropy (8bit):	5.307078591764481
Encrypted:	false
SSDEEP:	24:/OsIXvuPQa8VyIaoK8d7mQMJHvIOtmRY/Itt7IkHsBsj6GimR4Eq:DKgJTS7m9Zm7XCs9p4J
MD5:	9975A534A66E6E60FEA127A62C73D6C7
SHA1:	9D2775B6741B0355B55ACA73B4E04EB06C74E3A7
SHA-256:	E69CFAA365FF0368B5A5EA006727541132D780D8B58A0D7DA7B612F74EB236C7
SHA-512:	5BFCA983C5E2A01D962991B279B3A050E85F0953899144D015E5321AD0C93832F4A9709530AA0892A89EA83D0FC72A717514DE599594EAE130BEE70E28D41375
Malicious:	false
Reputation:	low
URL:	https://resources.digital-cloud.medallia.eu/wdceu/82320/onsite/embed.js
Preview:	.(function(){if(!window.KAMPYLE_EMBED){window.KAMPYLE_EMBED={kampyleInit:function(){var t=document.createElement('script');t.type='text/javascript';t.async=true;t.src=KAMPYLE_EMBED.getGenericLocation();t.charset='UTF-8';document.body.appendChild(t);},kampyleLoadLogger:function(){},kampyleEventHandler:function(elem,eventType,handler){if(elem.addEventListener){elem.addEventListener(eventType,handler,false);}.else if(elem.attachEvent){elem.attachEvent('on'+eventType,handler);}},isSupported:function(){var trident=window.KAMPYLE_EMBED.getUserAgent().match(/Trident\/(\d+)/);var msie=navigator.userAgent.match(/MSIE (\d+)/);return!(trident\|\|msie);},getUserAgent:function(){return navigator.userAgent;},getGenericLocation:function(){var genericLocation=location.protocol+'//'+'resources.digital-cloud.medallia.eu/wdceu/82320/onsite/generic1691916888878.js';return genericLocation;},};if(window.KAMPYLE_EMBED.isSupported()){if(document.readyState==='complete'){window.KAMPYLE_EMBED.kampyleInit();}.else

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2903
Entropy (8bit):	4.083203542470353
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7lJ/09Q9s4w76ODtzfcIsCvWIK+5B+jV9Pp:9LNV2onc/z7w76gzfcINj5Erx
MD5:	6672B70FD96AC4F96B0AE2062123A841
SHA1:	56BC3CEC1806A655931EC78812E3DBBBD640607F
SHA-256:	954D5CF01AE876E8AC27E08326750D0596F63BC0D3D1986DC611DA352BF451E4
SHA-512:	4B4A39C9EC6CB012B23916FB9DD116AAE3379D5815F43D6D2A24B693DE830DB1EC69D7ECC0CBE648FA60D19A5DAD0395E007E30F464421A7E9D0F0C93C0021A9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/avast-logos/avast-logo-default.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/49845595/web/i/v2/components/store-badge/google-play/google-play-badge.svg
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1525)
Category:	downloaded
Size (bytes):	1569
Entropy (8bit):	5.126938374269885
Encrypted:	false
SSDEEP:	48:8jeDUpC0mGRHjeN1gbIe8CC3v1XpC38t1jDXz+Kc7gL:8jC0mGRGWEe8CC/hpCstZjS17S
MD5:	7DA8C586100994E20F2CD4B8E4E17475
SHA1:	C234D0AD7B42D4BE26E9F36FB02F0DB334635A35
SHA-256:	3FBB684F58BB9F117EAF93AF39E37BEAB247AC1B53D733ABBDFEDAD6703D2882
SHA-512:	A2D942A4E1C18E3F63931698D69C997B332859AE52CB452722B3CEAEDE26202A70DBFCFA8C4C3D55ABF2E548177180261FB6C3CAB1F60DF86E947F69344F70CF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/ab-download-ids.js
Preview:	var ABTestDownloadIDs=ABTestDownloadIDs\|\|function(){"use strict";var a={};return{init:function(b){a=b},run:function(){function b(a){if((!a.getAttribute("data-behavior")\|\|a.getAttribute("data-behavior")&&"downloadpage"!==a.getAttribute("data-behavior").toLowerCase())&&!avastGlobals.detect.os.isAndroid&&!avastGlobals.detect.os.isIOS){var b=new URL(a.href),c=b?b.searchParams:null;c.set("direct",1),b.search=c.toString(),a.href=b.toString()}var e=a.getAttribute("data-download-name"),g=a.getAttribute("href");f.push({el:a,defaultID:-1===e.search(d)?e:e.replace(d,""),defaultHref:-1===g.search(d)?g:g.replace(d,""),testID:-1===e.search(d)?e+d:e,testHref:-1===g.search(d)?g.replace(e,e+d):g})}function c(a){/OptanonConsent[^\s]+C0002%3A1/.test(document.cookie)?a.forEach(function(a){a.el.setAttribute("href",a.testHref),a.el.setAttribute("data-bi-download-name",a.testID),a.el.setAttribute("data-download-name",a.testID)}):a.forEach(function(a){a.el.setAttribute("href",a.defaultHref),a.el.setAttribute(

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	4.083203542470353
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7lJ/09Q9s4w76ODtzfcIsCvWIK+5B+jV9Pp:9LNV2onc/z7w76gzfcINj5Erx
MD5:	6672B70FD96AC4F96B0AE2062123A841
SHA1:	56BC3CEC1806A655931EC78812E3DBBBD640607F
SHA-256:	954D5CF01AE876E8AC27E08326750D0596F63BC0D3D1986DC611DA352BF451E4
SHA-512:	4B4A39C9EC6CB012B23916FB9DD116AAE3379D5815F43D6D2A24B693DE830DB1EC69D7ECC0CBE648FA60D19A5DAD0395E007E30F464421A7E9D0F0C93C0021A9
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56245)
Category:	downloaded
Size (bytes):	244125
Entropy (8bit):	5.534149985446952
Encrypted:	false
SSDEEP:	6144:si93PlWUYbcFgAbN0rDSl85572qbd9yYyJNNXJcnOWpb8:si93PlWUbgO0rDSl8557Hj3yd
MD5:	21989ECCDE693D338BA36F7318E06A57
SHA1:	0AECCDCE91E39DF1581891635D83F5303C7B17A3
SHA-256:	3DD2B01330B0C126E01BFFB67C279F039B3F8119013F69E83CD2FD4FD9F50F9A
SHA-512:	F19487F90CE1CF7242D6BA2FF82180AA86584A821EA9213EF129742441758BADFE184C460EFA227C614A2EA5B822A306947C105ADABE7AEE0DEEDC136E0E1EF9
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-WPC6R3K&l=sdl
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"84",. . "macros":[{"function":"__e"},{"function":"__jsm","vtp_javascript":["template","(function(){return window.sdlHub.cookieGet})();"]},{"function":"__v","vtp_dataLayerVersion":1,"vtp_setDefaultValue":false,"vtp_name":"sdlEventID"},{"function":"__jsm","vtp_javascript":["template","(function(){return window.sdlHub[",["escape",["macro",2],8,16],"].consentGroups})();"]},{"function":"__jsm","vtp_javascript":["template","(function(){var a=window.OptanonActiveGroups,b=\"C0001:1\";if(a){var c=[];a.split(\",\").forEach(function(d){d\u0026\u0026c.push(d+\":1\")});b=c.join(\", \")}return b})();"]},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	4.201219141408615
Encrypted:	false
SSDEEP:	24:t5Iu2eFA8C+w7Li+OMgJbuPogg9+5ZhUqT9VEujfWQofRn3DAx3OvvCIsyAKmq:ae/Ca+9gBqTgU9Jj+NpTAx3+vXsycq
MD5:	17D244683C9737C01686C384F87145E2
SHA1:	44AACB11ECF74D8594C95AF08D9787C654A7D248
SHA-256:	77B31D0E25FFE381DCD42AA468F074882CB5CB0F0B8BF26FA913308CD4D2772C
SHA-512:	AD80BB26C37BC2B8418DBAA31A3E4B3465D00FB5C5481C5E6BD4CF4746ECC103465DAA83137195729E33F7849DCF4B15D9F489F00C7858F3A566C40EA1A7EECF
Malicious:	false
Reputation:	low
Preview:	<svg width="38" height="18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.947 14.895c2.198 0 4.003-.765 5.18-2.57v2.158h2.414V9.047c0-1.275-.687-1.824-1.982-1.824H7.77V8.32c0 .942.51 1.315 1.373 1.315h1.746c-.274 1.452-1.608 2.53-3.454 2.53-2.237 0-4.022-1.824-4.022-4.709 0-2.57 1.55-4.63 4.297-4.63.588 0 1.06.097 1.491.274.55.216.824.471 1.237.863.352.353.627.608 1.314.608h2.434C13.697 1.688 10.733 0 7.672 0 3.159 0 0 3.454 0 7.79c0 4.378 3.473 7.105 6.947 7.105zm18.966-5.69c0-3.1-2.12-5.121-5.063-5.121-2.963 0-5.376 2.276-5.376 5.514 0 3.277 2.315 5.298 5.317 5.298 1.904 0 3.729-.863 4.611-2.393a6.478 6.478 0 00-.568-.432c-.334-.236-.628-.373-1.02-.373-.373 0-.707.216-1.119.491-.451.294-1.04.452-1.589.452-1.295 0-2.511-.766-2.708-2.335h7.436c.059-.219.079-.807.079-1.101zm-2.944-.843h-4.533c.216-1.315 1.118-2.139 2.354-2.139s2.179.844 2.179 2.12v.019zm3.895 6.121h2.924V9.224c0-1.707.843-2.766 2.257-2.766 1.139 0 1.923.568 1.923 2.001v4.65c0 .883.413 1.394 1.394 1.373h1.53

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2560
Entropy (8bit):	4.112283361727405
Encrypted:	false
SSDEEP:	48:zHkiUw9JEj9uDniegT1AxpdOIz3bZX958RuvOcPeLQYadETAb9ToUxWrRGjZXUwx:rkiUwr6aUTiOUrP58koLQmTuTo3kNx
MD5:	3762B9725281D979BEFBE26627F548A4
SHA1:	A4197369F6CDAAC10A5F2FCD37A99C2AB0F84EBD
SHA-256:	C564C654D2E8B15D5687FA376A014792B26B1A308395381D133D3BDBFFFEC487
SHA-512:	DD12F126808A0D8DBC7341A635139473465FF1D403263038D148FF9E237AFF66DD30A77E1BA0F3F3092BAE438809B759B6EB7F5A775534042F782E69FB6DC04E
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-breachguard_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.18 18.496l-.577.16.578-.16zm-.63-4.862l.6.004-.6-.004zm9.022 13.862l-.292.524.292-.524zm11.247-9l.578.16-.578-.16zm.631-4.862l-.6.004.6-.004zm-9.022 13.862l.293.524-.293-.524zM7.819 6.334l.172.575-.172-.575zm6.827-2.007l.168.575-.168-.575zM5.554 9.388l.6-.001-.6.001zm20.892 0l.6.002-.6-.002zm-2.265-3.054l.171-.575-.171.575zm-6.827-2.007l-.168.575.168-.575zm-5.406 15.547l.592.093-.592-.093zm8.302 0l-.593.091v.002l.593-.093zm-6.981-3.242l.26-.54a.6.6 0 00-.733.17l.473.37zm5.617 0l.464-.38a.6.6 0 00-.723-.161l.26.541zM6.76 18.335a17.416 17.416 0 01-.61-4.697l-1.2-.008a18.615 18.615 0 00.653 5.028l1.156-.322zm8.105 8.637c-3.61-2.015-7.028-4.77-8.105-8.637l-1.156.322c1.212 4.352 5.004 7.313 8.677 9.363l.584-1.048zm11.533-8.315c.398-1.43.667-3.19.653-5.028l-1.2.01c.013 1.72-.24 3.369-.609 4.696l1.156.322zm-8.676 9.363c3.672-2.05 7.464-5.011 8.676-9.363l-1.156-.322c-1.077 3.867-4.496 6.622-8.105 8.637l.585

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (555)
Category:	downloaded
Size (bytes):	2510414
Entropy (8bit):	5.663278684366249
Encrypted:	false
SSDEEP:	24576:AgFvmaRsqXpB1h8dDwGHYYRt+UcMqFsykrDD0vrr9:nmamCqdDwGHYYRt+UwFsyU0vrx
MD5:	6A871C8E4F4CAB80BAF1F8BBB86C9F68
SHA1:	27043D1A079C3D7FCD9B7F91ABB323F1CDA13E1A
SHA-256:	5D6EC233052FCB44C8C64CDF3980D4E080BF40E9AFBAEF5C3425E19F63534C3C
SHA-512:	0F656D0EC954F734094011519ACDB0466ABCF3663626222156909B7D2A135EF29E7C729ADD5E23302979F953770C00B764E95289B4D4F83B71245B7A3765CB47
Malicious:	false
Reputation:	low
URL:	https://www.youtube-nocookie.com/s/player/2070f79f/player_ias.vflset/en_US/base.js
Preview:	var _yt_player={};(function(g){var window=this;/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././*.. (The MIT License).. Copyright (C) 2014 by Vitaly Puzrin.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONIN

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HI:o
MD5:	4EBDCAAFA9875BE61C163F7EDB37FB04
SHA1:	9C3C91B31734F9DFBFB0E4E1A7ECEF49C9737BBA
SHA-256:	9C7BA65377A6BB9696042281450DAE51AE7F6135D66C0344EDD4646AC1AA6C51
SHA-512:	553860837CD6C9BE45F0A2B557CBD3A21D22A257437AB90E15A4F8C3B671DD7C54171F38335E65E89E4DBD716BCC43F1EC45465FA2B224E6810D541B654E0C76
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmC8FuY1xGpIBIFDVjM1ww=?alt=proto
Preview:	CgkKBw1YzNcMGgA=

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2050
Entropy (8bit):	4.535583369231597
Encrypted:	false
SSDEEP:	48:c/dFpl5+5lSeC1+XTAj/L/T+zfFBTl5+BAxAjUaEaTYyWz+AD:arpf+7S51CAX/TiFdf+BAxANvY5z3D
MD5:	928CA01F2EE63C298CAD657CDB7575DC
SHA1:	F5C753A41F45D4433E97596E3F34CCF5E31F3932
SHA-256:	5A93336B4C154ACD04A3BD927F05026C6EE568540190CF6B3BC42AAE13AC7E06
SHA-512:	65CF82E07FFD6E6065577A3D7CA1F18ACF9FD69E06E4152D2E6EFF8A795A5C7B7A6BCA5DDACA2AFF573657740442CF75691D7A2762574ABCC37C35D0EA848006
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <path d="m17.2485,21.8496v1.5448c0,2.3302,1.3617,4.0165,3.8883,4.0165,3.4854,0,3.8358-2.2649,3.8358-5.0979-2.1178-1.7358-5.3444-1.4294-7.7241-.4634Z" fill="#ffddbf"/>. <path d="m7.0274,22.313c0,2.8331.3511,5.0979,3.8363,5.0979,2.5217,0,3.862-1.6548,3.862-4.0165v-1.5448c-2.3691-.9761-5.5888-1.2633-7.6983.4634Z" fill="#ffddbf"/>. <path d="m25.475,11.3964c-.6489-.1836-1.3389-.3265-2.0599-.4635-.1714-2.3687-.6001-4.085-1.2871-5.1494-.7553-1.1154-1.8537-1.3301-3.2955-.6437-2.2956,1.0929-3.3676,1.0803-5.6642,0-1.4593-.6864-2.5578-.4717-3.2956.6437-.6864,1.0644-1.1161,2.7807-1.2876,5.1494l-.0775,3.0639c-.017-1.1329.0091-2.1545.0775-3.0639-.7214.137-1.402.2773-2.0598.4635-2.6092.7384-3.9135,1.6138-3.9135,2.6262,0,1.0299,1.3043,1.914,3.9135,2.6519,5.9115,1.6349,13.0382,1.6345,18.9498,0,2.6091-.7379,3.9134-1.6221,3.9134-2.6519

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/91842088/web/i/v2/components/store-badge/app-store/app-store-badge.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5856)
Category:	downloaded
Size (bytes):	5857
Entropy (8bit):	5.052030918499695
Encrypted:	false
SSDEEP:	48:jrSkqhEnzd3j3VVQC3QQzinA/uCb/C9LcYDBwgj40AzZ+gAwhEp4bE2EExLh7kLL:XtOQusCZ/kzjAeE9ExOwVQbYQvk8xvV
MD5:	B8817001660473057B0C5A0BF31BED43
SHA1:	122AEFB73ED4A03B4F74F910628E9AA21C81F756
SHA-256:	F605266A1CBE41D2872130680D7A2A39B16F4A274A8B502F59C1556C1CDF5C3F
SHA-512:	1CE142B6D8389A39D56FD28E3195BDFCAC3567FF29C0B786E04B2BD20A93D4AA0D8EA39A4FE57BD490F9C9CA8A662E3DBD08C6A18DEE7BCDF8DCAF8B52A75FD6
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/js/prebuild/nav.js
Preview:	!function(){"use strict";avm.define("navigation-oo-19798",function(){var e,s,n=avm.require("jquery"),o=avm.require("avast.url.unserialize"),i=(avm.require("avast.url.unserialize"),n(window)),t=n("body"),a=n(".js-navigation-oo-19798"),r=a.find("[data-first-menu]"),l=a.find("[data-second-menu]"),c=a.find(".js-back"),u=a.find(".js-toggle-menu"),d=a.find(".js-regions"),m=a.find(".js-regions-toggle"),f=a.find(".js-search-toggler"),v=n(".search-input"),g=["first-menu-for-home","first-menu-for-business","first-menu-for-partners","first-menu-about-us","first-menu-regions"],p=["second-menu-security","second-menu-privacy","second-menu-performance","second-menu-family","second-menu-bundles","second-menu-products","second-menu-press-center","second-menu-investors","second-menu-business-partners","second-menu-resources","second-menu-login"],h=a.find(".js-blogs"),b=a.find(".second-menu.blogs"),w=a.find(".js-hint-toggler"),C=a.find(".js-hint-close"),M=(window.getComputedStyle?window.getComputedStyle(

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6298)
Category:	downloaded
Size (bytes):	6332
Entropy (8bit):	5.322442783435324
Encrypted:	false
SSDEEP:	96:iq3DTDqIzsjFJtueU3c60AEQ1YgTITC88VeX7Hr2WqHrs6HrzWNY:iqleEE6UXmH
MD5:	AC531AFE629C7DC849A9D39D9D4AACBE
SHA1:	4DF9C9610969AC9384248E68ADE45E3451D45576
SHA-256:	EB08F534286B8AD3BBBB036419F8F4B490B2EDDC5877E98209E402544E1533CC
SHA-512:	B6C411377CBD7F4BBAB562086F90CA2D37D77583967BCD1829D4E0097A96289CBB37645D80D39CD7C9C961418440B50CBBE44E4C2375DC87385BA1063C514EB7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/pages/index.js
Preview:	function stopAutoplay(a){var b=document.querySelector("[data-name="+a+"]"),c=b.querySelector(".packed-control"),d=function(){medias.pause()},e=function(){medias.play()};c.addEventListener("mouseenter",d),c.addEventListener("mouseleave",e),c.addEventListener("click",function(){c.removeEventListener("mouseenter",d),c.removeEventListener("mouseleave",e)})}if("en-us"==avastGlobals.web.locale\|\|"en-gb"==avastGlobals.web.locale\|\|"en-ca"==avastGlobals.web.locale\|\|"en-au"==avastGlobals.web.locale\|\|"fr-fr"==avastGlobals.web.locale\|\|"fr-ch"==avastGlobals.web.locale\|\|"fr-ca"==avastGlobals.web.locale\|\|"de-de"==avastGlobals.web.locale\|\|"de-ch"==avastGlobals.web.locale){var medias=tns({container:".slider-medias",mode:"gallery",controlsContainer:".slider-medias-controls",navContainer:".slider-medias-navs",controlsPosition:"bottom",navPosition:"bottom",slideBy:"page",autoplay:!0,autoplayButtonOutput:!1,onInit:function(){stopAutoplay("slider-medias")}});avm.require("avast.web.slideCounter")(medias)}$(do

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	255
Entropy (8bit):	5.048990789969975
Encrypted:	false
SSDEEP:	6:qQQjg4LGfJMG3D+mYMoIKEKa7e4fg+RUX2XF/7fUIKIEL:cJLGfJHT+UoIKEKa7e41I2XFzUIKB
MD5:	0F5686DB1F844DBE5C857A8758C5B1F5
SHA1:	FA082E896CD43E19A7E3A78CD1885B29B1ED7C56
SHA-256:	EF3D4C61563A73FCB45D4CE329C24ED53D44F0330E71224470779D8461F7AFF5
SHA-512:	EE12E01B0CE0BF857FF4C549DEFF4511E0D7BBA37A89018A38D11BC1A477DC263355712F38F90A8735363C88729E16275530C63D14B7195DFFEBA3A9A7C8D5A8
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/lp/lp-safe-emailing.js
Preview:	!function(){"use strict";function a(){"undefined"!=typeof avastGlobals.client&&(window.location.href="lp-safe-emailing-win-browser?brcmpgid=6306")}window.addEventListener("clientLoaded",function(){a()}),a()}();.//# sourceMappingURL=lp-safe-emailing.js.map

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5194
Entropy (8bit):	3.976628767895142
Encrypted:	false
SSDEEP:	96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV
MD5:	63E737D3544164D2B7F4FBCA416AC807
SHA1:	030370AA38715E4C41589633F69D0BFE8255D46C
SHA-256:	5FA00D047ACD959697B9D7772C31DCD37BEC33C70C6FBF80AB8316205D1D286D
SHA-512:	31EE1BB536C0E50F5568A415EA3308367BFCFD11D2A6F7DFF1C8E3A982F7BE790C240A603CD4C6E187672824B8E5D07646049A28C6A88A7B001EB9A0142F312B
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Preview:	<svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83 0 01.74.77 2.25 2.25 0 01.25 1.07 2.26 2.26 0 01-.25 1.08 1.77 1.77 0 01-.74.77 2.55 2.55 0 01-1.28.29H.66v-.72h1.59a1.81 1.81 0 00.87-.19 1.1 1.1 0 00.48-.5 1.73 1.73 0 00.15-.73A1.66 1.66 0 003.6 7a1.1 1.1 0 00-.48-.5 1.86 1.86 0 00-.88-.18H.81v6zm7.74.1a2.29 2.29 0 01-1.2-.32 2.29 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.6 0 00.5-.69 2.9 2.9 0 00.16-.94 2.85 2.85 0 00-.16-.94 1.67 1.67 0 00-.5-.71 1.37 1.37 0 00-.85-.26 1.35 1.35 0 00-.85.26 1.67 1.67 0 00-.5.71 2.85 2.85 0 00-.16.94 2.9 2.9 0 00.16.94 1.6 1.6 0 00.5.69 1.29 1.29 0 00.85.27zm4.43.59l-1.54-5h.82l1.08 3

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.987289583764496
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9GBVlmAmYHZAAbBAA8ckHeE0:tI9mc4slzcWER9j9EmqZlllH
MD5:	957C5C2E48799915D4F59B5662106A5B
SHA1:	21C196C0C143793B54A8C080F0C1AD4434014517
SHA-256:	022FFE557E2191A389DB907EF5131A82438FFE864014FB6656AE849DD00C0773
SHA-512:	6E1D5C4BCDE72A476A2E9930A3D529051A00C03569E1CBDC1D1DBCF8FBCBE6C2D9BEC4CA64F3D530124FC94EEDFC9F026D481BFFF3FA249F32222999D720F0C3
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#4E22D0" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M10 2L4 8l6 6"/></svg>

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1372
Entropy (8bit):	5.109952293136637
Encrypted:	false
SSDEEP:	24:2dAAfgl4z7OWWqXsuqtCNRMx2K5GY7OWWqXCuqt89WxMwLhllld9mGZNMjLhlllR:cZ84zyWWPuqikkWWfuq6/GZNw
MD5:	CD19091C7015ABBB49BB204D76711ECA
SHA1:	EB9A50F7AC2F6280D532B0A786CE88C510857A89
SHA-256:	F138B5DA80CD45CF44CD64418F425BF2804E0BA945D18BD7C08EE77E591AB659
SHA-512:	610871598DAD710F3D8795AABBD0A2F2CF4780133DE71AB5144EF1893A86ACF4393914B9C3CCE7C958BEC4417CEB4FA22AF432C0B80FA7BB755DAE37776E9B8F
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/what_is_a_computer_virus_academy_refresh/icon-02.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <path d="M9.8296,16.7702l6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.0711-.337,1.4773-1.0714,1.2199-2.2015l-6.9903-26.1788c-.3376-1.1103-1.0616-1.5368-2.1719-1.2794L13.3106,10.7909" fill="#ff5833" fill-rule="evenodd"/>. <g>. <path d="M9.7508,11.332c.2777,1.1103-.1487,1.825-1.2788,2.1423l-3.0051,.803,6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.0711-.337,1.4773-1.0714,1.2199-2.2015L28.1052,5.0255c-.3376-1.1103-1.0616-1.5368-2.1719-1.2794L8.9478,8.2979l.803,3.0341Zm-.803-3.0341l-3.481,5.9794" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <g>. <path d="M14.8444,24.0796l5.8282,3.3377c.6316,.3617,1.4367,.1473,1.8049-.4806l3.4093-5.8146" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10002223/web/i/v3/components/avast-logos/avast-logo-inverse.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	186
Entropy (8bit):	4.9466765885296295
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9fDlWRFAmYHZAAbBAA8ckHeE0:tI9mc4slzcWER9j9fhWR6mqZlllH
MD5:	A3700FCEADB2AB0EA5D6165EFAF02F22
SHA1:	551763DD62816F00B6D42C44892637077128C2A7
SHA-256:	015F2F037FCBED958E69C050DB47D7C844DDA675FDB1B964DF281193BC93FD5C
SHA-512:	515E5CF1B7F7DD0044A51AB750B8B723450A978FA60EDA73FC65D9E0E456EC094363DBC8613C65EB72B477288CA1CF01FE61494148031A77CFD6B7B8D4085BA5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/back-s-white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M10 2L4 8l6 6"/></svg>

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	15238
Entropy (8bit):	7.9666070443885975
Encrypted:	false
SSDEEP:	384:efxiL5DOlqgKclfkiJIWDrIvyNrF9hvZuH71YbNhsrz99YU6SbXykjW:qxiluqg/j8Dbu58z916SG
MD5:	B2A06877A8CCE4B5683A3913DEF5645A
SHA1:	A4BD3A319442C70BF9C6AC43778038674DAFC205
SHA-256:	5BCCDF1385566D676AD62B611860437D08AC4C9AC8709D7E9C60109BDBF5A70E
SHA-512:	2AED61C78E2D708863FB74170BF30D96633F90FB121596B040559792681E532FB0291E4952318CF6BEE7AEC9577E87365F83ACD4AD31741EE53BED40F720A27F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/aim/img/_components/dtyp-thumbup.png
Preview:	RIFF~;..WEBPVP8X...........)..ALPH.-...........^..; "..m...e.=Bo..#. e=..%..S..8k-...a.V.....w(...<.P.....o.\0.+C..L........:_[..d.dR....v.B..b......N/.s..Z...u...W.._7!...$../.om.y.m..........!J`.7.;;.........P.J@.,a.$.E...q..1.~.m..h...t0(A%..u0.`......&\|2<...B......sz<c...("&.~\|9......}.s..V3w....%'....!.7...V.J......}.g......Y..G.&....5I.L/..E4.:.oy8O%.&.\.O.T.J`:$G.R...6.R.Bb...QS.NF....fC..C..k..S.@=f...U.r...Z...#S..W..\|....^sd:....M..pd0<l6&...y...k./..S.z.,L'.......o..V..`.-.. _.28.}LL.R.y...\|...n9...:5.z./...V[U..w.W..7.j.......9\|.p6..Q....j...25,.(t...lU.:..l&L.['...o.1.Zf..A..5~a.a...{....Bj...?.c....D1,[a......".[Zb...:.U......}.:ci.._:.....K...y..D.j.c...P..........A..........WA....C......@.........,_...[.....`.O.t..}....-?.~t.B.y~.v{.......'.B.b.....K/...?5x......'`^.MO.R.^.$.w..Yz.V.D...dSG_R..y...`.B.q:../......8%.V.Z..k..2..Kz^..Q...Z~R]..K....n..~@.qzN...:.>..iY..xE.0?.~t...z..o.+b.-?.R.9.u.

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5762
Entropy (8bit):	5.106105673726928
Encrypted:	false
SSDEEP:	96:eL1ZZRvumfSrvUOZxxTGCOB+hSGluB+huLDyPP8cgc1PBgVJRyM:eLDZ4zrvUOPxCCU+hSG6+huM5Enz
MD5:	45D1842A532D5CD77F0A0452B7142B2A
SHA1:	523A4B108D1A010AD6AA2D3F05FBB64A61CDF030
SHA-256:	CD83CD7F0DC0E81FF9D5E857E9E25A42AAAA5A8DC2BCEC0A06E8E018989CF2CF
SHA-512:	2C2CFFAA7BFA71841CBD7B02EA52A148C46D16A12A305111EE2694480230BB49FD6F3E4A042BBD7D641344B8FA32499B6FEC8C4ED0B28A2D60DD1B8F29E5D43F
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	4.083203542470353
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7lJ/09Q9s4w76ODtzfcIsCvWIK+5B+jV9Pp:9LNV2onc/z7w76gzfcINj5Erx
MD5:	6672B70FD96AC4F96B0AE2062123A841
SHA1:	56BC3CEC1806A655931EC78812E3DBBBD640607F
SHA-256:	954D5CF01AE876E8AC27E08326750D0596F63BC0D3D1986DC611DA352BF451E4
SHA-512:	4B4A39C9EC6CB012B23916FB9DD116AAE3379D5815F43D6D2A24B693DE830DB1EC69D7ECC0CBE648FA60D19A5DAD0395E007E30F464421A7E9D0F0C93C0021A9
Malicious:	false
Reputation:	low
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104701
Entropy (8bit):	7.98697235116745
Encrypted:	false
SSDEEP:	1536:aStJPArc60WsgUav+GgrlpklHDG43D7qGKxTq6AMq7j0SKj3Hz/z2WLv1:nJYTsdav+GgPkJ13I8noJj3zzt1
MD5:	5EB3B3EE5360FD8E797BBD70BE7DB1B4
SHA1:	B609E419629F5B45DF186F55B07549D1094AD080
SHA-256:	F53596A4A29BC3EA7436D16B6F396AAC57F6E5C538F52BF89E1141B22745F6E8
SHA-512:	B37138CF811098655683BB0505810958B809F9299BAE2ADFA7E50EAC9CA84448C5D5C41C2C101E9E0C15F321149C57A57D8583E4F22809DCB62326AB8CBABB74
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X.........r5......orNT..w.....IDATx...y..Wz........gbK$v...})n...}.T.n.e.h4#.my<.#.as.....G......Kv...ek.V..F.H...}.2.{..}.9....E&....$...S....}y....>.y....by..N]. N.$....N.~E....kH@.Hk./.X......g.g..5R..%X,.....~......;.....k.r........rW..K._...l....#B.....Z-n......5%e.........._..b.......X,...N.<...m..(-^-....KB.o.;.....!.B.(..........=w.......C{.%..{......x..~i...#..,.....;....I..Y:..5?..~Z......H)....b..W.r..uU.W.]....._..._....W.Br.d...}<+...I..,..f......... .Y.kx..Oi.....0S9....."g......;..Z.n.AP..r.a..=.2<<rrvvF....W>.j.X>b...X,k.../....;_..8.4.z..)....%`#.-..t$RH....v.*'O....cLNN!Ds].....;;;..................[,.....~.....Qq....$.<...8...i..h...\|.c`.....055...'x...LLL..B:.q..U.0.....?X....R~..~....#..,..f(..Io...=..\|I.C....'...C)%Zk&''.......x.....8Hy............/~~.......K.X,.1V`Y,.O-G.N..Y`ii.8.q.z.R{....Z.0>..H)...R.p..Y..:..1.2.....N.QZg..r..u?..G.....X,.1V`Y,.O%.....:}...{.R..R.>....\|....-.....8.k5.^....'9z.

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.120838366800474
Encrypted:	false
SSDEEP:	6:tnrhRcQ9tumc4sl7vrERIxkAl9jS04/qmqZllv:trhy4uJlBlBSdShllv
MD5:	E05C250261453D8437F2C957A7423B1B
SHA1:	F9D5873206EB92AA4840D3A888FBB0461F91CD89
SHA-256:	7B71172BCB0341F29607766E9AE2E2ECF698D9ED72EBC393C933318741A14C2D
SHA-512:	D68BCEE9E3F633F04548281D2F2E4BF741030D799FA1734119B7EF9A8BCD34E15588B37CBE8B39CF777AE1CC79922B7DD73B0AE8137BC385AF505ACD28D28E07
Malicious:	false
Reputation:	low
Preview:	<svg width="52" height="51" viewBox="0 0 52 51" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M2 49.501V1.50098H50" stroke="#FF7800" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	5655
Entropy (8bit):	7.886020216347696
Encrypted:	false
SSDEEP:	96:rGg6a0wRH5zl/4Dtykvg/olu5NdFQ2jAizAn1jVIuqSDrSUtOSug8hWwiGI585:rGa045Z/4RymYecTQ28ic1Bq/gOSN8hD
MD5:	DE8262DC78DAA2F3C23624557B189D5C
SHA1:	9C7376BE48C9B9EE3FA14F1F40241D9B6C2CA5C6
SHA-256:	4543F5512C9BF63C2ECA1103C7A4C6D1458EBA3A3B3A2FDF50EF8EA69A7C7FD6
SHA-512:	E731355E2E8F4113A64A0E48C6FA6B26A385EC475357021CFB6E1EEB62B75F5E6E1DD496621CFCA2CB74BF947AD8FBE4C016FCA0BA848CCC05CF29CA52AAB511
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-carousel.png?width=580
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...................F.....................8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......X........pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......X........pixi............ipma..........................iref........auxl.........cmdat.....&%~...2...`.@P.?^j.W[.o..t.A?.?#.i.J.Y.X\|.W.!...w..P\|.Z6.K..Y8.O]>2.....:.K..?...vB.O......(.[..NL6A.Q...d7.r.0...............N...c..h..;.#O&.C#.. <<$.v.PC;5m..BT.[m.Q......^..=G.....K......i.....0No..7.{.I}.1....R.7l.[Q'k.K..ct...F........V...o....s.t.. .y@..[.(.x%._0B.A.."^.P.[.>...P..p@.....fu.I..,..O ....{...#.Y(.E.....\|............../ik.....U...?&............h&B...U.^S....Q/.j.w...... e......F...[^)..C\...[f...7....a....h.z(.V..gMT.z..Z{.E!...G...b.3HG.....n\|.z7U..a .D...mZM.h....s.....k.\|.._.kS.7GJ...XN\.L.......s....

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2050
Entropy (8bit):	4.535583369231597
Encrypted:	false
SSDEEP:	48:c/dFpl5+5lSeC1+XTAj/L/T+zfFBTl5+BAxAjUaEaTYyWz+AD:arpf+7S51CAX/TiFdf+BAxANvY5z3D
MD5:	928CA01F2EE63C298CAD657CDB7575DC
SHA1:	F5C753A41F45D4433E97596E3F34CCF5E31F3932
SHA-256:	5A93336B4C154ACD04A3BD927F05026C6EE568540190CF6B3BC42AAE13AC7E06
SHA-512:	65CF82E07FFD6E6065577A3D7CA1F18ACF9FD69E06E4152D2E6EFF8A795A5C7B7A6BCA5DDACA2AFF573657740442CF75691D7A2762574ABCC37C35D0EA848006
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <path d="m17.2485,21.8496v1.5448c0,2.3302,1.3617,4.0165,3.8883,4.0165,3.4854,0,3.8358-2.2649,3.8358-5.0979-2.1178-1.7358-5.3444-1.4294-7.7241-.4634Z" fill="#ffddbf"/>. <path d="m7.0274,22.313c0,2.8331.3511,5.0979,3.8363,5.0979,2.5217,0,3.862-1.6548,3.862-4.0165v-1.5448c-2.3691-.9761-5.5888-1.2633-7.6983.4634Z" fill="#ffddbf"/>. <path d="m25.475,11.3964c-.6489-.1836-1.3389-.3265-2.0599-.4635-.1714-2.3687-.6001-4.085-1.2871-5.1494-.7553-1.1154-1.8537-1.3301-3.2955-.6437-2.2956,1.0929-3.3676,1.0803-5.6642,0-1.4593-.6864-2.5578-.4717-3.2956.6437-.6864,1.0644-1.1161,2.7807-1.2876,5.1494l-.0775,3.0639c-.017-1.1329.0091-2.1545.0775-3.0639-.7214.137-1.402.2773-2.0598.4635-2.6092.7384-3.9135,1.6138-3.9135,2.6262,0,1.0299,1.3043,1.914,3.9135,2.6519,5.9115,1.6349,13.0382,1.6345,18.9498,0,2.6091-.7379,3.9134-1.6221,3.9134-2.6519

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65098)
Category:	downloaded
Size (bytes):	213725
Entropy (8bit):	5.361679936162521
Encrypted:	false
SSDEEP:	3072:z63NGm+mJgNeQQi8iqGHIKnJUtpT+BsbNLZ9ip0q:INGmYaGH5Urcso0q
MD5:	F1D54743DBCC9A03EB08F14D0DE65DA4
SHA1:	16B96431016B503517462F0797901AD8DAC94481
SHA-256:	4E973E1B8E6B798931086CF372B83E40C417E33C0922087DAD0EB2F89FA891AC
SHA-512:	209CC5643F2EFEB7E0EDD8CF015FCFF122BC355FE89694650A0CE7761FA1B22284A26CE218FE6A5337E9DCA6F7704A7AE523B997413338FF98AE10FC54804736
Malicious:	false
Reputation:	low
URL:	https://s.go-mpulse.net/boomerang/9K3EU-JY7U6-TD3RC-2KCEC-AH4A8
Preview:	/. Copyright (c) 2011, Yahoo! Inc. All rights reserved.. * Copyright (c) 2011-2012, Log-Normal, Inc. All rights reserved.. * Copyright (c) 2012-2017, SOASTA, Inc. All rights reserved.. * Copyright (c) 2017-2022, Akamai Technologies, Inc. All rights reserved.. * Copyrights licensed under the BSD License. See the accompanying LICENSE.txt file for terms.. /./ Boomerang Version: 1.766.0 c28975a504c1aa46de14fe358f4875ace2917401 */..BOOMR_start=(new Date).getTime();function BOOMR_check_doc_domain(e){if(window){if(!e){if(window.parent===window\|\|!document.getElementById("boomr-if-as"))return;if(window.BOOMR&&BOOMR.boomerang_frame&&BOOMR.window)try{BOOMR.boomerang_frame.document.domain!==BOOMR.window.document.domain&&(BOOMR.boomerang_frame.document.domain=BOOMR.window.document.domain)}catch(t){BOOMR.isCrossOriginError(t)\|\|BOOMR.addError(t,"BOOMR_check_doc_domain.domainFix")}e=document.domain}if(e&&-1!==e.indexOf(".")&&window.parent){try{window.parent.document;return}catch(t){try{document

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4661
Entropy (8bit):	4.289945951414576
Encrypted:	false
SSDEEP:	96:YCsKv1sDlOdAwOYbOuQr9Nv1s7MMc5CY+Z5tjNQOAt/dV42GLQ:VvSpfwOYbOLfvS4WftjbQd+tLQ
MD5:	80DF532E02EAEC08EF491B4B4420AB14
SHA1:	5860F53B875350C2559F598A42A13E5B25045CE6
SHA-256:	6781CC289EF1A3359AC96F7D84A0EB0BEF8B8D001FAB80EE8B74C6CFB8B8C805
SHA-512:	C1271A569373BE2B8BA3E570B5BE90605B535FC541878C7E9ED1AE701B990A72E05FC581BFA32D9F41B48A89F1B82920E803DA670D1892BA9100B6F7FA1DB937
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/illustrations/dtyp-thumb-sm.svg
Preview:	<svg width="200" height="146" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M.584 48.47c.859.984 1.846.505 2.83-.354.983-.859 1.59-1.773.73-2.756a2.364 2.364 0 00-3.56 3.11z" fill="#0070F6"/><path d="M29.272 75.75c-1.874-.915-3.03.4-3.946 2.274-.916 1.873-.249 2.706 1.624 3.621 1.874.916 3.14 1.028 4.056-.845a3.775 3.775 0 00-1.734-5.05z" fill="#21455C"/><path d="M114.424 33.25c1.375 1.713 3.068.978 4.782-.398 1.713-1.375 1.451-2.468.076-4.18-1.376-1.714-2.533-2.39-4.246-1.014a3.978 3.978 0 00-.612 5.592z" fill="#D93511"/><path d="M20.526 132a3.158 3.158 0 100-6.316 3.158 3.158 0 000 6.316z" fill="#21455C"/><path opacity=".8" d="M154.737 100.948a2.103 2.103 0 01-2.105 2.105 2.103 2.103 0 01-2.106-2.105c0-1.165.941-2.106 2.106-2.106 1.119 0 2.105.94 2.105 2.106z" fill="#0070F6"/><path opacity=".64" d="M83.161 127.374c2.047 5.696 10.983 3.982 10.983 3.982s6.564-3.285 4.517-8.981c-2.046-5.697-1.606-7.957-10.136-6.658-5.984.911-7.41 5.961-5.364 11.657z" fill="#9AE437

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	440
Entropy (8bit):	5.096102752005268
Encrypted:	false
SSDEEP:	12:tr9RJAuC37viD1DfSoSt4LaL2gC6jAm6x74q4Yhll7:tJRJAu+7viDdqouAZ74q4Yhll7
MD5:	C5DB236E6F64D30313FDAFC455C1CEED
SHA1:	D665037543D0F8DC69743B368EB252531D571AC8
SHA-256:	BC3E2B58759CDBDB4F42A7BAB15602D04AFB88EDD12C9E77F7B0A7DAB40A9FB1
SHA-512:	A8B275686E2D60A9758AA39E3FE4439ADC55FFBFE9A18287A01815ED2CA62C41411AD6E5D4F5D2D666BCFB2620E79A0E714E5CF380EA4EE7BE25125E2B5F81D4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/pages/about/play-button.svg
Preview:	<svg width="100" height="100" fill="none" xmlns="http://www.w3.org/2000/svg"><circle opacity=".32" cx="50" cy="50" r="50" fill="#071D2B"/><circle cx="50" cy="50" fill="#fff" r="32"/><path d="M41.5 39.656c0-1.994 2.22-3.185 3.881-2.084l15.61 10.344c1.492.989 1.492 3.18 0 4.168l-15.61 10.344c-1.662 1.102-3.881-.09-3.881-2.084V39.656z" fill="#071D2B" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout?
Preview:	<html></html>

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (972)
Category:	downloaded
Size (bytes):	1010
Entropy (8bit):	5.013859345459063
Encrypted:	false
SSDEEP:	24:bRRpKGkIgdOyMVRF6yGRRpWORR19hrIbXZyXLd:btcdrMVjPGtt/lIb0B
MD5:	2C31476E4A42056CE5898EA8B4FB6D18
SHA1:	4447ED0AAD40E9F79A73EA6D5B49FB9C692C26F4
SHA-256:	4AB1F474E4841BB4F871A578F69D0F19F97BEB7E7FEAC50A7A28ED5113428894
SHA-512:	92A3CB693FEC9BADEC591BDA7B176399EA519997DF9B88EF83776EF03BA5F7E4F20B228C0D8D6447AAA0D8939F97AF6C1D3F85169B9625C284EAAC15AA505F7C
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/vendor/one-trust.js
Preview:	function OptanonWrapper(){var a=document.getElementById("onetrust-consent-sdk");document.body.prepend(a),function(a){var b="; "+document.cookie,c=b.split("; "+a+"=");if(2==c.length)return c.pop().split(";").shift()}("OptanonAlertBoxClosed")\|\|($(".ot-accordion-layout button").attr("aria-expanded","true"),$(".ot-pc-footer .ot-pc-refuse-all-handler").length>0&&$(".ot-pc-footer .ot-pc-refuse-all-handler").insertAfter("#accept-recommended-btn-handler"));const b=navigator.globalPrivacyControl;if(b){document.getElementById("onetrust-consent-sdk").classList.toggle("gpc-detected")}var c=document.querySelector(".gpc-on"),d=document.getElementById("cookieGPCControlButton"),e=document.querySelector(".banner-actions-container");c&&(e.appendChild(d),b?d.addEventListener("click",function(){OneTrust.Close(),document.body.classList.remove("ot-overflow-hidden")}):d.addEventListener("click",function(){OneTrust.AllowAll(),document.body.classList.remove("ot-overflow-hidden")}))}.//# sourceMappingURL=one-tr

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	43043
Entropy (8bit):	4.962717584097643
Encrypted:	false
SSDEEP:	384:lJJI/s9vcKS5Dwvj/3mhVRweqV6nKElg5ka5JW7QDchsn23hFa4Qma1EXMqCGgnU:EIfS6a0Ihs2WCAbJWnmk0KJJ
MD5:	1A6805C49ACD98690EC6B24F6C15D719
SHA1:	70AEEB2F4EBD36A426D2CA2F9729C4FC3CB87C9D
SHA-256:	0360B7A141E00D88183C2EF15B4719825564598C2AAEC00ED994EC7ECFBB1BA9
SHA-512:	95545D1FFE3371784B18819C8C4ECA83F37DDBB0BD871899F035982AC31EF44F3FD8F7B5A40E0C240C8722E571D18FFC48D133096B6FB00A1B7D8C531031DC40
Malicious:	false
Reputation:	low
Preview:	<svg width="24" height="1248" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" r="12" fill="#fff"/><mask id="a" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="24" height="24"><circle cx="12" cy="12" r="12" fill="#fff"/></mask><g mask="url(#a)"><path d="M12 23.5C5.649 23.5.5 18.351.5 12S5.649.5 12 .5 23.5 5.649 23.5 12 18.351 23.5 12 23.5z" fill="#F7FAFC" stroke="#E1EAF0"/><path fill-rule="evenodd" clip-rule="evenodd" d="M16.965 22.928C21.115 21.039 24 16.856 24 12c0-.219-.006-.437-.017-.653l-1.107-1.086a.828.828 0 00-1.28.149l-.144.229a.252.252 0 00.07.341l.292.204c.17.117.227.342.134.526l-1.022 2.03c-.11.218-.4.406-.644.395a.857.857 0 01-.618-.307l-1.758-2.11a.43.43 0 00-.66.549l1.759 2.11c.328.393.816.62 1.33.616.478-.003.794.5.604.94l-1.764 4.078a4.133 4.133 0 01-.625 1.014l-1.585 1.903zm-.09.04A11.958 11.958 0 0112 24C5.373 24 0 18.628 0 12 0 5.373 5.373 0 12 0c.596 0 1.181.043 1.754.127l.808.988c.097.118.12.281.06.422l-.556 1.3a.187.187

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	38496
Entropy (8bit):	7.99152590040494
Encrypted:	true
SSDEEP:	768:+3c1xAkHNdE50OBHIJSrJDBSh/f62KljNM8j5yHhwEXeDrdr0:CK7E50OZrVBc4j5lshwEXIrp0
MD5:	A67D4E2CCF6216F0F7E1F0D88E69D825
SHA1:	3873A52E854514971E19D3D46E1434B37E3716ED
SHA-256:	35F652AC0A66633C80600FA0DC264EB0958D72BE634D63FF368EF81F4C300874
SHA-512:	22062C608B8A7EF65E0D5686F81BF771537E3C8F2271C57F98E4580CEA26EE8DBB4BCF8DDAD7D6CA4F83354FF7C235154629434A4A9E73C747E8BE9B61337694
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware-EN.png?width=1684&height=1200&name=Types-of-Malware-EN.png
Preview:	RIFFX...WEBPVP8LK.../..+.?.!.$..,.c./.../..z.?.p.I..4..{..Z......op.I......y$..D...=.l#U.`..`..0..H...#F...qD...."Ed..QD..`.m.m2.\|..F.7.\|..fh.w...&...B..r]n...)4...R.1...D.A".)O.Cy1.q..0..............,\|.`%.k.._.l...........6`1t.].a2...bHJ..#r;1.Hh.....R...[.%F...o...q* ..d.`......9B."E.A..)."Q.V.7k..&>...sfr. ..:F...\|.T...6.rs..A-.p....j.....q...lp.0.e....}...;......F.$Irw..3.z..........~..D<{..d....e_....zD..i..vn..+..k.......O.;kT..............A....u+4~.(_C..V.c..i....]g.W~.GNo...x.....@.....d..7.>..O..77..o.r@.{..y8.../...........=.7..#..2m0Z..=.....u...n... ."..:.xs..:qm:Q......J.yT.RE.W....g.R..q8.4\|).z.M.O..6..=..I..$V.n..+@......,!$b`..P.=...e..!T...=R....9,......Y...*..>..e..S......K.l+j..`.......$.T....$I..K.......E}...P%"&...8.l..~G...m.q.....a......C.....HRW.e]T..m...U...^..E.T.......".......eB..9j.}5G.a.B.$.....g.....@..d...#<2"DD.e..6.}m.4...U.M:o>~'...C...4\|.................................\|.?.?.?.?_..w.....'"..?.B.'.m\|"..%.u.......

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.125690883199848
Encrypted:	false
SSDEEP:	96:jrpDczmboPWKGMUgEY2pYYtD/RUEOcLLkUBcb/7EmDlLk4OYtcHRUyKWc4LKgPKg:/pQaU+RMrIYYtD/6wyXEmptOYtcH6yOe
MD5:	7F66FC5E3A9918651007A95CAC6F6C16
SHA1:	6884415E530A725E957FFC9B23DC457376A21487
SHA-256:	EBD65E90FF5AB91E3C327867A28C9729FDF1C312E75C56E05A3F4BC861D47556
SHA-512:	8389C055A75579F93F711AC27130F13513CAB59E7C063D10324D053B94161861979F4ABECBF2095B36608E577F13C9773E57C2D36B3E7B876C580DCE9C79362B
Malicious:	false
Reputation:	low
Preview:	<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M38.44 14.855l-1.174 2.512-2.725.345 1.995 1.885-.516 2.69 2.42-1.32 2.42 1.32-.515-2.69 1.995-1.885-2.724-.345-1.175-2.512zM7.352 35.322a1.39 1.39 0 102.778 0 1.39 1.39 0 00-2.778 0zm2.66-24.526a1.39 1.39 0 102.779 0 1.39 1.39 0 00-2.78 0z" stroke="#FFD900" stroke-width="1.5" stroke-linejoin="round"/><path d="M11.897 24.769a.75.75 0 10-1.27.797l1.27-.797zm6.761 17.63a.75.75 0 001.423-.476l-1.423.475zm3.714-33.082l.094.744a.75.75 0 00.585-.426l-.68-.318zm1.627-3.477l.679-.318a.75.75 0 00-1.359 0l.68.318zm-2.637 6.564l.736.142a.75.75 0 00-.221-.687l-.515.545zm-2.763-2.61l-.095-.744a.75.75 0 00-.42 1.29l.515-.546zm5.4 4.508l.359-.658a.75.75 0 00-.718 0l.359.658zm-3.351 1.828l-.737-.141a.75.75 0 001.096.8l-.36-.66zm4.978-6.813l-.68.318a.75.75 0 00.585.426l.095-.744zm1.01 3.087l-.515-.545a.75.75 0 00-.222.687l.737-.142zm2.763-2.61l.515.546a.75.75 0 00-.421-1.29l-.094.744zm-2.05 6.336l-.359.658a.75.75 0 001.

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	872
Entropy (8bit):	4.240395450257712
Encrypted:	false
SSDEEP:	24:tY1EuJKSeLQxevyMlw0AAiA/YYfUL7Gpjn:YISeMevFX/xsel
MD5:	D3C6807718E415C9FE487EF1ED95DF48
SHA1:	CAB5F7524E8E3725CBC7B1E8326A594EEE62B0B6
SHA-256:	0C1EB13462651387D238B31A04D0C31B7785071CB4901CBE9E6597B78DCDB37D
SHA-512:	D32DA29A7652E3DA675EADBFD5F5CDE277A22749E4C51A5AB1EFF4F4E5DDA85A89254333FAAAC131A8E09C2CF760038FF7AA57E24D09BF99337DE296A8D8AB27
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/quote-redesign.svg
Preview:	<svg width="24" height="18" viewBox="0 0 24 18" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13 11.726C13 6.80351 16.5682 1.66376 22.2332 0.177044C22.6794 0.0599559 23.1364 0.295646 23.3301 0.714252L23.5321 1.1507C23.7762 1.67797 23.5162 2.30096 23.0302 2.6194C21.5425 3.59421 20.2956 5.38572 19.8061 6.94382C19.6462 7.45283 20.0236 7.92861 20.5266 8.10655C22.5503 8.82245 24 10.7521 24 13.022C24 16.204 21.416 18.001 18.801 18.001C15.786 18.001 13 15.696 13 11.726ZM0 11.726C0 6.80351 3.56816 1.66376 9.23324 0.177044C9.6794 0.0599558 10.1364 0.295646 10.3301 0.714251L10.5321 1.1507C10.7762 1.67797 10.5162 2.30096 10.0302 2.6194C8.54252 3.59421 7.29557 5.38572 6.8061 6.94382C6.6462 7.45283 7.02357 7.92861 7.52657 8.10655C9.55032 8.82245 11 10.7521 11 13.022C11 16.204 8.416 18.001 5.801 18.001C2.786 18.001 0 15.696 0 11.726Z" fill="#FF7800"/>..</svg>..

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10002223/web/i/v2/components/logos/avast-logos/avast-logo-inverse.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.096102752005268
Encrypted:	false
SSDEEP:	12:tr9RJAuC37viD1DfSoSt4LaL2gC6jAm6x74q4Yhll7:tJRJAu+7viDdqouAZ74q4Yhll7
MD5:	C5DB236E6F64D30313FDAFC455C1CEED
SHA1:	D665037543D0F8DC69743B368EB252531D571AC8
SHA-256:	BC3E2B58759CDBDB4F42A7BAB15602D04AFB88EDD12C9E77F7B0A7DAB40A9FB1
SHA-512:	A8B275686E2D60A9758AA39E3FE4439ADC55FFBFE9A18287A01815ED2CA62C41411AD6E5D4F5D2D666BCFB2620E79A0E714E5CF380EA4EE7BE25125E2B5F81D4
Malicious:	false
Reputation:	low
Preview:	<svg width="100" height="100" fill="none" xmlns="http://www.w3.org/2000/svg"><circle opacity=".32" cx="50" cy="50" r="50" fill="#071D2B"/><circle cx="50" cy="50" fill="#fff" r="32"/><path d="M41.5 39.656c0-1.994 2.22-3.185 3.881-2.084l15.61 10.344c1.492.989 1.492 3.18 0 4.168l-15.61 10.344c-1.662 1.102-3.881-.09-3.881-2.084V39.656z" fill="#071D2B" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9507
Entropy (8bit):	5.3592270038592424
Encrypted:	false
SSDEEP:	192:ebkfPUyAQgtNBIWguxw68uCItctpwfTh3fYwuoOE5YBTi+1POyj/0Pp5b5LfvEf0:PSN9cO51r
MD5:	4D67D7FCE83E8D073C84E4D5B5936E71
SHA1:	E02711957EA1C637BE41485526C65E4B56C55FD3
SHA-256:	1DA25CF82F065474AADCE40A8C7369F6DF48E1847CB95C21BD9083488EFF7390
SHA-512:	1E9D7565BEF92D1C2DA126245D6392176D29A4BE7F1B4623FB367B4C345AA5381EB9022ECD3317CC946B48E2AF89073C80EDCEE0FC121073C88643B191D8E4D0
Malicious:	false
Reputation:	low
Preview:	. {. "name": "otCenterRounded",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZXRydXN0LXBvbGljeS10ZXh0Ij48ZGl2IGNsYXNzPSJvdC1zZGstcm93Ij48ZGl2IGlkPSJvbmV0cnVzdC1ncm91cC1jb250YWluZXIiIGNsYXNzPSJvdC1zZGstdHdlbHZlIG90LXNkay1jb2x1bW5zIj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3kiPjxkaXYgY2xhc3M9ImJhbm5lci1oZWFkZXIiPjxkaXYgY2xhc3M9ImJhbm5lcl9sb2dvIj48L2Rpdj48L2Rpdj48aDIgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgaWQ9ImJhbm5lci1vcHRpb25zIj48ZGl2IGNsYXNzPSJiYW5uZXItb3B0aW9uIj48YnV0dG9uIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIiBjbGFzcz0iYmFubmVyLW9wdGlvbi1pbnB1dCI+PHNwYW4gY2xhc3M9ImJhb

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.366634665454505
Encrypted:	false
SSDEEP:	3:CUdlG9h/:Xl2/
MD5:	BFF56CE49DD485D195FDFA0A02342568
SHA1:	74FB4071DEAB7D3AB083562067B735DF32C43397
SHA-256:	0E4B1E428A2198EF747010C094101C257B568A97CDCC0F31ED5E9868CC835B39
SHA-512:	15BC2B5B57144C4F71DC203E16B0F7235EC5E659532D5BAFFD3E91D57CEC61D36CA1B7EA28156AB11A3FA46982FE252A58410D7ADF6693C93EDCCA2B2FA1ABB8
Malicious:	false
Reputation:	low
URL:	https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A50%20GMT&n=-1&b=Avast%20About%20us%20%7C%20About%20AVAST%20Software&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 469, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	54536
Entropy (8bit):	7.984946306471293
Encrypted:	false
SSDEEP:	1536:lg5t+x4HT3w03hbI2j93DAQxZh6dTLkSA/Y:oz3w0xHV3xZwLiw
MD5:	832D207427225CC727C9FCCB1E5ABE61
SHA1:	7FD8A0ED35E88E93E5885FB388C3B2F8BB4546A9
SHA-256:	02DB4DCFF6CA3BDA30F9AE509685FED95FD9DF8C030E38B210E011C1EDA75D2D
SHA-512:	7FF8CDBE396A99C4075AE878694B43844DC1FCFB4AA5CC1E45E3A7387E1FFB96F57B8D648963363ABE829C6FAA46162D1F0EAB8E2E1470C6C0F8758C669E2018
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X.........-..G....orNT..w.....IDATx...w.$.}.~..8y6.....HD ...1..EJ.d.W.e..O.W......k[.][Vr.-[.d...$H.......wvbOO.t..s.........0.....S'\|.w~.w.. .=sy.R.8...........5...U.a.#...5.00....@..[x....k.P@..5.c...k.._.H......)..S0.L..6.8...h......M.2..X!....T.... ..EZAh#..p....~.<0.R-.M.P?.....).&c..l.6.#.z`-....!\|...lZW.. _.o._x].&.......1..m..Y$..^.....r...04$. ..H..Bb.C ....0....;......e`/....l-.....P..... .El...\......1..J1.=f]..e./..$....&N... .. ....!?.....T.P.;.g....o.V`O..6..0...V.y\|.5.\..].S.N...a...........K.'.B.F..D,f...D..bM..Q.Q..c.......m..Q.d.Z). ..........0pA)..q..7V., g.p@.AA....,..@f..e.@a.O.v.{...A....`?..T......vM.....k..Jq..<...#.10...!...D..I"..y.3.t.M...{.{.C..\|A%....v.y\|........p...C1?../~\. ...r.......=...F......~......}.z[.f.d.Q..........Ha\|..(l..Q08 . ....B..C,f......\|Q....:...\|Qu......4.."./...^..Q...7..-m.....>K.RA.*.VA...O.......T....5..(...........%.?c...i....-....Q...N.....(.. .. T.H."!.K..ViC

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	19786
Entropy (8bit):	4.351677647512085
Encrypted:	false
SSDEEP:	384:ywwJuCUTXsE4hVRCiigCAtUHt0N0Pu1EINs9In1kssJF7TEo4yDpWm:ZCThVRCrfAtSte19W8ODIm
MD5:	B170730CF7844667FF057B7E25C5D5D1
SHA1:	590B8880BE0CF52D93904F986D89B3B85F20A71D
SHA-256:	3266F3A4E033A79BEB74D3A866DBCE75A052E79A872FFC8C3FA1F68A61A6087E
SHA-512:	9A9AA25F52BA24A39371FD4E996BE5860238F0560F123582633087B3E19DF8E4F23E790B8DAEA7A77C517FF0E9DD7CEFC18C9FE753C1348FEDC860D9BBB3C185
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/sprites/icons-40.svg?v1
Preview:	<svg width="656" height="224" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.521 15.98h25m0 0l-8.683-7.65m8.682 7.65l-8.681 7.65m56.64-7.61h-25m0 0l8.682 7.65m-8.681-7.65l8.681-7.65M160.021 5v22m0 0l7.649-8.682M160.021 27l-7.65-8.682M112.021 27V5m0 0l7.649 8.682M112.021 5l-7.65 8.682" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M57.5 121.6c-.7 0-1.233-.217-1.6-.65-.4-.4-.6-.917-.6-1.55 0-1.2.783-2.533 2.35-4 1.667-1.567 3.767-2.35 6.3-2.35s4.617.783 6.25 2.35c1.6 1.467 2.4 2.8 2.4 4 0 .6-.183 1.083-.55 1.45-.333.467-.8.717-1.4.75H57.5zm6.45-11.5c1.2 0 2.233-.433 3.1-1.3.833-.833 1.25-1.833 1.25-3 0-1.2-.417-2.217-1.25-3.05-.867-.9-1.9-1.35-3.1-1.35-1.2 0-2.233.45-3.1 1.35-.833.833-1.25 1.85-1.25 3.05 0 1.167.417 2.167 1.25 3 .867.867 1.9 1.3 3.1 1.3z" stroke="#071D2B" stroke-width="1.2"/><path d="M25.05 112.1v7.25c0 1.4-.683 2.1-2.05 2.1h-4.65v-7.55h-4.6v7.55H9.1c-1.367 0-2.05-.7-2.05-2.1v-7.25m-1.95-1.5l8.95-8.95c1.333-1.333

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	185
Entropy (8bit):	4.896987120741646
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9jvwaOAmYHZAAbBAA8ckHRXkJTS0:tI9mc4slzcWER9j9jI6mqZlllXd7
MD5:	E5CDE96BF911F2A4EB6552BADEDF39BB
SHA1:	065E6EE982EE624A34B3C33C22E3DF3149262E76
SHA-256:	C85394445D0546C858FF180139E56DE5628546521C6EBDE1A1901CEF07868358
SHA-512:	7E9AC0DDA09AAD594F1495D7C2404E6193AA7FD53BCBAE9A3AADF8C4E1B90225BBABCF94D739991776648390BB1DEBC1B7C6D367818784BD9F8A8F739D353762
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/next-s-white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M6 2l6 6-6 6"/></svg>

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/store-badge/app-store/app-store-badge.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11123)
Category:	downloaded
Size (bytes):	21595
Entropy (8bit):	4.996635198401547
Encrypted:	false
SSDEEP:	192:LIsia0zYw49vRn4l7cWQjRkmSxoVGD/4OIZZTg8l9Qonnq3WwmpUkG4HfeXiPcB7:HRc7fQZNGoFQlC2cXaivSYBQY2YpuMc
MD5:	487143B593B69C366E88F0D6F37A7521
SHA1:	24C38C758BD6EC62B838E5E9FB4A3D7A9E2ACB17
SHA-256:	8EDBD08B9BB87F815AD871E44AAE03AF609FC44B1961D608E94EFF3F4E010375
SHA-512:	531294B797609050BBA3CB476A478E653D177BC09643C1E4C78CA38AD6401F1C6646F727D73A612C6A2CDA2086D5E33D8118AFE97FB1459FFBF42AD748DC4D76
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31970)
Category:	downloaded
Size (bytes):	32166
Entropy (8bit):	5.498550886008934
Encrypted:	false
SSDEEP:	768:8kHsUmpwGQMEgCFKs4Dwdfaj4OymzO2N3nbstXUFEDhsWh:8kMPpwGfCV48o4Oyie5DS+
MD5:	0C38942942EF59ADAF59E2CBBEF52C57
SHA1:	42187FC58CEF92F80F0C2B9D46961AEFC715399D
SHA-256:	405BC15523E269ACDA95810E007214B82E4FC5BF53AB0FBA34DB698F204416AC
SHA-512:	26744BEF1FDE91E3AEFFAEBB0F459BCADC880FD4F1D0575D491E37BC71E51DF1779765C4819360978588BA60FDB00194C9BEFD4E0E751463C2AC5E44A8CC14AA
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/vendor/tiny-slider-2.9.4.min.js
Preview:	var tns=function(){function a(){for(var a,b,c,d=arguments[0]\|\|{},e=1,f=arguments.length;e<f;e++)if(null!==(a=arguments[e]))for(b in a)d!==(c=a[b])&&void 0!==c&&(d[b]=c);return d}function b(a){return 0<=["true","false"].indexOf(a)?JSON.parse(a):a}function c(a,b,c,d){if(d)try{a.setItem(b,c)}catch(a){}return c}function d(){var a=document,b=a.body;return b\|\|((b=a.createElement("body")).fake=!0),b}function e(a){var b="";return a.fake&&(b=B.style.overflow,a.style.background="",a.style.overflow=B.style.overflow="hidden",B.appendChild(a)),b}function f(a,b){a.fake&&(a.remove(),B.style.overflow=b,B.offsetHeight)}function g(a,b,c,d){"insertRule"in a?a.insertRule(b+"{"+c+"}",d):a.addRule(b,c,d)}function h(a){return("insertRule"in a?a.cssRules:a.rules).length}function i(a,b,c){for(var d=0,e=a.length;d<e;d++)b.call(c,a[d],d)}function j(a,b){return a.hasAttribute(b)}function k(a,b){return a.getAttribute(b)}function l(a){return void 0!==a.item}function m(a,b){if(a=l(a)\|\|a instanceof Array?a:[a],"[obje

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2562
Entropy (8bit):	5.114548114833202
Encrypted:	false
SSDEEP:	24:2d/EMBEEa5M9jj2/xRhykCLhlllE94dga4KXqveJnJl7HGqLhlllfHlbjLhlllht:c/dEBKcUtffX6e/l/Z6P6CczZSWKn8T
MD5:	18715D69DDD4017FCA484C62932EE2D8
SHA1:	010E59351D7E5EE67C726885BAF92E79C7F21B4E
SHA-256:	A3D7AF88825B7F1DDCA196D9D839ACF5BD7E58F29FFDD66208EF348859B99910
SHA-512:	107F7D6F2713DCE320BDCA1E8C5000AB98819AE1B421A2E9550A5FE659F8D22BAF8FC8E06F4A355656E157B939BEBCF6322F076B1B90663F4776638337FF195F
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-01.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <path d="m7.3905,8.8375h16.8121c1.4122,0,2.5586,1.1465,2.5586,2.5586v11.8278H4.8319v-11.8278c0-1.4122,1.1465-2.5586,2.5586-2.5586Z" fill="#fff"/>. <g>. <path d="m6.6665,8.691c-1.2184.0004-1.8279.6117-1.8279,1.8349v12.1698m22.0022,0v-12.1698c0-1.2231-.6222-1.8344-1.8667-1.8349" fill="#fff" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. <g>. <path d="m23.1856,13.1459v-5.1334c0-.6023-.3703-.7946-.8944-.9569l-5.6196-1.6397c-.6686-.1971-1.0846-.2087-1.75,0l-5.6196,1.6397c-.5334.1649-.8751.3511-.8751.9569v5.153c0,4.0023,3.4114,7.0368,6.7095,8.8388.3978.2174.8793.2093,1.2729-.0156,3.3906-1.9374,6.7763-4.7746,6.7763-8.8428Z" fill="#ff5833" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. <path d="m14.3382,15.6641c.4278.2475,1.0046.3513,1.4584.3513

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1248), with no line terminators
Category:	downloaded
Size (bytes):	1248
Entropy (8bit):	5.144854320553841
Encrypted:	false
SSDEEP:	24:BG/Bn680wKGDJ3V9oR2C1gT0p7kMw7usGsc33ZvDxY2AUaaaodcaKakqyZn:B00wRJlO8n0tk/cVYC3gqwn
MD5:	0011AAF4067B097BCBFD9DC99A4B94C0
SHA1:	A7706CCF57CF0A36CDB60C83811B808A94D58D00
SHA-256:	AB449241B50123673E76DBCD70F869AE11D26920F0CE1670FDFD266308058179
SHA-512:	4F041B5B2BEC19E7F0F9051E56198577556A9FAC44966DC00137F09644D7D512A73B0D28D6F63EF693F1056CCD84DDDC76CACCC70CE13F1D33A084BF6ED65A3E
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hs/hsstatic/cos-i18n/static-1.10/bundles/project.js
Preview:	"use strict";function hs_i18n_log(n){console.log("i18n_getmessage: "+n)}function hs_i18n_substituteStrings(n,e){var l=n.match(new RegExp("\\$[0-9]+","g"));if(null==l)return n;for(var r=0;r<l.length;r++){var s=l[r],t=parseInt(s.replace("$",""));0>=t\|\|null==e\|\|t>e.length?hs_i18n_log("no substitution string at index "+t+" found for string '"+n+"'"):n=n.replace(s,e[t-1])}return n}function hs_i18n_insertPlaceholders(n,e){var l=n.message,r=l.match(new RegExp("\\$\\w+\\$","g"));if(null==r)return l;for(var s=0;s<r.length;s++){var t=r[s],o=t.replace(new RegExp("\\$","g"),"").toLowerCase(),a=n.placeholders[o];null==a&&hs_i18n_log("no placeholder found for '"+o+"'");l=l.replace(t,a.content)}l=hs_i18n_substituteStrings(l,e);return l.replace(/\$\$/g,"$")}function hs_i18n_getMessage(n,e){if(null==n){hs_i18n_log("no messages found");return""}var l=arguments[2];if(null==l\|\|0==l.length\|\|null==l[0]){hs_i18n_log("no message name passed");return""}var r=l[0],s=e.split("-")[0],t=null==t&&s!=e?n[s]:n[e];if(

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	11458
Entropy (8bit):	4.1591617490515285
Encrypted:	false
SSDEEP:	192:VKCSqC0RGBiRd/Yf8yW6SXDxqfS0n7Nd/oizEXIyiSfyCa:VWKYf8HDxpc
MD5:	7479893859C68FE2CCE8594F3AF64644
SHA1:	240F7D1C2D0E4128F41822B26B72CB33BAAB09DC
SHA-256:	CB986BD98010C3E350B47C183A375DB680E987A90B8D9EE3AAD9B8E110502D1B
SHA-512:	8F3C4504B1A09FB66AD2E849941F67EF8B261B875E0DCC846E30795C58A7B2650B6E01588BF849418EA0C6516C38985AA5F2E396DCF44936B2913B09F476F053
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/js/sdl1.js
Preview:	/* Single data layer 2 /.window.sdl = window.sdl \|\| []; //Initialisation./ End Single data layer /..$(document).ready(function () {. try {. / . Description: Gets the cookie value for a specific name. * var name (string) -- the cookie name. * /.. function getCookie(name) {. var value = ';'+ document.cookie.toString();. var str = '; '+name+'=';. var parts = value.split(str);. if (parts.length === 2) return parts.pop().split(';').shift();. }.. / . Description: Returns the locale value for the Single Data Layer. * /.. function getLocaleAndCountry(loc) {. var localeAndCountry = {. locale: 'en-ww',. country: 'WW'. }.. var shortLoc = /^\/[a-z]{2}(\/)?$\|\/[a-z]{2}\/./g. var normalLoc = /^\/[a-z]{2}-[a-z]{2}(\/)?.*/g.. if (loc.pathname.match(shortLoc)) {. var lang = l

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	4.179049372563972
Encrypted:	false
SSDEEP:	48:wVBBRnxAuPjV7ZfRpKrWYS7bHASYppXPDMUic9uF6mdva0UrjA:UvnxAuPjVdlHUSuhgncVK/U/A
MD5:	ABA4EC0135E28E9DE058F6573D9744DD
SHA1:	641FCE0CA2D0DCF911A52F1B67CD9787E5BDE31C
SHA-256:	9FF5D6FA1BB703573697600E4968736214766A212D724876ECF54301653F2B77
SHA-512:	72959C3833EE5C928091372A14D49E754A5FD7C0B68B1AC18073691B854F2DD8096E8C72F7B8EA2BF0C64ED8D7BA765555CC0FBDD058B3DC1991BC09E89DB1D5
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.164 25.71l-.683.692c-.263.228-.606.281-.91.096a.756.756 0 01-.36-.864l.265-.98m1.688 1.056a8.657 8.657 0 01-1.688-1.056m1.688 1.056c1.905.947 4.156 1.19 6.238.769m-7.926-1.825c-1.485-1.215-2.689-2.753-3.299-4.592m13.178 5.821l-.057-1.805c0-1.059-1.055-1.682-1.953-1.46-.929.293-1.402 1.46-.872 2.324l.929 1.537m1.953-.596c1.074-.486 2.117-1.223 3.014-2.132m-3.014 2.132c0 .473-.294.948-.759 1.076-.466.13-.961-.047-1.194-.48M6.177 20.062h1.725c.98 0 1.7-1.048 1.441-1.979-.273-.914-1.44-1.446-2.294-.883l-1.327.806m.455 2.056c-.528 0-.966-.183-1.138-.73-.157-.586.176-1.069.683-1.326m0 0a9.988 9.988 0 01.607-4.918m12.798-5.475l.493-.461c.18-.184.509-.2.72-.077a.63.63 0 01.266.692l-.17.537m-1.309-.691c.455.192.891.422 1.308.691m-1.308-.691a9.189 9.189 0 00-2.806-.653m4.114 1.344a9.905 9.905 0 012.825 2.594m-16.93 2.19l-.683-.538c-.283-.191-.368-.595-.246-.903a.795.795 0 01.815-.48l1.062.135m-.948 1.786c.252

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	31453
Entropy (8bit):	4.371102091920534
Encrypted:	false
SSDEEP:	768:VACkgQcLStkn/ut190+ixFqw13aBJFTWBvMqHP:tkgQiG4ur90PxjVUqt5P
MD5:	CA31E9A22214D4435F9B4CF273D5E97F
SHA1:	18BFCA5C384D4519509A3E4794EB4A4D8A33FA4E
SHA-256:	8201E5EB56D7B84CDF89140158E030384263EE9AB70C7C6379F8F5179F6045CB
SHA-512:	31D8738B061D23E4B808A01C36FFD6EC0EFD964847FCFC194AA94A0B84248453894F6B2B1EC2800E53FDBB151FF49B1D444E0BE924BAD4786CD8860F731C7237
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/icons/sprites/icons-32.svg?v4
Preview:	<svg width="752" height="320" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.521 15.98h25m0 0l-8.683-7.65m8.682 7.65l-8.681 7.65m56.64-7.61h-25m0 0l8.682 7.65m-8.681-7.65l8.681-7.65M160.021 5v22m0 0l7.649-8.682M160.021 27l-7.65-8.682M112.021 27V5m0 0l7.649 8.682M112.021 5l-7.65 8.682" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M57.5 121.6c-.7 0-1.234-.217-1.6-.65-.4-.4-.6-.917-.6-1.55 0-1.2.783-2.533 2.35-4 1.666-1.567 3.766-2.35 6.3-2.35 2.533 0 4.616.783 6.25 2.35 1.6 1.467 2.4 2.8 2.4 4 0 .6-.183 1.083-.55 1.45-.334.467-.8.717-1.4.75H57.5zm6.45-11.5c1.2 0 2.233-.433 3.1-1.3.833-.833 1.25-1.833 1.25-3 0-1.2-.417-2.217-1.25-3.05-.867-.9-1.9-1.35-3.1-1.35-1.2 0-2.234.45-3.1 1.35-.834.833-1.25 1.85-1.25 3.05 0 1.167.416 2.167 1.25 3 .866.867 1.9 1.3 3.1 1.3z" stroke="#000" stroke-width="1.2"/><path d="M25.05 112.1v7.55a1.8 1.8 0 01-1.8 1.8h-4.9v-7.55h-4.6v7.55h-4.9a1.8 1.8 0 01-1.8-1.8v-7.55m-1.95-1.5l9.087-9.087a2.6 2.6 0 013.6

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50511)
Category:	downloaded
Size (bytes):	51695
Entropy (8bit):	5.684158608347602
Encrypted:	false
SSDEEP:	1536:jQZeXOt545MuErPRlQco0F7LN9xbJV/FfE6Jdh7x:6euMMuErVF7h9VRE6JLx
MD5:	70D99B95A724010FC25CBB6524C7EFB6
SHA1:	6DCD49996FE1456E12B5FB237E54EA5344A0DC87
SHA-256:	4E840E117E609FD08E398399F7FFC2F5D6B6C6522B0B330F7E52F66AC4281A1C
SHA-512:	040B07D2CDDCB9EE481BC2AADE90ADD0347796740EE76F55E62964AAB7E76AF314EB9A5EC34DCCABE96CFE68EE692B9C50B332EE6BA7228A72B059A9F9F33746
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/th/ToQOEX5gn9COOYOZ9__C9da2xlIrCzMPflL2asQoGhw.js
Preview:	//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==.(function(){function d(p){return p}var y=this\|\|self,c=function(p,t,J,h,G,k,T,I,u,Z,E,x){for(E=(x=45,72);;)try{if(x==h)break;else if(1==x)E=t,u=I.createPolicy(k,{createHTML:L,createScript:L,createScriptURL:L}),x=46;else{if(46==x)return E=72,u;if(x==J)return u;77==x?x=y.console?p:46:x==p?(y.console[G](Z.message),x=46):39==x?(E=72,x=77):45==x?(u=T,I=y.trustedTypes,x=85):85==x&&(x=I&&I.createPolicy?1:J)}}catch(S){if(72==E)throw S;E==t&&(Z=S,x=39)}},L=function(p){return d.call(this,p)};(0,eval)(function(p,t){return(t=c(38,42,31,17,"error","ad",null))&&1===p.eval(t.createScript("1"))?function(J){return t.createScript(J)}:function(J){return""+J}}(y)(Array(7824*Math.random()\|0).join("\n")+['//# sourceMappingURL=data:application/json;charset=utf-8;base64

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1331)
Category:	downloaded
Size (bytes):	1380
Entropy (8bit):	5.169550122190653
Encrypted:	false
SSDEEP:	24:cg/VlUvP6L3dIQuTldhkbDW+YpIOwoozL3nYEZXON8TZ1CN9CJBQq92JWT4lHV:hUvPgnqbtPDMMEQN4WYBQq99E1
MD5:	95F4EE6427F8CAD5DB99A5AED1FFA36A
SHA1:	F2234D1A511B6EBE7EF3784B58B758F38DB04530
SHA-256:	0677B681CAED4FFDD34905570F67970C4002E9ACA427B7DB1E65A19641996AED
SHA-512:	3B05545CBDD66B3CDE59A08B8409A79EFAE4BA7286CC5DBC3615E92DCB8FEF22097654728EED2622FD066EDDCD21F26E978246563A822163B65A5F06733C34A1
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/cmp-academy-carousel.js
Preview:	!function(){"use strict";var a=avm.require("cash"),b=function(a){function b(a){var b=a.items>1?Math.ceil(a.slideCount/a.items):a.slideCount,c=a.items>1?Math.ceil(a.displayIndex/a.items):a.displayIndex;f.innerHTML=c+"/"+b}var c=a.getInfo(),d=c.container.classList[1],e=document.querySelector("[data-name="+d+"]"),f=e.querySelector(".tns-liveregion");b(c),a.events.on("transitionStart",b),a.events.on("newBreakpointEnd",b)},c=function(c){window[c]=tns({container:"."+c,controlsContainer:"."+c+"-controls",preventScrollOnTouch:"force",controlsPosition:"bottom",navPosition:"bottom",loop:!1,slideBy:"page",responsive:{576:{items:2},992:{items:3},1366:{items:4}},onInit:function(){a("."+c+"-controls").attr("tabindex",-1),a("."+c+'-controls [data-controls="next"]').attr("tabindex",0),a(".carousel .tns-nav").attr("tabindex",-1),a(".carousel [data-nav]").attr("tabindex",0)}}),window[c].events.on("indexChanged",function(){a("."+c+'-controls [data-controls="prev"]:not([disabled])').attr("tabindex",0)}),b

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 120x90, components 3
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	7.7185854935853335
Encrypted:	false
SSDEEP:	48:Q2IroOAaf14ARmK7R39hRd0CTxTRX/Hmodd2d:Q2IroQaUlnRd00lXOof2d
MD5:	FA11216CE023ED1B668363898F1A10EB
SHA1:	6ABA3FF8253C1A922F5C9586BECE1FA84BE64156
SHA-256:	B9A3EB98C189D63290DD889DA677D37D273C179A6C75CAEA2D488ACB88C428F1
SHA-512:	0948E6D9B80F581304179E2787EBA41334AD11428952201454D40DCFB47A87FB1F40E89DE8AD20E5F752BB879F3436661C13D98D9CD83671224F7D3E817661D1
Malicious:	false
Reputation:	low
Preview:	......JFIF..................................................."... ....+. $%(((..0=,&0.'40...........'!..222''202'2(22'&&2&&2&22&&(&2&&&2&&&&&&&&&&22&&&&&......Z.x.."........................................B.........................!1AQ.."Taq....2.......#DSr....$B..3b.....................................................!A..1............?....E..[.....p..@/.48W.C..}}....P..7.x......)...t.m.A..$...&.):.....e.&.$V..6....}Rz....:V.~z.$......y....pQ..y....pPc.[.....,~...G....,~...A..l^N..H...G..N..H...G..:..W..o&kh..}...M.A.?.d...H2.-W.....OY_.....e......OO1.?..{@..R.o.m..`kZ...0#-....JZ.{........sX.G.l..^v...2..TCu...pV.....!...E...4..........W........2.P7..oj..).f2@v.s'(.....n#9e...Jce.c....d[...g....:..~.Jk\5)yD.1!...!..Uk#.$.LH\.`p....#.P..XA3..P..g?...-...Z..0..]...i..Vk....7<........{....Z.o.~K.U...o.7x...[)...p...J..._t.V.M..j;.0N.1.kc.*.vsw^.....a.m6....H..;...LN.;P.....e...m.]/....."5&D.......@...5.......He...!.....=......:..'.#..px...;.E..`.C

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2096
Entropy (8bit):	4.179049372563972
Encrypted:	false
SSDEEP:	48:wVBBRnxAuPjV7ZfRpKrWYS7bHASYppXPDMUic9uF6mdva0UrjA:UvnxAuPjVdlHUSuhgncVK/U/A
MD5:	ABA4EC0135E28E9DE058F6573D9744DD
SHA1:	641FCE0CA2D0DCF911A52F1B67CD9787E5BDE31C
SHA-256:	9FF5D6FA1BB703573697600E4968736214766A212D724876ECF54301653F2B77
SHA-512:	72959C3833EE5C928091372A14D49E754A5FD7C0B68B1AC18073691B854F2DD8096E8C72F7B8EA2BF0C64ED8D7BA765555CC0FBDD058B3DC1991BC09E89DB1D5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/gloweb-8096/viruses.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.164 25.71l-.683.692c-.263.228-.606.281-.91.096a.756.756 0 01-.36-.864l.265-.98m1.688 1.056a8.657 8.657 0 01-1.688-1.056m1.688 1.056c1.905.947 4.156 1.19 6.238.769m-7.926-1.825c-1.485-1.215-2.689-2.753-3.299-4.592m13.178 5.821l-.057-1.805c0-1.059-1.055-1.682-1.953-1.46-.929.293-1.402 1.46-.872 2.324l.929 1.537m1.953-.596c1.074-.486 2.117-1.223 3.014-2.132m-3.014 2.132c0 .473-.294.948-.759 1.076-.466.13-.961-.047-1.194-.48M6.177 20.062h1.725c.98 0 1.7-1.048 1.441-1.979-.273-.914-1.44-1.446-2.294-.883l-1.327.806m.455 2.056c-.528 0-.966-.183-1.138-.73-.157-.586.176-1.069.683-1.326m0 0a9.988 9.988 0 01.607-4.918m12.798-5.475l.493-.461c.18-.184.509-.2.72-.077a.63.63 0 01.266.692l-.17.537m-1.309-.691c.455.192.891.422 1.308.691m-1.308-.691a9.189 9.189 0 00-2.806-.653m4.114 1.344a9.905 9.905 0 012.825 2.594m-16.93 2.19l-.683-.538c-.283-.191-.368-.595-.246-.903a.795.795 0 01.815-.48l1.062.135m-.948 1.786c.252

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	506
Entropy (8bit):	4.6475821195383835
Encrypted:	false
SSDEEP:	12:trF9XjugPLVEPKI7UpXQx7maRVRo9AuGY8nwVUO8:th9zugJEPKI7V7maFCAa80V8
MD5:	1BF2FF2A2381F6721BA20A466919AEA7
SHA1:	1B66A4002AB76CB687E9FF14EC5B77A4B793295B
SHA-256:	2152E6A6BC3A49C946098BE8212921581EA021F8222653E952E55F4316193C0D
SHA-512:	65D7810BD4C997FEF7A957E2992ADE99E19579F10C1F60BE7A3E307FA0F506482F04C49CFDC522E87057455B759217938BC9C2151FBB813090E43642689C5F41
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/header-stripe/header-stripe-normal.svg
Preview:	<svg width="212" height="44" fill="none" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="none"><path d="M13.603 8.405l.068-.018C63.851.25 91.728-.565 141.111.248c49.383.814 62.623 10.168 67.703 17.088C211.204 20.59 212 24.659 212 27.1c0 2.44-2.205 1.63-3.986 1.628-2.386-.001-3.183 1.626-6.372 1.628-3.189.001-54.162.814-54.162.814-28.143.813-84.422 3.253-111.507 8.95-21.95 4.618-27.88 5.698-31.063 0C1.727 34.424.837 30.355.129 23.847-1.141 12.171 7.24 10.03 13.603 8.405z" fill="#FFDDBF"/></svg>

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (32769)
Category:	downloaded
Size (bytes):	93868
Entropy (8bit):	5.372204012865564
Encrypted:	false
SSDEEP:	1536:k5RKUpVgklsdbuLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8FbGzA81+xRRi1Z3
MD5:	DDB84C1587287B2DF08966081EF063BF
SHA1:	9EB9AC595E9B5544E2DC79FFF7CD2D0B4B5EF71F
SHA-256:	88171413FC76DDA23AB32BAA17B11E4FFF89141C633ECE737852445F1BA6C1BD
SHA-512:	0640605A22F437F10521B2D96064E06E4B0A1B96D2E8FB709D6BD593781C72FF8A86D2BFE3090BC4244687E91E94A897C7B132E237D369B2E0DC01083C2EC434
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hs/hsstatic/jquery-libs/static-1.1/jquery/jquery-1.7.1.js
Preview:	/! jQuery v1.7.1 jquery.com \| jquery.org/license /.(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView\|\|a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"\|\|e===""){cl\|\|(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm\|\|!cl.createElement)cm=(cl.contentWindow\|\|cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"")+"<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 767 x 554, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42182
Entropy (8bit):	7.942215223817182
Encrypted:	false
SSDEEP:	768:KY5jYDNCjATBHu6i1OWGtlKyzqnBF++ikS2v1vA7Oh5NtG+D0mNO:KpDTBsgWc4yzqBQyA7aNtG+DTM
MD5:	0495ED911DB87B4B70E903CC0C767B62
SHA1:	892D8723110EB6BD968ED6DAEC2333EF65C8EAB3
SHA-256:	F30E5E82C17BF012ECC031776338D2B97CC2058382EDE138EF97CB35774219D2
SHA-512:	4D9D447E1C4A89F8A74BA477961C539CB3372E0B338C4B39B4B794CF66120FA2A3214B923781B5A9D43A2F3EEC1F8E1C12EE9836D60179B4C088CEB123A9A065
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............%.....orNT..w.....IDATx...]lc.'...w...W...4.R..Hj..9.f!.{{......MZ....bM. .(.f.dl....>..A...p..R]%q...7s.dR.3.>.9v.%i/.....w..{.nU..}r...E}.>H.~..@....TIz.w=.............l..U....Z.....e.CDD4(.v.DDW.'.L&.yG.k..q.M..E..T...}>4.j;.j;...V...H...H.i...... .....&...".iqb.:NA4....0."..<T\....I..V....jC.RE."ZU.....J.....xb.OD...}..l6.....cnB...w...Yy..j.....D.........R.........].....$.\|... .C.p.DY.....J;...}i A(...@...V.....Jk\|.w.Y.Y.mi....j.4I.U.+.\|...Z.L...k..b..rP@DD..."....w.....u.p.3..K'..T.....S.A5J..........[.....q.MU./?@.@..U.(.~.....tb.ODW.D.../.H...Nh......F._.....5V...a.3......w@.......&".hL....v\|......3..hA/.t..\|k.UL5......\|.w[......].k...[..."........\|.....\|....k."....q2e4..NZ....F..A....q>;.Z....._Z.V....i.."".<&.Dt...;.U...`t.\Ib...D.\|.~#.:..........H.......Txg..h.0.'"..n.V4.."*.A...@..X...e'\|[f.?........0..s..h...6..m...A...hc.O4.v\|.n..`LT.s.o.../..J.uXa.?....(.(.......PV._......DD...?..yQ....\|.

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	915
Entropy (8bit):	4.969931986406253
Encrypted:	false
SSDEEP:	24:YaWVyVVWVyVGHlVjLClOY4W/nNIgYgIPs:YaWgVVWgVaPCd4W/nNIgfqs
MD5:	F10AC6AD4101EFBD0B875103172B62B3
SHA1:	A98E48874F1FE33E96358263C75DE3D555387ED7
SHA-256:	29423A280BC436749F5EB385564F72FC80A0333FD0BAF0BD263FD05958073990
SHA-512:	BECF16859EF7BC86862B69F50D912AF74590BFDDD6F26304CFBA5B0604A8B43E41F15FB65F4C8A103F6B68052B512975101948F76B357324D601240B0185DF40
Malicious:	false
Reputation:	low
Preview:	{"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"reviews":null,"links":{"profileUrl":"https://www.trustpilot.com/review/www.avast.com","evaluateUrl":"https://www.trustpilot.com/evaluate/www.avast.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/www.avast.com","consumerWebPageUrl":null},"starsString":"Great","translations":{"main":"<strong>[NOREVIEWS]</strong> reviews <span>on</span>","firstreviewer":"Be the first to review us on"},"settings":{"customStylesAllowed":true,"syndicationEnabled":false}}

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	26075
Entropy (8bit):	4.373872319729878
Encrypted:	false
SSDEEP:	768:58jVGkjvx68p88abpKoHwTnOqnkGp0KBO/rYYUJ:5w/jvx68p8wOkkGp0KBO/9K
MD5:	F2F5E2D15E4880710C6416C51393A38F
SHA1:	3A66F0F8BDC994B597A44107D885B9481121336A
SHA-256:	3E8207BDB63436BB44EEACF45FEEC9B145A411ACF42EB3AC972D9D7BB43DD83B
SHA-512:	0B1D066D38F8565B8D468E1C1B0BD3BADF9DA02505F8FA1AAF72F5B8EB3108C826CD452BACBA1D4959DCEB548995A75F783D96A1DA757675CB3EC18553A3D709
Malicious:	false
Reputation:	low
Preview:	<svg width="496" height="144" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#071D2B"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/seo/favicon.ico?v=1
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57565)
Category:	downloaded
Size (bytes):	549897
Entropy (8bit):	5.542662008832408
Encrypted:	false
SSDEEP:	6144:/BOTQJqQAq/dyEPYybY8NXJcnOWp0QMbB:5OTyIEQy1
MD5:	C16AA2296932AEEAA1CBE47E0F82049F
SHA1:	88CD58E5E7B88E42B5D5F144EE29C206AF8C74DC
SHA-256:	85FD3D9C873BDDF99973BE47E224E844D3DBFCA3B7A3A9B9CADF47C70A1255A3
SHA-512:	92F70FAB4C6DC6940D4D641D6E012053548064247BF5B8B683B27D23349E1C8919A32D3A93AB9F7FC597E9A00B4F8ADA7C9A202229F5D55178C90E5DAECA0262
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-PZ48F8
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"676",. . "macros":[{"function":"__e"},{"function":"__v","vtp_setDefaultValue":false,"vtp_dataLayerVersion":2,"vtp_name":"contentGroup"},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__remm","vtp_setDefaultValue":false,"vtp_input":["macro",2],"vtp_fullMatch":false,"vtp_replaceAfterMatch":false,"vtp_ignoreCase":false,"vtp_map":["list",["map","key","\/-c\|\/windows-10-vpn","value","New Content"]]},{"function":"__v","vtp_setDefaultValue":false,"vtp_dataLayerVersion":2,"vtp_name":"pageGroup"},{"function":"__c","vtp_value":"avast.co.jp,avast.com,avast.jobs.cz,avast.ru,avast.ua,nadacnifond.avast.cz,store.digitalriver.com,avastbrowser.com"},{"function":"__jsm","vtp_javascript":["template","(function(){ret

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1320 x 601, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	34146
Entropy (8bit):	7.842213162645585
Encrypted:	false
SSDEEP:	768:C50AY98q+rgepMZHqlkQgCxqzPM94njdJ39R7p44:n8q+7MQlkQgC8ZxJrz
MD5:	A5C410CE574F68DF077D03D147F26444
SHA1:	0BD4C698B16F734B0D519DC01F289ACEDF7EB589
SHA-256:	E354F2B99057C500B4AECD5F8E8A3EF84F940FD78FE1EE3E529D779D48B4417D
SHA-512:	08CDD1FB734F0E99E4A2DE698FDE402D5E902BFC6B253137F40AE7570A225D38D98C5CAAC55A1959F741C868A3293B9A09C3CDBD131E53748FF1FFD8BA206B8C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(...Y......H.b....IDATx^..}.]e}.....a.l..9..J.j $1.()2.M.Gj..'.S/.R..Z.E.U.S#.Z.85U.U..;....8...S..)m.O~..s%.4i................~...uA~.i..K.u....U..'.......C.].{.....`....:C=.........-....X8.....@...+....,..J........t.......%......cAG...`Q.P......;.t.......%...........F@..............(.(......3....,..J... ...:.... .....rb.......(....../..t...EB@.....t......H.(........t.......%....SE'...`..P......?.t.......%........:....!.....r9.?....,..J... .6.... .......wo.A...X4.....@.'...s...ED@.....p.@.9...XD.....@.l.....G@.........s......(........:...........h..cA....`Q.P....M;v0....,.J....i....9...."......v..c......(.......g.1...XT.....@.:...........h..CA....`..P....M:r_.)...Xd.....@...'....,2.J....I...:...........hRE....`..P....M9q$....,:.J....)G...r...EG@....4....C......(......A...@......h...A....`..P....M8y,..........h..Ag.........@3. ......%........q....P.......3.....J.......q....P.....c.......(......^.:....8...........q....B@.......]AG......P..

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32743)
Category:	downloaded
Size (bytes):	182032
Entropy (8bit):	5.365391197338181
Encrypted:	false
SSDEEP:	3072:AfU/kKPX7V8wLS2ldlK6uN9m38uw+1lsIp:AfU/L7V9LSclK6uNQ38uw+F
MD5:	51E91F7BE70D8084DD67095C42218616
SHA1:	542610CCDF6C703FCF96B50E9D5FE09DC80D0C39
SHA-256:	8A1783F8B3194938BBFC516D258D1CB140F47C2715F96902BD17E2B40EB501A2
SHA-512:	0DC5665C159460F2A086BEA41845C150A9C0BD52B3486B00420DE76DE2BECC7748DAABD37AF4077BBABDE51616786FAAB81FDD1FE2FFBA779D1855D02E66C3D8
Malicious:	false
Reputation:	low
URL:	https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-02-06T23:17:47Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"ENe5f28798d073455d88b6f8f4fd63eb52",stage:"production"},dataElements:{site_language:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_language"}},TCG:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.test_group"}},site_country:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_country"}},pagename:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.page_name"}},"site section":{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_section"}},"Dynamic A

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21384, version 1.131
Category:	downloaded
Size (bytes):	21384
Entropy (8bit):	7.986837797592255
Encrypted:	false
SSDEEP:	384:kHFef7jPmayeS0fYuptQic/oTKd9eqY3JgR0j/DwmXX211YAl/1hldblb:EI77maXS0NtLKvBiMADwm2zYALX
MD5:	5148AA75DAC43A70C0512BB307ADA1CC
SHA1:	A1C959DAEB71ECA67A420A80CB106EF3474E4E02
SHA-256:	3BBAEC0CF947AEA822F475E7DBB50579624C8DD1BAD50F33233C79B3F98DF843
SHA-512:	9AEAED348DD3F00319692A913AB1D7B8ED53849A9A7738FAA1C2CE43AA3C7A09539C37D208E51E0FA56001C515B33BFB0F82BC3D98DD1DE5A79EFD2E0CB250F2
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/o/f/700/MierB03-SubsetEng-Bold.woff2
Preview:	wOF2......S........@..S#..........................h...L..(.`..D..v........p....6.$..$..... ..V. ..z.3.7.n..X....}..&#...(Q...'..y.C"......g-.1.)nI...s7.@...ju.y.6...{... X- .w..f8aA...b.Sn.0...==.....v.....K..a.z.yx.b..C\7..8.....OR.=.%<Q..I.~?B}.....$.4.U._.]..i....3.\|.\|/..e.S...=.!rB.'7.^......eB.....,..9N.^....K.]q.E..G6..`....e.S.9..W.\...s~.K.`...d.G.f.G ..9.._g......d....U."......l..h9...Q......%.DJD.R.u..W....K}. ....t.P.%..A.(...e.6=9.t_....{......&..I.p.''.....x..I..`.NTw.:..v.r....^7t....P.)...~..EB.....0P..\.t.J..J]T.........c..C,2.(...\|D..s..:.u.t.p.^.4..MmJ..s...x.a..H.d9.r..TL.....? E`..d....T.<.3.......e]cB....V.H...%)d.I.lx..W.....~..\|?ZX..5..-@....H)`.i...B....8..>......z...l.,VK.j..4.B........3.\.7Z....!9.j..z...}.U0D.4w..K..q....._^..].&n.....a,.L......3...Qg....H:.~..j.r..\..7......2..D..'..%.J./a.... }.u..%....$.%]..!U....[..!U.Ey.....5nS..Wnz.}.k......Z.,.7.ng.o....s.0.?..x..O.ov..:..:{u...h..P..X.9..cL:.V..~L..j..4R..b

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (866), with no line terminators
Category:	downloaded
Size (bytes):	866
Entropy (8bit):	5.58591606764812
Encrypted:	false
SSDEEP:	24:hMiRO9YywPBT7KqyG6t8G9xu7K4MH8wRCXTEJTEn:NODATJyG6SG9o6cwRUTEJTEn
MD5:	76B18683F8BE59DE160CED4FC0A20AAE
SHA1:	B76AF5C5AE60D3866E50C72E82A9EC8B7E3A8BAB
SHA-256:	6479558B6E80B7CE96B0CEE8F086D0C700550152DE81540A7FC8AEF26663B367
SHA-512:	D0325B2E55BB6FA7EAFB5D25E9EFC9573251C11FE892A3646F7DB2C1FA17A3CAEB703CE2ECF79F9CA556A0BEF974BBC3332C871147FBF1C2AE9E9B02AA49C0F0
Malicious:	false
Reputation:	low
URL:	https://4711400.fls.doubleclick.net/activityi;dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient"/></body></html>

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x441, components 3
Category:	dropped
Size (bytes):	84377
Entropy (8bit):	7.9850721564058285
Encrypted:	false
SSDEEP:	1536:lfSOFiLloj+gW6UmfiIviYo0bI3upu5lQnPJ4DGgbMEBvk6v+O2T:l90ujrZvvO0KuAlQbENkw+O2
MD5:	6983E89528D63885527FF060A1715654
SHA1:	C544D8D535017B38F38EC18C739EF0F8244B9C2A
SHA-256:	F34B13138C0AE5F4D4471C129023974E5FD1BD342912D2C3AA1035F923516369
SHA-512:	72B7EBFB897BE997CFEF30DFA34C8E029F3197C6A6209D5613783B3FB624D479B10796947B354699B9A5EDD593FD8AE5DEC95952360E8553BB264166246A2412
Malicious:	false
Reputation:	low
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".....!....5...................................................................\|^...W.....g.m....c..8...\.g..[.S....g...x.u..y.h.W#.<....rK.v.=.r..i..y.v6BL.../.~6.r~..\|.p.ekM..5..;.L...#)..........R........B}.;e.NN[YW._.....:.._.........A..l.d=v.[.xx.......Y...:...].>.CX5.g..U~&...`....C..\|.......-5Y..\.n.[...7r..3...Y<..S..~..0...J...w.4p..\|.....!...^..w.Eui>.gU.......;..T;KVp..`G....9..N..-..s............rq..-.>..tn..9..S.%?.'[../.h....[,..r..G....?q..M..\.~..R.~...>..>.,.Z-7}.8.....y.%..J.....`.u.O.............dx..;a.H....-...`.}.O..~.....V{,...[..~/.m.C....e...zY....}F.%.;.K.....}...t..Y:.c.9.Lnu1i{.....:..........\|..s..^.=.~q.V^[YQ......bGT.g.[..U.A.a..;...U......?H..B.c....w....s.t..k....t..^l&]w'.......7.=.aS.i.}.....;.C...i.i.....W5....E.WO;.../y..v}@@..#..s...]JS.U...

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	31305
Entropy (8bit):	4.385799751453472
Encrypted:	false
SSDEEP:	384:ZZee7VAeCPUeCkOuBuctBrSXnNRm5I4j3jQgIzLq7M2oxGXXPLabnfT7mOuC2tKQ:zqzszGucrO9RoCp1xGXXPwf/aCQKQ
MD5:	DED03AA6F0840D4688249276F3574286
SHA1:	A340C02876210ADB246763F7F3D8D172BA6AED82
SHA-256:	8999989CD61F70B3D2D85CFE1BD182BAFE69C341CD9165CA9F8BB8AAFB7DCD4B
SHA-512:	2E7603A35E2F587BDB387E615A525A0304B9F44A526F0EEAE76F226C711B7A4D0802D27DE9338267522F637B075156FBD31F21F9A2CDA769C8B5836186554D59
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v3/components/icons/sprites/icons-24.svg?v4
Preview:	<svg width="624" height="264" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.614 12.045h18.749m0 0l-6.511-5.737m6.511 5.737l-6.511 5.737M332 96.4v-5.2m0-2.5v-1.1m9 4.4c0-4.936-4.055-9-9-9-4.91 0-9 4.095-9 9 0 4.9 4.1 9 9 9 4.936 0 9-4.069 9-9z" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M369.398 128.259l-.307.515 1.03.615.307-.515-1.03-.615zm3.044 7.395a.6.6 0 00-1.2 0h1.2zm-1.2.874a.6.6 0 101.2 0h-1.2zm1.911-4.989l-.351-.487.351.487zm.334-1.823c0 .55-.269 1.036-.685 1.336l.702.974a2.844 2.844 0 001.183-2.31h-1.2zm-1.645-1.644c.908 0 1.645.736 1.645 1.644h1.2a2.844 2.844 0 00-2.845-2.844v1.2zm-.6 5.289v.4h1.2v-.4h-1.2zm-.814-4.487a1.645 1.645 0 011.414-.802v-1.2c-1.04 0-1.948.557-2.444 1.387l1.03.615zm.814 6.78v.874h1.2v-.874h-1.2zM372 123.6c4.613 0 8.4 3.795 8.4 8.4h1.2c0-5.267-4.323-9.6-9.6-9.6v1.2zm8.4 8.4c0 4.6-3.796 8.4-8.4 8.4v1.2c5.267 0 9.6-4.337 9.6-9.6h-1.2zm-8.4 8.4c-4.569 0-8.4-3.831-8.4-8.4h-1.2c0 5.232 4.368 9.6 9

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	814
Entropy (8bit):	4.262051022846105
Encrypted:	false
SSDEEP:	24:t41PiSeuqeQurCKV/SeuPpwQudk1IUeoUAt3Cc9YP:CKSfltSfPpd+tAt37i
MD5:	E89108D4006B6921D46EE4FE285E9A30
SHA1:	25CC22FDBFA2776D3231D7AD4159F44BDD6AFB45
SHA-256:	3EA97497C219F5C1E06DE12EF9270DFA57C9E6D52F3486272E3F16CEE0FFE14B
SHA-512:	F2F5B051F2ECAE30764F1290F2BE1B7353B6CEAF9507A4C949CD15259A94FCDEB1F86F1ADAD264444A39DF7FF5E97A5DD3D2228266426490841464C8229BC0BF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/logos/avast-logos/seo/favicon.svg?v=2
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M181.2 158.3c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6 2.9 4.1 6.1 7.9 9.6 11.6 18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4 1.4-1.7 2.7-3.5 4-5.3z" fill="#fff"/><path d="M85.8 24.9c12.8-8.8 30.4-4 37.1 10l58.4 123.4c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6l2.3-.5 38.1-8.4c1.1-.2 1.6 1.2.7 1.8l-31.5 18.7c18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4L81.7 63.1C71.1 51.9 73 33.7 85.8 24.9zm17.9 113.4l-61.4 5.3c-6.7.6-12.2-4.9-11.8-11.6.5-6.7 6.8-11.3 13.3-9.8l60 14.1c1.1.4 1 1.9-.1 2zm-28.4-54l74.5 60.3c.9.7.1 2-.9 1.7l-89.6-34c-9.4-3.6-13.4-14.7-8.4-23.4 4.9-8.8 16.5-10.9 24.4-4.6z" fill="#ff7800"/></svg>

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1084)
Category:	downloaded
Size (bytes):	1128
Entropy (8bit):	5.13655803265401
Encrypted:	false
SSDEEP:	24:cs9tETnnWNw2Kol73oWA5PKvKbtiS7IQYhZapGfxq:RAT43a5CCbXIZ28q
MD5:	776A03FB91A5A6C5F80E453652BA4EF3
SHA1:	1952BFFD9588610B295DE9A351249E5DEE1A21CB
SHA-256:	5497705C3331BECBCBA9001F4713389619DA62D8148061732A178EF3512ECE7B
SHA-512:	C9837D72DDEDD380EF6112D0F68901D2B460DC2690C46DCFFEF07B900A91A34D0D5C0786C6297F39B22F67DC6CBB8B8FA516655F8104591AA2B95B9CAEBB3288
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/cmp-sticky-bars.js
Preview:	!function(){"use strict";function a(a){f.forEach(function(b){b.setAttribute("tabindex",a)})}function b(b){e.forEach(function(c){b?(c.classList.add("is-sticky"),a(0)):(c.classList.remove("is-sticky"),a(-1))})}function c(){var a=!1;h&&h.length>0&&h.forEach(function(b){if(b.classList.contains("tables--sticky"))var c=b.querySelector("thead th");else var c=b.querySelector("thead");a=a\|\|d(c,64,null,!0)&&d(b)}),a?g?g.classList.add("hidden"):b(!1):g?(b(!1),a\|\|g.classList.remove("hidden")):b(d(i,null,null,!0)?!0:!1)}try{var d=avm.require("avast.web.waypoints"),e=document.querySelectorAll(".sticky-bar"),f=document.querySelectorAll(".sticky-bar a"),g=document.querySelector(".message-bar.sticky-message"),h=document.querySelectorAll(".tables-common.sticky-header, .tables.tables--sticky"),i=".sticky-waypoint";a(-1),(document.querySelector(i)\|\|g)&&(window.addEventListener("scroll",function(){c()}),window.addEventListener("resize",function(){c()}))}catch(j){"undefined"!=typeof sdl&&(console.error(j),s

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5667
Entropy (8bit):	5.097553602115559
Encrypted:	false
SSDEEP:	96:eKa3EeRvdIflrvaOdJmDY7Yy0luY7Yx0y21P8qQ91ZBwVLRCM:eKterYrvaO+0cy0zc+kr0dj
MD5:	7675713BCAC0BC7CF2379F1A7EB1A17C
SHA1:	EEAB0E556692A206962D3AF265FEBBC2F6FACD21
SHA-256:	F043FF16359C98E32CE144800BD2502C5BD111479BEEC7BD282DCCDD38B013F4
SHA-512:	456EEAC916739ED4694FB4F9FAD9BB974F10D298DAD663DC5D3F57487902062995AF229EF958C9FF25D6E81BF7DE7828A10E58261C7E4AF02CEBE6C2B30CEAFA
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-secure-browser-color.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.836-3.145-1.93-4.224-3.255a10.892 10.892 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.065 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145.095 1.4-.06 2.807-.454 4.155a10.9 10.9 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.157a1.86 1.86 0 00-1.72 1.674v-.003a1.857 1.857 0 001.127 1.89v2.104c0 .142.114.256.255.256h.949a.256.256 0 00.256-.256v-2.102a1.86 1.86 0 00-.867-3.563z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.407-.042 5.214-3.265 9.618-7.707 11.626zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.467 4.

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2903
Entropy (8bit):	4.083203542470353
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7lJ/09Q9s4w76ODtzfcIsCvWIK+5B+jV9Pp:9LNV2onc/z7w76gzfcINj5Erx
MD5:	6672B70FD96AC4F96B0AE2062123A841
SHA1:	56BC3CEC1806A655931EC78812E3DBBBD640607F
SHA-256:	954D5CF01AE876E8AC27E08326750D0596F63BC0D3D1986DC611DA352BF451E4
SHA-512:	4B4A39C9EC6CB012B23916FB9DD116AAE3379D5815F43D6D2A24B693DE830DB1EC69D7ECC0CBE648FA60D19A5DAD0395E007E30F464421A7E9D0F0C93C0021A9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/logos/avast-logos/avast-logo-default.svg
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	834
Entropy (8bit):	4.4068516180284085
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDjySBDfk/r6Tuw4Oi/yoSPa/R+:Ofvtzlfk/OTPi/yY0
MD5:	5B726129A8C315687E028CDF4E75D0F7
SHA1:	8E15800AE8EA9480D1D63ECFD04C1A07EECB89A2
SHA-256:	AE9317D6E44154976E50735BFE9BACBA5CCBC6DA6E0B87B926EE62F97875E6A2
SHA-512:	6D3C4659DFBEF3E87E70A80C1A70174D3000087FB579A179ABDE3561DFB5176E045042826ED6AD71214AD17FB54AF45A9EF16C43CC3A92A7A74701AB18002BFC
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_online-privacy-and-security_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#FF7800"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.733 12.733 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.731 12.731 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FFF"/></svg>

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	176
Entropy (8bit):	6.720573095811691
Encrypted:	false
SSDEEP:	3:K1Zr5l/K/Bh1D1mya8sKfszCF9tF7GRYYovO3ttuzX+n+1atCi+7jsLtJvjucP3i:K1ZS/Bh1Ba8ozCT7GR8mjzjP+7jGtJax
MD5:	53ECB3C9E33A270D58BF77250A2FB4B8
SHA1:	48E51997AA843A92F51562B2CBC7AF63495483C1
SHA-256:	A50320570F86A53075AC927F6AC8BEABC15E90C8E0AD894060FCED2734439DC8
SHA-512:	0A2FCC0EC206A53A8E83C514F5BD07022166695114CE074B7EF15D0BA742809BEF2D52C45D8BD999707AC295B337C2E3C1FB65907E6853E8FB58BEC3D8C6DA15
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/i/helpers/hamburguer-menu-bars.png
Preview:	RIFF....WEBPVP8L....//...o...$h69....V.@.6../..pf.q......"Ij.....D..-H...#.......M..#'...e$...l#.Vr?..Q.....C[.B...}.H"...m...Nw.@2...q.H4.'X".. DT.....LD9.~av7...4.wK.....

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	915
Entropy (8bit):	4.969931986406253
Encrypted:	false
SSDEEP:	24:YaWVyVVWVyVGHlVjLClOY4W/nNIgYgIPs:YaWgVVWgVaPCd4W/nNIgfqs
MD5:	F10AC6AD4101EFBD0B875103172B62B3
SHA1:	A98E48874F1FE33E96358263C75DE3D555387ED7
SHA-256:	29423A280BC436749F5EB385564F72FC80A0333FD0BAF0BD263FD05958073990
SHA-512:	BECF16859EF7BC86862B69F50D912AF74590BFDDD6F26304CFBA5B0604A8B43E41F15FB65F4C8A103F6B68052B512975101948F76B357324D601240B0185DF40
Malicious:	false
Reputation:	low
Preview:	{"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"reviews":null,"links":{"profileUrl":"https://www.trustpilot.com/review/www.avast.com","evaluateUrl":"https://www.trustpilot.com/evaluate/www.avast.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/www.avast.com","consumerWebPageUrl":null},"starsString":"Great","translations":{"main":"<strong>[NOREVIEWS]</strong> reviews <span>on</span>","firstreviewer":"Be the first to review us on"},"settings":{"customStylesAllowed":true,"syndicationEnabled":false}}

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20380, version 1.131
Category:	downloaded
Size (bytes):	20380
Entropy (8bit):	7.9917391274857446
Encrypted:	true
SSDEEP:	384:T+0KlK4X3Ybypt5G5/udHLmNXP+TregSqDvpNpSMCfsF7XGstu7uFK+aJGJ0Z:SM4X3fpb8KSpP+TK7spHAfO7XGZq6a0Z
MD5:	53E1D69438CDD1D1F14394539A80E625
SHA1:	21CFA22D0DE9907DFCCA0220D4678A7CCE58D922
SHA-256:	C18B8A1FF97ECF28C4FD06BB2424188166116BC36FE87759CF8395FD2DF114BB
SHA-512:	B01C6C5DD7C8BC8CFBCB8C845F17EDD8EA629A238C9D2AED07011557E701CEA8DCBA2353E31B97AA1B5AE1D964898EAC27B756187E6931FBF37A9619B5551BF3
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/o/f/800/MierB03-SubsetEng-ExtraBold.woff2
Preview:	wOF2......O...........O8..........................n...R..(.`..D..v........\|..+.6.$..$..... ..\. ..z....6.z.......;.!l...d'...a..6........j.!....Z.y..dTj..A;%.B..:..)...\.h..e>...X#.........k....h)..4..s..q9<.2.x8L..`R.b.#Uy`.t`..7....}.8..G....0..E`...:I......_..{...!./.:...&..c.'1...H...E:.Z}Q.......Z.>..I.8.C.).&W...._9.=...w..)...DI..D.`...X.F....l."......=...1..O..-..$S.@..<.....O......._....I..{..vfvO....k.R..t...H.v.5!...}..p.....c.....i.m..K..D.R. ..J_#Q..&.T. ..&F..#.^u0.T].4..'........$.....:..g.ye.}..;....'o\Dp...w.n.......?.4..........T@.I...(5n.9.mzr.*U....@..3..P.e).........NY\|......LS.Lk.a[y..jD.......d.J...l.1.+....f..;..v.....:.....U4`r.E.M3....{o....%...X,(....b.i.P_;..... ...2.M3('J.....r.h\t..c.t.r.rY.}a.OO.X.`A..A.~.^&>..2.j......-....V$...nT........W...."... u.h \..K#D.t...cL...1..y !~.q......f.d.7>.....W.d.GDRDN.h."q......G.$ I...)H.!H..$K6...H.".m8.U..0.7.$..Sq3T....5..@5.V..A#.Y'.(.....Y.[b.n...2.p+..=.Q..IA..

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18187), with no line terminators
Category:	downloaded
Size (bytes):	18187
Entropy (8bit):	5.347759003709589
Encrypted:	false
SSDEEP:	384:s40C/Y3uOOpp9W89rzOv4m8Avx2kjEhNgyyuek:VjOOp281UsAlErPyud
MD5:	5C6ED25DCE803FD84288922B8928409E
SHA1:	3CCC10546AE12F160BACAC1E9E422AF091EA4A41
SHA-256:	480B06B23E574B4BF386FDE1A91145A4171F97AEB5EE800E4BE1850F29B1AD91
SHA-512:	FE9265D2E6EA4ACB7E0A87E08BEDFAF48BCBAD62BB7A86E73F9AE21C8437AF3334D2A9733C6BC47A12BBF54F97EC79271CB5300F90231614F407599D1B4C05E5
Malicious:	false
Reputation:	low
URL:	https://s.yimg.com/wi/ytc.js
Preview:	!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=0)}([function(e,t,n){"use strict";function r(){if("undefined"==typeof TextEncoder){window.Tex

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2784x1336, components 3
Category:	dropped
Size (bytes):	150843
Entropy (8bit):	7.971704432924276
Encrypted:	false
SSDEEP:	3072:M6u4aYyNsbfesmwlr2UGb328O08c5nRNMks6d1TSjcWI++Q/Be:7y9sbfXm+2Urbc5RNMM0oWto
MD5:	623C5A8E5DAD2DBB3E4B194C62A8EF28
SHA1:	2A35330630D8E68332B4236F28F52BED0A8FB83E
SHA-256:	26B22540129136308B7DFAC21299D7F2B08114498A2E5B51A25C0F858D33E511
SHA-512:	2F940AA5560DD7CB21E758A68EC288568EB2C101BA6D703D6915102E24F25CEFEE9E4A78B73BC495E41E18E70D428F4BF5197E2FAB8C844133CF5C15F4B439D2
Malicious:	false
Reputation:	low
Preview:	......JFIF..........................................................$...........$.6.".(.".".(.".6.0.:./.,./.:.0.V.D.<.<.D.V.d.T.O.T.d.y.l.l.y........................................................$...........$.6.".(.".".(.".6.0.:./.,./.:.0.V.D.<.<.D.V.d.T.O.T.d.y.l.l.y..................8...."..........3..................................................................~7#HU....L...Km.D.Xl.:f.Jl.r.i4..Q..r...l8iek`,.B.GAC@UmVb....83.%.HcU..U9kKS`...u...t.+Z(.J-.\.Wv..fk..m..}B.9..m.e/,.iyuY.[kP.)q..&..jWV...9w............./.....r:..6...d+.eY.J.F.....u..yz...w....Q..lw%.%V.+WQ..TK....S....Q.~c.=/.o.....I.d.0K.....FP...U....b4.`B..".:...\.ks....f}ST..v;e.s.%.....3v.7...wQG..I$..2BI.$ ...H"H. X X...X.,..).JD.D..!$.V.........G.$.@VL.h.?l......%e..,3+.T."..Gdji%..(W...P.j..\.-Z...$..{g...fK...1i.....@........fE]......p,...F..#[S /J.^..O:......` ....-.D..2.er.j.u:.16C ....W...t....`.@`....+ +e.&......Z..IU...jK4.Km..-.........k.Lo$d.Z..uj....ek......j..

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient?
Preview:	<html></html>

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2024
Entropy (8bit):	4.8193527284808075
Encrypted:	false
SSDEEP:	24:2dsMBMEPfxWoFY+pf0m6CMU0ELmLU0PLuuxMwLhlllpaMB+u2/nQkpVjWgWeq1oh:cV/oIf/SXLU0zu0jkQkSg5qqjkQkk
MD5:	51730E5547DB617F6F3517E9D2E11458
SHA1:	6E08A11F465E3401BC218B95E5A9ED37632A814D
SHA-256:	BDBA0FC116C604CA6824068397EFBC91159E5275B180F501B9E9C477E1A5E2C1
SHA-512:	AA92A95A8BC5699920657DBCF2EFD50353E0EA90632B8203D780765588BA9CFEBFA8FBBBA0CC76A3124E5B64D142DAB74B733935A8466448AB8094FFF5EDC440
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_6" data-name="Layer 6" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <rect x="2.3516" y="7.5324" width="27.2967" height="17.3842" rx="2.0398" ry="2.0398" fill="#fff"/>. <path d="m2.3516,8.9824v-2.8663c.0227-1.2056.6258-1.8197,1.8087-1.8427h23.6114c.6824.023,1.1489.1936,1.3988.5118.3186.3412.4778.7851.4778,1.3309v2.8663H2.3516Z" fill="#ffddbf" fill-rule="evenodd"/>. <path d="m6.5557,24.9166h-2.3954c-1.1829,0-1.786-.6028-1.8087-1.8083V6.1161c.0227-1.2056.6258-1.8197,1.8087-1.8427h23.6114c.6824.023,1.1489.1936,1.3988.5118.3186.3412.4778.7851.4778,1.3309v16.9922c-.0227.6371-.1819,1.0806-.4778,1.3309-.3412.3186-.807.4775-1.3988.4775h-2.2769M7.9476,6.6619h-3.4121m25.1129,2.3205H2.3516" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <path d="m8.8476,18.376v4.9504c0,.4885.1943.9569.54,1.3019l3.498,3.491c.34

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (64709), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	280364
Entropy (8bit):	5.400628237358764
Encrypted:	false
SSDEEP:	3072:vs5yDt+KI+99jlx8Ux82h1L2q/Bzgnczbr+v:vfW2hcurzbr+v
MD5:	63E1D4E943CDE09BACA8392ACDED4A72
SHA1:	9F2DF193922FF69022C02C2E10AFC541942B54DB
SHA-256:	D314F25D1E40F8A8BEA3B7BAA8554ABE827565986E894E9306320C72BDC0D96B
SHA-512:	06100D6FA9C62AA8BD707CF91249EB7AFA6475D083A78ADF6EDCDBBC75F5F0E5667336C81F43690023C63B80BA67A9A383AEB0E85A5F4CDFEF88062519723C22
Malicious:	false
Reputation:	low
URL:	https://mstatic.avast.com/api/mhubc.js
Preview:	(function(apiUrl){..window.mhubc={ads:[],push:function(u){window.mhubc.queue.push(u)},queue:window.mhubc&&window.mhubc instanceof Array?window.mhubc:[]};var util={define:function(u,o,t){window.setTimeout((function(){var e=util.modules[u]=function(){},i=o.map((function(u){switch(u){case"require":return util.require;case"exports":return e;case"./generated/mhub_pb":return util.proto.CrossMasters.MHubCloud.Protobuf;case"google-protobuf":return util.jspb;default:if(util.modules.hasOwnProperty(u))return util.modules[u];throw"Not supported dependency "+u}}));t.apply(null,i)}),1)},modules:{},exports:function(){},require:function(){},main:function(u){var o=u(util.define,util.exports,window.mhubc);util.jspb=o.jspb,util.proto=o.proto,util.apiUrl=apiUrl},jspb:void 0,proto:void 0};...util.main(function(define, exports, mhubc){..var $jscomp=$jscomp\|\|{};$jscomp.scope={},$jscomp.findInternal=function(e,t,o){e instanceof String&&(e=String(e));for(var r=e.length,s=0;s<r;s++){var n=e[s];if(t.call(o,n,s,e

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1501
Entropy (8bit):	4.236121657737995
Encrypted:	false
SSDEEP:	24:tCbaAuc7Fsxis7cWK9BDQYywdOEnbLrbgcW2tn9SgpdBxliEID32rTcVuVX3QdnJ:EFYis7HcFQYywdOELbgZKn9SgpdBxliJ
MD5:	202BD8895C79A450E6C53AB68620783A
SHA1:	5A5C371C82F1DF4B6C367B8ACCF8AF4EF3FC4B0E
SHA-256:	5718C42DAA9F2388854D67760E2BABC8E6CE20800FD199AB0E00B6BFEBBB3370
SHA-512:	EDBFF8024CBA39FF9FF6D8B9DF3DE8A7DEE5034B3355726C05BA141D78ABF3409C114B9EF76887394DE1565C737AA83848F31EFC6C5F9E96E48BB6D89390A12C
Malicious:	false
Reputation:	low
Preview:	<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M15.973 34.247l-2.98 7.008a.6.6 0 00.768.794l3.213-1.24a1 1 0 011.284.55l1.374 3.322a.6.6 0 001.106.006l2.597-6.083a.723.723 0 01.665-.44v0c.29 0 .552.173.665.44l2.597 6.083a.6.6 0 001.106-.006l1.374-3.321a1 1 0 011.284-.55l3.195 1.232a.6.6 0 00.766-.8l-3.056-6.995M15.023 19.435h2.817m2.927 4.778l9.364-9.364m-22.184 4.3c0-1.203 1.61-2.626 2.293-3.536.867-1.156 1.186-2.258 1.529-3.63.31-1.242-.114-3.214.956-4.3 1.07-1.088 2.756-.778 3.917-.956 1.651-.254 2.481-.667 3.823-1.625C21.362 4.462 22.77 3 24 3s2.639 1.461 3.536 2.102c1.341.958 2.17 1.37 3.822 1.625 1.16.178 2.848-.132 3.918.955 1.07 1.087.645 3.06.955 4.3.343 1.373.662 2.475 1.53 3.631.681.91 2.292 2.333 2.292 3.536 0 1.203-1.61 2.626-2.293 3.535-.867 1.156-1.186 2.259-1.529 3.632-.31 1.24.115 3.213-.955 4.3-1.07 1.086-2.757.776-3.918.955-1.651.254-2.481.666-3.822 1.625-.897.64-2.306 2.102-3.536 2.102s-2.638-1.462-3.535-2.102c-1.342-.959-2.172-1

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.406109308257852
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDJ0BDfk/r6Tuw4Oi/yoSPa/RjT:Ofvt6lfk/OTPi/yYZ
MD5:	B22D91DA365579F870039A2F77FF41C4
SHA1:	41BD074A7E46477C97C8A14A4E5E8121B88118DA
SHA-256:	CD645A4ADBF12890C83BC860810C1F636416333DAE6210156D204FC4DD471EBB
SHA-512:	AFC625D1EA7F025CF0243CBDA805F121D5ECD128CC3EBA5E0B82EC51A52381438609CB56B31F6EDA6D68DEC94A3FCAB93B190CA60CDD63A635546FC3B69BFA14
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#fff"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.734 12.734 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.731 12.731 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FF7800"/></svg>

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1349
Entropy (8bit):	4.201219141408615
Encrypted:	false
SSDEEP:	24:t5Iu2eFA8C+w7Li+OMgJbuPogg9+5ZhUqT9VEujfWQofRn3DAx3OvvCIsyAKmq:ae/Ca+9gBqTgU9Jj+NpTAx3+vXsycq
MD5:	17D244683C9737C01686C384F87145E2
SHA1:	44AACB11ECF74D8594C95AF08D9787C654A7D248
SHA-256:	77B31D0E25FFE381DCD42AA468F074882CB5CB0F0B8BF26FA913308CD4D2772C
SHA-512:	AD80BB26C37BC2B8418DBAA31A3E4B3465D00FB5C5481C5E6BD4CF4746ECC103465DAA83137195729E33F7849DCF4B15D9F489F00C7858F3A566C40EA1A7EECF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/gen-logos/gen-logo.svg
Preview:	<svg width="38" height="18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.947 14.895c2.198 0 4.003-.765 5.18-2.57v2.158h2.414V9.047c0-1.275-.687-1.824-1.982-1.824H7.77V8.32c0 .942.51 1.315 1.373 1.315h1.746c-.274 1.452-1.608 2.53-3.454 2.53-2.237 0-4.022-1.824-4.022-4.709 0-2.57 1.55-4.63 4.297-4.63.588 0 1.06.097 1.491.274.55.216.824.471 1.237.863.352.353.627.608 1.314.608h2.434C13.697 1.688 10.733 0 7.672 0 3.159 0 0 3.454 0 7.79c0 4.378 3.473 7.105 6.947 7.105zm18.966-5.69c0-3.1-2.12-5.121-5.063-5.121-2.963 0-5.376 2.276-5.376 5.514 0 3.277 2.315 5.298 5.317 5.298 1.904 0 3.729-.863 4.611-2.393a6.478 6.478 0 00-.568-.432c-.334-.236-.628-.373-1.02-.373-.373 0-.707.216-1.119.491-.451.294-1.04.452-1.589.452-1.295 0-2.511-.766-2.708-2.335h7.436c.059-.219.079-.807.079-1.101zm-2.944-.843h-4.533c.216-1.315 1.118-2.139 2.354-2.139s2.179.844 2.179 2.12v.019zm3.895 6.121h2.924V9.224c0-1.707.843-2.766 2.257-2.766 1.139 0 1.923.568 1.923 2.001v4.65c0 .883.413 1.394 1.394 1.373h1.53

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2961
Entropy (8bit):	4.952945362592522
Encrypted:	false
SSDEEP:	48:cZ84hAWbJxQjXQtVbsTbJxQjRljL6JqIzgrGRpG+:c8B7eGKL6JTckG+
MD5:	567C783CB00B7E353776C56F873D3213
SHA1:	06E47E36A7054C3B5E10A6729276170D5E8593D0
SHA-256:	3FC870549063F9AC69339D0BB33E5755ED774F7DE57801B32B7826E019488B3E
SHA-512:	737A093A9D1B86C9771AF430844AFCB608F880A8A82E8DBA18198B6D4B1C0F414478AC78C1E25DED584B44962FA8A0CD52BBDA5B8D0C5BA30C4F3D2C1B98595D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <path d="M16.0042,38.1651c-2.5402-2.5161-3.8103-5.6248-3.8103-9.3266,0-3.6041,1.2701-6.7134,3.8103-9.3259,2.6132-2.5402,5.7219-3.8103,9.3266-3.8103,3.653,0,6.7496,1.2701,9.2898,3.8103,2.5884,2.6125,3.8826,5.7219,3.8826,9.3259,0,3.7019-1.2942,6.8105-3.8826,9.3266-.5564,.5564-1.1248,1.0518-1.7053,1.4877-2.2021,1.5728-4.7296,2.3588-7.5845,2.3588-2.8067,0-5.3349-.786-7.5845-2.3588-.6046-.4359-1.1858-.9313-1.7422-1.4877Z" fill="#ff5833" fill-rule="evenodd"/>. <g>. <path d="M6.0924,3.1374H38.9076c1.3891,0,2.5168,1.1277,2.5168,2.5168v4.3021H3.5756V5.6542c0-1.3891,1.1277-2.5168,2.5168-2.5168Z" fill="#fff" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/>. <path d="M31.7717,6.1821v.6535m8.5279-3.5927c-.3147-.1694-.7137-.2545-1.1978-.2545H5.9705c-.5805,0-1.0164,.061-1.3063,.1814-.7258,.3147-1.0887,1

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (978)
Category:	downloaded
Size (bytes):	1022
Entropy (8bit):	5.155402665459105
Encrypted:	false
SSDEEP:	24:cs9tETnnWNx/l73oWA5PKvK0S7IQYhZapGfxq:RAT4ra5CCvIZ28q
MD5:	70CA310D708E515399CF80D8B7BBFAE3
SHA1:	2CFA0951F3F78BB3E62C0FCE41DBA10C2F1565A5
SHA-256:	EDF958A4619728E7CF17EF834E1B3EA0584CDFAAF63AB5DDDF88651C341B5627
SHA-512:	55CAAAC6032DD32AAAEFF0559E8FB5937050708E2976E40671BB08B02D0F1E60F1D2E00C09C132CCFBF1C2962642D05BEC466C11C964D4CB807AE8384359E7FD
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/cmp-sticky-bars.js
Preview:	!function(){"use strict";function a(a){f.forEach(function(b){b.setAttribute("tabindex",a)})}function b(b){e.forEach(function(c){b?(c.classList.add("is-sticky"),a(0)):(c.classList.remove("is-sticky"),a(-1))})}function c(){var a=!1;h&&h.length>0&&h.forEach(function(b){var c=b.querySelector(".tr.table-header-tr");a=a\|\|d(c,64,null,!0)&&d(b)}),a?g?g.classList.add("hidden"):b(!1):g?(b(!1),a\|\|g.classList.remove("hidden")):b(d(i,null,null,!0)?!0:!1)}try{var d=avm.require("avast.web.waypoints"),e=document.querySelectorAll(".sticky-bar"),f=document.querySelectorAll(".sticky-bar a"),g=document.querySelector(".message-bar.sticky-message"),h=document.querySelectorAll(".table.sticky"),i=".sticky-waypoint";a(-1),(document.querySelector(i)\|\|g)&&(window.addEventListener("scroll",function(){c()}),window.addEventListener("resize",function(){c()}))}catch(j){"undefined"!=typeof sdl&&(console.error(j),sdl.push({system:{error:{type:j.name,message:j.message}},event:"system.error"}))}}();.//# sourceMappingURL=

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1321 x 601, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	46448
Entropy (8bit):	7.878726759947888
Encrypted:	false
SSDEEP:	768:UKzt6qfRcTdgBjY57/NmG1KK8a9GoWCmnnF6dqYJ7tuSvXTkaJwN12OSFtLq7u0C:Nzt6q87yK8eGhR4J7nAaY1YEM
MD5:	8462FB18718E5C0119542930B54C24ED
SHA1:	099F9A3CAA317639D3CCBE0DD3B6959EA86F510B
SHA-256:	7690D49CD549464B3729E8C98C678BB1A9FCB0D2A105A5586DCC72141D1214AC
SHA-512:	D5ED7BAE4A541C356C8D9C7E54EDA47D63BE09D62432EEB583171F77E0321DC345D8A5EBFF5704394443791729607089D8DCFEAA3C4830211B818B4965AA0544
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...)...Y.....E..\....IDATx^....eU....m..'..eB...A...HA.............3....f....R.2.J.V...r..4....&..,.... J#."..a....<K.Z...v..>7.7......k...Z{..'.e`..=..}....Q.....U..........\./^..o.....................@L.....................%%........().......DEI....... JJ.......QQR.................@T.....................%%........().......DEI....... JJ.......QQR.................@T.....................%%........().......DEI....... JJ.......QQR.................@T.....................%%.... a..)..k....rBI.....H.......O..3.-.......i..,.q...PR....."...x.PQ.../$..y.....DI.......FK..TQ<.._@6.R.^/.`.().....=GLj..-..P.i...`.().....=.I.z..m[4..~/...QR.....:......b.K.{.............]M.^.~o...QR......PN.Eb..m....%%........v.I]W....v..........HS..>.mh...O..+GN_...eo..`.()........XQ<w./.Ci..N]...b/o............F:>.._.6......5,.u[.X.^..0v........4....M...I{........cGI.........mw.nSN.......:.....QR.....*..l3..m9YZTRj..{..`.()........E[...5'.6.ij..rJJ...%%........K.g...E

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	329514
Entropy (8bit):	5.0865762305251705
Encrypted:	false
SSDEEP:	1536:huACHDCt/V4P34r8YqdbtJSfMfjGD4XcN1omSMAPHlJ48pG2228W45zNZQkTyCA9:jKcroMAYAioFyei0Ojrkr0J2/Z3omWs
MD5:	59A868F97AC39676DF6770D33420D3C2
SHA1:	3DC214A5ABB0BE542CF5BED33F8451A2DDA5FD3C
SHA-256:	DFBF92DAC66ED487442697FC53902E66536FD5143AECE4D1D5098A555630B482
SHA-512:	18E0A2AD8C3D46182FA2CC9959C73BBB9CA35AC7D7DA58196947263F85F782CE4B8F1497BE220A7535EA938515ACD70296C6F166A6E42C0A528D518C4490A7F0
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.css
Preview:	@charset "utf-8";body{font-family:"Mier B"}@font-face{font-family:"Mier B";src:url(../o/f/400/MierB03-Regular.woff2) format('woff2'),url(../o/f/400/MierB03-Regular.woff) format('woff');font-style:normal;font-weight:400;font-display:swap}@font-face{font-family:"Mier B";src:url(../o/f/700/MierB03-Bold.woff2) format('woff2'),url(../o/f/700/MierB03-Bold.woff) format('woff');font-style:normal;font-weight:700;font-display:swap}@font-face{font-family:"Mier B";src:url(../o/f/800/MierB03-ExtraBold.woff2) format('woff2'),url(../o/f/800/MierB03-ExtraBold.woff) format('woff');font-style:normal;font-weight:800;font-display:swap}abbr,address,article,aside,audio,b,blockquote,body,canvas,caption,cite,code,dd,del,details,dfn,div,dl,dt,em,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,p,pre,q,samp,section,small,span,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,ul,var,video{margin:0;padding:0;border:

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	458
Entropy (8bit):	4.829431768551787
Encrypted:	false
SSDEEP:	6:tnr/kumc4slm8A9zQkQNENXG1NwVs/SkizWeBvcp5OhL1W6kzSZV6kzQ0TCV79jb:tr/kuI85p+M1y2SkW1LGBhB9YU
MD5:	960DC631F4792A41E550B03056423D53
SHA1:	805309342C8A793E8C9D1352E124965FE8BB2794
SHA-256:	4C834597DBFEA8CD691579E3526B8DF855291AFEF5DD4BF50EB93DD5F4066509
SHA-512:	5458D71C1B956B9D89DF17A44E2364FFA346F2E03F0B415248CC546E68AB83B4345D650B90232821F8D30A301BEA43D857B410819A180CB7E0017D4BB802E5ED
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-smb-small-business_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M17.267 26.4h-1.901v-3.626a.55.55 0 00-.56-.54h-2.154a.55.55 0 00-.56.54V26.4H7.6V7.526c0-1.064.895-1.926 2-1.926h8.257c1.105 0 2 .862 2 1.926V26.4h5.768V15.674c0-1.063-.895-1.925-2-1.925h-1.18m-10.76-3.646v.646m0 2.826v.646m0 2.825v.646m4.087-7.589v.646m0 2.826v.646m0 2.825v.646m6.969.254v.646m0 2.826v.646" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7438
Entropy (8bit):	4.165436375230474
Encrypted:	false
SSDEEP:	192:ypmpVQxhGVV5/XomxNNpffFilOFkIplHUvRHMPvRYu:ypmpqzsVjN/UyCu
MD5:	A97FE84F0BC1F01FEF99D5FFA64CC08D
SHA1:	4045C03BB4FCB779947FF54676E48E06DB986093
SHA-256:	4E31C241E2961A79E33C55DCCF1F36F844FF603F6C4BF5025D73A9EDF81FB148
SHA-512:	66C5305199DEEF43F032E1261D75E6F7C51F8AA15FC2596EEF54BA1BEB035A2BC65BDA737780BFAE68AA723303599814CC0C5391503095392041461A62AD860F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/pages/about/160/all-platform--windows-mac-android.svg
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M58.871 68.438l7.403 1.386A3.147 3.147 0 0070 66.731V53.61a3.147 3.147 0 00-3.737-3.092l-7.392 1.41-5.674 1.055a3.147 3.147 0 00-2.572 3.094v8.185a3.147 3.147 0 002.558 3.092l5.688 1.084z" fill="#FFDDBF"/><path d="M100.319 68H105a5 5 0 005-5v-1.773c-.193-1.872-3.152-4.677-6.22-5.575-2.896-.856-6.592-.873-9.505-.03-3.1.94-6.125 3.666-6.275 5.605V63c0 2.761 2.249 5 5.01 5h7.309z" fill="#D5F2A5"/><path d="M77.41 38.678c-1.476.588-2.848.681-4.083-.46-3.492-3.25-5.768-9.666-3.273-14.116 1.584-2.651 4.538-3.67 7.355-2.532 1.562.606 2.161.493 3.735-.077 2.61-1.013 5.546-.497 7.278 1.842-1.752.785-2.734 2.794-2.734 4.641.034 2.01 1.3 4.186 3.312 4.795-.517 2.017-1.784 4.025-3.312 5.447-1.272 1.126-2.621 1.02-4.12.46-1.406-.654-2.758-.674-4.159 0z" fill="#D4E7FF"/><path d="M143.048 67.606c.673 3.194 4.63 3.64 6.598 3.227 5.206-1.096 3.788-9-1.5-9-2.052 0-5.77 2.58-5.098 5.773z" fill="#FFBF00"/><path d="M25.85 3

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	39677
Entropy (8bit):	4.943865445231978
Encrypted:	false
SSDEEP:	384:IKET7QDchsn26tF/lXGSONRgfZ7s3EAkcrPJI/Nrazqj33a5bo6Zd+Oo3iJMqkRL:M0Ihs2DMFnCdJvSojK5InKV
MD5:	2AD9B8CF20FCFE7F44364C847D6E3E9A
SHA1:	C3FAACF9CBAF9E78ED35AE8A3D4F76860914E054
SHA-256:	A09B570D4112E3BAB40E4D28A03441C5102591BA3B5BF0FF7206D7F86F998A33
SHA-512:	5D114E748534D6C6F4145FEEDC6FBD838B8EF738FBE4D2095444D376CC2C250E5214C47927E83425E2BABA1CE5B97082112FDD24F193CF733EE2DC70C0B3243C
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/flags/flag-language-selector-v3.svg
Preview:	<svg width="24" height="1224" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="a" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="384" width="24" height="24"><circle cx="12" cy="396" r="12" fill="#fff"/></mask><g mask="url(#a)"><circle cx="12" cy="396" r="11.5" fill="#F8F9FA" stroke="#E5E8EA"/><path d="M11.478 396H24a12.01 12.01 0 00-.413-3.13H11.478V396zm0-6.261h10.76a12.052 12.052 0 00-2.768-3.13h-7.992v3.13zM12 408c2.824 0 5.42-.976 7.47-2.609H4.53A11.946 11.946 0 0012 408zm-10.239-5.739H22.24a11.915 11.915 0 001.348-3.131H.413a11.949 11.949 0 001.348 3.131z" fill="#D80027"/><path fill-rule="evenodd" clip-rule="evenodd" d="M6.652 385.874H5.56A11.946 11.946 0 0112 384v12H0c0-.507.032-1.006.093-1.496l.609-.443 1.017.739-.388-1.196 1.017-.739H1.09l-.341-1.048c.118-.317.249-.628.392-.932l.577.419-.309-.951c.093-.174.19-.345.29-.513l.648-.47h-.35a12.063 12.063 0 012.327-2.594l-.336 1.033 1.017-.739 1.018.739-.389-1.196 1.017-.739zm-1.646 8.187l1.018.739-.389-1.196 1.0

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	61332
Entropy (8bit):	7.996607266636867
Encrypted:	true
SSDEEP:	1536:gvam7er043Z0vOUiINlJ8f1X2XHO363WNUpqBNE3M:gSm7QRIntXHO3KWJNE8
MD5:	18495FB39F1237A2330AD9BDDA9DDFA2
SHA1:	A01463981432D05D9F6A195AF1C002558DA099A0
SHA-256:	08C6E0CFFE5CE9B89F3C102F1CFFE1724B44E10A0A63097C06D20D71717D2D08
SHA-512:	2CFCF8EB8EDDDA01AE233272E2783EA94C19475514635A3B7EC176B5155979F1AA34BCE34B79D147488E2EFDCECD6DD5A6849A6F834B36A7C375AF0A306DE5F9
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/img-about-mobile.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@......................#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe...........8....pixi............ipma..................mdat.......~..@...2....... .@......4a...$r....8...n....<q.T.5ua9rX....0.d..}.B5.N.....c..%$.....x%V.G...Ti..(.S...B}(t..}..EoQ.....wz.R2Rz..7O..>..%.'4;...n.Q......{......"...O..X.PC?..Q..\iA....;>.........'.]...F...f.......M..a..2.#...Jv'G.W.l..$...5.Fq.....^.......;.D=k.Z.L..}.....)._..^....@L.l......Xp...{z....\|.M.c.w6.Y..h.#3<..c.C..kE!...6..........J`......a.Lt.n.).....T..,..cS.N.....~...!.....o..^.4).!..Ec...p....P.C....m&.j.c.3aZ2.gW.._.`..NH.+r.~P.H`d...q.q..!...b..}M..2V.D.(.\5.d.....6I....f.x7..`...`!.El.f..5. .\....x6L."...se4.[..v(:...+...j.z..D..u .....Z..Eo>..K-.`.@..>.vM.a...~W,6..T...u.l.H..6..t..wH.9...!LC.A.....5'.N.+...]X.^N.j...@}....I.^.{.V.=.K.]E.(..N..E.\cV..k.d.0.

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.660791464285325
Encrypted:	false
SSDEEP:	24:tzkuHyj2zpZmjl0Up5iA7e2IKiTYhll+wIbU3favg8HhQdYhll7:9S6pZmB14wuUSgk
MD5:	945B6233DADFEB4446D51BF931490F0D
SHA1:	10DB331A389EE3C42A42EA716F854526D4DC3214
SHA-256:	72395798A29BC168B956D804D038DF8790B9C2BE39E4CE91269A52E76678BFF1
SHA-512:	8CE590D422BD6B85D9109E31CA41C9E2ADB01665B24555A2FEF2048500905FD90E7E5A65BBEF4BC59413357D9F3DCEFAF74CFCFD3446BEC9E75FE664A793D2FB
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M18.277 15.077l2.238-1.644c.1-.076.046-.247-.081-.247h-2.747c-.333 0-.474-.117-.57-.432l-.855-2.65c-.052-.105-.292-.132-.326 0l-.854 2.65c-.114.299-.242.432-.57.432h-2.748c-.144 0-.197.16-.081.247l2.218 1.644c.247.174.322.37.204.657l-.855 2.651c-.025.126.109.252.224.165l2.239-1.644c.263-.17.495-.182.752 0l2.26 1.644c.103.104.249-.047.203-.165l-.855-2.65c-.096-.293-.05-.48.204-.658z" stroke="#FF7800" stroke-width="1.2" stroke-linecap="ro

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55725
Category:	downloaded
Size (bytes):	17136
Entropy (8bit):	7.984967554238888
Encrypted:	false
SSDEEP:	384:E2p4dVPlCU7GiAI6rv/HkKyUOcKXsolEv5Dfx:EVt1GJI6rnHkzpcoI5jx
MD5:	DC592904280A455012599B68215EAE0F
SHA1:	F6BF1868C5EEDD10F9931BEB10444A0FE340EA85
SHA-256:	7ECAF0F45DCAD41EC6E181E33CBC42A94A6B37F0CA79A692893EF442053A5276
SHA-512:	5E52431A7DFFCB3E86EB72423F1E0742D2F33449713A69C16EB734DB33469E656CA599483E8BB38635E235817D55B4230E92CA2B06B62E1A719513041344F8CB
Malicious:	false
Reputation:	low
URL:	https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/main.js
Preview:	............v.F....<E..GJ.. ..lYe...ey,..c.[...I.3.6.$E...<...q.e^`^a..#..L...U..JU.L...;.}..@.....?:[..:+.Q9...H.....F..fg.G.q}"~...)G.LS]....L..Q...:+....z...^....G9.}d..TmK.V_...8.....,..<....e.b...e:z...{..M..y.Hg......w.~....?~....7..@.../.......A..['.<Y..)o.j.c.U.T...}r...............4...9....`.Hg.A.41.i~^_..{{z5N0.~.@.o..q..Q..~...tT.e6....e.c._.r]......i.~...e19+.Uz]..h..-..i......{n.D...~....K.HA.....L..f...wi.......:.>.6:...3......a5f.KZi.A._.0....U.^?/.y....I.~.....2.%.....-..,......+.Y9..../Jp.Q............5.X6....,3t=.Hj...lA8L...1Y/.i..04k..6...a)..J...+.....Z.d..f..iL.>.k....1$6........<O.g......_...e./..+nJX....i.~..o.../^...<z.................t.u._d..e.....z}u...W.v\...(...uP>M.J.Q.7...ER>.....<[.....P...s)yz#o.f.X:(.......J....2........p.o..j.FM.UJ..z..(...1&..WKS..x.+.6A{....4.I.Ls.Z..iUM.7H;N..1C.9hj.F.{.vh(..:>......p[2.....*;O.4.\|v..5.{T\....,.p8....]...R....y=N..r........Z....o..........."..

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1684 x 1200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	108799
Entropy (8bit):	7.902359469780325
Encrypted:	false
SSDEEP:	1536:SxFZAjeq5tG7nkmFwcoZBdMo93t9VR/zetfzPLHqlWa0Q5QdTeY7OAfp0SWHu671:3jeGCKdtNbet7I0Q6eY7OAx0SWHu1Fy
MD5:	1806D19E710B9B4F989D80C2F8554643
SHA1:	8C56AFE74FBAB70B3050511EAAE2AEC08369E608
SHA-256:	9DDDEBBE35DEB392882BA72720A6126D29F98262813D9DC307587FE9A526B421
SHA-512:	234614B78D9C2045F99C34B969C89A5DEB7456B61D4CF212DEBED067ED4849AE01B28CABBB1CCD54A5BBB10C21F52A7CAD0D7218C538F866A38B62D9B16E183E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................IDATx^.._.&W......H..fW\..06m...HfWV..qdkZ..edyz.e..L....-..dF...0b4. 7.+.lm'...M.f"...VC.aa..x.L....B{....)....w...K...._OU=..sN..........Y......h...7....@......#..@;l.....V.J...].J...q.P...P+.%.....%...8[..........h.....h.-.....@.....@...4..j...jE.....E.....g.5...."P...."P..........Z.(...v.(.....B...@.....@.....@.l.....V.J...].J...q.P...P+.%.....%...8[..........h.....h.-.....@.....@...4..j...jE.....E.....g.5...."P...."P..........Z.(...v.(.....B...@.....@.....@.l.....V.J...].J...q.P...P+.%.....%...8[..........h.....h.-.....@.....@...4..j...jE.....E.....g.5...."P...."P..........Z.(...v.(.....B...@.....@.....@.l.....V.J...].J...q.P...P+.%.....%...8[..........h.....h.-.....@.....@...4..j...jE.....E.....g.5...."P...."P..........Z.(...v.(.....B...@.....@.....@.l.....V.J...].J...q.P...P+.%.....%...8[..........h.....h.-.....@.....@...4..j...jE.....E.....g.5...."P...."P..........Z.(...v.(.....B...@.....@.....@.l.....V.J...].J...q.P...P+.%.....%.

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1036
Entropy (8bit):	4.660791464285325
Encrypted:	false
SSDEEP:	24:tzkuHyj2zpZmjl0Up5iA7e2IKiTYhll+wIbU3favg8HhQdYhll7:9S6pZmB14wuUSgk
MD5:	945B6233DADFEB4446D51BF931490F0D
SHA1:	10DB331A389EE3C42A42EA716F854526D4DC3214
SHA-256:	72395798A29BC168B956D804D038DF8790B9C2BE39E4CE91269A52E76678BFF1
SHA-512:	8CE590D422BD6B85D9109E31CA41C9E2ADB01665B24555A2FEF2048500905FD90E7E5A65BBEF4BC59413357D9F3DCEFAF74CFCFD3446BEC9E75FE664A793D2FB
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_premium-security_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M18.277 15.077l2.238-1.644c.1-.076.046-.247-.081-.247h-2.747c-.333 0-.474-.117-.57-.432l-.855-2.65c-.052-.105-.292-.132-.326 0l-.854 2.65c-.114.299-.242.432-.57.432h-2.748c-.144 0-.197.16-.081.247l2.218 1.644c.247.174.322.37.204.657l-.855 2.651c-.025.126.109.252.224.165l2.239-1.644c.263-.17.495-.182.752 0l2.26 1.644c.103.104.249-.047.203-.165l-.855-2.65c-.096-.293-.05-.48.204-.658z" stroke="#FF7800" stroke-width="1.2" stroke-linecap="ro

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	9507
Entropy (8bit):	5.3592270038592424
Encrypted:	false
SSDEEP:	192:ebkfPUyAQgtNBIWguxw68uCItctpwfTh3fYwuoOE5YBTi+1POyj/0Pp5b5LfvEf0:PSN9cO51r
MD5:	4D67D7FCE83E8D073C84E4D5B5936E71
SHA1:	E02711957EA1C637BE41485526C65E4B56C55FD3
SHA-256:	1DA25CF82F065474AADCE40A8C7369F6DF48E1847CB95C21BD9083488EFF7390
SHA-512:	1E9D7565BEF92D1C2DA126245D6392176D29A4BE7F1B4623FB367B4C345AA5381EB9022ECD3317CC946B48E2AF89073C80EDCEE0FC121073C88643B191D8E4D0
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCenterRounded.json
Preview:	. {. "name": "otCenterRounded",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZXRydXN0LXBvbGljeS10ZXh0Ij48ZGl2IGNsYXNzPSJvdC1zZGstcm93Ij48ZGl2IGlkPSJvbmV0cnVzdC1ncm91cC1jb250YWluZXIiIGNsYXNzPSJvdC1zZGstdHdlbHZlIG90LXNkay1jb2x1bW5zIj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3kiPjxkaXYgY2xhc3M9ImJhbm5lci1oZWFkZXIiPjxkaXYgY2xhc3M9ImJhbm5lcl9sb2dvIj48L2Rpdj48L2Rpdj48aDIgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgaWQ9ImJhbm5lci1vcHRpb25zIj48ZGl2IGNsYXNzPSJiYW5uZXItb3B0aW9uIj48YnV0dG9uIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIiBjbGFzcz0iYmFubmVyLW9wdGlvbi1pbnB1dCI+PHNwYW4gY2xhc3M9ImJhb

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.4068516180284085
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDjySBDfk/r6Tuw4Oi/yoSPa/R+:Ofvtzlfk/OTPi/yY0
MD5:	5B726129A8C315687E028CDF4E75D0F7
SHA1:	8E15800AE8EA9480D1D63ECFD04C1A07EECB89A2
SHA-256:	AE9317D6E44154976E50735BFE9BACBA5CCBC6DA6E0B87B926EE62F97875E6A2
SHA-512:	6D3C4659DFBEF3E87E70A80C1A70174D3000087FB579A179ABDE3561DFB5176E045042826ED6AD71214AD17FB54AF45A9EF16C43CC3A92A7A74701AB18002BFC
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#FF7800"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.733 12.733 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.731 12.731 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FFF"/></svg>

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1036
Entropy (8bit):	4.660791464285325
Encrypted:	false
SSDEEP:	24:tzkuHyj2zpZmjl0Up5iA7e2IKiTYhll+wIbU3favg8HhQdYhll7:9S6pZmB14wuUSgk
MD5:	945B6233DADFEB4446D51BF931490F0D
SHA1:	10DB331A389EE3C42A42EA716F854526D4DC3214
SHA-256:	72395798A29BC168B956D804D038DF8790B9C2BE39E4CE91269A52E76678BFF1
SHA-512:	8CE590D422BD6B85D9109E31CA41C9E2ADB01665B24555A2FEF2048500905FD90E7E5A65BBEF4BC59413357D9F3DCEFAF74CFCFD3446BEC9E75FE664A793D2FB
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-premium_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M18.277 15.077l2.238-1.644c.1-.076.046-.247-.081-.247h-2.747c-.333 0-.474-.117-.57-.432l-.855-2.65c-.052-.105-.292-.132-.326 0l-.854 2.65c-.114.299-.242.432-.57.432h-2.748c-.144 0-.197.16-.081.247l2.218 1.644c.247.174.322.37.204.657l-.855 2.651c-.025.126.109.252.224.165l2.239-1.644c.263-.17.495-.182.752 0l2.26 1.644c.103.104.249-.047.203-.165l-.855-2.65c-.096-.293-.05-.48.204-.658z" stroke="#FF7800" stroke-width="1.2" stroke-linecap="ro

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2161
Entropy (8bit):	4.6277977137631074
Encrypted:	false
SSDEEP:	48:cZ84rWWAo0IEp/BN+uDa+lv6fBZuPYbB1bjw8Ao0IEp/Bg:c8zFdIEdDa+lv6fBZ7B5jOdIEw
MD5:	2980634C868A2531D8D26A9A34C92E16
SHA1:	E98982BCCA3CB88FD0A4807B8ABE93BD9306EEFA
SHA-256:	E9B4022F0CB8CF108F3A48AE9EF846FE9C17BC9CDC38C59DFDF2EB2873D3C399
SHA-512:	C2EFE5F9C24AF71E4FA9BE963D945E2214BC6512A0979EAE7CA4F7BF7D8A9592E9107279176610D0218BB926AF00272502BAF5E7DCC96C630662E3FCCADB779B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <rect x="2.4521" y="4.7397" width="40.0958" height="29.6924" rx="4.4845" ry="4.4845" fill="#fff"/>. <path d="M42.4347,11.6464H19.1014l-1.6941-3.9778H8.2106l-1.4521,3.9778H2.7579V7.6396c0-1.6016,1.2984-2.9,2.9-2.9H39.5347c1.6016,0,2.9,1.2984,2.9,2.9v4.0067Z" fill="#ffddbf"/>. <path d="M11.8532,26.2532v6.7447c0,.6655,.2647,1.3037,.7358,1.7738l4.7658,4.7564c.4699,.4689,1.1065,.7323,1.7703,.7323h6.7223c.6616,0,1.2964-.2616,1.7658-.7278l4.7933-4.7601c.4738-.4705,.7402-1.1105,.7402-1.7782v-6.7337c0-.6677-.2664-1.3076-.7401-1.7781l-4.7935-4.7606c-.4695-.4663-1.1043-.7279-1.7659-.7279h-6.7496c-.666,0-1.3046,.2651-1.7748,.7368l-4.7384,4.7533c-.4683,.4697-.7312,1.106-.7312,1.7692Z" fill="#ffddbf"/>. <path d="M42.5479,16.7002v14.9146c0,1.5559-1.2613,2.8173-2.8173,2.8173h-4.7006m7.5179-17.7319v-5.0538m0,5.0538H2.4521m40.0959-5.0538H19.5057

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1597
Entropy (8bit):	5.015388542092885
Encrypted:	false
SSDEEP:	24:2dAAfgl4mVnP9B52TyF7PhIFjrReEwB5RCZ+jUEJJIVLJYQKAxMwLhlllQfjLhl4:cZ84SVbPhWnMEwBvC4JJ4X
MD5:	E5B6246059CBAEFD13D4AAA720CF8530
SHA1:	EF54BFDAD6F5CD58F267C2FEBFF82816C9E75C6C
SHA-256:	04AED4F1D862AC4DE0BAE647D6C5AF11C950CDF5FA53B301CF6D9DEB5F368B45
SHA-512:	3B59666260F90F93DA43B9C18D0D5D12005771BA412A71C4DAE9B5FD6A9472FF7729E51B02188A4079E562A5A87AA648188FB13C8525C2A28D780342AC010318
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/what_is_a_computer_virus_academy_refresh/icon-03.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <ellipse cx="23.6306" cy="23.5332" rx="17.9895" ry="16.4885" fill="#ffddbf"/>. <g>. <path d="M29.4926,6.6474c.1731,.0743,.334,.1485,.4821,.2228,1.3848,.6922,2.6707,1.5699,3.8577,2.6334,.0989,.0493,.1855,.1112,.2597,.1855,.9396,.8654,1.7557,1.7803,2.4479,2.7449,1.7803,2.4725,2.7199,5.279,2.8188,8.4195v.4825c0,.5687-.0246,1.1251-.0739,1.6691-.3463,3.8327-2.0774,7.1586-5.1928,9.9775-3.5114,3.1901-7.7646,4.785-12.7597,4.785-2.2751,0-4.4014-.3463-6.3798-1.0385-.2967-.0743-.6056-.1855-.9273-.334-.5687-.2474-1.1374-.5194-1.7061-.8161l-7.4183,3.1528,2.0027-7.6038c-.3213-.4452-.6553-.89-1.0012-1.3352-.7668-1.1378-1.3602-2.3244-1.7807-3.561-.4944-1.5329-.7418-3.1651-.7418-4.8958,0-4.5503,1.7434-8.4322,5.2302-11.647,.0743-.0743,.1358-.1362,.1855-.1855,3.5114-3.0166,7.6904-4.5253,12.5369-4.5253,2.992,0,5.7123,.5564,8.1602,1.6691Z" fill="n

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.1925825200734
Encrypted:	false
SSDEEP:	3:YXLfcglsW0GxoW/eYJzAXWMSIp24brEJ4:YaixoW/9FMSUrZ
MD5:	3944D2F4EF92AF425D5A341E3D40D7A8
SHA1:	4392645F29C17DED10D16622BA237CE690224FD9
SHA-256:	9369B2673DB55DE20067C87D7BE63F4197A69C3236D0A1C108000B938594B9DF
SHA-512:	D233DEE1FBC2143015BB77156AF6BA35D64FDF634A08F69EE7DB092282AA540ADEE892E00CE2C136D004FF7BC262D485D07B16872198790B5FA1E4EA57E4A8CA
Malicious:	false
Reputation:	low
Preview:	{"reason":"Invalid arguments","events_count":"0","results":{},"version":"5","status":false}

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	272
Entropy (8bit):	5.1625695992699665
Encrypted:	false
SSDEEP:	6:tnr3rpqULyKumc4sl7vrERIykdgZmiAELbHsR69/KlW6YmqZllv:tr3rpq6juJlJeZoELbHs4OYhllv
MD5:	5AD7A6AA7F2D255641479F2F3FD8A213
SHA1:	48F120A75EEF107EB1C3A510414921D1871C9E2B
SHA-256:	D41F8873EA314FBD365E50B1B8484E925064AC5250F22660AC06D89C6014F5DD
SHA-512:	7255E92DD22074B6D7AECEF7457A5ED69D873EB346FD2CEE4F075EF72079343820CA6F34FA6981400326015EAB5F0AF7819E64758E406CA104101A73FB6C53C8
Malicious:	false
Reputation:	low
Preview:	<svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#0070F6" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	4.969931986406253
Encrypted:	false
SSDEEP:	24:YaWVyVVWVyVGHlVjLClOY4W/nNIgYgIPs:YaWgVVWgVaPCd4W/nNIgfqs
MD5:	F10AC6AD4101EFBD0B875103172B62B3
SHA1:	A98E48874F1FE33E96358263C75DE3D555387ED7
SHA-256:	29423A280BC436749F5EB385564F72FC80A0333FD0BAF0BD263FD05958073990
SHA-512:	BECF16859EF7BC86862B69F50D912AF74590BFDDD6F26304CFBA5B0604A8B43E41F15FB65F4C8A103F6B68052B512975101948F76B357324D601240B0185DF40
Malicious:	false
Reputation:	low
URL:	https://widget.trustpilot.com/trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en-us
Preview:	{"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"reviews":null,"links":{"profileUrl":"https://www.trustpilot.com/review/www.avast.com","evaluateUrl":"https://www.trustpilot.com/evaluate/www.avast.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/www.avast.com","consumerWebPageUrl":null},"starsString":"Great","translations":{"main":"<strong>[NOREVIEWS]</strong> reviews <span>on</span>","firstreviewer":"Be the first to review us on"},"settings":{"customStylesAllowed":true,"syndicationEnabled":false}}

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	3.9638823518918755
Encrypted:	false
SSDEEP:	48:CCYWGxek1sprEaPu1UHdrEO9WFmbiZwiREv/XZfdSWpbFSNDH:3YWGxek1sAaPuiaaZfdN5FSNDH
MD5:	E48F1562B2FF1CEEEFD7322A1BA4E230
SHA1:	95DC95C6D284EAD06EC107EFB28A8EC8456551E4
SHA-256:	7765991A7B59FF69FD88865D83E268A8C9F7EF7690CEC18EE9D5084C47628C16
SHA-512:	D2E5C50FC7827A02D3B44A59B218BA4D24E655733F72B6861758561971D375E15F7EA8DE468C112B34B1E00E0A9401B268942C116F55E4A5549489521164D7F7
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 643.4 200"><path d="M635.5 89.1c4.4 0 8-3.6 8-8v-9.8h-24.8V49.7H605c-4.4 0-8 3.6-8 8v13.7h-4c-4.4 0-8 3.6-8 8v9.8h12v31.7c0 5.1.1 9.8.2 13.8.1 4.1 1.2 8.1 3.3 12 2.3 4.2 5.7 7.2 10.2 9.1 4.5 1.9 9.6 2.9 15.3 3 5.7.1 11.5-.4 17.5-1.5V148c0-4.5-3.7-8.1-8.2-8-2 .1-3.9 0-5.7-.1-4.2-.3-7.2-1.9-9.2-4.9-1-1.6-1.6-3.7-1.6-6.4-.1-2.7-.1-5.7-.1-9V89.1h16.8zM296.7 42.8h-23l-41.3 114.5H250c3.3 0 6.3-2.1 7.5-5.2l6.9-18.7h51.1l6.9 18.7c1.2 3.1 4.1 5.2 7.5 5.2h17.5L309.2 51.6c-1.9-5.2-6.9-8.8-12.5-8.8m-25 71l18.2-49.1 18.2 49.1h-36.4zm189.7-44.6c-18.2 0-29.9 8.1-36 23.9l13.1 4.6c3.1 1.1 6.7.1 8.8-2.5 2.8-3.5 6-6.4 13.9-6.4 9.9 0 14 3.5 14.8 12.9l-26.5 4.6c-24.5 4-27.5 19.1-27.5 27.4 0 8.3 6.3 26.1 30 26.1 12 0 20.6-4.4 26.2-9.8.3 4.1 3.7 7.4 7.9 7.4H497V102c0-23.1-14.6-32.8-35.6-32.8m-6.1 73.5c-8.3 0-12.4-2.8-12.4-8.1s3.9-10.9 17.2-13.2c7.3-1.3 13.1-2.4 16.9-3.1v5.4c0 11.2-11.1 19-21.7 19m-49.5-71.2c-3.3 0-6.3 2.1-7.5 5.2l-19.5 52.9-19.5-52.9c-1.2-

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	191
Entropy (8bit):	4.7955558078723834
Encrypted:	false
SSDEEP:	3:CAXkxdLREbXxrVdq5AayAXk3sKhRpDVSdAI1FVAnFe5D/kQorq3fsV/YpaWMI8A:D4LRMYA+ruNRIPVAnFeBfo6kewE
MD5:	009650662ED3A341C96831978A47C91E
SHA1:	5000D0763027134D88682C350917E3385BE93E09
SHA-256:	A210D9C1E9B3863D3E7B5BFADC0218AC180B26A6171BA54B9E530DA3996F8CBD
SHA-512:	4037254E0D567A19CD194954A2284988F2DE7B0882A35EF77ECA671AF5DC21A1544BBC95CCC7CAF027EDE7260743A3B26347FBEAE1E76B10B302D02F0CA9625A
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v2/avast/pages/eula.css
Preview:	.hero-centered .container{padding-top:8rem}.hero-centered h1{margin-bottom:0}#eula-content{padding:8rem 0 8rem 0}#eula-content h2{margin:2.5rem 0 1.5rem}../# sourceMappingURL=eula.css.map /

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7916
Category:	downloaded
Size (bytes):	2144
Entropy (8bit):	7.876056245780182
Encrypted:	false
SSDEEP:	48:XwFKBvebTCTh27GIOutt0J5mu0gZxZpS+p9dsl3rsrIXwpZYe+O:gFKIbTOh27Gct0Lmu0iZA+PiBoIkb+O
MD5:	1307E3FD5846BACC989C2FD05996F010
SHA1:	3FD96ECEA8C4A91980939FE1E1EFE9EC0F47EEBC
SHA-256:	39F14C526D9F43A24B5C1E219E7EE63500F90B39517D18085573DCF73EB33D87
SHA-512:	DDB52F415B686D9DB2ECDCC5BF5B40D6E9BAA9B5CBEAC0AF9E48FE37FEDC1F96EF254F4F00520342D7EED54EA75446D9AB350EDF08370C05D178ABAACEBDC81A
Malicious:	false
Reputation:	low
URL:	https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775
Preview:	...........Ym....~...!.nK.....C.4E..m..(.iAI..[J..w...=C..)Y.w.h.....3....j......o...(....n.<.Z.$..E.4........B...$..o.dT//...oA5AqN.....ip?A.~cI..a"E$...X......L....k#...H.8a+.RbRU.j,.O4...$.\|..9.p~.......G\.O...W.b.I.ILb).u.I.H...X.c.}b.P.P.......0+.~.....V.....Xi...y.2....Z...8.5f8.......8I...3.2.....B....f.4.e.5.8. .f....S!4...XK(`.`"5..+Q,1...Q.]...@.h..d5(..V.....$.....-k\.....j.e....b..U.......Pz.N..+.Ul"!AP8].`..9.L.@..i8.N.].......Y.AiE.z...YV..Q...n.J....8....o..N.u...rcf.r.\...5..).k\|-,...\|.ic.j......Q.W..`z..\..yx8.,..gm.8.b.9......5....F.KnJ.....'.W.0..Ak:...(.U2..H....I'.i...6r..H}nx..N........$.0=r..5h......... ....2..x...~.......IP.. .....N..P./.M.A.r.).t...50..D..............V.^....O.......^....8....E...V.uAo~..b.jR`+"............H.^k...-.T..v...'.......\|.....db....Ze.@.V.U.b...c..W......Z.x{1.u...L...\|I. ..u..KJ..3.V.A......i...Mb....:#..h8A"..\|.......g....Y..'..h.1..I.t....5;J].*......Vjp3c...T...6./.....+t

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10336)
Category:	downloaded
Size (bytes):	17968
Entropy (8bit):	5.244632480196632
Encrypted:	false
SSDEEP:	384:XbYUyZYjOZYui4pOYYX+bnMbseaUxQzEwDB5C:rYUiYCYqVYEf7AwXC
MD5:	7AA25D5C5A008BD4A96EB7DAF3924659
SHA1:	91DD93F8E8DF52120BCBA490AFF72105FFA7F7CC
SHA-256:	08CE2C96C259F96267DF26B74D598787CF44CCF38919B9A6B71F8C1AE0067E97
SHA-512:	9340A98F17B23CF78D4AE7107CCAC8698AF37230E07D4623086A849B286FC0663418971085371B4D624523C9406782A359C28FC34C746C32F1A30498061A379A
Malicious:	false
Reputation:	low
URL:	https://static.hotjar.com/c/hotjar-470805.js?sv=7
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":470805,"rec_value":0.07918918918918919,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":null,"suppress_location":false,"user_attributes_enabled":true,"legal_name":"Avast","privacy_policy_url":"https://www.avast.com/privacy-policy","deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[{"id":397263,"created_epoch_time":1649746901,"effective_show_branding":true,"skin":"light","background":"#ee8031","position":"middle_right","content":{"email":"We may wish to follow up. Enter your email if you're happy for us to contact you.","emotion":"How would you rate your experience?","initial":"Help us improve by sharing your feedback.","thankyou":"Thank you for sharing your feedback with

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.5
Encrypted:	false
SSDEEP:	3:x:x
MD5:	402E7A087747CB56C718BDE84651F96A
SHA1:	7CE01F6381463362CF6AEF2F843A59261E8F5587
SHA-256:	662EFAF46C617DDBCB8FF4A2A8F64CFFD3D93630F1003F8E66511F369B87730F
SHA-512:	5080D776D0B123F20E97D44472EF2343BC022105AA67FC802B71668BAEB74A81530355589D50B1142165D17EF995AEAC196B6C15136D518A1EC0ABFA13C91D10
Malicious:	false
Reputation:	low
Preview:	Success!

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.413909765557392
Encrypted:	false
SSDEEP:	3:H+Wth6G+:rv+
MD5:	FA249E038D10AD3C4C2EB24AEF0A42FC
SHA1:	61B74E47ADEB43A6D0ABE89AB40A59689E9FA87C
SHA-256:	17E530EC9699F6EC2381AFB264B35D878B75C01A8C772E1D2E456B3671C6A5E2
SHA-512:	1788BF2FB021EE646DC8D9CA997FC66B86ED35BC39D2A863E272441477ED9798B3CC72493C486A090D88A9CB07454E3864F8B45601EF2EEE2E4E30989C01E6EC
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmC8FuY1xGpIBIFDVjM1wwSEAk2n2UUBqYs5BIFDaWTNiQ=?alt=proto
Preview:	CgkKBw1YzNcMGgAKCQoHDaWTNiQaAA==

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	4.212450020453697
Encrypted:	false
SSDEEP:	48:ccYG3XJAjCXx8U2xVKjDHN8V97gPINlW34noKyh9NBrEp8uUClJK0h97bS9w:VF7zHN8VaPqwA/pNC9w
MD5:	27DF154AA257ABD1CB7BED2A04A4C6BD
SHA1:	63460F677D8499B64DC1206A4B77D5D7018BE6FE
SHA-256:	8919E04CC8C411083D4F27EE23CE39AA225FB1B9B24BC5F754765D66107AFA8A
SHA-512:	864DA5F6602B9F7A1C451570ED21D404E1F73978D081D25B7797F4D9C92ECE5697B0E25AB8CF2329C7E9C3ABB4FDB17521E536EE77C17F468EB28ED4C9B51E15
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.28 28.388a.6.6 0 001.2 0h-1.2zm-11.744 0a.6.6 0 001.2 0h-1.2zM3.6 9.544a.6.6 0 000 1.2v-1.2zm0 11.727a.6.6 0 100 1.2v-1.2zm-.002-5.864a.6.6 0 00.004 1.2l-.004-1.2zm7.138-11.795a.6.6 0 00-1.2 0h1.2zM28.4 10.744a.6.6 0 000-1.2v1.2zm0 11.727a.6.6 0 000-1.2v1.2zm-5.92-18.86a.6.6 0 10-1.2 0h1.2zM9.362 16.375l.285-.528-.933-.504.048 1.06.6-.028zm3.303 2.466a.6.6 0 10.57-1.055l-.57 1.055zm9.974-3.2l-.287.528.934.509-.048-1.063-.6.027zm-3.302-2.481a.6.6 0 00-.574 1.054l.574-1.054zM16.6 3.612a.6.6 0 10-1.2 0h1.2zm11.8 12.987a.6.6 0 000-1.2v1.2zm-13 11.789a.6.6 0 001.2 0h-1.2zM9.516 12.724a.6.6 0 101.068.548l-1.068-.548zm12.973 6.55a.6.6 0 00-1.07-.545l1.07.545zM5.836 15.399l-2.238.008.004 1.2 2.239-.008-.005-1.2zm3.24 1.503l3.589 1.938.57-1.055-3.588-1.94-.57 1.057zm13.85-1.788l-3.59-1.955-.573 1.054 3.588 1.955.575-1.054zM16 22.046c-3.168 0-5.895-2.54-6.04-5.7l-1.198.055c.174 3.82 3.447 6.845 7.238 6.845v-1

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3184)
Category:	downloaded
Size (bytes):	54297
Entropy (8bit):	5.323011319466482
Encrypted:	false
SSDEEP:	768:so/MPceY1RWU9Yw5SY6nxBMYUYARGj+DYfq5j1JY8Z02LKVYKYLyYurgOmLnKIn3:RJeURT7z6nHM9rEqJ1JTZ02LKVlEyg
MD5:	953C976F6D4AFB4503DFD00663F23DA8
SHA1:	10EF03D92DA1876062EA47967EC0728D3E0C2717
SHA-256:	3BC4EFC188A0E9BA9C694F7EE9AA71EDDFFCD82A18CE6D0140CF6A2FE338C41C
SHA-512:	53154613E17C2B9DA9451C976FEB8C38FF6E681B821A487E400FCDACE2AC28CD9AC922CDEE896FCC5654E344F49BCCBB2728D388FF635D9FAF2F040EE9B8B0FB
Malicious:	false
Reputation:	low
URL:	https://connect.facebook.net/signals/config/334783782127169?v=2.9.147&r=stable&domain=www.avast.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19944, version 1.66
Category:	downloaded
Size (bytes):	19944
Entropy (8bit):	7.989554271513606
Encrypted:	false
SSDEEP:	384:GlrbV2qSfi0AYHvQrKMMU8micjK7fOhvPYHtP9CQ4WGYIIah65N/at7:c3V2jihYHoIljcYGdw99iz7bMbg
MD5:	F2C718E58AF39D28C873ADCFF1FE9FBF
SHA1:	3B0D9926841FF1F0501887634878B908BEE926AF
SHA-256:	C2770B7FDECF2796C4F54910A5882BD28315CDF727676A796CDA2B0F4A7EEE6F
SHA-512:	40F8C9805824E24B3EC5A60D1EF8BD303DC0FF4C1317C093F3FFA77A8D0011D8CB34FD1D71E8A440D0A46916B2A624CE1862E52BC6C2AC8BDE44CB7C269AC067
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/Avast/Academy/assets/o/f/800/MierB03-SubsetEng-ExtraBold.woff2
Preview:	wOF2......M..........M....B......................b..L..(.`..4..v.............6.$........ ..J. ..z....6.f..R.`.}........fGX.8.<X~......9b...._5.PUQ..<+..>..=R.q....>..Qy...q[..j.R..=n...R.K.hK......5G.. ...dH.a...z.._e./..O.@.(..;..u..O.2..\.t.....S.n....}....IN...Z..0...bK..GO..<..{ t.?Os{...[$.-.<.Q[kS..5..F..Y..Y....:..{..6..3c..=..,.{.$0.Z..KI{..l..7.6.......=..l[... .. HP....o...#].?..<I.">Iw:"....\|]...,....T.........f.F... ....t...r.A............,;>K.>.....)...DK..D.` .(.3...'....9u..R].Uz.......[...7.d^.z...$!...8..hY3.lY~..Z.0.0.6..np....9...^ ....;M....U..+..\....c..f.TJ.<.....e......].n..6........T......t..A.v.E.VW.t\|..:...KV2.?.S....=C`F.M.......+.~.In.......oj...{..G.BP.9c,(D.*.:..r.........a.......;!..F.....x..'.w...)....Se.)T....E'..]..\.h...e....K..T4&g#.i.k..w........M.s....X...<.qX..;G..!%....Z}....x.D.P../....D.Q.D...M").R......6L..._..;5..m..M..".}.....2..@...-K.H,...rTu.Ld.y.z.;...MkS.%w..uTE...1b..#...c.}.!.u.a..

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (711), with no line terminators
Category:	downloaded
Size (bytes):	711
Entropy (8bit):	5.597166900955265
Encrypted:	false
SSDEEP:	12:hnMQbwuOaxyCkv4AEH8z4Z4rekI6XnxOQGMc6RH1LTW5dUBMKTiUMGT2IWSBWrc7:hMiRO9/wT63BTZRVLTW5dot8G9xuZRPI
MD5:	5C63021E6D7339254AAC72B64CAE9F4B
SHA1:	9C791DE9909DAB309F0D96D1A2B7772CFB12F4C6
SHA-256:	AE99D96D377DE4139262DFCEE9CFAE438A331467FB20202A2EFE7ADECD5DAEF9
SHA-512:	7A87E6E7F835E7F44C93E652B6BF010D332AB18B8F27544374A63162A877305BC5CF09364BE423926266825910EB2F3239C2BF99136965461F28BC746FB813E3
Malicious:	false
Reputation:	low
URL:	https://4711400.fls.doubleclick.net/activityi;dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus"/></body></html>

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	272
Entropy (8bit):	5.176412743225632
Encrypted:	false
SSDEEP:	6:tnr3rpqULyKumc4sl7vrERIykdgZmiAELbHsR69k4YmqZllv:tr3rpq6juJlJeZoELbHs4q4Yhllv
MD5:	72B10EA8B9BE2E07F04BFE67CEA21E99
SHA1:	27330D448B1A76081776CFCA69F7959FF7069BDB
SHA-256:	FED5F96D993DCF84D9FA314DC9956A5044FF59842E8B2B65409C795804F3F5A0
SHA-512:	C1FD7FB839F076A4CBC30BF05A606483E208BD899B6742B441190D4C45489C3E76AEF1FD9F1F4F94A61470F6AE43E0B4B8F126C0B4F781827F6DD8E1426F3270
Malicious:	false
Reputation:	low
Preview:	<svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>..</svg>..

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (743)
Category:	downloaded
Size (bytes):	785
Entropy (8bit):	5.306213986254662
Encrypted:	false
SSDEEP:	24:cbwNVuu3IlHuOouMUR3+kIdxBa5KGfa3z:Ou+Hu1uMuukIdxBa56D
MD5:	826C178D8ED6886E4807FCD9088E6CAB
SHA1:	B412CC003F588EC4CF4C71B0E3F0A5A88F78352D
SHA-256:	B132E3C40C34D62FBD045FB30DCAC6B77D85B1C520AFADADB92548F5D4DBF517
SHA-512:	9C4284FFC97AC561971D5B8AF8A18037C924462F95D904DB22B8965730311DEAF9E2A014CC708313734FA4D5025319ABFC16244C64ECF889ED9DEC673432AC48
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/cmp-countdown.js
Preview:	!function(){"use strict";try{if(document.querySelector(".cmp-countdown"))var a=document.querySelector(".cmp-countdown"),b=a.dataset.expiration,c=new Date(b).getTime(),d=a.querySelector(".days .numbers"),e=a.querySelector(".hrs .numbers"),f=a.querySelector(".mins .numbers"),g=a.querySelector(".sec .numbers"),h=setInterval(function(){var b=(new Date).getTime(),i=c-b,j=Math.floor(i/864e5),k=Math.floor(i%864e5/36e5),l=Math.floor(i%36e5/6e4),m=Math.floor(i%6e4/1e3);d.innerHTML=j<10?"0"+j:j,e.innerHTML=k<10?"0"+k:k,f.innerHTML=l<10?"0"+l:l,g.innerHTML=m<10?"0"+m:m,i<0&&(clearInterval(h),a.remove())},1e3)}catch(i){"undefined"!=typeof sdl&&(console.error(i),sdl.push({system:{error:{type:i.name,message:i.message}},event:"system.error"}))}}();.//# sourceMappingURL=cmp-countdown.js.map

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	19786
Entropy (8bit):	4.351677647512085
Encrypted:	false
SSDEEP:	384:ywwJuCUTXsE4hVRCiigCAtUHt0N0Pu1EINs9In1kssJF7TEo4yDpWm:ZCThVRCrfAtSte19W8ODIm
MD5:	B170730CF7844667FF057B7E25C5D5D1
SHA1:	590B8880BE0CF52D93904F986D89B3B85F20A71D
SHA-256:	3266F3A4E033A79BEB74D3A866DBCE75A052E79A872FFC8C3FA1F68A61A6087E
SHA-512:	9A9AA25F52BA24A39371FD4E996BE5860238F0560F123582633087B3E19DF8E4F23E790B8DAEA7A77C517FF0E9DD7CEFC18C9FE753C1348FEDC860D9BBB3C185
Malicious:	false
Reputation:	low
Preview:	<svg width="656" height="224" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.521 15.98h25m0 0l-8.683-7.65m8.682 7.65l-8.681 7.65m56.64-7.61h-25m0 0l8.682 7.65m-8.681-7.65l8.681-7.65M160.021 5v22m0 0l7.649-8.682M160.021 27l-7.65-8.682M112.021 27V5m0 0l7.649 8.682M112.021 5l-7.65 8.682" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M57.5 121.6c-.7 0-1.233-.217-1.6-.65-.4-.4-.6-.917-.6-1.55 0-1.2.783-2.533 2.35-4 1.667-1.567 3.767-2.35 6.3-2.35s4.617.783 6.25 2.35c1.6 1.467 2.4 2.8 2.4 4 0 .6-.183 1.083-.55 1.45-.333.467-.8.717-1.4.75H57.5zm6.45-11.5c1.2 0 2.233-.433 3.1-1.3.833-.833 1.25-1.833 1.25-3 0-1.2-.417-2.217-1.25-3.05-.867-.9-1.9-1.35-3.1-1.35-1.2 0-2.233.45-3.1 1.35-.833.833-1.25 1.85-1.25 3.05 0 1.167.417 2.167 1.25 3 .867.867 1.9 1.3 3.1 1.3z" stroke="#071D2B" stroke-width="1.2"/><path d="M25.05 112.1v7.25c0 1.4-.683 2.1-2.05 2.1h-4.65v-7.55h-4.6v7.55H9.1c-1.367 0-2.05-.7-2.05-2.1v-7.25m-1.95-1.5l8.95-8.95c1.333-1.333

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	79869
Entropy (8bit):	3.880428996568255
Encrypted:	false
SSDEEP:	1536:gWX0vmJ7GdznAmsfQnlGsHwK48TfvP8fJnoF2:ZWOYC
MD5:	7093E092AA3B2E4C4E03EED07D2CCEFA
SHA1:	CB280DBFE2CF1AD72CB3D305A2D434B4D56ADA57
SHA-256:	0D7AAF229F1C76C7BB81EEF649DA877E8A90D2B46BB704C9FF3C9E11718970D1
SHA-512:	5E4CBD341AF0CCEEF6C52E56834E49A2724FEE0EA09220E1F5C0FE21AAA553079496034DEC119E0B68213E1030A9776C77C24D833A18F2FD3A95EBBB9B987E86
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/media-platinum.svg?width=580
Preview:	<svg width="504" height="364" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M244.525 308.085c118.027 18.982 242.927-25.974 257.456-116.313 14.529-90.339-75.506-160.401-193.533-179.383C160.306-11.437 77.688 76.006 63.159 166.345c-14.529 90.339 63.339 122.757 181.366 141.74z" fill="#FFF9F5"/><path d="M129.925 218.751c.643-2.865-1.915-4.105-5.246-4.851-3.332-.746-6.175-.716-6.818 2.15-.642 2.865 1.537 5.793 4.868 6.539 3.331.746 6.553-.972 7.196-3.838z" fill="#FFAF9D"/><path d="M158.025 336.24h-28.114a4 4 0 01-3.932-3.267l-4.899-26.285a4 4 0 013.932-4.733h33.013a4 4 0 014 4v26.285a4 4 0 01-4 4z" fill="#C5D6E0"/><path d="M491.419 62.657c-2.46-6.802-7.778-6.58-13.665-4.448-5.888 2.133-10.115 5.369-7.654 12.171 2.461 6.803 9.228 10.588 15.115 8.456 5.888-2.133 8.665-9.376 6.204-16.179z" fill="#B7EB6E"/><path d="M240.977 136.894c7.383-7.736-8.863-7.972-15.782-14.59-6.918-6.619-7.509-18.854-14.632-15.525-8.455 3.952-5.522 20.725 1.397 27.343 6.918 6.618 21.633 10.508 29.017 2.772z" f

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49150
Entropy (8bit):	5.523809476276692
Encrypted:	false
SSDEEP:	384:sXusESRaiLBhTbSsEFL/Rvqu41wFQrpagwXt7bRApQoe/4TfCS3HH2Orv5ZKibT0:s+tbcBZj1paRZlzoj7HHfP4F
MD5:	CD46DA23147D575E2E1C368FF7432446
SHA1:	763FB3A733E8A5A721B2CCB6867B4E7E224D8D5F
SHA-256:	AE45F042DB0F3B2D2FFE2BC7F5193A9713B4095048EFE83EB847FD8E0FF70920
SHA-512:	9C7B442B7E4C589DA28F9DEEAE61AAC3EC70AC853696032FB6DBF9B3AA9D9DF11176EEF67AB9B6516D3C9BC870C301F806103CEF29F94C6BBF74DEF6099AE27E
Malicious:	false
Reputation:	low
Preview:	. {. "name": "otPcPanel",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMgSGVhZGVyIC0tPjxkaXYgY2xhc3M9Im90LXBjLWhlYWRlciI+PGRpdiBjbGFzcz0ib3QtcGMtbG9nbyIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDb21wYW55IExvZ28iPjwvZGl2PjxidXR0b24gaWQ9ImNsb3NlLXBjLWJ0bi1oYW5kbGVyIiBjbGFzcz0ib3QtY2xvc2UtaWNvbiIgYXJpYS1sYWJlbD0iQ2xvc2UiPjwvYnV0dG9uPjwvZGl2PjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGktdGl0bGUiPkxlZ2l0LiB

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	274834
Entropy (8bit):	5.571716809943375
Encrypted:	false
SSDEEP:	3072:VbuyyayyE+B8ysr4wUimS8tCYTkvJpgA3mgiN12J/EnO3G80rb9Emmtqt3h+rBwY:5KqBdsrAiYyJV3AN12JcnOWrbrtR+rBz
MD5:	5F4E5B6F2155AA822BD7A2C145BCD89D
SHA1:	3BC2D736131335FB8055970F7B1EAE081C188ED3
SHA-256:	3FE65988464C20EBA72165FE47CD2B0206792F0420AB9668049BBEB53EC46238
SHA-512:	29A807FC0B1198485090FD090A9054F3B3D0E1E292F894BB108ECC06750E4D12823B1ADA964E8CEE962E7B555571DE670D3F2F97BED8FC2991331607487ACB75
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-WZQ6MQ6RF3&l=sdl&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_auto_events","priority":23,"vtp_enableScroll":false,"vtp_enableOutboundClick":true,"vtp_enableDownload":false,"vtp_enableHistoryEvents":false,"vtp_enableForm":true,"vtp_enableVideo":true,"vtp_enablePageView":true,"tag_id":9},{"function":"__ogt_cross_domain","priority":23,"vtp_rules":["list","avast\\.co\\.jp","avast\\.ua","avast\\.ru"],"tag_id":11},{"function":"__ogt_1p_data_v2","priority":13,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionT

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	189
Entropy (8bit):	4.987289583764496
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMccwR+83ERNiq7mA9GBVlmAmYHZAAbBAA8ckHeE0:tI9mc4slzcWER9j9EmqZlllH
MD5:	957C5C2E48799915D4F59B5662106A5B
SHA1:	21C196C0C143793B54A8C080F0C1AD4434014517
SHA-256:	022FFE557E2191A389DB907EF5131A82438FFE864014FB6656AE849DD00C0773
SHA-512:	6E1D5C4BCDE72A476A2E9930A3D529051A00C03569E1CBDC1D1DBCF8FBCBE6C2D9BEC4CA64F3D530124FC94EEDFC9F026D481BFFF3FA249F32222999D720F0C3
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/back-s-purple.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path fill="none" stroke="#4E22D0" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2" d="M10 2L4 8l6 6"/></svg>

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	5.151456067598993
Encrypted:	false
SSDEEP:	96:nMx7ysrOysO7sres0j2VmC9XilbJeVBiTPLW+3:nMxxrOdOArp0j2VmC9XilPb3
MD5:	BAF689FEF07AEEA5F07E027755A3B325
SHA1:	751E35ADA81C39560E44F70C17D5D3C658D94412
SHA-256:	5A60454BE8ADD0F1BE9080C4BCC98D7699FA110350EF955F9AFCFE8BE09667E4
SHA-512:	3B6B7B24B192A371EF46B2E41612EF8AD7ED1B8C36F04517D3355B3F4F988432662163178AC39A3BB754EED260899F588AF69A43159BB3AC213F5D19F35D6F53
Malicious:	false
Reputation:	low
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603606765,"h.cr":"136231073195d6d689c1bebe642dead606a6afdb-d71e44c7-f3212ea","session_id":"bdf68160-dc5b-4267-bc66-2ff715f0b210","site_domain":"avast.com","beacon_url":"//173bf109.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 86 x 42, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1913
Entropy (8bit):	7.820200650332238
Encrypted:	false
SSDEEP:	48:FPG2OnkxMlgALmKHHhc4wiD5yxyyxJbKSA9tHk:5OkKlgUy4wi1Pyxx7A9+
MD5:	44BFEC2BD65012E5770BD48C310F5C7C
SHA1:	A5220322F5D58570A93A7162A07E7BC24C800E52
SHA-256:	E0D79A537444762F3E5E1507B875877982129A4D423D82CF177FAEC260D05E32
SHA-512:	C2F0DD29088CD7186B6E278E7211E3B7124C55ED869504835EA1AB436F36DC0EFE6A7308325D4A1718755558B804A9DED49BBBBF150F4D52CAA1C5D5165D942A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...*......h\.....PLTE....Pp.Pp.Hp.Pj.Ll....Mm.Nn.Mk.Ln.Ll.Ll....Mm.Ll.Lm.......Mm....Mm..................................................................................................................................................................}}v..v...y\|.y}p..p..o...oo.oo.nn.nng...kn`..`..`..`...``.``.__Y...]_X...]_.RR.RRP..P...QQP..P...PQ.OQJ..I...DD.CC.CC@z.@y..BC;w..55.55.45.44.35.340o.0n.,m.,l..&&.&&.%& c..c..b........."..".%-.Xv.Xv.Wv.Wvx,8`3BH9M<=S0@X.Gb.Fb.Jh.Mm........tRNS.. 0@P`op............G.=....#IDATx..{.D......NtZ..[.,3.).n..2:.]..)..P-..:..s5R..m...j^...Q.......n.{....z...{/..g..=.5...x...k..u.)&[..G.\|..a......a....o..I....S....V.W.o...W...}_..U....S.G..[b_!.8..}..t.......d..RY.."E..{gX.l2.....Z..<q....B.I.s.....5D..._.`\|.&k.]....'......N...~r..$....G>....d1.k<......H...o..s.u.....[...l=+.7..%...X.j./.8.M.^.FL6`....;Q..JtT.V..e...8`.K. ...x.b.z}C....>..G..Y.K6.%.Q..x.}.S\4A:...4..A.-

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	23433
Entropy (8bit):	6.941972639834794
Encrypted:	false
SSDEEP:	384:p5Cnbn1nEjnQ1ntDhnXnc/ntZyxnxJm8nnOMImggRz2oKnoyniEynC6nnHmsVPuW:p521MePXc/GxxJPOM79z2oKoyiEyVGsn
MD5:	9BE89914EF1FE3586978ECD4C579FE68
SHA1:	EA0CED9F541F265AA08B2B7C6185DDFB7D5C1435
SHA-256:	5D2A31F06A96103F3AE0A3B1105657200AB602F2D23CDDB862090D19F938F3AC
SHA-512:	A34E09D186832409AEBF083B9CF44CA9B38B9E3C1788F162FA27ABC08F3185DDB81FB885F9776878C79DC63E4399F8FEF2CC69C209E7EE28D969FC0231C54F12
Malicious:	false
Reputation:	low
Preview:	GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))**+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccme].hS.kE.p3.s#.u..w..w..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..y..z..{..\|..~................................. .. .. .."..$..&..+..2..8..;..>..?..?..?..A..C..E..H..M..R..W..[..].._..`..b..d..g..j..m..s..v..z..}..~...............................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......N....Ao..)...E{.$J$u..u..i..N 1`..r;e)....FF..M........=Z#k..t.h..x}%.W.N...*z..Bu..Z.....7>..R....YT%9$......T..]..b.v..t....<...s..+xj.`av.%..`c.;JN\y.`.

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	82612
Entropy (8bit):	5.195720484658254
Encrypted:	false
SSDEEP:	384:N6VJ70gGjhiJgnjhtTO/xi7FavgIjrijI+pg+jyQ8g5jCing6jRKjIzKeg1jxIc9:Ng+f0Khb6wbY4kGJXRRsuM5
MD5:	8C66D79DB4FF5D2EF4664CEE20AD1E23
SHA1:	8C6EAC58A6EB1ADF6AFA32B2AE31F4812CC36D7E
SHA-256:	84CB6C08CD598CEAB07E6ED9DD2AEF5E5E4CB05DD1D4C73D6B47B516D912E0D8
SHA-512:	98957498E9A7FEC13FE6B26516EDB8F32BCA4C66FD06FBC645D4D9C13CFE16CE64EB9C64E5D3D1D2EA028E28C8FA04EE73E8EBB58FFECF24D81B8CFC9E28EE00
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/2000673/web/o/i/flags/flag-language-selector-v2.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. <svg xmlns="http://www.w3.org/2000/svg" width="25" height="1224" viewBox="0 0 25 1224">.<style type="text/css">...st0{fill:none;stroke:#AAABB6;}...st1{fill:#D3D4DE;}...st2{filter:url(#Adobe_OpacityMaskFilter);}...st3{fill-rule:evenodd;clip-rule:evenodd;fill:#FFFFFF;}...st4{mask:url(#mask-2_1_);fill:#0052B4;}...st5{filter:url(#Adobe_OpacityMaskFilter_1_);}...st6{mask:url(#mask-4_1_);fill:#F0F0F0;}...st7{filter:url(#Adobe_OpacityMaskFilter_2_);}...st8{mask:url(#mask-6_1_);}...st9{fill:#00A651;}...st10{fill:#F0F0F0;}...st11{filter:url(#Adobe_OpacityMaskFilter_3_);}...st12{mask:url(#mask-8_1_);fill:#F0F0F0;}...st13{filter:url(#Adobe_OpacityMaskFilter_4_);}...st14{mask:url(#mask-10_1_);fill:#00A9FF;}...st15{filter:url(#Adobe_OpacityMaskFilter_5_);}...st16{mask:url(#mask-12_1_);}...st17{fill:#6DA544;}...st18{filter:url(#Adobe_OpacityMaskFilter_6_);}...st19{mask:url(#mask-14_1_);}...st20{fill:#007859;}...st21{fill:#FEFEFE;}...st22{fill:#FFFFFF;}...st23

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	736
Entropy (8bit):	4.587375423593685
Encrypted:	false
SSDEEP:	12:tr/kuIcStgLxMV1mmnHJM/z2gR2LhSakbitKkJZqPFnRFiX/arn5lB9Yhll7:tzkuUQ01/Wz2U08akbiWFnRQv2n5lTYJ
MD5:	2D7D61EBC98D03A9D776873CD4308D67
SHA1:	A436D09A98E111C9F2E42C82067267C294502691
SHA-256:	DE0B0065FC39FBD241E7483978E55DF1D4261304A38EF8131CACE1B8CF8351BD
SHA-512:	D787B24877B9972851011F4C9203492E52C9F65D1820EF4CBA9D4D9FAB5A9BAD2764FA51B236DF7522C080B0CFC9D0CFA01F226EDB0BC6D4829B3F52ECD923B6
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secure-identity_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.808 11.417V8.756a5.192 5.192 0 0110.384 0v2.661m-8.509 16.078c2.125.83 4.509.83 6.634 0m-12.548-8.29C6.765 14.19 10.966 9.98 16 9.975c5.034.004 9.235 4.215 9.231 9.23.002 2.685-1.201 5.14-3.092 6.842-.325.292-.828.116-.97-.297-.568-1.646-1.42-2.952-1.93-3.646-.244-.333-.687-.42-1.07-.267-1.534.608-2.804.608-4.337 0-.384-.153-.827-.066-1.072.267-.51.694-1.36 2-1.928 3.646-.142.413-.646.59-.97.297-1.892-1.702-3.095-4.157-3.093-6.842zm9.231.319c-1.422 0-2.574-1.164-2.574-2.6 0-1.435 1.152-2.601 2.574-2.601s2.575 1.165 2.575 2.6c0 1.437-1.153 2.6-2.575 2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4478
Entropy (8bit):	4.434482939817795
Encrypted:	false
SSDEEP:	96:jEmxEuUhZ1dwhSEP38TSGaS4PhioN4PhiXodhNV2UodhysKh:jELTwfmSDPhLCPhhdhNV2ldhyph
MD5:	84BB61A453E675247310728DEE1CE888
SHA1:	67F2AB9754F42FED3740AFEC1C00772DE966D465
SHA-256:	FFE164E0D9BDA881D0BAE30EE4042C35A149468EE9DC37C0C374DC2B1739FE1A
SHA-512:	D1F37F2E20C3D2C2D3606CD861A118A90FAA799F5DEC6B3460E7DB73C0B7BDEA37E42698DCBE9FFCF4EFA9D3027FE5929F882B91CC5C4A5241D9DA35299F99BF
Malicious:	false
Reputation:	low
Preview:	<svg width="1360" height="304" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M505.936 52.968s41.802 5.632 64.883-5.768c13.269 22.836 49.475 40.731 49.475 40.731s-12.608 43.187-33.079 67.297c-22.389 26.368-58.608 26.146-58.608 26.146-15.262-8.958-31.29-30.27-33.968-54.449-2.934-26.502 11.297-73.957 11.297-73.957z" fill="#F7FAFC"/><path d="M539.807 136.042c13.157 11.013 24.87 2.941 35.724-10.025 10.854-12.966 7.138-20.894-6.019-31.907-13.156-11.013-26.877-11.218-37.731 1.748-14.248 17.021-5.13 29.171 8.026 40.184z" fill="#B7EB6E"/><path d="M566.667 109.315a3.022 3.022 0 10-2.84-5.334l-17.073 9.204-3.932-7.313a2.901 2.901 0 00-5.116 2.735l3.968 7.463a5.676 5.676 0 007.653 2.36l17.34-9.115z" fill="#fff"/><path d="M501.337 149.949c-1.939.027-17.728-1.742-17.33-11.062.547-12.796 24.546-1.938 29.494 1.687 20.919 15.327 27.353 31.904 59.687 37.161 19.083 3.103 30.752-8.825 16.07-24.736M570.819 47.2c-23.081 11.4-64.883 5.768-64.883 5.768s-14.231 47.455-11.297 73.957c2.678 24.179 18.70

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	43043
Entropy (8bit):	4.962717584097643
Encrypted:	false
SSDEEP:	384:lJJI/s9vcKS5Dwvj/3mhVRweqV6nKElg5ka5JW7QDchsn23hFa4Qma1EXMqCGgnU:EIfS6a0Ihs2WCAbJWnmk0KJJ
MD5:	1A6805C49ACD98690EC6B24F6C15D719
SHA1:	70AEEB2F4EBD36A426D2CA2F9729C4FC3CB87C9D
SHA-256:	0360B7A141E00D88183C2EF15B4719825564598C2AAEC00ED994EC7ECFBB1BA9
SHA-512:	95545D1FFE3371784B18819C8C4ECA83F37DDBB0BD871899F035982AC31EF44F3FD8F7B5A40E0C240C8722E571D18FFC48D133096B6FB00A1B7D8C531031DC40
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/flags/flag-language-selector-v3.svg
Preview:	<svg width="24" height="1248" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" r="12" fill="#fff"/><mask id="a" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="24" height="24"><circle cx="12" cy="12" r="12" fill="#fff"/></mask><g mask="url(#a)"><path d="M12 23.5C5.649 23.5.5 18.351.5 12S5.649.5 12 .5 23.5 5.649 23.5 12 18.351 23.5 12 23.5z" fill="#F7FAFC" stroke="#E1EAF0"/><path fill-rule="evenodd" clip-rule="evenodd" d="M16.965 22.928C21.115 21.039 24 16.856 24 12c0-.219-.006-.437-.017-.653l-1.107-1.086a.828.828 0 00-1.28.149l-.144.229a.252.252 0 00.07.341l.292.204c.17.117.227.342.134.526l-1.022 2.03c-.11.218-.4.406-.644.395a.857.857 0 01-.618-.307l-1.758-2.11a.43.43 0 00-.66.549l1.759 2.11c.328.393.816.62 1.33.616.478-.003.794.5.604.94l-1.764 4.078a4.133 4.133 0 01-.625 1.014l-1.585 1.903zm-.09.04A11.958 11.958 0 0112 24C5.373 24 0 18.628 0 12 0 5.373 5.373 0 12 0c.596 0 1.181.043 1.754.127l.808.988c.097.118.12.281.06.422l-.556 1.3a.187.187

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1609
Entropy (8bit):	5.268171846580519
Encrypted:	false
SSDEEP:	24:hY6sv7zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5zF5cUehk2:3q3+pUAew85zvc/hk2
MD5:	20D444971B8254AC39C8145D99D6CA4C
SHA1:	72E41F2A340F4A6E3A748CB57D293631390B733A
SHA-256:	A04F41837D317573EA61EA29ABBA7C4FF4E38C9177DA68F4706B9C13921A8D82
SHA-512:	BEA16497D014481EE10EB80A129846B7B184AB1ECA242FA38B84255C6461C748A62F1BD6C15D1807F8B5E926E550C30AB47F8A40AE43BE229E6AB857C4EA6F6F
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 405 (Method Not Allowed)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:u

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7155)
Category:	downloaded
Size (bytes):	7202
Entropy (8bit):	5.163602320067472
Encrypted:	false
SSDEEP:	192:iolclWB7AMSMpCppfpiplpSpYpJp0O13WjwYCiwWy31alsG+:ulWB7AMSMpqpfpiplpSpYpJp0s3WjwYw
MD5:	09A36CA27AD999025CDB09D025D9AEE0
SHA1:	90F6D9F0EA5A34AB860025553F9910292422E6D0
SHA-256:	A6BCD82A9D47FFCA4B4E8772EC5C8E7895084FEB555A49D2A46EC7E9906C149A
SHA-512:	EB8E51DF13ABA8324FF416FE09D9436E192E7BCC42B71BBFE698BA68298284812C7C6AABCA57CA357955C26DFD40F4FC6ACC287E5312CC4DB456FC088BFB8F0F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/singleDL-secondary.js
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{var a={buttons:function(){document.addEventListener("click",function(b){if(b.target.closest('a[data-role="download-link"]')){var c=b.target.closest('a[data-role="download-link"]');if(c&&sdl.push({user:{download:{products:[{campaign:a.checkAttribute(c,"data-campaign"),campaignMarker:a.checkAttribute(c,"data-campaign-marker"),sku:a.checkAttribute(c,"data-download-name"),maintenance:0,seats:1,quantity:1,currencyCode:"USD",category:"Consumer",price:0,tax:0,brand:"Avast",link:a.removeUnwantedParamsFromLink(c.href),offerType:"download",localPrice:0,localTax:0}]}},event:"user.download.products"}),document.querySelector('[data-behavior="downloadPopup"]')!==undefined){var d=document.querySelector('[data-behavior="downloadPopup"]');sdl.push({system:{modal:{id:d.id,component:a.checkAttribute(d,"data-cmp-name"),path:"/"+sdlObj.screen.locale+"/"+a.checkAttribute(d,"data-cmp-name")}},event:"system.modal"});var e=new URLSearchParams(window.locati

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3099)
Category:	downloaded
Size (bytes):	27118
Entropy (8bit):	5.419532681443692
Encrypted:	false
SSDEEP:	768:kNPTv3rsKaMUGifMp0MoDaLorsrOOHktp1p9ijIZ7HpfeNLOGOOovtupaiuowRIS:y7v3rsKaMUGCMp0MoDEoSOhD1p9ijIZN
MD5:	52284F7FEC7918CC11AC3BED814C0FEB
SHA1:	4803FE88B4AE3E529069AE769B720C398AAA2DD8
SHA-256:	275F748599A09D643B700C919A0FB1F3402F859021A13498D1B307AE74B87941
SHA-512:	EAEF328F8933161A41A2C1B867AD45D9EE44568F2877A51C4458EB153A4C23B230CFE9CF439BAC30838C79D934A2FC92A8B633A4A6969681F062152A4078625F
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/en-us/lp-safe-emailing?full_trSrc=mmm_ava_esg_000_361_m&utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
Preview:	<!DOCTYPE html>.<html lang="en-us" class="no-js">..<head>...<meta charset="utf-8">.....<script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js" ></script>.<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486" ></script>.<script type="text/javascript" src="https://static3.avast.com/10003548/web/j/vendor/one-trust.js"></script>.....<script>. /! Declare GTM dataLayer /. window.dataLayer = window.dataLayer \|\| [];..window.sdl = window.sdl \|\| [];. . /! Dimensions to dataLayer /. (function(){. var dataObj = {. 'contentLocale': 'en-us',. 'pageName': 'en-us \| en-us/lp-safe-emailing',. 'pageId': 'f8759d7ff4ec777866c403d26d64bd4c'. };. var contentGroup = 'Consumer';. if (contentGroup != '') {. dataObj

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	26075
Entropy (8bit):	4.373872319729878
Encrypted:	false
SSDEEP:	768:58jVGkjvx68p88abpKoHwTnOqnkGp0KBO/rYYUJ:5w/jvx68p8wOkkGp0KBO/9K
MD5:	F2F5E2D15E4880710C6416C51393A38F
SHA1:	3A66F0F8BDC994B597A44107D885B9481121336A
SHA-256:	3E8207BDB63436BB44EEACF45FEEC9B145A411ACF42EB3AC972D9D7BB43DD83B
SHA-512:	0B1D066D38F8565B8D468E1C1B0BD3BADF9DA02505F8FA1AAF72F5B8EB3108C826CD452BACBA1D4959DCEB548995A75F783D96A1DA757675CB3EC18553A3D709
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/web/i/v2/components/icons/sprites/icons-16.svg?v1
Preview:	<svg width="496" height="144" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#071D2B"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	downloaded
Size (bytes):	23433
Entropy (8bit):	6.941972639834794
Encrypted:	false
SSDEEP:	384:p5Cnbn1nEjnQ1ntDhnXnc/ntZyxnxJm8nnOMImggRz2oKnoyniEynC6nnHmsVPuW:p521MePXc/GxxJPOM79z2oKoyiEyVGsn
MD5:	9BE89914EF1FE3586978ECD4C579FE68
SHA1:	EA0CED9F541F265AA08B2B7C6185DDFB7D5C1435
SHA-256:	5D2A31F06A96103F3AE0A3B1105657200AB602F2D23CDDB862090D19F938F3AC
SHA-512:	A34E09D186832409AEBF083B9CF44CA9B38B9E3C1788F162FA27ABC08F3185DDB81FB885F9776878C79DC63E4399F8FEF2CC69C209E7EE28D969FC0231C54F12
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/gifs/spinner-light.gif
Preview:	GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))**+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccme].hS.kE.p3.s#.u..w..w..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..y..z..{..\|..~................................. .. .. .."..$..&..+..2..8..;..>..?..?..?..A..C..E..H..M..R..W..[..].._..`..b..d..g..j..m..s..v..z..}..~...............................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......N....Ao..)...E{.$J$u..u..i..N 1`..r;e)....FF..M........=Z#k..t.h..x}%.W.N...*z..Bu..Z.....7>..R....YT%9$......T..]..b.v..t....<...s..+xj.`av.%..`c.;JN\y.`.

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75787
Entropy (8bit):	7.981477696209924
Encrypted:	false
SSDEEP:	1536:wS4h4LqaXe8WCj8oEvbRXAwoSmHu7DxUEuouo5NbPS50Xp:wrhdmQCjRxySCNGa5
MD5:	462608BCB7D24CF316A3C78DF0954852
SHA1:	2F3800BF48A0937CA0B6A2075F3A6B9242DB39A6
SHA-256:	228E2D22F12D02D1254EA5A899729F5BA4BAAB59AC2BED4285E900C945CC0FE4
SHA-512:	40A17BD4D6C0B3A268B8F2E8532050D1C5695D3F8CA0E9B36EB7DB582FCEB77789728BA9350107AC8E15E2D15364DD968E4EE313FAF8B1051AEE6AF0A10BFD7E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X.........r5......orNT..w.....IDATx...w.e.}.y~..y..VVfVfV.7....h@...J\.R.DJ"%.9...jc#&&F.].f#v..(.#.;"5$..H..Hx.vhW]]....\|..{.............\|"......U...w~...h......?.......}.....o_'..Ne.P.C....c@...R./).7....#...}#{}...i.%../@.......".../.....f9...v.Z.~R)...~.........R.<Q.`......E</....^_..i.}C.X.....G?IwW7...X.T......t..B.#.iF.RB)u..........7L#..S.[.@...v..ei....t..i..../.%.S7.19.....`ww..K&...S..}}....X,... ..\|..6.o#.......X~.X&..ad$...i...t..i........t.._.._\|,_(..P..R.0......F9}...==....F...\|I)...<wtl_......8\|h.^_..i.....=.....C,.h......r...... .4....9\|.0......$....>....(.g....w..^0.,# Pen\~.d..'.\|r./[.4.=c....4......,,../........ w>/.@..kk\.z...U....qC...-.Y.F!\|7p.!F..a)((......_.EN..............4M{O.{..4M{o.....M.".P..!..u.i..>./^b..$...s..)FF..H...ug...>..P .+..;......Yp..A...^_..i.{F.X....r.........~*.(.I......\|.s.......,G.......4.;N..Q\|.8...w#.?.r............D.'....i..+t...=d~....C.....\.)?P.....c}..4M...q...F.......4....

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	736
Entropy (8bit):	4.587375423593685
Encrypted:	false
SSDEEP:	12:tr/kuIcStgLxMV1mmnHJM/z2gR2LhSakbitKkJZqPFnRFiX/arn5lB9Yhll7:tzkuUQ01/Wz2U08akbiWFnRQv2n5lTYJ
MD5:	2D7D61EBC98D03A9D776873CD4308D67
SHA1:	A436D09A98E111C9F2E42C82067267C294502691
SHA-256:	DE0B0065FC39FBD241E7483978E55DF1D4261304A38EF8131CACE1B8CF8351BD
SHA-512:	D787B24877B9972851011F4C9203492E52C9F65D1820EF4CBA9D4D9FAB5A9BAD2764FA51B236DF7522C080B0CFC9D0CFA01F226EDB0BC6D4829B3F52ECD923B6
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.808 11.417V8.756a5.192 5.192 0 0110.384 0v2.661m-8.509 16.078c2.125.83 4.509.83 6.634 0m-12.548-8.29C6.765 14.19 10.966 9.98 16 9.975c5.034.004 9.235 4.215 9.231 9.23.002 2.685-1.201 5.14-3.092 6.842-.325.292-.828.116-.97-.297-.568-1.646-1.42-2.952-1.93-3.646-.244-.333-.687-.42-1.07-.267-1.534.608-2.804.608-4.337 0-.384-.153-.827-.066-1.072.267-.51.694-1.36 2-1.928 3.646-.142.413-.646.59-.97.297-1.892-1.702-3.095-4.157-3.093-6.842zm9.231.319c-1.422 0-2.574-1.164-2.574-2.6 0-1.435 1.152-2.601 2.574-2.601s2.575 1.165 2.575 2.6c0 1.437-1.153 2.6-2.575 2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5762
Entropy (8bit):	5.106105673726928
Encrypted:	false
SSDEEP:	96:eL1ZZRvumfSrvUOZxxTGCOB+hSGluB+huLDyPP8cgc1PBgVJRyM:eLDZ4zrvUOPxCCU+hSG6+huM5Enz
MD5:	45D1842A532D5CD77F0A0452B7142B2A
SHA1:	523A4B108D1A010AD6AA2D3F05FBB64A61CDF030
SHA-256:	CD83CD7F0DC0E81FF9D5E857E9E25A42AAAA5A8DC2BCEC0A06E8E018989CF2CF
SHA-512:	2C2CFFAA7BFA71841CBD7B02EA52A148C46D16A12A305111EE2694480230BB49FD6F3E4A042BBD7D641344B8FA32499B6FEC8C4ED0B28A2D60DD1B8F29E5D43F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secure-browser-color.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	6906
Entropy (8bit):	7.907370076812908
Encrypted:	false
SSDEEP:	192:rG9K7TaPOt3ZgkaqMQfnYRX/O5EYjku+Tva:rx7WPCZJ9BiGuYKa
MD5:	F1F86A049816378D8B02341F2B4150A1
SHA1:	14EC7101427304AD341D72947061E2BFBADC6F9F
SHA-256:	B979503238229DA68DC95C1B59351AFCBE7BE615E7A11600816B5B67C9F3483E
SHA-512:	EF2D8FB7472E52E937134E3441AD739120310E9D3FA646B6C89FD7FCCE12191658CDCF0BE1061A32D0790B0117D7CE20BAED1F9FEF12625DB921FA2A4253B335
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/aim/img/lp-safe-emailing/hijack@2x.png?width=568
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@.....................................?...8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......X........pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......X........pixi............ipma..........................iref........auxl.........Fmdat.....f%\|{..2...`.@P.?^j.W[.o.d...[....G..E8..r.l......n.Y.k.OD...r....=b}...z../..Q8...T,.G.....=v.}.:.{u..[..(.m.h..Y..?..`....1.@.....\OZ..Q...'.d..-c2..-&$..R..[:....<...]F..@../..s.V>-....3`.',.{i..Y-g.......J.UA........1.Y.^.qq.07.'....a.f%Z+.0~...E.~@.@8..K...J..A.D....w..vl.C..b..........Z...v..;#mVUm..(.1.].s4/]..:.s.w.C[.l......t.u..~[K.k..5.......X.h.m'^......IU......B....D..C.H(...[-..wl.7......}E..Nw....r.a...3g....&..D..U...`............... ..g~0....dT.'.....$.;..u..R1l.P&...g..3./.'.....o..&E.*....{....)....

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4917
Entropy (8bit):	4.158360633170648
Encrypted:	false
SSDEEP:	96:vglOJanhZN1vr8RGvowCEbaZKmek9WPW+DMhX0Ct3ZH7lIMW:olwanhZNtr8R0QZK3kgPW+DEkCt3hW
MD5:	F694D10A3E7A838F6AA70B978ADC82AA
SHA1:	CD2DB49EC746658B4B1B5EE86873C39822EA3932
SHA-256:	10B685A75E0FDEB28B2B4033370EF57D0D593EECC0BD266A5817C0674F2F1341
SHA-512:	6E00A9A2309A047E70DC0109FC9D916ECBF58F591AB990DD033D7D59BD2A859B88AC36C955B935C1D497440E91B68F793ABE36ADFC6CFE6C8D0AD266A35B3547
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/89477463/web/i/v2/components/store-badge/google-play/google-play-badge.svg
Preview:	<svg width="180" height="53.333" xmlns="http://www.w3.org/2000/svg"><path d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666" fill="#100f0d"/><path d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 01-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6h166.66" fill="#a2a2a1"/><path d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664l-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 01-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.308-4.804 3.752 0 2.23 1.952

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	458
Entropy (8bit):	4.829431768551787
Encrypted:	false
SSDEEP:	6:tnr/kumc4slm8A9zQkQNENXG1NwVs/SkizWeBvcp5OhL1W6kzSZV6kzQ0TCV79jb:tr/kuI85p+M1y2SkW1LGBhB9YU
MD5:	960DC631F4792A41E550B03056423D53
SHA1:	805309342C8A793E8C9D1352E124965FE8BB2794
SHA-256:	4C834597DBFEA8CD691579E3526B8DF855291AFEF5DD4BF50EB93DD5F4066509
SHA-512:	5458D71C1B956B9D89DF17A44E2364FFA346F2E03F0B415248CC546E68AB83B4345D650B90232821F8D30A301BEA43D857B410819A180CB7E0017D4BB802E5ED
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M17.267 26.4h-1.901v-3.626a.55.55 0 00-.56-.54h-2.154a.55.55 0 00-.56.54V26.4H7.6V7.526c0-1.064.895-1.926 2-1.926h8.257c1.105 0 2 .862 2 1.926V26.4h5.768V15.674c0-1.063-.895-1.925-2-1.925h-1.18m-10.76-3.646v.646m0 2.826v.646m0 2.825v.646m4.087-7.589v.646m0 2.826v.646m0 2.825v.646m6.969.254v.646m0 2.826v.646" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8070), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	117732
Entropy (8bit):	5.334830362304828
Encrypted:	false
SSDEEP:	1536:5JmUyYpz1bf7e7nBoUE8rW8S9C8ekW3Ho62ait3jpb9I36+jr05qiCzQVpIINeVY:bpJe7nN/No6hhzKf
MD5:	804ED20E3DE091143F53D563B74FE6F5
SHA1:	838DD2787136B5DA55C96AC0239703CCC77D0002
SHA-256:	6D88E2FEE3081515EE87861FB8D07D53CAD3AC3B274C6787FB18FD1584A99EB2
SHA-512:	3AAF2B31692FDD435718FA8DD129FC419F185C3AB5B9560507EA9E761DA77A883C8E1AE158F5CBC9D0EAD09BE31C8C0DCB1772F56B1CCA0945C32E39A4922B47
Malicious:	false
Reputation:	low
URL:	https://www.upsellit.com/active/avastcom.jsp
Preview:	Array.prototype.filter\|\|(Array.prototype.filter=function(t,e){"use strict";if("Function"!=typeof t&&"function"!=typeof t\|\|!this)throw new TypeError;var r=this.length>>>0,o=new Array(r),n=this,l=0,i=-1;if(void 0===e)for(;++i!==r;)i in this&&t(n[i],i,n)&&(o[l++]=n[i]);else for(;++i!==r;)i in this&&t.call(e,n[i],i,n)&&(o[l++]=n[i]);return o.length=l,o}),Array.prototype.forEach\|\|(Array.prototype.forEach=function(t){var e,r;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),n=o.length>>>0;if("function"!=typeof t)throw new TypeError(t+" is not a function");for(arguments.length>1&&(e=arguments[1]),r=0;r<n;){var l;r in o&&(l=o[r],t.call(e,l,r,o)),r++}}),window.NodeList&&!NodeList.prototype.forEach&&(NodeList.prototype.forEach=Array.prototype.forEach),Array.prototype.indexOf\|\|(Array.prototype.indexOf=function(t,e){var r;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),n=o.length>>>0;if(0===n)return-1;var l=0\|e;if(l>=n)retur

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4118
Entropy (8bit):	5.050536106767674
Encrypted:	false
SSDEEP:	96:aeLtCRkK4YD5q0izZ70Ulby9hY4n4TEAby24iEDBzEuBJcEkg:autCRkKF5VaFzMaw4TtbszlmQ
MD5:	2D20353CF7AB34148CEA8990568F1752
SHA1:	463F8D7143A8E6C29B0F437E2EB2AD9D69C68D40
SHA-256:	BB227C43B5FCFCAC106013853C5EA41258588515EA64DB30C773490DF51D8D2E
SHA-512:	5B1416D49346F461E478321D25E62D1CBD639D8B3779FAAE8B0E76AC4B1724793B885F8F410FA5D140352859A2E265A12C93D0E0F798DBEC04C9EFFE41AFFA74
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <rect x="2.7453" y="9.1411" width="26.5094" height="16.8828" rx="3.8379" ry="3.8379" fill="#fff"/>. <path d="m2.7453,10.5493v-2.7836c.022-1.1708.6077-1.7672,1.7565-1.7895h22.9303c.6627.0223,1.1158.188,1.3585.4971.3094.3314.464.7624.464,1.2925v2.7836H2.7453Z" fill="#ff5833" fill-rule="evenodd"/>. <path d="m9.5235,26.0239h-5.0216c-1.1488,0-1.7345-.5854-1.7565-1.7562V7.7657c.022-1.1708.6077-1.7672,1.7565-1.7895h22.9303c.6627.0223,1.1158.188,1.3585.4971.3094.3314.464.7624.464,1.2925v16.502c-.022.6187-.1767,1.0494-.464,1.2925-.3314.3094-.7837.4637-1.3585.4637H9.5235Zm-2.1399-17.7281h-1.689m23.5601,2.2536H2.7453" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <path d="m15.5741,12.8749c-2.7224,0-4.9293,2.2069-4.9293,4.9293l2.9353.082c0-1.

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2161
Entropy (8bit):	4.6277977137631074
Encrypted:	false
SSDEEP:	48:cZ84rWWAo0IEp/BN+uDa+lv6fBZuPYbB1bjw8Ao0IEp/Bg:c8zFdIEdDa+lv6fBZ7B5jOdIEw
MD5:	2980634C868A2531D8D26A9A34C92E16
SHA1:	E98982BCCA3CB88FD0A4807B8ABE93BD9306EEFA
SHA-256:	E9B4022F0CB8CF108F3A48AE9EF846FE9C17BC9CDC38C59DFDF2EB2873D3C399
SHA-512:	C2EFE5F9C24AF71E4FA9BE963D945E2214BC6512A0979EAE7CA4F7BF7D8A9592E9107279176610D0218BB926AF00272502BAF5E7DCC96C630662E3FCCADB779B
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/what_is_a_computer_virus_academy_refresh/icon-05.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <rect x="2.4521" y="4.7397" width="40.0958" height="29.6924" rx="4.4845" ry="4.4845" fill="#fff"/>. <path d="M42.4347,11.6464H19.1014l-1.6941-3.9778H8.2106l-1.4521,3.9778H2.7579V7.6396c0-1.6016,1.2984-2.9,2.9-2.9H39.5347c1.6016,0,2.9,1.2984,2.9,2.9v4.0067Z" fill="#ffddbf"/>. <path d="M11.8532,26.2532v6.7447c0,.6655,.2647,1.3037,.7358,1.7738l4.7658,4.7564c.4699,.4689,1.1065,.7323,1.7703,.7323h6.7223c.6616,0,1.2964-.2616,1.7658-.7278l4.7933-4.7601c.4738-.4705,.7402-1.1105,.7402-1.7782v-6.7337c0-.6677-.2664-1.3076-.7401-1.7781l-4.7935-4.7606c-.4695-.4663-1.1043-.7279-1.7659-.7279h-6.7496c-.666,0-1.3046,.2651-1.7748,.7368l-4.7384,4.7533c-.4683,.4697-.7312,1.106-.7312,1.7692Z" fill="#ffddbf"/>. <path d="M42.5479,16.7002v14.9146c0,1.5559-1.2613,2.8173-2.8173,2.8173h-4.7006m7.5179-17.7319v-5.0538m0,5.0538H2.4521m40.0959-5.0538H19.5057

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65310)
Category:	downloaded
Size (bytes):	761953
Entropy (8bit):	5.09694143863498
Encrypted:	false
SSDEEP:	12288:laijslnRvvwiZNLRDjLDvM2ayxmPtqt4XNXcrgGtqfqtp:la+slnRvvwiZNLRDjLDvM2ayxmPtqt4u
MD5:	0C333C119611B0D0392D4B7931892105
SHA1:	11833217C08044E34B29999AA4C0912553E46037
SHA-256:	1083D91ED29E7A91B1E4D457B9C5C7A3AED4AA907F1DF45815850732C3DA564C
SHA-512:	DB1618C4D85E91C7A0CB1374232BA0E23BCA2865303B5CF6278037D3438E92E72C0A15D1C60E5A26C19D21E1506B7457652147C51FF36963F6ECB6E113297F70
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v3/avast.css
Preview:	/!.=========================================================. Avast styles.=========================================================.* Include only global stuff here.=========================================================.*/#onetrust-consent-sdk .btn{position:relative;font-weight:750;display:inline-flex;align-items:center;z-index:0;text-decoration:none;border-radius:400px;transition:all ease-out .2s;cursor:pointer;color:inherit;background-color:transparent}#onetrust-consent-sdk .btn.with-label{position:relative}#onetrust-consent-sdk .btn.with-label .label{position:absolute;z-index:1;top:0;left:50%;transform:translate(-50%, -50%)}#onetrust-consent-sdk .btn:not(.link):before{content:"";position:absolute;height:100%;width:100%;z-index:-1;transition:all ease-out .2s;top:50%;left:50%;transform:translate(-50%, -50%);border-radius:400px;border-style:solid;border-color:transparent}#onetrust-consent-sdk .btn.disabled,#onetrust-consent-sdk .btn:disabled{cursor:initial;pointer-events:none}#on

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	4.969931986406253
Encrypted:	false
SSDEEP:	24:YaWVyVVWVyVGHlVjLClOY4W/nNIgYgIPs:YaWgVVWgVaPCd4W/nNIgfqs
MD5:	F10AC6AD4101EFBD0B875103172B62B3
SHA1:	A98E48874F1FE33E96358263C75DE3D555387ED7
SHA-256:	29423A280BC436749F5EB385564F72FC80A0333FD0BAF0BD263FD05958073990
SHA-512:	BECF16859EF7BC86862B69F50D912AF74590BFDDD6F26304CFBA5B0604A8B43E41F15FB65F4C8A103F6B68052B512975101948F76B357324D601240B0185DF40
Malicious:	false
Reputation:	low
URL:	https://widget.trustpilot.com/trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en
Preview:	{"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"reviews":null,"links":{"profileUrl":"https://www.trustpilot.com/review/www.avast.com","evaluateUrl":"https://www.trustpilot.com/evaluate/www.avast.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/www.avast.com","consumerWebPageUrl":null},"starsString":"Great","translations":{"main":"<strong>[NOREVIEWS]</strong> reviews <span>on</span>","firstreviewer":"Be the first to review us on"},"settings":{"customStylesAllowed":true,"syndicationEnabled":false}}

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.262051022846105
Encrypted:	false
SSDEEP:	24:t41PiSeuqeQurCKV/SeuPpwQudk1IUeoUAt3Cc9YP:CKSfltSfPpd+tAt37i
MD5:	E89108D4006B6921D46EE4FE285E9A30
SHA1:	25CC22FDBFA2776D3231D7AD4159F44BDD6AFB45
SHA-256:	3EA97497C219F5C1E06DE12EF9270DFA57C9E6D52F3486272E3F16CEE0FFE14B
SHA-512:	F2F5B051F2ECAE30764F1290F2BE1B7353B6CEAF9507A4C949CD15259A94FCDEB1F86F1ADAD264444A39DF7FF5E97A5DD3D2228266426490841464C8229BC0BF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M181.2 158.3c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6 2.9 4.1 6.1 7.9 9.6 11.6 18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4 1.4-1.7 2.7-3.5 4-5.3z" fill="#fff"/><path d="M85.8 24.9c12.8-8.8 30.4-4 37.1 10l58.4 123.4c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6l2.3-.5 38.1-8.4c1.1-.2 1.6 1.2.7 1.8l-31.5 18.7c18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4L81.7 63.1C71.1 51.9 73 33.7 85.8 24.9zm17.9 113.4l-61.4 5.3c-6.7.6-12.2-4.9-11.8-11.6.5-6.7 6.8-11.3 13.3-9.8l60 14.1c1.1.4 1 1.9-.1 2zm-28.4-54l74.5 60.3c.9.7.1 2-.9 1.7l-89.6-34c-9.4-3.6-13.4-14.7-8.4-23.4 4.9-8.8 16.5-10.9 24.4-4.6z" fill="#ff7800"/></svg>

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.262051022846105
Encrypted:	false
SSDEEP:	24:t41PiSeuqeQurCKV/SeuPpwQudk1IUeoUAt3Cc9YP:CKSfltSfPpd+tAt37i
MD5:	E89108D4006B6921D46EE4FE285E9A30
SHA1:	25CC22FDBFA2776D3231D7AD4159F44BDD6AFB45
SHA-256:	3EA97497C219F5C1E06DE12EF9270DFA57C9E6D52F3486272E3F16CEE0FFE14B
SHA-512:	F2F5B051F2ECAE30764F1290F2BE1B7353B6CEAF9507A4C949CD15259A94FCDEB1F86F1ADAD264444A39DF7FF5E97A5DD3D2228266426490841464C8229BC0BF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M181.2 158.3c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6 2.9 4.1 6.1 7.9 9.6 11.6 18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4 1.4-1.7 2.7-3.5 4-5.3z" fill="#fff"/><path d="M85.8 24.9c12.8-8.8 30.4-4 37.1 10l58.4 123.4c11.7-16.2 18.6-36.1 18.8-57.6C200.4 45.5 155.9.4 100.7 0S.4 44.1 0 99.3c-.2 21.8 6.7 42.1 18.5 58.6l2.3-.5 38.1-8.4c1.1-.2 1.6 1.2.7 1.8l-31.5 18.7c18 18.6 43.2 30.3 71.2 30.5 31.3.2 59.4-14 77.9-36.4L81.7 63.1C71.1 51.9 73 33.7 85.8 24.9zm17.9 113.4l-61.4 5.3c-6.7.6-12.2-4.9-11.8-11.6.5-6.7 6.8-11.3 13.3-9.8l60 14.1c1.1.4 1 1.9-.1 2zm-28.4-54l74.5 60.3c.9.7.1 2-.9 1.7l-89.6-34c-9.4-3.6-13.4-14.7-8.4-23.4 4.9-8.8 16.5-10.9 24.4-4.6z" fill="#ff7800"/></svg>

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	452
Entropy (8bit):	4.831287070425481
Encrypted:	false
SSDEEP:	12:tr/kuItbLdk1uFTRXFktUmr0t80B9Yhll7:tzkus1d1fWUzTYhll7
MD5:	50F355DD3AFB228FCAB72C7AB365028C
SHA1:	D305E627CA3FE0F80E775198338DC9C971999B24
SHA-256:	1D317ADF5597D4C31C5924A95ADC3B93145DF8CBC7A4336DE82E9BFD1CA0FCA7
SHA-512:	1EE7F063C6873B8D3874C3B2BFDB38A87C999BCF471596F267B7F284CB185C0F2E3954DBCE540C610299FF125339A3AD7B33E44927898E48FD66D13271620D01
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.884 17.192v-2.284a4.122 4.122 0 018.244 0v2.284m-4.122 6.438v-2.435m-5.152-12.01c2.876-2.635 7.436-2.666 10.305 0M8.4 6.583c4.211-3.96 11.008-3.995 15.212 0M20.476 17.19h-8.94a2.4 2.4 0 00-2.4 2.4v5.61a2.4 2.4 0 002.4 2.4h8.94a2.4 2.4 0 002.4-2.4v-5.608a2.4 2.4 0 00-2.4-2.4z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2207 x 1531, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	152040
Entropy (8bit):	7.750855557547408
Encrypted:	false
SSDEEP:	3072:tWSJBIKXxPnXGYacYuOziO6smvZNVVLnH4A:tbHPPXGuYpudxfVLH4A
MD5:	5808A1EAF5342D26A21E53E4EAF1663E
SHA1:	979B7895DAC478CB7424036A2383571A5A178C85
SHA-256:	9C4A758C92862E591F12B77BF5614387896DC435D59555C0E946EBD37D48A420
SHA-512:	E99607383BCC8D932603DDA0BF4301807E58EF7FABF2800AE1AB7E81D0DB5139B35F7D29C6DB4ADE8F09DF7FE6A2E2381CD12BC7491984BF4C4170651C4980E4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................N....tEXtSoftware.Adobe ImageReadyq.e<...tiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:78fdebba-f5ec-40b7-93f9-65e204c5ef99" xmpMM:DocumentID="xmp.did:35E406FA439411EC8CC2E5558938CBBC" xmpMM:InstanceID="xmp.iid:35E406F9439411EC8CC2E5558938CBBC" xmp:CreatorTool="Adobe Photoshop 2022 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:78fdebba-f5ec-40b7-93f9-65e204c5ef99" stRef:documentID="xmp.did:78fdebba-f5ec-40b7-93f9-65e204c5ef99"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>;;n[..N.IDATx.....dUy7...{6fg..fSY..P4

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	545
Entropy (8bit):	4.754128613009515
Encrypted:	false
SSDEEP:	12:tr/kuINyGdOU2zhjZmfJsXjMl0UVSzIDh1tiq5Mb0u/Xm/B9Yhll7:tzkuHyj2zpZmjl0Up5iA7e2/TYhll7
MD5:	90847F1EA9446C6C882BCE55658B729F
SHA1:	F4B3EAD41C56B796AE2DB5CE210E9BFAE675D677
SHA-256:	E1A666F4C9298EE14EBF790E41A103BBA3299B145A90E1FE5E124D692F40D211
SHA-512:	6F0F0A083D7F15FCF4A29C66103796326261B96186B198C0AA396452A5114CC8B89643A7FD85A96320907790873AC1B5A2BC0D116B30FB1EB6AC237485EF96F9
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	8
Entropy (8bit):	2.5
Encrypted:	false
SSDEEP:	3:x:x
MD5:	402E7A087747CB56C718BDE84651F96A
SHA1:	7CE01F6381463362CF6AEF2F843A59261E8F5587
SHA-256:	662EFAF46C617DDBCB8FF4A2A8F64CFFD3D93630F1003F8E66511F369B87730F
SHA-512:	5080D776D0B123F20E97D44472EF2343BC022105AA67FC802B71668BAEB74A81530355589D50B1142165D17EF995AEAC196B6C15136D518A1EC0ABFA13C91D10
Malicious:	false
Reputation:	low
URL:	https://x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net/eum/results.txt
Preview:	Success!

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	low
Preview:	{}

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.593498476722124
Encrypted:	false
SSDEEP:	24:tzkuOU6joxiRnG7TYhllBjdlUcd3y5DPHAXvzRRcHV7/pjXBDpTYhll7:QU60M5G+WcNbLRC7xrBDA
MD5:	C526F0A4834C12DCDDAB62927102F8B8
SHA1:	BD2E83E856A38B1A5EE1548B741A9C197F97130B
SHA-256:	DD886A8A6D218329AE63D319D5FEB0459FFD3869F2570D312386935B53399868
SHA-512:	6551553FD2708D9C90E39BD5CDBA3DFCE28111AC53BF3D6EFDDFC6968425453818665752267CCAD89DC62F94982029968AF64FFD032048F1E00E0A6D836C531A
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.525 20.717a.734.734 0 00.725-.843c-.2-1.3-.685-2.414-1.364-3.242-1.893.907-3.68.907-5.574 0-.679.828-1.165 1.941-1.364 3.242-.07.44.276.843.725.843h6.852zM16.098 9.4c1.422 0 2.576 1.165 2.576 2.6 0 1.437-1.154 2.6-2.576 2.6-1.422 0-2.574-1.163-2.574-2.6 0-1.434 1.152-2.6 2.574-2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path clip-rule="evenodd" d="M6.18 18.496a18.016 18.016 0 01-.63-4.862c.01-1.415.008-2.83.004-4.246A3.176 3.176 0 017.82 6.334c2.273-.678 4.55-1.34 6.827-2.007a4.819 4.819 0 012.708 0c2.276.666 4.554 1.329 6.827 2.007a3.176 3.176 0 012.265 3.054c-.004 1.415-.007 2.83.004 4.246a18.02 18.02 0 01-.63 4.862c-1.145 4.109-4.75 6.967-8.392 9a2.929 2.929 0 01-2.856 0c-3.641-2.033-7.247-4.891-8.391-9zm14.07 1.378a.734.734 0 01-.725.843h-6.852a.734.734 0 01-.725-.843c.2-1.3.685-2.414 1.364-3.242 1.894.907 3.68.907 5.574 0 .679.828 1.165 1.941 1.364 3.

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:HAOfaY:gOfaY
MD5:	4C8A26E14EDABDD7D6BFBF1472AFC853
SHA1:	F268C3DB54608F753ED9320CB2411B00A40C8D65
SHA-256:	B9224CA870B658AB694ECED1FBB07A971FCE7D0C990E50046929E9968BAF435C
SHA-512:	820B85A739953E8A71E89FEB45BBFB01E2D2F8977D30B0AB11BED28A7CA2B0365595AA7074A3A9780C8DE95E0C8DE839B5C390519F5238E8435F44736CDD497F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk2n2UUBqYs5BIFDaWTNiQ=?alt=proto
Preview:	CgkKBw2lkzYkGgA=

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	545
Entropy (8bit):	4.754128613009515
Encrypted:	false
SSDEEP:	12:tr/kuINyGdOU2zhjZmfJsXjMl0UVSzIDh1tiq5Mb0u/Xm/B9Yhll7:tzkuHyj2zpZmjl0Up5iA7e2/TYhll7
MD5:	90847F1EA9446C6C882BCE55658B729F
SHA1:	F4B3EAD41C56B796AE2DB5CE210E9BFAE675D677
SHA-256:	E1A666F4C9298EE14EBF790E41A103BBA3299B145A90E1FE5E124D692F40D211
SHA-512:	6F0F0A083D7F15FCF4A29C66103796326261B96186B198C0AA396452A5114CC8B89643A7FD85A96320907790873AC1B5A2BC0D116B30FB1EB6AC237485EF96F9
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1166
Entropy (8bit):	4.332122219703909
Encrypted:	false
SSDEEP:	24:tzkuAQqDntULTc9Tq0tRAP9qF3ONH4Uof1kbES7PsQ9q7P2rQdYhll7:vctULTiGpNHySvEQ47OV
MD5:	3E0CF241495509C989A9C3E058E3521A
SHA1:	6490806ABCC74D49776D47EFB1FCCE4965A74694
SHA-256:	F8A299341DE7D91A5C330C6F501B4CE4FE535AD4B0BD5CB8F08C4E9F4CEF4EC3
SHA-512:	4D9979037B4EC05FEB6AB6F81738A79B186652BA273A3C8E0976CD9600F7694506BA795DB9A86303BA5990B89AFA78923C0BDD9DAB3D62D860233D028D58F939
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/index/gloweb-8096/family-protection-controls.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.255 12.862c0-1.956 1.462-3.968 3.439-4.274.206-.464.71-.739 1.204-.739.691 0 1.283.596 1.283 1.283 1.12.75 1.749 2.38 1.749 3.73m-7.675 0c1.985-.244 4.057-1.06 4.702-3.147.302 1.772 1.254 2.574 2.973 3.147m-7.675 0c-.878.394-1.05 1.971.33 2.332.49 1.51 1.859 2.759 3.497 2.759 1.702 0 2.94-1.268 3.537-2.76 1.305-.396 1.243-2.02.31-2.33m-10.317-2.08l-.077-.583c-.31-2.507-2.148-5.052-4.877-5.052-2.726 0-4.636 2.518-4.897 5.052v.486m9.851.097c1.08.817.912 2.533-.427 2.895-.713 1.928-2.376 3.556-4.527 3.556-2.181 0-3.827-1.611-4.547-3.556-1.594-.29-1.608-2.581-.35-2.992m9.851.097c-1.61-.396-3.098-1.013-4.313-2.195-1.024-.985-1.963-1.341-2.818-1.07-.997.325-1.904 1.38-2.72 3.168m16.464 14.068h5.59c.794 0 1.293-.448 1.165-1.263l-.33-2.313c-.257-1.427-1.185-2.393-2.785-2.9M7.08 17.723c-2.608.711-4.12 1.974-4.536 3.787-.376 1.619-.557 2.934-.544 3.944 0 .777.653 1.399 1.418 1.399h16.419c.758 0 1.457-.626 1.4

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	233737
Entropy (8bit):	5.375346659587657
Encrypted:	false
SSDEEP:	1536:lwMdGAYvgJwnOFi9/jYEDnezczP2HgwqXDbGw5MPEfF9EVMwtaGG84NOHDzC1T7M:M1OFwFP2HgwSRF9EVMwC8odH1+pSsY/Q
MD5:	085399D9C08A65342FDC858566305C02
SHA1:	14A8285EBE56DF3A8C4AD963A9A33084694D8AD1
SHA-256:	C60A1C9A37989557AED8884899DDEC28096D9624F4B43C602F9B335AE1DB25CF
SHA-512:	73C741C4B420734AFE21E258F17DA3A839BF030B16B0738D2197A13EC52C5C6708BDA6C4FBD47725F8FAAD448D615930862E784553A0635CF2C598124DCB93EF
Malicious:	false
Reputation:	low
URL:	https://script.hotjar.com/modules.3ba69200791f16077ba8.js
Preview:	/! For license information please see modules.3ba69200791f16077ba8.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	4.438018402648471
Encrypted:	false
SSDEEP:	48:+nufOxD9/vSqYMbIVsV+U3BoOWv8s3tgdB/lbCbHLX0m64vKSus:gufOxtIMbIVkh3BvV9D4HLXZTgs
MD5:	67F7FA125B62D65B6847CAB461FAB4AA
SHA1:	1B88072AC4B46706F2949F34E54E44B5A8F62B49
SHA-256:	287947719CC9F762112173012BC6915E533E308D1C1DD8990DDB05DF37C22BE3
SHA-512:	871E4E75D42FF4F8E6C0428765D21F32ADA95ECE1F8B3AB1C3FB5BD3FCEB99809E3C871B6BABAAA419E439D0854914BBD785DD0F274F0B8668F94F9A070056F7
Malicious:	false
Reputation:	low
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M65 39.106c.021-2.828 0-6.835 0-6.868 0-2.368 1.432-4.162 3.52-4.71 1.382-.362 10.656-3.157 10.656-3.157 1.698-.504 2.945-.486 4.648 0 0 0 9.274 2.795 10.656 3.158 2.088.547 3.52 2.341 3.52 4.709 0 .033-.021 4.04 0 6.868 0 12.08-6.295 17.675-15.371 22.629a2.535 2.535 0 01-2.258 0C71.295 56.78 65 51.186 65 39.106z" fill="#FFDDBF"/><path d="M87.67 61.578l4.96 5.017V49.227c.129-1.28 1.133-2.367 2.457-2.367 1.311 0 2.346 1.076 2.41 2.367v9.89c.064-1.31 1.093-2.319 2.409-2.319 1.316 0 2.345 1.01 2.409 2.319.065-1.31 1.094-2.319 2.41-2.319s2.345 1.01 2.409 2.32v2.223c.061-1.294 1.092-2.366 2.41-2.366 1.257 0 2.456 1.072 2.456 2.36v7.01c0 5.398-5.21 9.749-10.393 9.749-2.677 0-5.008-.9-6.992-2.699l-10.347-10.41c-.901-.967-.843-2.408.047-3.359.937-.938 2.38-.904 3.355-.048z" fill="#fff"/><path d="M4.46 50.758c.673 3.193 4.63 3.64 6.599 3.226 5.205-1.096 3.788-9-1.5-9-2.053 0-5.77 2.58-5.098 5.773z" fill="#FFDDB

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56086)
Category:	downloaded
Size (bytes):	56150
Entropy (8bit):	4.824033795022507
Encrypted:	false
SSDEEP:	384:sY1dFo2Rzjx4JVcB1ZPP8MRbmbUetn7TbVquengTiB9Wen/URozOy4dTRst:5bFc2d+pTbVNegmB9We/URozQdT6
MD5:	8FB6BEB64D6A1F79A254D8D9D5971D5A
SHA1:	86FFCBFFE1DD25A168C2F38564A19EE46AF7003F
SHA-256:	FFC91E3D67046163E05C3051E80E6B5A2EB61D8F2A078E5A3E089E91B185C383
SHA-512:	19C0EA968AC1B0EC589E1495F16562CA171C37FB929B0C0AE5919E395B87C506FC9AD7326B43D7FB6957F39438261C0793721A38208FD205EA78DB4106200E08
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/1/web/c/v2/vendor/onetrust/onetrust-avast-floating-center.css?t=13
Preview:	#onetrust-consent-sdk .btn-wrapper{display:inline-block;vertical-align:top;max-width:100%}#onetrust-consent-sdk .btn-wrapper.with-badge{position:relative}#onetrust-consent-sdk .btn-wrapper.with-badge .badge{position:absolute;z-index:1;top:0;left:50%;transform:translate(-50%, -50%)}#onetrust-consent-sdk .btn{position:relative;font-size:14px;text-transform:uppercase;font-weight:800;letter-spacing:1px;padding:0 32px;display:inline-flex;align-items:center;height:56px;z-index:0;border-width:0}#onetrust-consent-sdk .btn:before{content:"";position:absolute;height:100%;width:100%;border-radius:28px;z-index:-1;transition:all ease-out .2s;top:50%;left:50%;transform:translate(-50%, -50%)}#onetrust-consent-sdk .btn .btn-icon-hover{display:none}#onetrust-consent-sdk .btn img{height:24px}#onetrust-consent-sdk .btn.disabled{cursor:initial}#onetrust-consent-sdk .btn.disabled:before,#onetrust-consent-sdk .btn:disabled:before{display:none;pointer-events:none;border-radius:28px}#onetrust-consent-sdk .btn

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	4.212491397865705
Encrypted:	false
SSDEEP:	48:cJ8G3HAjCXx8i+2f+KjDHN8V97gPINlW34noKyh9NBrEp8uUClJK0h97bS9w:IBlPHN8VaPqwA/pNC9w
MD5:	3CD7B3CD682B8FA2DCB46F16B59C3CD7
SHA1:	CB26256C73D5A087C82181FC0130018A7F4879CB
SHA-256:	F4D132ACE5766F7D219BAF8A4FD575B048AB64B0CB1ED107D91C4FFF3BF8383E
SHA-512:	47327E5BCC1063FCB1EC387E284AD8287DAA97DCC45EBA9712609ED3488AD2676375B810DC7C776B8E217554342C861C725634CA7098611D076975C47E247CBC
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.28 28.388a.6.6 0 101.2 0h-1.2zm-11.744 0a.6.6 0 101.2 0h-1.2zM3.6 9.544a.6.6 0 100 1.2v-1.2zm0 11.727a.6.6 0 000 1.2v-1.2zm-.002-5.864a.6.6 0 10.004 1.2l-.004-1.2zm7.138-11.795a.6.6 0 00-1.2 0h1.2zM28.4 10.744a.6.6 0 000-1.2v1.2zm0 11.727a.6.6 0 000-1.2v1.2zM22.48 3.612a.6.6 0 10-1.2 0h1.2zM9.362 16.374l.285-.528-.933-.504.048 1.06.6-.028zm3.303 2.466a.6.6 0 10.57-1.055l-.57 1.055zm9.974-3.2l-.287.528.934.509-.048-1.063-.6.027zm-3.302-2.481a.6.6 0 00-.574 1.054l.574-1.054zM16.6 3.612a.6.6 0 10-1.2 0h1.2zm11.8 12.987a.6.6 0 000-1.2v1.2zm-13 11.789a.6.6 0 001.2 0h-1.2zM9.516 12.724a.6.6 0 001.068.548l-1.068-.548zm12.973 6.55a.6.6 0 00-1.07-.545l1.07.545zM5.836 15.399l-2.238.008.004 1.2 2.239-.008-.005-1.2zm3.24 1.503l3.589 1.938.57-1.055-3.588-1.939-.57 1.056zm13.85-1.788l-3.59-1.955-.573 1.054 3.588 1.955.575-1.054zM16 22.046c-3.168 0-5.895-2.54-6.04-5.7l-1.198.055c.174 3.82 3.447 6.845 7.238 6.845v-

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4287)
Category:	downloaded
Size (bytes):	4326
Entropy (8bit):	5.128111197353052
Encrypted:	false
SSDEEP:	96:ZAHFLIO9/T3apTxkLtvQCW8TUWeX8tuV0e8Kv8K5rGLmG/P:ZYLIO9b3YtM5QwXoT8Kv8K5rGLm2
MD5:	3CF642808B2B26D57F275BE6EE23F74F
SHA1:	DDC589C60671BD54F42846E75EC1CFEDC899CEC7
SHA-256:	17A7CED49E8E171D70F0808C58917D968CD5ECD36871E596D2E49091BBBE02A6
SHA-512:	A54FD4C9BB127265EB030F412E0677BBA9453DB13FE735BC0D014A56528F82BCE5EBC5ECC6C70C4D35E1EDC0CA8E94087B63D9DC68D83467ED97B33A95FF9A06
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v2/avast/pages/mkt/about.css
Preview:	#hero.bg-faint-orange-color{background-color:#fff9f5}@media (min-width: 992px){#hero{padding-bottom:7rem}}#hero .container{padding-bottom:0}#hero h1 span:not(.header-stripe){white-space:nowrap;display:flex;flex-wrap:nowrap;justify-content:center}@media (min-width: 768px){#hero h1 span:not(.header-stripe){background:url("../../../../../i/v2/aim/img/about/headline-background.png") no-repeat;padding:0 .5625rem;margin:0 .1875rem;display:inline-block;background-position:center bottom .1875rem}}@media (max-width: 991.98px){#hero h1 span:not(.header-stripe){background:url("../../../../../i/v2/aim/img/about/headline-background-small.png") no-repeat;padding:0 .5625rem;margin:0 .1875rem;background-position:center;white-space:normal}}#hero .hero-subheadline{max-width:50.375rem;margin-bottom:3.5rem}#hero .video-wrapper{position:relative;max-width:70.5rem;margin:0 auto}#hero .video-wrapper .video-placeholder{width:100%;border-radius:40px}#hero .video-wrapper .play-button{position:absolute;cursor:po

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (803)
Category:	downloaded
Size (bytes):	844
Entropy (8bit):	5.1467948948397675
Encrypted:	false
SSDEEP:	12:cgQZGVVtf8FGUAsolMvRrjHVESIOTE8HnbYPvrH3aHCAvo8xZXOTa8Y/G/N1PgNd:cgxERIOAibovL3aCYxZXOe8Yi1Pta
MD5:	DE3AB3EFD593E4BE42959AC78E826E0C
SHA1:	A82DE5A21E5D6C4953CFF3A0A662878B3436E382
SHA-256:	FD68B59D903AC2750327B16910480619212CA58B284E36DEC9704E8AC09F6767
SHA-512:	ED7646394EBF8CA5AE7A6B095798D99FF2FE48EC5B7F92A44182022C8E2CFD5D31D44F8CBC4BE38D484401D1E723474C6466E28345468B949B56E4BBBBF51B67
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/components/cmp-articles.js
Preview:	!function(){"use strict";var a=avm.require("cash"),b=function(b){window[b]=tns({container:"."+b,controlsContainer:"."+b+"-controls",controlsPosition:"bottom",preventScrollOnTouch:"force",controls:!1,navPosition:"bottom",nav:!0,mouseDrag:!0,speed:400,loop:!1,fixedWidth:280,slideBy:1,responsive:{992:{controls:!0},1280:{fixedWidth:316}},onInit:function(){a("."+b+"-controls").attr("tabindex",-1),a("."+b+'-controls [data-controls="next"]').attr("tabindex",0),a(".carousel-slider .tns-nav").attr("tabindex",-1),a(".carousel-slider [data-nav]").attr("tabindex",0)}}),window[b].events.on("indexChanged",function(){a("."+b+'-controls [data-controls="prev"]:not([disabled])').attr("tabindex",0)})};a(".carousel-slider .article-items").each(function(){var c=a(this).attr("class").split(/\s+/),d=c[1];b(d)})}();.//# sourceMappingURL=cmp-articles.js.map

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	143395
Entropy (8bit):	5.194177982842232
Encrypted:	false
SSDEEP:	1536:g/AS/PCczkJeTNV8NLl+oXtKp0w+kx4k2BBp3Sxufjd5gxJgk8k1+4Cdi4u1SlY7:MAICiN6k8kCzY9L7B
MD5:	42BA75D6C9A4B568FC269E4BBEB7E41F
SHA1:	87CB0939D42D0EB1BD1F1939A72FC89E0F1552CE
SHA-256:	6BB6CE004CA90C4C5DE76DD02D965E41CDD3C0171CD6CC34BB1EB319E4DC64C9
SHA-512:	7667E38D2145F6DEABA30A5CCE293ECC26C2A54DFE7CF56A2F2507223524D6F1476A376D71A1722F6CBDD17D389FEB7926E969753B525B22932AE85DA676DE4D
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy preference center","MainInfoText":"By clicking \"Accept all\" you allow cookies that improve your experience on our site, help us analyze site performance and usage, and enable us to show relevant marketing content. You can manage cookie settings below. By clicking .Confirm selection. you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.avast.com/cookies-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"OK\" you allow cookies that improve your experience on ou

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1849
Entropy (8bit):	4.688805772371818
Encrypted:	false
SSDEEP:	48:8IcJ7VLLRHBNwIMweFBrKAhm4QQCAfROUuMN:m7RdHfwIMh5KgmQzSMN
MD5:	C97F97E8C32797DD5FE80FDC4006F5F2
SHA1:	6FDB61BBF5A528833B60A4BFB826E2C20C91AE97
SHA-256:	740A98390EB5122E695895C0BA780027C8D0A890B468140F4F5BF3A63B842177
SHA-512:	16B70279E44E8A0E86D492F0C206EC740F6B13E421B85BDB10149F12280348D7052323466755BBABB8DF8D0A5FA0850A8E2076EC088294B8605E875769364DCF
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/pages/about/160/junk-free-devices--rocket-cleanup.svg
Preview:	<svg width="160" height="96" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M81.921 30.517c5.708-5.708 12.803-7.255 18.063-7.485 4.584-.2 8.184 3.4 7.984 7.984-.23 5.26-1.777 12.355-7.485 18.063-5.845 5.845-12.418 9.509-17.071 11.602-3.701 1.664-7.903.548-10.772-2.321-2.87-2.87-3.985-7.07-2.32-10.772 2.092-4.653 5.756-11.226 11.602-17.07z" fill="#D4E7FF"/><path d="M87.66 39.342a6.009 6.009 0 108.497-8.498 6.009 6.009 0 00-8.498 8.498z" fill="#fff"/><path d="M138.048 57.606c.673 3.194 4.63 3.64 6.598 3.227 5.206-1.096 3.788-9-1.5-9-2.052 0-5.77 2.58-5.098 5.773z" fill="#B7EB6E"/><path d="M130.45 80.772c1.022 2.804 3.522 2.596 6.327 1.574 2.804-1.022 2.944-2.543 1.921-5.348-1.022-2.804-2.217-4.178-5.021-3.156a5.405 5.405 0 00-3.227 6.93z" fill="#FFBF00"/><path d="M18.378 28.181c-2.824-.967-4.233 1.108-5.2 3.932-.967 2.824.128 3.889 2.952 4.856 2.824.967 4.644.9 5.61-1.924a5.405 5.405 0 00-3.362-6.864z" fill="#7BB5FB"/><path d="M146.588 58.5a4 4 0 100-8 4 4 0 000 8zM21 65v5.333m0

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4287
Entropy (8bit):	4.3546531859688065
Encrypted:	false
SSDEEP:	48:ZyIATAo26sVkgb6/YeR2+Ox9uV2KwG0HSjxafBFt7SPFlaNXNHdAXtgm7YfyIhXm:YTgm5LOWcsxaHN9HJfdhJK4ccbOb
MD5:	EEEDCF9760A2CC6E0F2713E69C2DC787
SHA1:	68FD0715CEF1890539D613805148BDB84058E38D
SHA-256:	8258BFF5A1B2BCEF837103F05B401398829FDE13CF2E0E10D3FC001DAFBF328D
SHA-512:	A54A48C5F807187C6D521947600BEFE942F539D15600411AE5DA393D3EAE9104B6CE8BEC92E4F03C098EBDE61D478A01D29B5A6328F4AACFEAAC460BB8175713
Malicious:	false
Reputation:	low
Preview:	<svg width="380" height="276" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M1.109 91.293c1.632 1.868 3.508.96 5.376-.672 1.869-1.632 3.022-3.37 1.39-5.238a4.492 4.492 0 10-6.766 5.91z" fill="#0070F6"/><path d="M55.617 143.125c-3.56-1.74-5.758.76-7.498 4.32-1.74 3.559-.472 5.141 3.087 6.881 3.56 1.739 5.966 1.952 7.705-1.607a7.173 7.173 0 00-3.294-9.594z" fill="#21455C"/><path d="M217.405 62.374c2.613 3.255 5.83 1.858 9.085-.755 3.256-2.612 2.758-4.69.145-7.944-2.613-3.255-4.812-4.538-8.067-1.926a7.558 7.558 0 00-1.163 10.625z" fill="#D93511"/><path d="M39 250a6 6 0 100-12 6 6 0 000 12z" fill="#21455C"/><path opacity=".8" d="M294 191c0 2.213-1.787 4-4 4s-4-1.787-4-4 1.787-4 4-4c2.128 0 4 1.787 4 4z" fill="#0070F6"/><path opacity=".64" d="M158.007 241.21c3.888 10.823 20.867 7.566 20.867 7.566s12.471-6.242 8.582-17.065c-3.888-10.823-3.052-15.118-19.259-12.649-11.369 1.732-14.079 11.325-10.19 22.148z" fill="#9AE437"/><path opacity=".64" d="M101.902 79.9a8 8 0 01-8 8

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4429
Entropy (8bit):	4.319292533127892
Encrypted:	false
SSDEEP:	96:vUgpLMM2H2kW1YD2lOOdRg0W3cK9E0Vu1UrgxMUuzFJkZYt8PQt:7u2kW1YD2lOO3g0ecK9E0VfzFqZk5
MD5:	C7D92B27504C8D1A7D867BB4191D0611
SHA1:	8F21EF8CA9AFDC2DB183D8EDB2CFA8EB3A35E80B
SHA-256:	8A9C2ACCCFCEBE7A67872A51F9CC08E985DBEA93FD0280637A0F71D74D5B1A56
SHA-512:	51759241852734BDA8D21981D8C2432BFEF4A0D18002F1B007F6E7031FC341F8CA3601501885E72DFAA71D606F521D83E22678E4C400FD68646873A2EB6F9564
Malicious:	false
Reputation:	low
Preview:	<svg width="416" height="33" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M17.597 11.722v2.188h3.067l-.509 3.273h-2.558v7.824h-3.542v-7.824h-2.862V13.91h2.862v-2.988c0-.542.113-1.069.339-1.581.227-.512.541-.95.942-1.312 1.18-1.027 3.004-1.27 5.47-.728v2.767h-1.501c-.549.009-.97.158-1.265.45-.291.284-.439.685-.443 1.204z" fill="#071D2B"/><path fill-rule="evenodd" clip-rule="evenodd" d="M58.398 5.143c1.447-.22 3.29-.243 5.622-.243s4.174.023 5.62.243c1.474.225 2.66.67 3.599 1.604l.019.02c.933.937 1.38 2.122 1.606 3.596.222 1.447.246 3.289.246 5.622 0 2.333-.024 4.175-.246 5.622-.226 1.474-.673 2.66-1.606 3.597l-.02.019c-.938.934-2.124 1.38-3.597 1.604-1.447.22-3.289.243-5.621.243-2.333 0-4.175-.023-5.621-.243-1.474-.225-2.66-.67-3.598-1.604l-.02-.02c-.931-.936-1.381-2.12-1.61-3.594-.225-1.448-.251-3.29-.251-5.624 0-2.334.026-4.176.25-5.624.23-1.474.68-2.658 1.612-3.595l.019-.019c.938-.934 2.124-1.38 3.597-1.604zM58.7 7.12c-1.242.19-1.963.522-2.488 1.045l-.013.012c-.524.527-.86

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/45265626/web/i/v2/components/store-badge/app-store/app-store-badge.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	79869
Entropy (8bit):	3.880428996568255
Encrypted:	false
SSDEEP:	1536:gWX0vmJ7GdznAmsfQnlGsHwK48TfvP8fJnoF2:ZWOYC
MD5:	7093E092AA3B2E4C4E03EED07D2CCEFA
SHA1:	CB280DBFE2CF1AD72CB3D305A2D434B4D56ADA57
SHA-256:	0D7AAF229F1C76C7BB81EEF649DA877E8A90D2B46BB704C9FF3C9E11718970D1
SHA-512:	5E4CBD341AF0CCEEF6C52E56834E49A2724FEE0EA09220E1F5C0FE21AAA553079496034DEC119E0B68213E1030A9776C77C24D833A18F2FD3A95EBBB9B987E86
Malicious:	false
Reputation:	low
Preview:	<svg width="504" height="364" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M244.525 308.085c118.027 18.982 242.927-25.974 257.456-116.313 14.529-90.339-75.506-160.401-193.533-179.383C160.306-11.437 77.688 76.006 63.159 166.345c-14.529 90.339 63.339 122.757 181.366 141.74z" fill="#FFF9F5"/><path d="M129.925 218.751c.643-2.865-1.915-4.105-5.246-4.851-3.332-.746-6.175-.716-6.818 2.15-.642 2.865 1.537 5.793 4.868 6.539 3.331.746 6.553-.972 7.196-3.838z" fill="#FFAF9D"/><path d="M158.025 336.24h-28.114a4 4 0 01-3.932-3.267l-4.899-26.285a4 4 0 013.932-4.733h33.013a4 4 0 014 4v26.285a4 4 0 01-4 4z" fill="#C5D6E0"/><path d="M491.419 62.657c-2.46-6.802-7.778-6.58-13.665-4.448-5.888 2.133-10.115 5.369-7.654 12.171 2.461 6.803 9.228 10.588 15.115 8.456 5.888-2.133 8.665-9.376 6.204-16.179z" fill="#B7EB6E"/><path d="M240.977 136.894c7.383-7.736-8.863-7.972-15.782-14.59-6.918-6.619-7.509-18.854-14.632-15.525-8.455 3.952-5.522 20.725 1.397 27.343 6.918 6.618 21.633 10.508 29.017 2.772z" f

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	18080
Entropy (8bit):	7.980231075975689
Encrypted:	false
SSDEEP:	384:M4F5vgbzJ1HluZGcTRkHpo93O1OaZSeQohYvGG9w5qV2ZfbhfmHZ7:vlgPXHlHcFkJI/aoMqvb9wqV0VfmHZ7
MD5:	2F28170F7B895F134D0F3C72A3FC71F9
SHA1:	A3D4837063A084B0856900183985BCA8974D7CF5
SHA-256:	DE2D525F68BAA79D832D30C651B5B00173FB3F2C52CF528367F05144D08ED005
SHA-512:	66F2A91A37C6CEB197C22C9D6B9E18C82B697BCA4AE8A2073FD3A13BA63DD58FEF3B0F5819450265651D55C11F1518CEA09DDA89254579442F7278C9120C3D4C
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware.png?width=1321&height=601&name=Types-of-Malware.png
Preview:	RIFF.F..WEBPVP8L.F../(....Q....uz..F..m..g.s..eA...}....+.;..AE.....l.......O@.........9....3W...{.w......{....k...w.>.c..y-.....~.....#..I8q.......[..o.PV..@..t.....F...n..z.%...oN..J.P.....)..Zx....(...0.;;.. .@.........;..W.Y..Vv60qeg3..t.\|....:g..".....B.%T\x..8K.....A%.g.h..:..tR+..Z..dd..asww.-......qww.0....5...;+..Y..S...m....m.m.&...).l#.....#.Yi.U...Rj....xx.~X...%'...g.{......g#..rp].+.%...v]o...W%.,..N..L..G.f%Wl.....Dq(..bae.9-.G...@d..yg!.1t...;.J."..8gsP.J...h...A.4ov....`...".!d0....sO.....a.!..G....@0...l...UmoQM.6.....W.dE.<)...e...B~....!@.J....?.... ^I..=...?=...?=...?=...?=..........8.....`......x2.i.p.q..aK2...9)."....,N..7.......E..)..{......x<...'.j&..FR,.)(.<.T....n.<..........9".!.f.@..E+.".%."..I.......$/ ~.<GG..H...E...`.q)m.&.........X&O8.......g."..b.q!?M..G..u.}...V......Z.iqd,<..J.........Q-............\|....s.a.............T.\|d0+.<<.t....`......=......%...i..G..m.*....Q.S.4....

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (521)
Category:	downloaded
Size (bytes):	559
Entropy (8bit):	5.021640599099995
Encrypted:	false
SSDEEP:	12:cwltFGSF949XuDhPgNn1gaSF949XuDhUXAXS/:cw1l949Xu1PgNnA949Xu1UQXq
MD5:	418B70662978F7BD2BAB04A5C2A819A3
SHA1:	E1B68DD2BDE9385BD39AEF2FE6969C1B5A01DCE0
SHA-256:	BF38D4B0DA29AC3E4FF07041AB69400C857A64CDC66CC36333A88CCEEB71848D
SHA-512:	79BAEE6FDCF6AA31D8B2C4EDBE1385976273F78E3E9219EABA3AD47DF8A75673B12F9709303CA62BAFD9423919FE97B3E12CCF9790D1635265185E10418B8FBD
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/components/aa-helper.js
Preview:	!function(){"use scrict";function a(a,b){"function"==typeof trackCustomDownload&&trackCustomDownload(a,b,"")}document.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})}),window.addEventListener("pricebox-updated",function(b){b.detail.element.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})})})}();.//# sourceMappingURL=aa-helper.js.map

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	68766
Entropy (8bit):	7.986140256268885
Encrypted:	false
SSDEEP:	1536:ScuERmFxPEfvvrrK8p406M0kqu2FgRB3mxj2ixzdxaUB0nVzMy2:EgmvEHvK8pFjBSgRBripdxaUyp2
MD5:	39C4D229A429426497F95C9F67ADC654
SHA1:	3C22592B50906F96548898CBF61F937C639E255C
SHA-256:	F7A5D654DD805B8C28CD2B380AEB37AF7675655028400A6F129B910152807189
SHA-512:	4F7F9ACDF586A897D677097377BE5809EE5AD014B6174F698C734570B0B1EA9452A61A23301B412DFE9332D902979D7D7EF0735CBAA85369C1898B6A0A191027
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/A1-Acanning-for-viruses.png?width=2207&name=A1-Acanning-for-viruses.png
Preview:	RIFF....WEBPVP8L..../..~..@r.H..;.z.......Q..#.?.z..)9.Y..l..{.Qh/ .....>S...v....2.+nlMM...A{....1......b4.Yi....5....0.LiL}...4...F..mbEz.w...ua@.....E.4..b..p..\....\...$..)..m=f...l0.M)3.w...9..t..A4...6?....5.._..r.;.m.V?.........[.u.>.7..6.v....+I.QV.LOWO.U...Ir.....o`2.i.....n.)J.q..@f...dA1..~'...3.X#.\.d..2...T.s..k...Z)8.R0..\......C>.q..E.....x.i.h;.!r9.^.NV....t.Z....;..tv0.Dw.0...Nq.6.d$.,...=$....!.d...k9...4eu8..\|Q$.P...\|.v.Fp.q...y..C......\.....K...\|..wC..m:.q......Us...G.....`.6..L..D....a(Hh..C...PE0...5.&.O......#.#.k...v..G"jr..$....y........I..L%...}..$_.c.h%.!.@.J. .`..MK.]o.<vIHS.aw....7/..vt....*.....XU.....cU....2D..>.5."...>.JZ...,=..L........8....j.m.m....].Zk.0.>k...s.......m......J..\.6.Ul'..h]..S...>....m.,...[3Nj.NV.\5b..S.ZW....+....WAa......m.u.c...l.y.....:c.m'..+...:)...m..6N.....H.][U.B:.....PSF\|q..c.j[.c}.5u.>.P`J.....D..Y.......xL..H.$E..i...~NW....n%I...aO..'eJ.?W?.........[./b.e1..YR...66.T.xG.?

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	4.831287070425481
Encrypted:	false
SSDEEP:	12:tr/kuItbLdk1uFTRXFktUmr0t80B9Yhll7:tzkus1d1fWUzTYhll7
MD5:	50F355DD3AFB228FCAB72C7AB365028C
SHA1:	D305E627CA3FE0F80E775198338DC9C971999B24
SHA-256:	1D317ADF5597D4C31C5924A95ADC3B93145DF8CBC7A4336DE82E9BFD1CA0FCA7
SHA-512:	1EE7F063C6873B8D3874C3B2BFDB38A87C999BCF471596F267B7F284CB185C0F2E3954DBCE540C610299FF125339A3AD7B33E44927898E48FD66D13271620D01
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/components/icons/product-icons/32/prodico-32_secureline-vpn_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.884 17.192v-2.284a4.122 4.122 0 018.244 0v2.284m-4.122 6.438v-2.435m-5.152-12.01c2.876-2.635 7.436-2.666 10.305 0M8.4 6.583c4.211-3.96 11.008-3.995 15.212 0M20.476 17.19h-8.94a2.4 2.4 0 00-2.4 2.4v5.61a2.4 2.4 0 002.4 2.4h8.94a2.4 2.4 0 002.4-2.4v-5.608a2.4 2.4 0 00-2.4-2.4z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	735
Entropy (8bit):	4.590926442269083
Encrypted:	false
SSDEEP:	12:tr/kuIcStgLwxswImmnHJM/z2gR2LhSakbitKkJZqPFnRFiX/arn5lB9Yhll7:tzkuU1/I/Wz2U08akbiWFnRQv2n5lTYJ
MD5:	0B065678380A5E9010F7354D610B4810
SHA1:	853545E07075056A3EB68F36C4944808814D3F13
SHA-256:	9DD8FED29647D327F106AFC9E329F2D2619ABF65E1DDFE6062900EE131CE4CA3
SHA-512:	7E4C9CFA09797061CA43FC58C39505D132038F3058070455650F107FF851592EEB8151215E8B5D541E1F435E7A48BB9F9F285EA378339E550DF175B69D031E40
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.808 11.417V8.756a5.192 5.192 0 0110.384 0v2.66m-8.509 16.078c2.125.83 4.509.83 6.634 0M6.769 19.205C6.765 14.19 10.966 9.98 16 9.975c5.034.004 9.235 4.215 9.231 9.23.002 2.685-1.201 5.14-3.092 6.842-.325.292-.828.116-.97-.297-.568-1.646-1.42-2.952-1.93-3.646-.244-.333-.687-.42-1.07-.267-1.534.608-2.804.608-4.337 0-.384-.153-.827-.066-1.072.267-.51.694-1.36 2-1.928 3.646-.142.413-.646.59-.97.297-1.892-1.702-3.095-4.157-3.093-6.842zm9.231.319c-1.422 0-2.574-1.164-2.574-2.6 0-1.435 1.152-2.601 2.574-2.601s2.575 1.165 2.575 2.6c0 1.437-1.153 2.6-2.575 2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22867)
Category:	downloaded
Size (bytes):	22906
Entropy (8bit):	5.318649210583925
Encrypted:	false
SSDEEP:	384:65+15324gZqV3QBm2v2fU+3Fy+fdwKvug0jnL+NWt86z33flOfiPCe585YPG4uyD:601M7ZkB+2F3Fy+fdwKvuRjLg4bz3PA8
MD5:	798D6A1C2E992608C71D4CC63BFD15BE
SHA1:	D26FEB8FC59AB573E912E47D1795481F40DE5AC8
SHA-256:	EB4A4944F833547C5C301C0D24853A8A627964251718282B12E68E2583C6EE91
SHA-512:	C9ECDADE13E0EE6868B9448A244CFC9661CF55F87638BF33E4AB2AF3D856EBE689B21D7206A89116BC700EC33F813417C1319F2F66B3D8B6489A178AED1D4D8E
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/vendor/trustpilot.js
Preview:	!function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};b[g][0].call(k.exports,function(a){return e(b[g][1][a]\|\|a)},k,k.exports,a,b,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g<d.length;g++)e(d[g]);return e}({1:[function(a,b,c){"use strict";function d(){var a=function(){try{return localStorage.getItem(j)}catch(a){return null}}();if(a)return a;var b=j+"=",c=document.cookie,d=c.indexOf(b);return-1<d?c.substring(d+b.length).split(";")[0]:void 0}function e(a,b){!function(a){try{return localStorage.setItem(j,a),!0}catch(a){return!1}}(a)&&(document.cookie=[j+"="+a,"path=/","domain="+function(){for(var a="weird_get_top_level_domain=cookie",b=document.location.hostname.split("."),c=b.length-1;0<=c;c--){var d=b.slice(c).join(".");if(document.cookie=a+";domain=."+d+";",-1<docume

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 120x90, components 3
Category:	downloaded
Size (bytes):	1880
Entropy (8bit):	7.7185854935853335
Encrypted:	false
SSDEEP:	48:Q2IroOAaf14ARmK7R39hRd0CTxTRX/Hmodd2d:Q2IroQaUlnRd00lXOof2d
MD5:	FA11216CE023ED1B668363898F1A10EB
SHA1:	6ABA3FF8253C1A922F5C9586BECE1FA84BE64156
SHA-256:	B9A3EB98C189D63290DD889DA677D37D273C179A6C75CAEA2D488ACB88C428F1
SHA-512:	0948E6D9B80F581304179E2787EBA41334AD11428952201454D40DCFB47A87FB1F40E89DE8AD20E5F752BB879F3436661C13D98D9CD83671224F7D3E817661D1
Malicious:	false
Reputation:	low
URL:	https://i.ytimg.com/vi/Yo9K67ixJ10/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB_gmAAtAFigIMCAAQARhyIEsoRjAP&rs=AOn4CLCJxsQZZEuXR5yZ_WuQyU6IJ0kWWQ
Preview:	......JFIF..................................................."... ....+. $%(((..0=,&0.'40...........'!..222''202'2(22'&&2&&2&22&&(&2&&&2&&&&&&&&&&22&&&&&......Z.x.."........................................B.........................!1AQ.."Taq....2.......#DSr....$B..3b.....................................................!A..1............?....E..[.....p..@/.48W.C..}}....P..7.x......)...t.m.A..$...&.):.....e.&.$V..6....}Rz....:V.~z.$......y....pQ..y....pPc.[.....,~...G....,~...A..l^N..H...G..N..H...G..:..W..o&kh..}...M.A.?.d...H2.-W.....OY_.....e......OO1.?..{@..R.o.m..`kZ...0#-....JZ.{........sX.G.l..^v...2..TCu...pV.....!...E...4..........W........2.P7..oj..).f2@v.s'(.....n#9e...Jce.c....d[...g....:..~.Jk\5)yD.1!...!..Uk#.$.LH\.`p....#.P..XA3..P..g?...-...Z..0..]...i..Vk....7<........{....Z.o.~K.U...o.7x...[)...p...J..._t.V.M..j;.0N.1.kc.*.vsw^.....a.m6....H..;...LN.;P.....e...m.]/....."5&D.......@...5.......He...!.....=......:..'.#..px...;.E..`.C

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4722
Entropy (8bit):	5.15073266234531
Encrypted:	false
SSDEEP:	96:nMkhfysrOysO7sres0j2VmC9XilbJeVBiTPLW+3:nMkhVrOdOArp0j2VmC9XilPb3
MD5:	C521A1F5B139B23927545A1A445232C3
SHA1:	8FB588B6251E039F87527FDFB4E96B131F8AAB1C
SHA-256:	08331CC3D7350B242345772FA3745BAD37F6A0DD1E9BBF7FCE2481F6A0C84461
SHA-512:	94FBF8A75E6461D50BE7D368817D5C996C385FA516206A39ED5BB9B91704A59FDFF26DED884270D197BF46253E284DD4F0623F0218A8AFC773E6DAF3682EE4C7
Malicious:	false
Reputation:	low
URL:	"https://c.go-mpulse.net/api/config.json?key=9K3EU-JY7U6-TD3RC-2KCEC-AH4A8&d=www.avast.com&t=5695345&v=1.766.0&if=&sl=1&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240-s99az4&bcn=%2F%2F173bf109.akstat.io%2F&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=208113"
Preview:	{"h.key":"9K3EU-JY7U6-TD3RC-2KCEC-AH4A8","h.d":"avast.com","h.t":1708603615915,"h.cr":"cfa7c2f7b0e7297bb28d3919e14258ab73f92ad9-d71e44c7-f3212ea","session_id":"def85bdd-3071-40ea-9c22-4366d90d5b9b","site_domain":"avast.com","beacon_url":"//173bf10e.akstat.io/","autorun":true,"strip_query_string":true,"beacon_interval":60,"BW":{"enabled":false},"RT":{"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"Continuity":{"enabled":true,"waitAfterOnload":3000},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/([\\w]{2})-([\\w]{2})/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Regexp","parameter1":"https?://www.(avast\|avg).(ru\|ae\|co.jp\|com)/privacy-policy","parameter2":"Privacy Policy","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[0].pageGroup","on":["navigation"]},{"type":"Custom","parameter1":"dataLayer[1].pageGroup","on":["navigation"]},{"type":"Custom","paramet

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (7046)
Category:	downloaded
Size (bytes):	726112
Entropy (8bit):	4.790043941144896
Encrypted:	false
SSDEEP:	3072:Eff8XJ8PWDJQPZMd1jskDRH3aY5IKh9tMtxWHUfsCVc:EymYjsk8YmKh9tMtxWHUfq
MD5:	CA9FD48DE99B5379D25130613E451BF4
SHA1:	44D6A5C714F6AA53F6598DC9EA6537D2BF6E5BE5
SHA-256:	2E542A70055E5C3B8DC9107F965D0027ADBA9BCBB9A95419A6A80F77AAABABA9
SHA-512:	A4054185653903F496458C010BF5309FF1FFACD8C0A23D0706579B0F07C585978878E785BAF557FFC98025A645932F1B237205200AB929A0574AFD6CACF4834F
Malicious:	false
Reputation:	low
URL:	https://www.avast.com/c-malware
Preview:	AB Testing variants--><!doctype html><html lang="en"><head>. . . . .. .. . Avast Cookie Bar -->.<link href="https://static3.avast.com/1/web/c/v2/vendor/onetrust/onetrust-avast-floating-center.css?t=13" media="all" rel="stylesheet">.. <script type="text/javascript" src="https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js"></script>. <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="text/javascript" charset="UTF-8" data-domain-script="b680e9a8-3d45-4e4a-998f-7d05f89e4486"></script>. <script type="text/javascript" src="https://static3.avast.com/1/web/j/vendor/one-trust.js?t=13">//</script>. /Avast Cookie Bar -->.. Google Tag Manager -->.<script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':. new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],. j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=tru

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	872
Entropy (8bit):	4.240395450257712
Encrypted:	false
SSDEEP:	24:tY1EuJKSeLQxevyMlw0AAiA/YYfUL7Gpjn:YISeMevFX/xsel
MD5:	D3C6807718E415C9FE487EF1ED95DF48
SHA1:	CAB5F7524E8E3725CBC7B1E8326A594EEE62B0B6
SHA-256:	0C1EB13462651387D238B31A04D0C31B7785071CB4901CBE9E6597B78DCDB37D
SHA-512:	D32DA29A7652E3DA675EADBFD5F5CDE277A22749E4C51A5AB1EFF4F4E5DDA85A89254333FAAAC131A8E09C2CF760038FF7AA57E24D09BF99337DE296A8D8AB27
Malicious:	false
Reputation:	low
Preview:	<svg width="24" height="18" viewBox="0 0 24 18" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13 11.726C13 6.80351 16.5682 1.66376 22.2332 0.177044C22.6794 0.0599559 23.1364 0.295646 23.3301 0.714252L23.5321 1.1507C23.7762 1.67797 23.5162 2.30096 23.0302 2.6194C21.5425 3.59421 20.2956 5.38572 19.8061 6.94382C19.6462 7.45283 20.0236 7.92861 20.5266 8.10655C22.5503 8.82245 24 10.7521 24 13.022C24 16.204 21.416 18.001 18.801 18.001C15.786 18.001 13 15.696 13 11.726ZM0 11.726C0 6.80351 3.56816 1.66376 9.23324 0.177044C9.6794 0.0599558 10.1364 0.295646 10.3301 0.714251L10.5321 1.1507C10.7762 1.67797 10.5162 2.30096 10.0302 2.6194C8.54252 3.59421 7.29557 5.38572 6.8061 6.94382C6.6462 7.45283 7.02357 7.92861 7.52657 8.10655C9.55032 8.82245 11 10.7521 11 13.022C11 16.204 8.416 18.001 5.801 18.001C2.786 18.001 0 15.696 0 11.726Z" fill="#FF7800"/>..</svg>..

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Reputation:	low
URL:	https://static.avast.com/client.js
Preview:	.

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.015388542092885
Encrypted:	false
SSDEEP:	24:2dAAfgl4mVnP9B52TyF7PhIFjrReEwB5RCZ+jUEJJIVLJYQKAxMwLhlllQfjLhl4:cZ84SVbPhWnMEwBvC4JJ4X
MD5:	E5B6246059CBAEFD13D4AAA720CF8530
SHA1:	EF54BFDAD6F5CD58F267C2FEBFF82816C9E75C6C
SHA-256:	04AED4F1D862AC4DE0BAE647D6C5AF11C950CDF5FA53B301CF6D9DEB5F368B45
SHA-512:	3B59666260F90F93DA43B9C18D0D5D12005771BA412A71C4DAE9B5FD6A9472FF7729E51B02188A4079E562A5A87AA648188FB13C8525C2A28D780342AC010318
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45">. <ellipse cx="23.6306" cy="23.5332" rx="17.9895" ry="16.4885" fill="#ffddbf"/>. <g>. <path d="M29.4926,6.6474c.1731,.0743,.334,.1485,.4821,.2228,1.3848,.6922,2.6707,1.5699,3.8577,2.6334,.0989,.0493,.1855,.1112,.2597,.1855,.9396,.8654,1.7557,1.7803,2.4479,2.7449,1.7803,2.4725,2.7199,5.279,2.8188,8.4195v.4825c0,.5687-.0246,1.1251-.0739,1.6691-.3463,3.8327-2.0774,7.1586-5.1928,9.9775-3.5114,3.1901-7.7646,4.785-12.7597,4.785-2.2751,0-4.4014-.3463-6.3798-1.0385-.2967-.0743-.6056-.1855-.9273-.334-.5687-.2474-1.1374-.5194-1.7061-.8161l-7.4183,3.1528,2.0027-7.6038c-.3213-.4452-.6553-.89-1.0012-1.3352-.7668-1.1378-1.3602-2.3244-1.7807-3.561-.4944-1.5329-.7418-3.1651-.7418-4.8958,0-4.5503,1.7434-8.4322,5.2302-11.647,.0743-.0743,.1358-.1362,.1855-.1855,3.5114-3.0166,7.6904-4.5253,12.5369-4.5253,2.992,0,5.7123,.5564,8.1602,1.6691Z" fill="n

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	832
Entropy (8bit):	4.409319333898914
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDjySBDfqR/r6Tuw4Oi/yoSPa/R+:OfvtzlfU/OTPi/yY0
MD5:	02C597F73361768A78F7B1B15B078CE1
SHA1:	99AE4542DE5CCA8B87238EB7D85B83886D389513
SHA-256:	CCC80A96969AB96114B8BA7998F891671FF9A683CF0180104938B9A7A904BD20
SHA-512:	D8B5771929711A8F1F8ACA2394316DDD37E9F501C4AF1D3EE8A75728406FD27C3FD7BD09F0C919231285EB6B7BB44ADA51B79E3D0CC429A63EF5ED716D3FB353
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-online-privacy-and-security_white.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#FF7800"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.733 12.733 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.73 12.73 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FFF"/></svg>

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3391)
Category:	downloaded
Size (bytes):	54672
Entropy (8bit):	5.583252519296738
Encrypted:	false
SSDEEP:	768:F+14T0xkrwoEt6Uo2SwoDSy/9M7b/Q/vEtFfcdfskKy2y:RTOkrdoo2yk/Q/RMy
MD5:	7BCBAF51B9EEB8CED3CC7ACAAD47144A
SHA1:	11A7B23D85952FD821E1AE6F5C391D6029A1BEDA
SHA-256:	4A8C95452B68D2811E16CA796D261482CEBC8DFAFD336F6F64940C61F32245B3
SHA-512:	56288C4247E7B08C8362A706984BEBA9817C2A0A27DF118BBF215E785B6417F8518F58397C5C350EF913FA735E88660A5FD020A98E2E5E9C3BF73DB2B60F9AD0
Malicious:	false
Reputation:	low
URL:	https://www.youtube-nocookie.com/s/player/2070f79f/player_ias.vflset/en_US/embed.js
Preview:	(function(g){var window=this;/. SPDX-License-Identifier: Apache-2.0 /./.. Copyright Google LLC All Rights Reserved... Use of this source code is governed by an MIT-style license that can be. found in the LICENSE file at https://angular.io/license././.. Copyright 2017 Google LLC. SPDX-License-Identifier: BSD-3-Clause./.'use strict';var upb=function(a){a.mutedAutoplay=!1;a.endSeconds=NaN;a.limitedPlaybackDurationInSeconds=NaN;g.jT(a)},vpb=function(){return{I:"svg",.Y:{height:"100%",version:"1.1",viewBox:"0 0 110 26",width:"100%"},V:[{I:"path",Ic:!0,S:"ytp-svg-fill",Y:{d:"M 16.68,.99 C 13.55,1.03 7.02,1.16 4.99,1.68 c -1.49,.4 -2.59,1.6 -2.99,3 -0.69,2.7 -0.68,8.31 -0.68,8.31 0,0 -0.01,5.61 .68,8.31 .39,1.5 1.59,2.6 2.99,3 2.69,.7 13.40,.68 13.40,.68 0,0 10.70,.01 13.40,-0.68 1.5,-0.4 2.59,-1.6 2.99,-3 .69,-2.7 .68,-8.31 .68,-8.31 0,0 .11,-5.61 -0.68,-8.31 -0.4,-1.5 -1.59,-2.6 -2.99,-3 C 29.11,.98 18.40,.99 18.40,.99 c 0,0 -0.67,-0.01 -1.71,0 z m 72.21,.90 0,21.28 2.78,0 .31,-1.37 .

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65443)
Category:	downloaded
Size (bytes):	522502
Entropy (8bit):	5.286131018415977
Encrypted:	false
SSDEEP:	6144:gUKTqhIrCKyziarU3Xy6UWZU5qkvIsz3KjZl4Uv3eecTkXZQfkOIQOUbncG3673h:g/B8IkcG3WBtTf6In
MD5:	DD51D567923295B9F7A0C343227E5E06
SHA1:	1107E40177E68C8363F8810B81787CB2278F6623
SHA-256:	49090A28E8803DB116AEF2109E83E70225081624038933CABB6D66626998D46F
SHA-512:	BC8A99B7B45E3BDDFD450B2C10D35B67E22EDE3D024AC824E359CFDC061A6CB88815A8F279B391964EEB28F8C675D98ED454246EE39BD8454AEAB264887B266A
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/apexcharts/3.45.2/apexcharts.min.js
Preview:	/!. ApexCharts v3.45.2. * (c) 2018-2024 ApexCharts. * Released under the MIT License.. */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).ApexCharts=e()}(this,(function(){"use strict";function t(t,e){var i=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),i.push.apply(i,a)}return i}function e(e){for(var i=1;i<arguments.length;i++){var a=null!=arguments[i]?arguments[i]:{};i%2?t(Object(a),!0).forEach((function(t){o(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):t(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function i(t){return i="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){re

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	834
Entropy (8bit):	4.406109308257852
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDJ0BDfk/r6Tuw4Oi/yoSPa/RjT:Ofvt6lfk/OTPi/yYZ
MD5:	B22D91DA365579F870039A2F77FF41C4
SHA1:	41BD074A7E46477C97C8A14A4E5E8121B88118DA
SHA-256:	CD645A4ADBF12890C83BC860810C1F636416333DAE6210156D204FC4DD471EBB
SHA-512:	AFC625D1EA7F025CF0243CBDA805F121D5ECD128CC3EBA5E0B82EC51A52381438609CB56B31F6EDA6D68DEC94A3FCAB93B190CA60CDD63A635546FC3B69BFA14
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/product-icons/32x32/product-icon-32x32-avast-one.svg
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#fff"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.734 12.734 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.731 12.731 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FF7800"/></svg>

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1996
Entropy (8bit):	5.1017749108455925
Encrypted:	false
SSDEEP:	24:2d/EMBMM/WrcLqtjanGwNKe0WnRUN5UzDjLhlllpak0wxMwLhlllW07GLxMwLhlA:c/dtWrcMwNKzqi4n6GrBxSMwZm
MD5:	9CB7C6DBEADCBEB59C505FD42D45D12A
SHA1:	810BD844DEB53660378786B6432E44FAA3DDBFB7
SHA-256:	445F7B1D360D78F807FBC03E97F9612D6952A6A63673E23A89A44D89A5180783
SHA-512:	CBF477E0301918E9DDE80ECF8E2E40BDAA7A8F7D44D2C34933CF747A0529B0D89C56C73B0177F8A5D96EE4F3DFF6594DE20B4206112DDC16277E54B9EC1A2325
Malicious:	false
Reputation:	low
URL:	https://academy.avast.com/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-02.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <g>. <path d="m28.2855,25.2368H3.7145c-.8296,0-1.5022-1.0555-1.5022-2.3575h0s10.083,0,10.083,0h17.4923c0,1.302-.6725,2.3575-1.5022,2.3575Z" fill="#ffddbf"/>. <path d="m7.3835,6.7632h17.2329c1.2108,0,2.1938.983,2.1938,2.1938H5.1898c0-1.2108.983-2.1938,2.1938-2.1938Z" fill="#ffddbf"/>. <polygon points="26.8845 22.8939 19.633 22.8939 12.2953 22.8939 5.137 22.8939 5.137 8.957 26.8845 8.957 26.8845 22.8939" fill="#fff"/>. <path d="m26.8845,20.7994v-11.859c0-1.2023-.9747-2.177-2.177-2.177H7.314c-1.2023-.0001-2.177.9746-2.177,2.1769v11.8591m2.0838-11.6142h17.5801M3.7145,25.2368c-.794-.0001-1.5022-1.0903-1.5022-2.3575h27.5753c0,1.2672-.7081,2.3574-1.5022,2.3575H3.7145Z" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/>. </g>. <g>. <polyline points="17.3418 12.3881 18.6837 13.

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (29815)
Category:	downloaded
Size (bytes):	29861
Entropy (8bit):	5.311692723363734
Encrypted:	false
SSDEEP:	768:nWAdef8QAu1susU9UdlV/EwRsgKmfiL3xW+4VTkQoMvJ690EUQ881+Mz+h1Enuns:WD8Q1sU94/EwKgFswblQ+eQI
MD5:	E0E5C7B79DF9903CE778501236FDA0DB
SHA1:	18BFDCFAA9BA2B8E774A7B1F2B6AEA3A4523BF14
SHA-256:	06E662E50C3A5F724FEA59572C7B8B3CAADDED16260EF8D16BFC0843CE12507F
SHA-512:	EE982EDFDEBB12E18F201AD6FDB4C7FB8C00233D987CFE28BAD4CBAC1CA9D9F25E289AD8CCF460959047E55CE90AC65B70EE835BC0EFEADBE62413F823102949
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/vendor/bootstrap-native.js
Preview:	!function(a,b){"object"==typeof exports&&"undefined"!=typeof module?module.exports=b():"function"==typeof define&&define.amd?define(b):(a=a\|\|self,a.BSN=b())}(this,function(){"use strict";function a(a,b){a.classList.add(b)}function b(a,b){a.classList.remove(b)}function c(a,b){return a.classList.contains(b)}function d(a,b,c,d){d=d\|\|!1,a.addEventListener(b,c,d)}function e(a,b,c,d){d=d\|\|!1,a.removeEventListener(b,c,d)}function f(a,b,c,f){d(a,b,function g(d){d.target===a&&(c(d),e(a,b,g,f))},f)}function g(a,b,c){var d=new CustomEvent(a+".bs."+b,{cancelable:!0});return d.relatedTarget=c,d}function h(a){this&&this.dispatchEvent(a)}function i(a,b){return[].slice.call(a.getElementsByClassName(b))}function j(a,b){var c=b\|\|document;return a instanceof Element?a:c.querySelector(a)}function k(a){var b=G?window.getComputedStyle(a)[I]:0;return b=parseFloat(b),b="number"!=typeof b\|\|isNaN(b)?0:1e3*b}function l(a,b){var c=0;k(a)?f(a,H,function(a){!c&&b(a),c=1}):setTimeout(function(){!c&&b(),c=1},17)}func

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5442
Entropy (8bit):	5.204459140492936
Encrypted:	false
SSDEEP:	48:+RKw8X9A6gw2+Jt9A6gwB7EenOKG2BVp9wmBYRm5mF4WMwm7IBh51uTIfcERm2Ym:+GFNJ33PomvbTnIm2YkTVp68F
MD5:	6B7C4C8E38B7114D0DAD03B1B890E232
SHA1:	376C87269D06A8643539AAC7604EA0146A67151D
SHA-256:	2238EB87612F8A90FF9FD69C29AEFD1C63272B0608C5724259C4A18CAA0F746B
SHA-512:	4858D5391C90E0232D4CDFE9665E9933416043811D1D4A76148E6A1CB79730B57C58F62C6908516EF13ADF3B880BB6431F2BD69249E7E611AC18D65B711FC196
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v2/components/icons/browsers/chrome.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="64" height="64"><defs><radialGradient id="j" cx="-4.847%" cy="-.239%" r="401.337%" fx="-4.847%" fy="-.239%" gradientTransform="matrix(.26722 0 0 1 -.036 0)"><stop offset="0%" stop-color="#3E2723" stop-opacity=".2"/><stop offset="100%" stop-color="#3E2723" stop-opacity="0"/></radialGradient><radialGradient id="m" cx="-.122%" cy=".104%" r="136.314%" fx="-.122%" fy=".104%" gradientTransform="scale(1 .84752)"><stop offset="0%" stop-color="#3E2723" stop-opacity=".2"/><stop offset="100%" stop-color="#3E2723" stop-opacity="0"/></radialGradient><radialGradient id="n" cx="10.227%" cy="-12.225%" r="226.352%" fx="10.227%" fy="-12.225%" gradientTransform="matrix(1 0 0 .49642 0 -.062)"><stop offset="0%" stop-color="#263238" stop-opacity=".2"/><stop offset="100%" stop-color="#263238" stop-opacity="0"/></radialGradient><linearGradient id="c" x1="4.549%" x2="36.95%" y1="55.356%" y2="42.739%"><stop offset="0%" sto

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Reputation:	low
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31980)
Category:	downloaded
Size (bytes):	52987
Entropy (8bit):	5.286522560974398
Encrypted:	false
SSDEEP:	768:UB0nRD8CMagCkqvrgJ8u9tmE3ciR7vAJWrZcvTcVkwPsoMXIaKWW5Tj0gZjObZaL:Lc2gJ7DcJJWNOwCYFR5D/
MD5:	892579F44585CDE98E76132FE6395613
SHA1:	17BC4223935E6468F93E6FBD197E03E19974220F
SHA-256:	1E0B2B302299F23030DCB0FC7DBBCF9560F84A84DCCD115257CF76D3ADA370F2
SHA-512:	C1495A4CD60A0302433033C719DBED2348AD47AE0BAA0000C0966FAE5DBBCCEA7C6775559F697F052B9290B0E111B580CEFC28B8CC17CA1EB71C0D73EE2A1934
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v3/vendor/bootstrap-native-v5.js
Preview:	"use strict";function _get(){return _get="undefined"!=typeof Reflect&&Reflect.get?Reflect.get.bind():function(a,b,c){var d=_superPropBase(a,b);if(d){var e=Object.getOwnPropertyDescriptor(d,b);return e.get?e.get.call(arguments.length<3?a:c):e.value}},_get.apply(this,arguments)}function _superPropBase(a,b){for(;!Object.prototype.hasOwnProperty.call(a,b)&&null!==(a=_getPrototypeOf(a)););return a}function _inherits(a,b){if("function"!=typeof b&&null!==b)throw new TypeError("Super expression must either be null or a function");a.prototype=Object.create(b&&b.prototype,{constructor:{value:a,writable:!0,configurable:!0}}),Object.defineProperty(a,"prototype",{writable:!1}),b&&_setPrototypeOf(a,b)}function _setPrototypeOf(a,b){return(_setPrototypeOf=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(a,b){return a.__proto__=b,a})(a,b)}function _createSuper(a){var b=_isNativeReflectConstruct();return function(){var c,d=_getPrototypeOf(a);if(b){var e=_getPrototypeOf(this).constructor;c=Ref

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31962)
Category:	downloaded
Size (bytes):	55397
Entropy (8bit):	5.294113395720541
Encrypted:	false
SSDEEP:	768:2K0DEMFIADptmDfWkksjaO7lhGkB31jQvRHzqPimK309J1VX0TzoHGCfmqSdBin9:2TYVt+O7KkBN9dezo9OmXDR
MD5:	28147104272848753E4C501CFDC81B44
SHA1:	25171C2F45E3786F3EE322E4E1FC81210DC9C33E
SHA-256:	3F52283C8829155058EE9F75EDA61B05190F045C2A7A647D1A7DCF9847B9ACF9
SHA-512:	19D1CD584F851E6C7D9EE51332BDD3ABAB65A6BDDDF4DEE2B4C97EB9002DC95DBF503C75934C0268254F08005DE150816D1B1F0B214B7F2E9156D6993989CDF1
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/j/v2/avast.js
Preview:	function loadEmailForm(a){var b="/"+avastGlobals.web.locale;switch(avastGlobals.web.locale){case"en-ww":case"ja-jp":case"ru-ru":case"uk-ua":b=""}fetch("https://"+avastGlobals.web.domain+b+"/email-capture-form",{headers:{Accept:"application/json","X-Requested-With":"XMLHttpRequest"}}).then(function(a){return a.text()}).then(function(b){var c=document.querySelector("#email-capture .modal-body");c.innerHTML=b,c.querySelector("#thank-page").classList.add("d-none"),c.querySelector("#session-note").classList.add("d-none"),c.querySelector("#frm-captcha")&&c.querySelector("#frm-captcha").setAttribute("placeholder",c.querySelector("#form-body").getAttribute("data-code")),a!==undefined&&c.querySelector("#frm-captcha").setAttribute("message",a),initAvastForm()})["catch"](function(a){/captcha/.test(a)&&(document.querySelector("#email-capture #form-body").classList.add("d-none"),document.querySelector("#email-capture #thank-page").classList.add("d-none"),document.querySelector("#email-capture #sess

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	low
URL:	https://s.yimg.com/wi/config/10156543.json
Preview:	{}

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1054)
Category:	downloaded
Size (bytes):	1104
Entropy (8bit):	5.266755055012912
Encrypted:	false
SSDEEP:	24:LD53EdKRiyF3Vs53EdKRiyEmpx53EdKRxXmpsN53EdKRJmpB53EdKRlmpw53EdKh:353ZXs53ZNv5386N53MP53IG53udz53c
MD5:	9C64B9822379D47CE035A6AF336F3BB3
SHA1:	11B74352A62B992AA475BF4E32D9F81144A5540F
SHA-256:	006ED2C4740ACCC90527119D5924424935D1724A723AEF381CCC5050E7BB1B00
SHA-512:	37206BB24D77604DF47E548F91EA9CE80676349655BFB217600606532727E2296C3E600E90F827DA13D71199FA272474B5B875521473A2712FB121A66FB7F0E5
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/c/v2/avast/pages/lp-safe-emailing.css
Preview:	#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=576&fcwidth=1152");background-repeat:no-repeat;background-size:cover}@media (min-width: 576px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=576&fcwidth=1152&fcheight=2000")}}@media (min-width: 768px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=768&fcwidth=1536&fcheight=2000")}}@media (min-width: 992px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=992&fcwidth=1984&fcheight=2000")}}@media (min-width: 1280px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=1280&fcwidth=2560&fcheight=2000")}}@media (min-width: 1366px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.jpg?width=1366&fcwidth=2732&fcheight=2000")}}@media (min-width: 1600px){#hero{background-image:url("../../../../i/v2/aim/bg/lp-safe-emailing/hero@2x.j

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	2841
Entropy (8bit):	7.683140678118131
Encrypted:	false
SSDEEP:	48:rGo/jPOJVLCd933SGejmIK6DyKNOisg8VkXxS1w7X9CCvMSi4xw+9XOsK2:rGgPutC33tSm/QQid8VkXkA/NGG1x
MD5:	23484694AAE7B1392FA36CEA6A43DF52
SHA1:	C2B7EB53284B47FD69ED6CC84386E03C50158349
SHA-256:	27B926F032EADDF7733321EC8939C8A62D4BB57A4C4E3125E40155F42D83DCBA
SHA-512:	627687C6088B19BC718BF1C9A270549B5878FF07A74C44F35FD2111423FCC7AE1C2547DDFB7461DAAB608E67E16B03AA928E5FF79538C591238523EE04D223E1
Malicious:	false
Reputation:	low
URL:	https://static3.avast.com/10003548/web/i/v3/aim/img/_awards/avc-top-rated-2022.png?height=72
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...........................b.............8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe................pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe................pixi............ipma..........................iref........auxl.........emdat.........T2..D.........8..M........M.....^D0.....}..T.X,..y.xW\|.. ..L..Z...-:%.q~*.P.....su.Y....y.X.FF.C..BJ.9.&6.+_...\|....dX..D.....2.62.....-....y...}.0......... @@.2..D....@P.../.3.Q...M.......i.'@....R.K.AV........0..T.0.n..:.!.jd...k\|.%BbY.z#%... @.5..#........c...'..agtk....L.&"ce...J.A.]y....B..?..b.....k..."c.w.=:...7`j..,.LeH.,.n.w.nF.~..o5.\..{A.0...eh..gcky.....w..b.U.=~.{....4..C..&g..t.R.fWa.6..[.}....{....E......k......P..K)...qh..H.......4..<6..(..6....h...g.~..f>W.3..v,8..QLjb@....P.......E!....~.....B

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Static File Info

⊘No static file info

File Icon


Icon Hash:	b29a8a8e86868381

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2024 13:06:30.320239067 CET	49678	443	192.168.2.4	104.46.162.224
Feb 22, 2024 13:06:31.523379087 CET	49675	443	192.168.2.4	173.222.162.32
Feb 22, 2024 13:06:39.284997940 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.285052061 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.285116911 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.285577059 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.285624981 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.285679102 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.285931110 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.285943031 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.286251068 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.286267996 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.532135010 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.532227039 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.532540083 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.532572985 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.532603979 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.532623053 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.533143997 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.533209085 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.534462929 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.534468889 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.534535885 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.534538984 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.535499096 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.535577059 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.535753965 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.535835981 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.535849094 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.535856009 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.536007881 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.536016941 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.585614920 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.613449097 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.698709965 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.699085951 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.699142933 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.699434996 CET	49731	443	192.168.2.4	142.250.80.110
Feb 22, 2024 13:06:39.699451923 CET	443	49731	142.250.80.110	192.168.2.4
Feb 22, 2024 13:06:39.734761000 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.734950066 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:39.735014915 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.735982895 CET	49730	443	192.168.2.4	172.253.122.84
Feb 22, 2024 13:06:39.736001968 CET	443	49730	172.253.122.84	192.168.2.4
Feb 22, 2024 13:06:41.135437012 CET	49675	443	192.168.2.4	173.222.162.32
Feb 22, 2024 13:06:41.907485008 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.907529116 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:41.907594919 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.908149958 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.908188105 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:41.908245087 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.908709049 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.908725023 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:41.909075022 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:41.909096003 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.007044077 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.007072926 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.007128954 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.009371996 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.009386063 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.026426077 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.026511908 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.026582003 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.027745962 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.027765989 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.032789946 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.032862902 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.032938004 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.033189058 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.033221960 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.133322954 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.134196043 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.134222031 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.135663033 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.135742903 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.148056030 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.148221016 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.161557913 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.161582947 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.209570885 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.287728071 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.288845062 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.288866043 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.289958954 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.290045977 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.290925026 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.291099072 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.291109085 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.334445953 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.334480047 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.351388931 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.355659962 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.355716944 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.356259108 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.356336117 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.356908083 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.356952906 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.358372927 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.358596087 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.361673117 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362143040 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362221003 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362224102 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362287045 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362344980 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362361908 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362426996 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362477064 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362483978 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362499952 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362550974 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362567902 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362648010 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362694025 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362694979 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362706900 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362759113 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362770081 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362869024 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.362920046 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.362932920 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363034964 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363087893 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.363095999 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363111973 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363164902 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.363209963 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363329887 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363378048 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.363389969 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363617897 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363668919 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.363681078 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363807917 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363857031 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.363867998 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.363976002 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364023924 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.364036083 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364444971 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364499092 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.364511013 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364593029 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364636898 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.364646912 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364660025 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.364708900 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.364809990 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365325928 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365381956 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.365387917 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365401983 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365452051 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.365468025 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365602016 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365648985 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.365659952 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365731001 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.365778923 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.365791082 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.366574049 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.366656065 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.366667986 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.381275892 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.389700890 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.390105963 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.390125036 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.392033100 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.392105103 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.393770933 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.393927097 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.398175955 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.398197889 CET	443	49747	69.147.82.60	192.168.2.4
Feb 22, 2024 13:06:42.412529945 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.443514109 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.443546057 CET	49747	443	192.168.2.4	69.147.82.60
Feb 22, 2024 13:06:42.443607092 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:42.450480938 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.450571060 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.450629950 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.450690985 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.451037884 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.451112986 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.451556921 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.451632977 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.451666117 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.451879025 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.451934099 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.452061892 CET	49738	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.452091932 CET	443	49738	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.491009951 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:42.496128082 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496186972 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496225119 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496234894 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.496253967 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496295929 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.496304035 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496457100 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496511936 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.496520996 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496639967 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496692896 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.496701956 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.496994972 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497066975 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.497075081 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497178078 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497227907 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.497236013 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497596025 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497648954 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.497657061 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497737885 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497785091 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.497792006 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497848034 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.497903109 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.524842978 CET	49737	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.524863005 CET	443	49737	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.547684908 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.547735929 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.547810078 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.548454046 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.548487902 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.654511929 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.655045986 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.655064106 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.656516075 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.656591892 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.660680056 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.660772085 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.710151911 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.710161924 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:42.730465889 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.730916023 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.730973959 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.732408047 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.732477903 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.733295918 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.733386040 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.733779907 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.733795881 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.751396894 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:42.792769909 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.968529940 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968591928 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968631029 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968667984 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968666077 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.968734026 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968774080 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.968794107 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968843937 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.968858957 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968889952 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:42.968949080 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.969882011 CET	49755	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:42.969908953 CET	443	49755	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:43.363933086 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:43.409899950 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:43.439621925 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:43.439640999 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:43.439703941 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:43.440527916 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:43.440551996 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:43.663912058 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:43.664288998 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:43.664299965 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:43.665954113 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:43.666032076 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:43.800484896 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:43.800740957 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:43.800822973 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:43.801135063 CET	49748	443	192.168.2.4	199.232.37.230
Feb 22, 2024 13:06:43.801173925 CET	443	49748	199.232.37.230	192.168.2.4
Feb 22, 2024 13:06:44.041454077 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:44.041765928 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:44.044508934 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:44.044531107 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:44.091088057 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:44.105003119 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.105041981 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.105106115 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.105576038 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.105600119 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.151264906 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:44.151427031 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:44.151501894 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:44.195689917 CET	49767	443	192.168.2.4	104.18.32.137
Feb 22, 2024 13:06:44.195707083 CET	443	49767	104.18.32.137	192.168.2.4
Feb 22, 2024 13:06:44.294442892 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.294464111 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.294533014 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.295149088 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.295164108 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.373912096 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.374509096 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.374531031 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.374633074 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.375329018 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.375329018 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.375339985 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.375360966 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.376303911 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.376379013 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.378782034 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.378840923 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.418200970 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.418206930 CET	443	49775	142.251.40.228	192.168.2.4
Feb 22, 2024 13:06:44.459623098 CET	49775	443	192.168.2.4	142.251.40.228
Feb 22, 2024 13:06:44.485253096 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.486435890 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.486443043 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.487775087 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.488635063 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.488635063 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.488718033 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.537328959 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.574433088 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.599900961 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.599915028 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.601085901 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.601157904 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.607249022 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.607323885 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.607692003 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.607701063 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.655085087 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.709263086 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709410906 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709542990 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709578991 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.709595919 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709695101 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709781885 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709815979 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.709825993 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.709852934 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.709963083 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710047960 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710128069 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710160017 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.710169077 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710197926 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.710274935 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710356951 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710386038 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.710393906 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710505009 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710541010 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.710549116 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710652113 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710958004 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.710989952 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.711003065 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711066008 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.711072922 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711184978 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.711199999 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711277008 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711371899 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711426020 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.711432934 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711834908 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711869955 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.711878061 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.711994886 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.712004900 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712085009 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712162018 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712239027 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712274075 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.712282896 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712311983 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.712708950 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712793112 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.712821007 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.712830067 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713027954 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713054895 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.713063002 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713162899 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.713169098 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713742018 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713843107 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713944912 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.713977098 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.713985920 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.714019060 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.714291096 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.714442968 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.714449883 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.759164095 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.760713100 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.760824919 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.760955095 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.775424957 CET	49780	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:44.775434017 CET	443	49780	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:44.797405005 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.797569990 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.797578096 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.797669888 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.797724009 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.797730923 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.797760010 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.797939062 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.798301935 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.798310995 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.798366070 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.798413992 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.798420906 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.798450947 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.798644066 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799020052 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.799026966 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799072981 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799108982 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.799114943 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799144030 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.799457073 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799587011 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.799593925 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799700975 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.799711943 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.799782038 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.800162077 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.800307989 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.800681114 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.800858974 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.800926924 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.801192999 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.801256895 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.801497936 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.801769018 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.801855087 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.802032948 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.802162886 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.802510977 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.802640915 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.884947062 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.885154963 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.885210037 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.885226011 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.885263920 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.885512114 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.885912895 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.885921001 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.885983944 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.886249065 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.886287928 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.886295080 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.886322975 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.886588097 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887023926 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887073040 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.887082100 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887110949 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.887439013 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887676954 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887721062 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.887727976 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.887758017 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.888017893 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.888410091 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.888715982 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.888756037 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.888763905 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.888793945 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.889108896 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.889379978 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.889417887 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.889425039 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.889455080 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.890023947 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.890067101 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.890073061 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.890103102 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.890296936 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.890594959 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.890634060 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.890640974 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.890670061 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.890739918 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.891443968 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.891484022 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.891490936 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.891519070 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.891685963 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.892196894 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.892235041 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.892241955 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.892267942 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.892400980 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.894035101 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.894076109 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.894083023 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.894120932 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.895612001 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.895653963 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.895653009 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.895689964 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.895698071 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.895725012 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.897273064 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.897314072 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.897368908 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.897378922 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.897408962 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.898861885 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.898919106 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.898964882 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.898972988 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.898999929 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.900417089 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.900459051 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.900506973 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.900512934 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.900540113 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.902070999 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.902112007 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.902152061 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.902158976 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.902184963 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.903624058 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.903675079 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.903723955 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.903731108 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.903757095 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.962024927 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.962064981 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.972981930 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.973038912 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.973079920 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.973089933 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.973118067 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:44.973277092 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:44.973422050 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.026761055 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.034737110 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.038588047 CET	49778	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.038624048 CET	443	49778	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.069911957 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.077579021 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.077600002 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.077967882 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.078533888 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.078579903 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.115633965 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.115720987 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.115937948 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.116485119 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.116527081 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.117003918 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.117033005 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.117127895 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.117271900 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.117288113 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.124876976 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.124896049 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.124999046 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.125205994 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.125221968 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.161252975 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.161287069 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.161350012 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.161597013 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.161611080 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.202119112 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202179909 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202378035 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202398062 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202503920 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202524900 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202553988 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.202553988 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.202617884 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202651978 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202661037 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.202712059 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.202725887 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.202760935 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.243084908 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.260922909 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.261209011 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.261230946 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.261672974 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.262157917 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.262157917 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.262176037 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.262239933 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.270190954 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.270267963 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.270431995 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.272521973 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.272559881 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.306015968 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.321439028 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.321775913 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.321835995 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.322738886 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.322818041 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.344672918 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.344861031 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.344873905 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.346570015 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.346623898 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.354396105 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.354595900 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.354617119 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.356013060 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.356066942 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.364967108 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.365169048 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.365189075 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.365427017 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.365511894 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.365618944 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.365686893 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.365806103 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.365875959 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.366086960 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.366157055 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.366306067 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.366372108 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.366712093 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.366776943 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.366945028 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.367010117 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.368674994 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.368841887 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.462632895 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.462699890 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.465325117 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.465339899 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.465828896 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.494318008 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494376898 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494466066 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494507074 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494528055 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.494560957 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494573116 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.494606018 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494659901 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494709015 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.494709015 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494724989 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494749069 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.494795084 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494837046 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.494837999 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.494848967 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495397091 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.495407104 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495516062 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495557070 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495600939 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495604992 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.495613098 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495640039 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.495682001 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.495719910 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.495729923 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496335983 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496376038 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496381044 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.496387005 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496434927 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.496443033 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496498108 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496536016 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496576071 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.496587038 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.496623993 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.497122049 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.497205019 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.497257948 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.497294903 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.497303009 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.497313976 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.497364044 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.498004913 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498045921 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498069048 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.498079062 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498116970 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.498121023 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498133898 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498178005 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.498186111 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498229980 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498270035 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.498279095 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.498972893 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.499022961 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.499033928 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.513953924 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.528541088 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528600931 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528629065 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528673887 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528701067 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528707027 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528737068 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528748989 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528770924 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528774977 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528821945 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528825045 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528841019 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528877974 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528907061 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528964043 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.528980017 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.528999090 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529053926 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529064894 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529088974 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529145956 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529155970 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529273987 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529297113 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529350042 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529405117 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529474020 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529505014 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529571056 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.529846907 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.529918909 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.530056000 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530116081 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.530457973 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530508995 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530529976 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.530539036 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530560970 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530565977 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.530607939 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.530617952 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.530709028 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.534841061 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.545958042 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.577924967 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.581811905 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582029104 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582046032 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.582060099 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582091093 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.582139015 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582187891 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.582196951 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582236052 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.582914114 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582957983 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.582990885 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.583000898 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.583043098 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.583797932 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.583863020 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.583879948 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.583885908 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.583903074 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.583952904 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.583961010 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.584683895 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.584748983 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.584758043 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.584796906 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.585520029 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.585571051 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.585583925 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.585592031 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.585619926 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.585642099 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.586369038 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.586447954 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.586462975 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.586525917 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.601346970 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.601543903 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.602044106 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.602061033 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.602279902 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.602468014 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.602684975 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.602706909 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.602830887 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.602962017 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.603578091 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.603737116 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.603754044 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.603755951 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.604944944 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.604964018 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.629720926 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.629786968 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.629915953 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.629980087 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.631378889 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.631514072 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.631692886 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.635953903 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.635967016 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.635989904 CET	49788	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:45.635997057 CET	443	49788	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:45.649646044 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.649651051 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.649666071 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.649671078 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.691854954 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.691916943 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.691926956 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.691937923 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.691972017 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.691996098 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.692256927 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.692363977 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.692399025 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.692476034 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.692671061 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.692735910 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.692838907 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.692905903 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.693131924 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.693231106 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.693344116 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.693420887 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.693563938 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.693628073 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.693917036 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.693998098 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.694107056 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.694165945 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.694219112 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.694279909 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.694473982 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.694538116 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.694745064 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.694816113 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.695019007 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.695084095 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.695103884 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.695132971 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.695152044 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.695188999 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.695214987 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.695334911 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.695347071 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.695405960 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.695411921 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.695563078 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.695636988 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.695861101 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.695930958 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.696146011 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.696238995 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.696302891 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.696369886 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.696764946 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.696830988 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.697050095 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.697122097 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.697521925 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.697609901 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.697706938 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.697776079 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.697989941 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.698050022 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.698189020 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.698247910 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.698868036 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.698950052 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.699116945 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.699179888 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.699309111 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.699362040 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.699706078 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.699767113 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.699876070 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.699939966 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.700184107 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.700248957 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.701787949 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.701848984 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.701952934 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.703218937 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.703246117 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.703309059 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.703330040 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.703355074 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.703366041 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.703401089 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.706919909 CET	49782	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.706932068 CET	443	49782	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.745913982 CET	49786	443	192.168.2.4	63.140.39.15
Feb 22, 2024 13:06:45.745932102 CET	443	49786	63.140.39.15	192.168.2.4
Feb 22, 2024 13:06:45.748730898 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.748769999 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.748852015 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.763895035 CET	49787	443	192.168.2.4	3.219.97.208
Feb 22, 2024 13:06:45.763912916 CET	443	49787	3.219.97.208	192.168.2.4
Feb 22, 2024 13:06:45.765901089 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.765933990 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.772381067 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.784827948 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.784837961 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.784856081 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.784904003 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.784955025 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.784990072 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.785017014 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.786957979 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.787019014 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.787033081 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.787082911 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.787087917 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.787133932 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.834052086 CET	49783	443	192.168.2.4	108.138.106.49
Feb 22, 2024 13:06:45.834079981 CET	443	49783	108.138.106.49	192.168.2.4
Feb 22, 2024 13:06:45.855995893 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856062889 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856113911 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856236935 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.856236935 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.856236935 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.856298923 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856425047 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856491089 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.856506109 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856604099 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856611013 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.856637001 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.856663942 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.857063055 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857140064 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.857150078 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857212067 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857275009 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.857285023 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857424974 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.857501984 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857506990 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.857521057 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.857573032 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.857583046 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857640982 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.857716084 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.857938051 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858100891 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858138084 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.858150005 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858186960 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.858314037 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858370066 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.858381033 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858462095 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.858830929 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.858903885 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.858952045 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.859008074 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.859018087 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.859046936 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.859066010 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.859087944 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.860424042 CET	49749	443	192.168.2.4	20.50.2.44
Feb 22, 2024 13:06:45.860450029 CET	443	49749	20.50.2.44	192.168.2.4
Feb 22, 2024 13:06:45.860544920 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.860618114 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.861881971 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.861901045 CET	443	49784	142.251.32.102	192.168.2.4
Feb 22, 2024 13:06:45.861917973 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.861953974 CET	49784	443	192.168.2.4	142.251.32.102
Feb 22, 2024 13:06:45.959511042 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.979768038 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.979787111 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.981251001 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.981316090 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.982582092 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.982676983 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:45.992464066 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:45.992472887 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.037264109 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.107119083 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.107148886 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.107321978 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.108511925 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.108539104 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.108620882 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.118782997 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.118849039 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.118915081 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.120393991 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.120404005 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.120465994 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.123775959 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.123796940 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.124368906 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.124385118 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.124910116 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.124941111 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.125103951 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.125111103 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.134493113 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.134505987 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.134566069 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.135359049 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.135370970 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.193520069 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193584919 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193627119 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193667889 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193684101 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.193703890 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193732023 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.193754911 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193815947 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.193829060 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193855047 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.193932056 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.195868969 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.195905924 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.195961952 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.198009014 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.198024988 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.199945927 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.199980021 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.200059891 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.200594902 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.200608015 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.211074114 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.211124897 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.211199999 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.212250948 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.212271929 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.212321997 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.214361906 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.214376926 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.215111017 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.215137959 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.217982054 CET	49789	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.218000889 CET	443	49789	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.310425043 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.310503006 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.310659885 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.311945915 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.311975956 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.312036037 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.313600063 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.313637972 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.313829899 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.313843012 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.343394041 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.343434095 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.343504906 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.345344067 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.345383883 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.345535040 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.348336935 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.348360062 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.348958969 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.348977089 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.484080076 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.484442949 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.492372036 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.492760897 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.492780924 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.494236946 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.494951963 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.495181084 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.495194912 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.511780024 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.512232065 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.512255907 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.512936115 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.514170885 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.514365911 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.514369011 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.514384985 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.514806986 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.514806986 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.514821053 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.514925003 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.515348911 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.515842915 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.516000986 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.516005039 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.525645018 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.535525084 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.535554886 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.536617994 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.537904978 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.544380903 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.559429884 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.559438944 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.559477091 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.559498072 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.585983038 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.590953112 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.607438087 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.613013983 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.613097906 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.613646984 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.613686085 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.636228085 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636284113 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636377096 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636387110 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636454105 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.636483908 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636588097 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636769056 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.636776924 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.636873007 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.636895895 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637059927 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637094021 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637198925 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.637207031 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637423038 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637454987 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.637460947 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637506962 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.637512922 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637582064 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637638092 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.637738943 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.637747049 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638313055 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638344049 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.638349056 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638420105 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638451099 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.638458014 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638547897 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638555050 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.638561010 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.638847113 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.638967037 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.639050007 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639151096 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639194012 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639225960 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.639231920 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639328003 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639364958 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639395952 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.639404058 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639482975 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.639848948 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639940023 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.639954090 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.639959097 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.640127897 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.640165091 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.640192986 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.640198946 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.640297890 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.640327930 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.641208887 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641283989 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641299009 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.641330004 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641365051 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.641390085 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641436100 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641469955 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.641479015 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641529083 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641562939 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.641568899 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641657114 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.641688108 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.647592068 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.654457092 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.677442074 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.677649975 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.677768946 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.681945086 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.682143927 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.682462931 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.682990074 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.691004992 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.691018105 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.692521095 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.692605019 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.694463968 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.694474936 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.695030928 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.703435898 CET	49797	443	192.168.2.4	3.225.167.6
Feb 22, 2024 13:06:46.703457117 CET	443	49797	3.225.167.6	192.168.2.4
Feb 22, 2024 13:06:46.705136061 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.705234051 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.708550930 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.708659887 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.711298943 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.711317062 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.711374044 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.711390018 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.711605072 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.711611032 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.711651087 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.711659908 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.712127924 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.712722063 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.712728024 CET	443	49804	142.250.64.70	192.168.2.4
Feb 22, 2024 13:06:46.713253021 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.713356972 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.713396072 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.713464022 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.713509083 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.713557959 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.713566065 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.713620901 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.715797901 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.716114044 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.716593027 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.716703892 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.717911959 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.719043970 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.724760056 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.725480080 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.725486040 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.725588083 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.725588083 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.725929022 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.725934982 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.725936890 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.725940943 CET	443	49811	172.64.155.119	192.168.2.4
Feb 22, 2024 13:06:46.726114988 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.726129055 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.726321936 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.726332903 CET	443	49803	34.117.39.58	192.168.2.4
Feb 22, 2024 13:06:46.726742029 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.726751089 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.728465080 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.728996038 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.728996038 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.729480982 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.729536057 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.729973078 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.729994059 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.730257988 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.731723070 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.735434055 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.738311052 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.738338947 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.741081953 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.741763115 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.741763115 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.741930962 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.741976023 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.750977039 CET	49795	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.750977993 CET	49796	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.750993013 CET	443	49795	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.751002073 CET	443	49796	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.753930092 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.762116909 CET	49804	443	192.168.2.4	142.250.64.70
Feb 22, 2024 13:06:46.769921064 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.776097059 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776146889 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776382923 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776427984 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.776464939 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776634932 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.776657104 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776860952 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.776902914 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777097940 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777151108 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777184010 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777189016 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.777209997 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777245998 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.777390003 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777437925 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777476072 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777477026 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.777489901 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777524948 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.777576923 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777637005 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777719021 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.777754068 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.777937889 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.778062105 CET	49803	443	192.168.2.4	34.117.39.58
Feb 22, 2024 13:06:46.778063059 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.778068066 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.778086901 CET	49811	443	192.168.2.4	172.64.155.119
Feb 22, 2024 13:06:46.778137922 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.778140068 CET	49807	443	192.168.2.4	18.164.96.87
Feb 22, 2024 13:06:46.778146029 CET	443	49814	142.251.40.230	192.168.2.4
Feb 22, 2024 13:06:46.785917997 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.792254925 CET	49813	443	192.168.2.4	63.140.39.150
Feb 22, 2024 13:06:46.792283058 CET	443	49813	63.140.39.150	192.168.2.4
Feb 22, 2024 13:06:46.800424099 CET	49794	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.800457001 CET	443	49794	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.814846992 CET	443	49807	18.164.96.87	192.168.2.4
Feb 22, 2024 13:06:46.822653055 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.822716951 CET	443	49809	34.224.119.52	192.168.2.4
Feb 22, 2024 13:06:46.822962999 CET	49809	443	192.168.2.4	34.224.119.52
Feb 22, 2024 13:06:46.823219061 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823295116 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823345900 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823389053 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823429108 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.823434114 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823451042 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823482037 CET	49814	443	192.168.2.4	142.251.40.230
Feb 22, 2024 13:06:46.823487043 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.823545933 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823584080 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.823606014 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823668003 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823714018 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823750019 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.823766947 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.823807001 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.823822021 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824083090 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.824095964 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824157000 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824203968 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824248075 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824295044 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824328899 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.824345112 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824714899 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824755907 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.824769020 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824892998 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824933052 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.824935913 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.824945927 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.824985981 CET	443	49798	184.29.132.67	192.168.2.4
Feb 22, 2024 13:06:46.825000048 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825027943 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.825042009 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825079918 CET	49798	443	192.168.2.4	184.29.132.67
Feb 22, 2024 13:06:46.825423002 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825469971 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825508118 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.825525045 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825582981 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825618982 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.825633049 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825687885 CET	443	49806	104.18.130.236	192.168.2.4
Feb 22, 2024 13:06:46.825723886 CET	49806	443	192.168.2.4	104.18.130.236
Feb 22, 2024 13:06:46.825731993 CET	443	49806	104.18.130.236	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 22, 2024 13:06:39.194812059 CET	192.168.2.4	1.1.1.1	0x7208	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:39.194813013 CET	192.168.2.4	1.1.1.1	0x5db3	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:39.195203066 CET	192.168.2.4	1.1.1.1	0xf1b0	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:39.195751905 CET	192.168.2.4	1.1.1.1	0xb536	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.142877102 CET	192.168.2.4	1.1.1.1	0x164b	Standard query (0)	www.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.143373966 CET	192.168.2.4	1.1.1.1	0x9e6a	Standard query (0)	www.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.817828894 CET	192.168.2.4	1.1.1.1	0xcb18	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.818346024 CET	192.168.2.4	1.1.1.1	0x9cd	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.821378946 CET	192.168.2.4	1.1.1.1	0x12d7	Standard query (0)	static3.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.822448015 CET	192.168.2.4	1.1.1.1	0xf26	Standard query (0)	static3.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.825702906 CET	192.168.2.4	1.1.1.1	0x670a	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.825900078 CET	192.168.2.4	1.1.1.1	0x3a93	Standard query (0)	assets.adobedtm.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.917119026 CET	192.168.2.4	1.1.1.1	0x82e2	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.917527914 CET	192.168.2.4	1.1.1.1	0x6d96	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.934878111 CET	192.168.2.4	1.1.1.1	0xeb54	Standard query (0)	mstatic.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.935199022 CET	192.168.2.4	1.1.1.1	0x31b9	Standard query (0)	mstatic.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:41.936006069 CET	192.168.2.4	1.1.1.1	0xd06b	Standard query (0)	resources.digital-cloud.medallia.eu	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.936392069 CET	192.168.2.4	1.1.1.1	0x5757	Standard query (0)	resources.digital-cloud.medallia.eu	65	IN (0x0001)	false
Feb 22, 2024 13:06:42.008269072 CET	192.168.2.4	1.1.1.1	0xdbbf	Standard query (0)	www.nortonlifelock.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.008588076 CET	192.168.2.4	1.1.1.1	0xba1f	Standard query (0)	www.nortonlifelock.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:42.027108908 CET	192.168.2.4	1.1.1.1	0x7eab	Standard query (0)	static.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.027352095 CET	192.168.2.4	1.1.1.1	0xc591	Standard query (0)	static.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:43.349668026 CET	192.168.2.4	1.1.1.1	0xdbfd	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:43.350475073 CET	192.168.2.4	1.1.1.1	0x1cd3	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:43.394977093 CET	192.168.2.4	1.1.1.1	0xfa7b	Standard query (0)	s.go-mpulse.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:43.396059990 CET	192.168.2.4	1.1.1.1	0xd72a	Standard query (0)	s.go-mpulse.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:44.014908075 CET	192.168.2.4	1.1.1.1	0x344c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.015115976 CET	192.168.2.4	1.1.1.1	0xcc65	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:44.285335064 CET	192.168.2.4	1.1.1.1	0x611e	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.285675049 CET	192.168.2.4	1.1.1.1	0x19e	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:44.501486063 CET	192.168.2.4	1.1.1.1	0x3cc1	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.501826048 CET	192.168.2.4	1.1.1.1	0xbdfe	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.025038958 CET	192.168.2.4	1.1.1.1	0x6806	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.026633024 CET	192.168.2.4	1.1.1.1	0x459	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.027702093 CET	192.168.2.4	1.1.1.1	0x2e22	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.028292894 CET	192.168.2.4	1.1.1.1	0xbbe0	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.029675007 CET	192.168.2.4	1.1.1.1	0xb929	Standard query (0)	symantec.demdex.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.029675007 CET	192.168.2.4	1.1.1.1	0x9cf9	Standard query (0)	symantec.demdex.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.030689001 CET	192.168.2.4	1.1.1.1	0x298a	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.030689001 CET	192.168.2.4	1.1.1.1	0x1928	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.032706976 CET	192.168.2.4	1.1.1.1	0xbf15	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.032706976 CET	192.168.2.4	1.1.1.1	0x98f4	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.633203030 CET	192.168.2.4	1.1.1.1	0x4f30	Standard query (0)	static3.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.637123108 CET	192.168.2.4	1.1.1.1	0x6f52	Standard query (0)	static3.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:45.638603926 CET	192.168.2.4	1.1.1.1	0xaf40	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.639096022 CET	192.168.2.4	1.1.1.1	0x6e91	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.105299950 CET	192.168.2.4	1.1.1.1	0x7751	Standard query (0)	www.upsellit.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.105822086 CET	192.168.2.4	1.1.1.1	0x99d6	Standard query (0)	www.upsellit.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.110347033 CET	192.168.2.4	1.1.1.1	0x3f44	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.110826969 CET	192.168.2.4	1.1.1.1	0xd69f	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.121468067 CET	192.168.2.4	1.1.1.1	0x5b1c	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.122056007 CET	192.168.2.4	1.1.1.1	0x9c72	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.201838970 CET	192.168.2.4	1.1.1.1	0xe43	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.202538967 CET	192.168.2.4	1.1.1.1	0x81ba	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.206311941 CET	192.168.2.4	1.1.1.1	0x4ccc	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.206896067 CET	192.168.2.4	1.1.1.1	0x3069	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.207897902 CET	192.168.2.4	1.1.1.1	0xac37	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.208472967 CET	192.168.2.4	1.1.1.1	0xe32d	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.223401070 CET	192.168.2.4	1.1.1.1	0x30	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.223823071 CET	192.168.2.4	1.1.1.1	0xbbd2	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.228389978 CET	192.168.2.4	1.1.1.1	0xed37	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.229407072 CET	192.168.2.4	1.1.1.1	0x9b6e	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.985430956 CET	192.168.2.4	1.1.1.1	0x6b35	Standard query (0)	4711400.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.986203909 CET	192.168.2.4	1.1.1.1	0x430b	Standard query (0)	4711400.fls.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.986203909 CET	192.168.2.4	1.1.1.1	0x4ccb	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.986484051 CET	192.168.2.4	1.1.1.1	0x24a5	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:46.987345934 CET	192.168.2.4	1.1.1.1	0x1be4	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.987345934 CET	192.168.2.4	1.1.1.1	0x409a	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:48.247153044 CET	192.168.2.4	1.1.1.1	0x7746	Standard query (0)	vc.hotjar.io	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.247530937 CET	192.168.2.4	1.1.1.1	0xe64c	Standard query (0)	vc.hotjar.io	65	IN (0x0001)	false
Feb 22, 2024 13:06:48.706633091 CET	192.168.2.4	1.1.1.1	0xb2e1	Standard query (0)	ampcid.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.706852913 CET	192.168.2.4	1.1.1.1	0xea7e	Standard query (0)	ampcid.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:49.642736912 CET	192.168.2.4	1.1.1.1	0x724c	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:49.643286943 CET	192.168.2.4	1.1.1.1	0xfaa9	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:50.868040085 CET	192.168.2.4	1.1.1.1	0x3160	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:50.868379116 CET	192.168.2.4	1.1.1.1	0xfe6f	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:50.928105116 CET	192.168.2.4	1.1.1.1	0xa5c7	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:50.928723097 CET	192.168.2.4	1.1.1.1	0x1872	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:50.967552900 CET	192.168.2.4	1.1.1.1	0x696a	Standard query (0)	ampcid.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:50.967855930 CET	192.168.2.4	1.1.1.1	0x7a94	Standard query (0)	ampcid.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:51.138547897 CET	192.168.2.4	1.1.1.1	0xf571	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.138844967 CET	192.168.2.4	1.1.1.1	0x80fb	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:51.343525887 CET	192.168.2.4	1.1.1.1	0x3f8e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.344830036 CET	192.168.2.4	1.1.1.1	0x496e	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:51.602936983 CET	192.168.2.4	1.1.1.1	0x6b5b	Standard query (0)	trial-eum-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.603223085 CET	192.168.2.4	1.1.1.1	0xdc14	Standard query (0)	trial-eum-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:51.603677034 CET	192.168.2.4	1.1.1.1	0xd208	Standard query (0)	trial-eum-clienttons-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.603908062 CET	192.168.2.4	1.1.1.1	0x8c54	Standard query (0)	trial-eum-clienttons-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:51.921549082 CET	192.168.2.4	1.1.1.1	0xc44c	Standard query (0)	173bf109.akstat.io	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.921731949 CET	192.168.2.4	1.1.1.1	0x27aa	Standard query (0)	173bf109.akstat.io	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.077069998 CET	192.168.2.4	1.1.1.1	0x394	Standard query (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.077455044 CET	192.168.2.4	1.1.1.1	0x8239	Standard query (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.146749973 CET	192.168.2.4	1.1.1.1	0xc2bb	Standard query (0)	udc-neb.kampyle.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.146953106 CET	192.168.2.4	1.1.1.1	0x83b	Standard query (0)	udc-neb.kampyle.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.381901979 CET	192.168.2.4	1.1.1.1	0x9944	Standard query (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.382090092 CET	192.168.2.4	1.1.1.1	0xc1d0	Standard query (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.597203016 CET	192.168.2.4	1.1.1.1	0x8e32	Standard query (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.597498894 CET	192.168.2.4	1.1.1.1	0x149a	Standard query (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.631392956 CET	192.168.2.4	1.1.1.1	0x8b62	Standard query (0)	udc-neb.kampyle.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.631753922 CET	192.168.2.4	1.1.1.1	0x8bc7	Standard query (0)	udc-neb.kampyle.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:52.907083988 CET	192.168.2.4	1.1.1.1	0xc01b	Standard query (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.907277107 CET	192.168.2.4	1.1.1.1	0xd5ba	Standard query (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:54.878726959 CET	192.168.2.4	1.1.1.1	0x620	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:54.889153957 CET	192.168.2.4	1.1.1.1	0x425d	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:55.420680046 CET	192.168.2.4	1.1.1.1	0x9c01	Standard query (0)	analytics.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:55.421380043 CET	192.168.2.4	1.1.1.1	0xf4ea	Standard query (0)	analytics.ff.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:55.930844069 CET	192.168.2.4	1.1.1.1	0x32fe	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:55.931071043 CET	192.168.2.4	1.1.1.1	0xb1a1	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:55.944678068 CET	192.168.2.4	1.1.1.1	0xa989	Standard query (0)	sp.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:55.944962025 CET	192.168.2.4	1.1.1.1	0xeb47	Standard query (0)	sp.analytics.yahoo.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:56.432472944 CET	192.168.2.4	1.1.1.1	0x6a39	Standard query (0)	analytics.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.432730913 CET	192.168.2.4	1.1.1.1	0xeda9	Standard query (0)	analytics.ff.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:56.519623041 CET	192.168.2.4	1.1.1.1	0x6384	Standard query (0)	sp.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.520090103 CET	192.168.2.4	1.1.1.1	0x7abc	Standard query (0)	sp.analytics.yahoo.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:56.818342924 CET	192.168.2.4	1.1.1.1	0x2a27	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.818674088 CET	192.168.2.4	1.1.1.1	0x246a	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:59.062654018 CET	192.168.2.4	1.1.1.1	0x8cdf	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.062928915 CET	192.168.2.4	1.1.1.1	0xe93e	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:59.104784012 CET	192.168.2.4	1.1.1.1	0xf56b	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.105112076 CET	192.168.2.4	1.1.1.1	0x3d53	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:59.612514973 CET	192.168.2.4	1.1.1.1	0x72d0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.613024950 CET	192.168.2.4	1.1.1.1	0xea38	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:06:59.627729893 CET	192.168.2.4	1.1.1.1	0xbba2	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.628206015 CET	192.168.2.4	1.1.1.1	0xd337	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:06:59.973862886 CET	192.168.2.4	1.1.1.1	0x5b15	Standard query (0)	bits.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.974064112 CET	192.168.2.4	1.1.1.1	0x7569	Standard query (0)	bits.avcdn.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:00.330842018 CET	192.168.2.4	1.1.1.1	0xe630	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:00.331022024 CET	192.168.2.4	1.1.1.1	0x24a2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:32.090246916 CET	192.168.2.4	1.1.1.1	0x21aa	Standard query (0)	academy.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.090508938 CET	192.168.2.4	1.1.1.1	0xb3e7	Standard query (0)	academy.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:32.091236115 CET	192.168.2.4	1.1.1.1	0x803b	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.091521025 CET	192.168.2.4	1.1.1.1	0xbd5a	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:32.892163992 CET	192.168.2.4	1.1.1.1	0xa1ff	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.892441034 CET	192.168.2.4	1.1.1.1	0xa64b	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:32.965521097 CET	192.168.2.4	1.1.1.1	0x13cd	Standard query (0)	academy.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.965521097 CET	192.168.2.4	1.1.1.1	0x1e2f	Standard query (0)	academy.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:33.892301083 CET	192.168.2.4	1.1.1.1	0xece8	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.892735004 CET	192.168.2.4	1.1.1.1	0x3fbf	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:34.218139887 CET	192.168.2.4	1.1.1.1	0x165c	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:34.218544960 CET	192.168.2.4	1.1.1.1	0xc8ad	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:35.977554083 CET	192.168.2.4	1.1.1.1	0x1daa	Standard query (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:35.977741003 CET	192.168.2.4	1.1.1.1	0x2068	Standard query (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:39.529393911 CET	192.168.2.4	1.1.1.1	0x47c	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:39.529799938 CET	192.168.2.4	1.1.1.1	0x23c9	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:41.966284990 CET	192.168.2.4	1.1.1.1	0x6ff6	Standard query (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:41.966689110 CET	192.168.2.4	1.1.1.1	0x1f82	Standard query (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:43.450453043 CET	192.168.2.4	1.1.1.1	0x766f	Standard query (0)	www.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:43.451147079 CET	192.168.2.4	1.1.1.1	0xf9d0	Standard query (0)	www.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:43.451577902 CET	192.168.2.4	1.1.1.1	0xee24	Standard query (0)	static3.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:43.453011990 CET	192.168.2.4	1.1.1.1	0x69a9	Standard query (0)	static3.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:43.702258110 CET	192.168.2.4	1.1.1.1	0xde0f	Standard query (0)	resources.digital-cloud.medallia.eu	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:43.702955008 CET	192.168.2.4	1.1.1.1	0x6f96	Standard query (0)	resources.digital-cloud.medallia.eu	65	IN (0x0001)	false
Feb 22, 2024 13:07:45.929033995 CET	192.168.2.4	1.1.1.1	0xb729	Standard query (0)	static3.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:45.929469109 CET	192.168.2.4	1.1.1.1	0x4588	Standard query (0)	static3.avast.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:45.929945946 CET	192.168.2.4	1.1.1.1	0x3b2	Standard query (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:45.930830002 CET	192.168.2.4	1.1.1.1	0xd6fd	Standard query (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:50.248999119 CET	192.168.2.4	1.1.1.1	0xb041	Standard query (0)	www.youtube-nocookie.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.249811888 CET	192.168.2.4	1.1.1.1	0x8760	Standard query (0)	www.youtube-nocookie.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.328859091 CET	192.168.2.4	1.1.1.1	0x77bb	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.329390049 CET	192.168.2.4	1.1.1.1	0xdf2c	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.360192060 CET	192.168.2.4	1.1.1.1	0xa22a	Standard query (0)	4711400.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.360382080 CET	192.168.2.4	1.1.1.1	0xc7fc	Standard query (0)	4711400.fls.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.364228964 CET	192.168.2.4	1.1.1.1	0x18c1	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.364414930 CET	192.168.2.4	1.1.1.1	0x542f	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.464132071 CET	192.168.2.4	1.1.1.1	0x41c7	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.464550018 CET	192.168.2.4	1.1.1.1	0x251d	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.466691017 CET	192.168.2.4	1.1.1.1	0x1ade	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.467139959 CET	192.168.2.4	1.1.1.1	0x6cb6	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.883095026 CET	192.168.2.4	1.1.1.1	0xdff3	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.883317947 CET	192.168.2.4	1.1.1.1	0xc21d	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:51.980070114 CET	192.168.2.4	1.1.1.1	0x158f	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.980324030 CET	192.168.2.4	1.1.1.1	0x9cf7	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:52.003396988 CET	192.168.2.4	1.1.1.1	0x86c0	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.003887892 CET	192.168.2.4	1.1.1.1	0x5541	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:52.088350058 CET	192.168.2.4	1.1.1.1	0xdbd1	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.088594913 CET	192.168.2.4	1.1.1.1	0x88c	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:52.194062948 CET	192.168.2.4	1.1.1.1	0x4ac3	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.194709063 CET	192.168.2.4	1.1.1.1	0x3ae7	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:52.630251884 CET	192.168.2.4	1.1.1.1	0x198a	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.630520105 CET	192.168.2.4	1.1.1.1	0xe0ce	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:54.805974960 CET	192.168.2.4	1.1.1.1	0x9fab	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:54.806510925 CET	192.168.2.4	1.1.1.1	0xdbab	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:55.029428005 CET	192.168.2.4	1.1.1.1	0x3d26	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.029645920 CET	192.168.2.4	1.1.1.1	0x9805	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:57.814414978 CET	192.168.2.4	1.1.1.1	0xd446	Standard query (0)	x5qohxtiidpyczoxhekq-f-3f33cf437-clientnsv4-s.akamaihd.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.814867020 CET	192.168.2.4	1.1.1.1	0xe8ea	Standard query (0)	x5qohxtiidpyczoxhekq-f-3f33cf437-clientnsv4-s.akamaihd.net	65	IN (0x0001)	false
Feb 22, 2024 13:07:57.817724943 CET	192.168.2.4	1.1.1.1	0xeb6	Standard query (0)	www.youtube-nocookie.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.817873955 CET	192.168.2.4	1.1.1.1	0x12e3	Standard query (0)	www.youtube-nocookie.com	65	IN (0x0001)	false
Feb 22, 2024 13:07:58.342756987 CET	192.168.2.4	1.1.1.1	0xb43	Standard query (0)	173bf109.akstat.io	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:58.343030930 CET	192.168.2.4	1.1.1.1	0xe431	Standard query (0)	173bf109.akstat.io	65	IN (0x0001)	false
Feb 22, 2024 13:07:59.597989082 CET	192.168.2.4	1.1.1.1	0xf675	Standard query (0)	v7event.stats.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:59.598304033 CET	192.168.2.4	1.1.1.1	0x721d	Standard query (0)	iavs9x.u.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:03.940474033 CET	192.168.2.4	1.1.1.1	0x38b1	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:06.182356119 CET	192.168.2.4	1.1.1.1	0x8d59	Standard query (0)	shepherd.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:06.271155119 CET	192.168.2.4	1.1.1.1	0xb184	Standard query (0)	shepherd.ff.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:06.393321037 CET	192.168.2.4	1.1.1.1	0x5e4b	Standard query (0)	shepherd.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:08.617631912 CET	192.168.2.4	1.1.1.1	0x2da1	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:08.617830038 CET	192.168.2.4	1.1.1.1	0x3b6a	Standard query (0)	clients1.google.com	65	IN (0x0001)	false
Feb 22, 2024 13:08:09.342592001 CET	192.168.2.4	8.8.8.8	0x5eb5	Standard query (0)	b8003600.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.344400883 CET	192.168.2.4	8.8.8.8	0x1ecc	Standard query (0)	b8003600.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.345083952 CET	192.168.2.4	8.8.8.8	0x9d05	Standard query (0)	n4291289.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.348371983 CET	192.168.2.4	8.8.8.8	0x5fe2	Standard query (0)	n4291289.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.349246979 CET	192.168.2.4	8.8.8.8	0x75cf	Standard query (0)	p1043812.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.351669073 CET	192.168.2.4	8.8.8.8	0x8355	Standard query (0)	r9319236.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.351669073 CET	192.168.2.4	8.8.8.8	0x2379	Standard query (0)	p1043812.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.353177071 CET	192.168.2.4	8.8.8.8	0x28f5	Standard query (0)	r9319236.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.354806900 CET	192.168.2.4	8.8.8.8	0x4d02	Standard query (0)	s-iavs9x.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.355170012 CET	192.168.2.4	8.8.8.8	0xdf10	Standard query (0)	s-iavs9x.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.355842113 CET	192.168.2.4	8.8.8.8	0xe7a1	Standard query (0)	y9830512.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.357327938 CET	192.168.2.4	8.8.8.8	0x7940	Standard query (0)	y9830512.iavs9x.u.avast.com	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:09.528764963 CET	192.168.2.4	8.8.8.8	0x2f40	Standard query (0)	b8003600.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.531075954 CET	192.168.2.4	8.8.8.8	0xb465	Standard query (0)	b8003600.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.531919956 CET	192.168.2.4	8.8.8.8	0x7bd8	Standard query (0)	n4291289.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.533477068 CET	192.168.2.4	8.8.8.8	0xbdb9	Standard query (0)	n4291289.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.534056902 CET	192.168.2.4	8.8.8.8	0xf3af	Standard query (0)	p1043812.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.535653114 CET	192.168.2.4	8.8.8.8	0x2fb8	Standard query (0)	p1043812.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.536339045 CET	192.168.2.4	8.8.8.8	0x8aa3	Standard query (0)	r9319236.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.538429022 CET	192.168.2.4	8.8.8.8	0x8e93	Standard query (0)	r9319236.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.538928986 CET	192.168.2.4	8.8.8.8	0xd2af	Standard query (0)	s-iavs9x.avcdn.net	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.540707111 CET	192.168.2.4	8.8.8.8	0xecfd	Standard query (0)	s-iavs9x.avcdn.net	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.541316032 CET	192.168.2.4	8.8.8.8	0x1e5e	Standard query (0)	y9830512.iavs9x.u.avast.com	28	IN (0x0001)	false
Feb 22, 2024 13:08:09.547898054 CET	192.168.2.4	8.8.8.8	0xf0ec	Standard query (0)	y9830512.iavs9x.u.avast.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 22, 2024 13:06:39.282568932 CET	1.1.1.1	192.168.2.4	0x5db3	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:39.282891989 CET	1.1.1.1	192.168.2.4	0x7208	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:39.282891989 CET	1.1.1.1	192.168.2.4	0x7208	No error (0)	clients.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:39.283333063 CET	1.1.1.1	192.168.2.4	0xf1b0	No error (0)	accounts.google.com		172.253.122.84	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.249797106 CET	1.1.1.1	192.168.2.4	0x9e6a	No error (0)	www.avast.com	www.avast.com-2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:41.252778053 CET	1.1.1.1	192.168.2.4	0x164b	No error (0)	www.avast.com	www.avast.com-2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:41.906303883 CET	1.1.1.1	192.168.2.4	0xcb18	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.906303883 CET	1.1.1.1	192.168.2.4	0xcb18	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:41.906639099 CET	1.1.1.1	192.168.2.4	0x9cd	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 22, 2024 13:06:41.912125111 CET	1.1.1.1	192.168.2.4	0x12d7	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:41.913885117 CET	1.1.1.1	192.168.2.4	0x3a93	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:41.915077925 CET	1.1.1.1	192.168.2.4	0x670a	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:41.927588940 CET	1.1.1.1	192.168.2.4	0xf26	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.005115986 CET	1.1.1.1	192.168.2.4	0x82e2	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.005115986 CET	1.1.1.1	192.168.2.4	0x82e2	No error (0)	edge.gycpi.b.yahoodns.net		69.147.82.60	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.005115986 CET	1.1.1.1	192.168.2.4	0x82e2	No error (0)	edge.gycpi.b.yahoodns.net		69.147.82.61	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.005815029 CET	1.1.1.1	192.168.2.4	0x6d96	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.024688959 CET	1.1.1.1	192.168.2.4	0xd06b	No error (0)	resources.digital-cloud.medallia.eu	medallia2.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.024688959 CET	1.1.1.1	192.168.2.4	0xd06b	No error (0)	medallia2.map.fastly.net		199.232.37.230	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.025613070 CET	1.1.1.1	192.168.2.4	0x5757	No error (0)	resources.digital-cloud.medallia.eu	medallia2.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.029865980 CET	1.1.1.1	192.168.2.4	0xeb54	No error (0)	mstatic.avast.com		20.50.2.44	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:42.105376005 CET	1.1.1.1	192.168.2.4	0xba1f	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.105402946 CET	1.1.1.1	192.168.2.4	0xdbbf	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.130426884 CET	1.1.1.1	192.168.2.4	0xc591	No error (0)	static.avast.com	static.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:42.131721973 CET	1.1.1.1	192.168.2.4	0x7eab	No error (0)	static.avast.com	static.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:43.438307047 CET	1.1.1.1	192.168.2.4	0xdbfd	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:43.438307047 CET	1.1.1.1	192.168.2.4	0xdbfd	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:43.438431978 CET	1.1.1.1	192.168.2.4	0x1cd3	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:43.483558893 CET	1.1.1.1	192.168.2.4	0xfa7b	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:43.483726978 CET	1.1.1.1	192.168.2.4	0xd72a	No error (0)	s.go-mpulse.net	ip46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.102791071 CET	1.1.1.1	192.168.2.4	0x344c	No error (0)	www.google.com		142.251.40.228	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.103023052 CET	1.1.1.1	192.168.2.4	0xcc65	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.225.167.6	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.224.142.177	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		35.170.183.53	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.224.119.52	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.231.127.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.4.149.116	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.220.199.248	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373209000 CET	1.1.1.1	192.168.2.4	0x611e	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.217.191.112	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373614073 CET	1.1.1.1	192.168.2.4	0x19e	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373614073 CET	1.1.1.1	192.168.2.4	0x19e	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.373614073 CET	1.1.1.1	192.168.2.4	0x19e	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.589411020 CET	1.1.1.1	192.168.2.4	0xbdfe	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:44.589497089 CET	1.1.1.1	192.168.2.4	0x3cc1	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.112628937 CET	1.1.1.1	192.168.2.4	0x6806	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.112628937 CET	1.1.1.1	192.168.2.4	0x6806	No error (0)	static-cdn.hotjar.com		108.138.106.49	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.112628937 CET	1.1.1.1	192.168.2.4	0x6806	No error (0)	static-cdn.hotjar.com		108.138.106.126	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.112628937 CET	1.1.1.1	192.168.2.4	0x6806	No error (0)	static-cdn.hotjar.com		108.138.106.101	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.112628937 CET	1.1.1.1	192.168.2.4	0x6806	No error (0)	static-cdn.hotjar.com		108.138.106.124	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.114886045 CET	1.1.1.1	192.168.2.4	0x459	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.115941048 CET	1.1.1.1	192.168.2.4	0x2e22	No error (0)	ad.doubleclick.net		142.251.32.102	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.116485119 CET	1.1.1.1	192.168.2.4	0xbbe0	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:06:45.119240046 CET	1.1.1.1	192.168.2.4	0x298a	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.119259119 CET	1.1.1.1	192.168.2.4	0x1928	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.122138023 CET	1.1.1.1	192.168.2.4	0xbf15	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.124358892 CET	1.1.1.1	192.168.2.4	0x98f4	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.219.97.208	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.211.69.59	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.224.67.55	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.194.7.215	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.0.249.61	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.205.41.36	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.164.110.171	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.143395901 CET	1.1.1.1	192.168.2.4	0x9cf9	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		35.168.166.37	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.160739899 CET	1.1.1.1	192.168.2.4	0xb929	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.160739899 CET	1.1.1.1	192.168.2.4	0xb929	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.160739899 CET	1.1.1.1	192.168.2.4	0xb929	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.723275900 CET	1.1.1.1	192.168.2.4	0x4f30	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:45.726696968 CET	1.1.1.1	192.168.2.4	0xaf40	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.726696968 CET	1.1.1.1	192.168.2.4	0xaf40	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:45.726838112 CET	1.1.1.1	192.168.2.4	0x6e91	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 22, 2024 13:06:45.741250038 CET	1.1.1.1	192.168.2.4	0x6f52	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.193447113 CET	1.1.1.1	192.168.2.4	0x7751	No error (0)	www.upsellit.com		34.117.39.58	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.198436975 CET	1.1.1.1	192.168.2.4	0x3f44	No error (0)	ad.doubleclick.net		142.250.64.70	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.198939085 CET	1.1.1.1	192.168.2.4	0xd69f	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:06:46.210813046 CET	1.1.1.1	192.168.2.4	0x5b1c	No error (0)	script.hotjar.com		18.164.96.87	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.210813046 CET	1.1.1.1	192.168.2.4	0x5b1c	No error (0)	script.hotjar.com		18.164.96.90	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.210813046 CET	1.1.1.1	192.168.2.4	0x5b1c	No error (0)	script.hotjar.com		18.164.96.46	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.210813046 CET	1.1.1.1	192.168.2.4	0x5b1c	No error (0)	script.hotjar.com		18.164.96.77	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.290417910 CET	1.1.1.1	192.168.2.4	0x81ba	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:46.290620089 CET	1.1.1.1	192.168.2.4	0xe43	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.290620089 CET	1.1.1.1	192.168.2.4	0xe43	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.224.119.52	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.219.97.208	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.234.185.161	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.209.16.161	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.214.25.46	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.89.77.80	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.196.29.48	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.294306993 CET	1.1.1.1	192.168.2.4	0x4ccc	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.209.221.84	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.295324087 CET	1.1.1.1	192.168.2.4	0x3069	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.295324087 CET	1.1.1.1	192.168.2.4	0x3069	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.295324087 CET	1.1.1.1	192.168.2.4	0x3069	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.296334028 CET	1.1.1.1	192.168.2.4	0xe32d	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.296768904 CET	1.1.1.1	192.168.2.4	0xac37	No error (0)	c.go-mpulse.net	wildcard46.go-mpulse.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.314976931 CET	1.1.1.1	192.168.2.4	0xbbd2	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.316612959 CET	1.1.1.1	192.168.2.4	0xed37	No error (0)	ad.doubleclick.net		142.251.40.230	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.317459106 CET	1.1.1.1	192.168.2.4	0x9b6e	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:46.321265936 CET	1.1.1.1	192.168.2.4	0x30	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:47.074922085 CET	1.1.1.1	192.168.2.4	0x4ccb	No error (0)	td.doubleclick.net		142.250.65.194	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:47.075606108 CET	1.1.1.1	192.168.2.4	0x1be4	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:47.075606108 CET	1.1.1.1	192.168.2.4	0x1be4	No error (0)	scontent.xx.fbcdn.net		157.240.241.1	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:47.075998068 CET	1.1.1.1	192.168.2.4	0x409a	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:47.089788914 CET	1.1.1.1	192.168.2.4	0x430b	No error (0)	4711400.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:47.092391014 CET	1.1.1.1	192.168.2.4	0x6b35	No error (0)	4711400.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:47.092391014 CET	1.1.1.1	192.168.2.4	0x6b35	No error (0)	dart.l.doubleclick.net		142.251.40.102	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.335690022 CET	1.1.1.1	192.168.2.4	0xe64c	No error (0)	vc.hotjar.io	vc-live-cf.hotjar.io		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:48.344268084 CET	1.1.1.1	192.168.2.4	0x7746	No error (0)	vc.hotjar.io	vc-live-cf.hotjar.io		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:48.344268084 CET	1.1.1.1	192.168.2.4	0x7746	No error (0)	vc-live-cf.hotjar.io		18.164.96.97	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.344268084 CET	1.1.1.1	192.168.2.4	0x7746	No error (0)	vc-live-cf.hotjar.io		18.164.96.95	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.344268084 CET	1.1.1.1	192.168.2.4	0x7746	No error (0)	vc-live-cf.hotjar.io		18.164.96.54	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.344268084 CET	1.1.1.1	192.168.2.4	0x7746	No error (0)	vc-live-cf.hotjar.io		18.164.96.52	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:48.794604063 CET	1.1.1.1	192.168.2.4	0xb2e1	No error (0)	ampcid.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:49.731260061 CET	1.1.1.1	192.168.2.4	0x724c	No error (0)	adservice.google.com		142.251.40.226	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:49.731400013 CET	1.1.1.1	192.168.2.4	0xfaa9	No error (0)	adservice.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:50.956264019 CET	1.1.1.1	192.168.2.4	0x3160	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:50.956264019 CET	1.1.1.1	192.168.2.4	0x3160	No error (0)	star-mini.c10r.facebook.com		31.13.71.36	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:50.956476927 CET	1.1.1.1	192.168.2.4	0xfe6f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.016026974 CET	1.1.1.1	192.168.2.4	0xa5c7	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.016026974 CET	1.1.1.1	192.168.2.4	0xa5c7	No error (0)	edge.gycpi.b.yahoodns.net		69.147.82.61	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.016026974 CET	1.1.1.1	192.168.2.4	0xa5c7	No error (0)	edge.gycpi.b.yahoodns.net		69.147.82.60	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.016855955 CET	1.1.1.1	192.168.2.4	0x1872	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.056149960 CET	1.1.1.1	192.168.2.4	0x696a	No error (0)	ampcid.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.226516962 CET	1.1.1.1	192.168.2.4	0xf571	No error (0)	adservice.google.com		142.250.80.66	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.226636887 CET	1.1.1.1	192.168.2.4	0x80fb	No error (0)	adservice.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:51.432486057 CET	1.1.1.1	192.168.2.4	0x3f8e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.432486057 CET	1.1.1.1	192.168.2.4	0x3f8e	No error (0)	star-mini.c10r.facebook.com		31.13.71.36	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:51.433293104 CET	1.1.1.1	192.168.2.4	0x496e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.690912962 CET	1.1.1.1	192.168.2.4	0x6b5b	No error (0)	trial-eum-clientnsv4-s.akamaihd.net	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.691178083 CET	1.1.1.1	192.168.2.4	0xdc14	No error (0)	trial-eum-clientnsv4-s.akamaihd.net	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.692642927 CET	1.1.1.1	192.168.2.4	0x8c54	No error (0)	trial-eum-clienttons-s.akamaihd.net	trial-eum.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.692642927 CET	1.1.1.1	192.168.2.4	0x8c54	No error (0)	trial-eum.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.693730116 CET	1.1.1.1	192.168.2.4	0xd208	No error (0)	trial-eum-clienttons-s.akamaihd.net	trial-eum.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:51.693730116 CET	1.1.1.1	192.168.2.4	0xd208	No error (0)	trial-eum.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.009932995 CET	1.1.1.1	192.168.2.4	0xc44c	No error (0)	173bf109.akstat.io	wildcard46.akstat.io.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.010921955 CET	1.1.1.1	192.168.2.4	0x27aa	No error (0)	173bf109.akstat.io	wildcard46.akstat.io.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.229368925 CET	1.1.1.1	192.168.2.4	0x8239	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.229368925 CET	1.1.1.1	192.168.2.4	0x8239	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.232152939 CET	1.1.1.1	192.168.2.4	0x394	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.232152939 CET	1.1.1.1	192.168.2.4	0x394	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.235115051 CET	1.1.1.1	192.168.2.4	0xc2bb	No error (0)	udc-neb.kampyle.com	cooladata.kampyle.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.235115051 CET	1.1.1.1	192.168.2.4	0xc2bb	No error (0)	cooladata.kampyle.com		35.241.45.82	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.235682964 CET	1.1.1.1	192.168.2.4	0x83b	No error (0)	udc-neb.kampyle.com	cooladata.kampyle.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.502296925 CET	1.1.1.1	192.168.2.4	0x9944	No error (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.502296925 CET	1.1.1.1	192.168.2.4	0x9944	No error (0)	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.568627119 CET	1.1.1.1	192.168.2.4	0xc1d0	No error (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.568627119 CET	1.1.1.1	192.168.2.4	0xc1d0	No error (0)	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.719400883 CET	1.1.1.1	192.168.2.4	0x8b62	No error (0)	udc-neb.kampyle.com	cooladata.kampyle.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.719400883 CET	1.1.1.1	192.168.2.4	0x8b62	No error (0)	cooladata.kampyle.com		35.241.45.82	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:52.720357895 CET	1.1.1.1	192.168.2.4	0x8bc7	No error (0)	udc-neb.kampyle.com	cooladata.kampyle.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.735537052 CET	1.1.1.1	192.168.2.4	0x149a	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.735537052 CET	1.1.1.1	192.168.2.4	0x149a	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.751944065 CET	1.1.1.1	192.168.2.4	0x8e32	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c-clientnsv4-s.akamaihd.net	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:52.751944065 CET	1.1.1.1	192.168.2.4	0x8e32	No error (0)	x5qohxvyk6wquzoxhdoa-pdyw8e-1e7b2815c.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:53.029045105 CET	1.1.1.1	192.168.2.4	0xc01b	No error (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:53.029045105 CET	1.1.1.1	192.168.2.4	0xc01b	No error (0)	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:53.037223101 CET	1.1.1.1	192.168.2.4	0xd5ba	No error (0)	191-96-227-222_s-23-55-235-226_ts-1708603612-clienttons-s.akamaihd.net	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:53.037223101 CET	1.1.1.1	192.168.2.4	0xd5ba	No error (0)	191.96.227.222_s-23.55.235.226_ts-1708603612.cname.clienttons.com	a1024.dscg.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:54.606580973 CET	1.1.1.1	192.168.2.4	0x5421	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:54.606580973 CET	1.1.1.1	192.168.2.4	0x5421	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:54.967262983 CET	1.1.1.1	192.168.2.4	0x620	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:54.967262983 CET	1.1.1.1	192.168.2.4	0x620	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:54.976844072 CET	1.1.1.1	192.168.2.4	0x425d	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:55.509218931 CET	1.1.1.1	192.168.2.4	0x9c01	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:55.509218931 CET	1.1.1.1	192.168.2.4	0x9c01	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:55.510946035 CET	1.1.1.1	192.168.2.4	0xf4ea	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.018645048 CET	1.1.1.1	192.168.2.4	0xb1a1	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:06:56.019119024 CET	1.1.1.1	192.168.2.4	0x32fe	No error (0)	ad.doubleclick.net		142.251.40.166	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.032357931 CET	1.1.1.1	192.168.2.4	0xa989	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.032357931 CET	1.1.1.1	192.168.2.4	0xa989	No error (0)	spdc-global.pbp.gysm.yahoodns.net		76.13.32.146	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.034332037 CET	1.1.1.1	192.168.2.4	0xeb47	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.520260096 CET	1.1.1.1	192.168.2.4	0x6a39	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.520260096 CET	1.1.1.1	192.168.2.4	0x6a39	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.521285057 CET	1.1.1.1	192.168.2.4	0xeda9	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.607429981 CET	1.1.1.1	192.168.2.4	0x6384	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.607429981 CET	1.1.1.1	192.168.2.4	0x6384	No error (0)	spdc-global.pbp.gysm.yahoodns.net		76.13.32.146	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.607831955 CET	1.1.1.1	192.168.2.4	0x7abc	No error (0)	sp.analytics.yahoo.com	spdc-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:06:56.907284975 CET	1.1.1.1	192.168.2.4	0x2a27	No error (0)	widget.trustpilot.com		13.225.214.12	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.907284975 CET	1.1.1.1	192.168.2.4	0x2a27	No error (0)	widget.trustpilot.com		13.225.214.116	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.907284975 CET	1.1.1.1	192.168.2.4	0x2a27	No error (0)	widget.trustpilot.com		13.225.214.35	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:56.907284975 CET	1.1.1.1	192.168.2.4	0x2a27	No error (0)	widget.trustpilot.com		13.225.214.29	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.150319099 CET	1.1.1.1	192.168.2.4	0x8cdf	No error (0)	widget.trustpilot.com		13.225.214.12	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.150319099 CET	1.1.1.1	192.168.2.4	0x8cdf	No error (0)	widget.trustpilot.com		13.225.214.29	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.150319099 CET	1.1.1.1	192.168.2.4	0x8cdf	No error (0)	widget.trustpilot.com		13.225.214.35	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.150319099 CET	1.1.1.1	192.168.2.4	0x8cdf	No error (0)	widget.trustpilot.com		13.225.214.116	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.193006992 CET	1.1.1.1	192.168.2.4	0xf56b	No error (0)	stats.g.doubleclick.net		172.253.115.156	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.193006992 CET	1.1.1.1	192.168.2.4	0xf56b	No error (0)	stats.g.doubleclick.net		172.253.115.155	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.700382948 CET	1.1.1.1	192.168.2.4	0x72d0	No error (0)	www.google.com		142.251.40.196	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.700840950 CET	1.1.1.1	192.168.2.4	0xea38	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:06:59.715472937 CET	1.1.1.1	192.168.2.4	0xbba2	No error (0)	stats.g.doubleclick.net		172.253.63.154	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:06:59.715472937 CET	1.1.1.1	192.168.2.4	0xbba2	No error (0)	stats.g.doubleclick.net		172.253.63.155	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:00.063671112 CET	1.1.1.1	192.168.2.4	0x5b15	No error (0)	bits.avcdn.net	bits.avast.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:00.077956915 CET	1.1.1.1	192.168.2.4	0x7569	No error (0)	bits.avcdn.net	bits.avast.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:00.418957949 CET	1.1.1.1	192.168.2.4	0xe630	No error (0)	www.google.com		142.250.80.36	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:00.419248104 CET	1.1.1.1	192.168.2.4	0x24a2	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:08.593122959 CET	1.1.1.1	192.168.2.4	0xfc9d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:08.593122959 CET	1.1.1.1	192.168.2.4	0xfc9d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:27.494188070 CET	1.1.1.1	192.168.2.4	0x1819	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:27.494188070 CET	1.1.1.1	192.168.2.4	0x1819	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.179406881 CET	1.1.1.1	192.168.2.4	0x803b	No error (0)	cdn2.hubspot.net		104.16.110.209	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.179406881 CET	1.1.1.1	192.168.2.4	0x803b	No error (0)	cdn2.hubspot.net		104.16.109.209	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.179406881 CET	1.1.1.1	192.168.2.4	0x803b	No error (0)	cdn2.hubspot.net		104.16.108.209	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.179406881 CET	1.1.1.1	192.168.2.4	0x803b	No error (0)	cdn2.hubspot.net		104.16.111.209	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.179406881 CET	1.1.1.1	192.168.2.4	0x803b	No error (0)	cdn2.hubspot.net		104.16.112.209	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.180304050 CET	1.1.1.1	192.168.2.4	0xbd5a	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:32.188816071 CET	1.1.1.1	192.168.2.4	0x21aa	No error (0)	academy.avast.com	4650993.group43.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:32.188816071 CET	1.1.1.1	192.168.2.4	0x21aa	No error (0)	4650993.group43.sites.hubspot.net	group43.sites.hscoscdn40.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:32.188816071 CET	1.1.1.1	192.168.2.4	0x21aa	No error (0)	group43.sites.hscoscdn40.net		199.60.103.28	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.188816071 CET	1.1.1.1	192.168.2.4	0x21aa	No error (0)	group43.sites.hscoscdn40.net		199.60.103.228	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:32.189932108 CET	1.1.1.1	192.168.2.4	0xb3e7	No error (0)	academy.avast.com	4650993.group43.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:32.189932108 CET	1.1.1.1	192.168.2.4	0xb3e7	No error (0)	4650993.group43.sites.hubspot.net	group43.sites.hscoscdn40.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:32.189932108 CET	1.1.1.1	192.168.2.4	0xb3e7	No error (0)	group43.sites.hscoscdn40.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:33.009078026 CET	1.1.1.1	192.168.2.4	0xa1ff	No error (0)	widget.trustpilot.com		13.225.214.29	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.009078026 CET	1.1.1.1	192.168.2.4	0xa1ff	No error (0)	widget.trustpilot.com		13.225.214.35	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.009078026 CET	1.1.1.1	192.168.2.4	0xa1ff	No error (0)	widget.trustpilot.com		13.225.214.116	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.009078026 CET	1.1.1.1	192.168.2.4	0xa1ff	No error (0)	widget.trustpilot.com		13.225.214.12	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.058051109 CET	1.1.1.1	192.168.2.4	0x13cd	No error (0)	academy.avast.com	4650993.group43.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:33.058051109 CET	1.1.1.1	192.168.2.4	0x13cd	No error (0)	4650993.group43.sites.hubspot.net	group43.sites.hscoscdn40.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:33.058051109 CET	1.1.1.1	192.168.2.4	0x13cd	No error (0)	group43.sites.hscoscdn40.net		199.60.103.28	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.058051109 CET	1.1.1.1	192.168.2.4	0x13cd	No error (0)	group43.sites.hscoscdn40.net		199.60.103.228	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:33.065028906 CET	1.1.1.1	192.168.2.4	0x1e2f	No error (0)	academy.avast.com	4650993.group43.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:33.065028906 CET	1.1.1.1	192.168.2.4	0x1e2f	No error (0)	4650993.group43.sites.hubspot.net	group43.sites.hscoscdn40.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:33.065028906 CET	1.1.1.1	192.168.2.4	0x1e2f	No error (0)	group43.sites.hscoscdn40.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:33.980011940 CET	1.1.1.1	192.168.2.4	0xece8	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:34.305915117 CET	1.1.1.1	192.168.2.4	0x165c	No error (0)	ad.doubleclick.net		142.250.65.230	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:34.306735039 CET	1.1.1.1	192.168.2.4	0xc8ad	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:36.171113014 CET	1.1.1.1	192.168.2.4	0x2068	No error (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhebq-f-3b19134bd.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:36.171113014 CET	1.1.1.1	192.168.2.4	0x2068	No error (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:36.202143908 CET	1.1.1.1	192.168.2.4	0x1daa	No error (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhebq-f-3b19134bd.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:36.202143908 CET	1.1.1.1	192.168.2.4	0x1daa	No error (0)	x5qohxqxjhzvuzoxhebq-f-3b19134bd.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:39.617631912 CET	1.1.1.1	192.168.2.4	0x23c9	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:39.617815971 CET	1.1.1.1	192.168.2.4	0x47c	No error (0)	ad.doubleclick.net		142.251.40.166	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:42.163321972 CET	1.1.1.1	192.168.2.4	0x6ff6	No error (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhefa-f-7c57ac479.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:42.163321972 CET	1.1.1.1	192.168.2.4	0x6ff6	No error (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:42.186654091 CET	1.1.1.1	192.168.2.4	0x1f82	No error (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhefa-f-7c57ac479.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:42.186654091 CET	1.1.1.1	192.168.2.4	0x1f82	No error (0)	x5qohxqxjhzvuzoxhefa-f-7c57ac479.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.540868044 CET	1.1.1.1	192.168.2.4	0x766f	No error (0)	www.avast.com	www.avast.com-2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.541765928 CET	1.1.1.1	192.168.2.4	0x69a9	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.542254925 CET	1.1.1.1	192.168.2.4	0xee24	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.554928064 CET	1.1.1.1	192.168.2.4	0xf9d0	No error (0)	www.avast.com	www.avast.com-2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.791044950 CET	1.1.1.1	192.168.2.4	0xde0f	No error (0)	resources.digital-cloud.medallia.eu	medallia2.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:43.791044950 CET	1.1.1.1	192.168.2.4	0xde0f	No error (0)	medallia2.map.fastly.net		199.232.37.230	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:43.791461945 CET	1.1.1.1	192.168.2.4	0x6f96	No error (0)	resources.digital-cloud.medallia.eu	medallia2.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.018088102 CET	1.1.1.1	192.168.2.4	0xb729	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.034476042 CET	1.1.1.1	192.168.2.4	0x4588	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.071583033 CET	1.1.1.1	192.168.2.4	0x3b2	No error (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhehq-f-42e1faec1.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.071583033 CET	1.1.1.1	192.168.2.4	0x3b2	No error (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.085475922 CET	1.1.1.1	192.168.2.4	0xd6fd	No error (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1-clientnsv4-s.akamaihd.net	x5qohxqxjhzvuzoxhehq-f-42e1faec1.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:46.085475922 CET	1.1.1.1	192.168.2.4	0xd6fd	No error (0)	x5qohxqxjhzvuzoxhehq-f-42e1faec1.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:50.337735891 CET	1.1.1.1	192.168.2.4	0x8760	No error (0)	www.youtube-nocookie.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:50.337735891 CET	1.1.1.1	192.168.2.4	0x8760	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	www.youtube-nocookie.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:50.338043928 CET	1.1.1.1	192.168.2.4	0xb041	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.417859077 CET	1.1.1.1	192.168.2.4	0x77bb	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.417859077 CET	1.1.1.1	192.168.2.4	0x77bb	No error (0)	static-cdn.hotjar.com		108.138.106.124	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.417859077 CET	1.1.1.1	192.168.2.4	0x77bb	No error (0)	static-cdn.hotjar.com		108.138.106.49	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.417859077 CET	1.1.1.1	192.168.2.4	0x77bb	No error (0)	static-cdn.hotjar.com		108.138.106.126	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.417859077 CET	1.1.1.1	192.168.2.4	0x77bb	No error (0)	static-cdn.hotjar.com		108.138.106.101	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.418375015 CET	1.1.1.1	192.168.2.4	0xdf2c	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.449609041 CET	1.1.1.1	192.168.2.4	0xa22a	No error (0)	4711400.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.449609041 CET	1.1.1.1	192.168.2.4	0xa22a	No error (0)	dart.l.doubleclick.net		142.251.40.134	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.453408003 CET	1.1.1.1	192.168.2.4	0x18c1	No error (0)	td.doubleclick.net		142.250.65.226	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.470464945 CET	1.1.1.1	192.168.2.4	0xc7fc	No error (0)	4711400.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554393053 CET	1.1.1.1	192.168.2.4	0x1ade	No error (0)	youtube-ui.l.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.55	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554538012 CET	1.1.1.1	192.168.2.4	0x41c7	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554948092 CET	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.554948092 CET	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:51.555185080 CET	1.1.1.1	192.168.2.4	0x251d	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:51.971218109 CET	1.1.1.1	192.168.2.4	0xc21d	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 22, 2024 13:07:51.971302986 CET	1.1.1.1	192.168.2.4	0xdff3	No error (0)	ad.doubleclick.net		142.251.32.102	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.251.40.214	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.251.40.246	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.251.40.182	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.251.41.22	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.80.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.65.246	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.176.214	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.64.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.81.246	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		172.217.165.150	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.068413973 CET	1.1.1.1	192.168.2.4	0x158f	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.091877937 CET	1.1.1.1	192.168.2.4	0x86c0	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.091877937 CET	1.1.1.1	192.168.2.4	0x86c0	No error (0)	star-mini.c10r.facebook.com		31.13.71.36	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.092099905 CET	1.1.1.1	192.168.2.4	0x5541	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.176234961 CET	1.1.1.1	192.168.2.4	0xdbd1	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.176234961 CET	1.1.1.1	192.168.2.4	0xdbd1	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.176984072 CET	1.1.1.1	192.168.2.4	0x88c	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.285051107 CET	1.1.1.1	192.168.2.4	0x4ac3	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:52.287177086 CET	1.1.1.1	192.168.2.4	0x3ae7	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.717907906 CET	1.1.1.1	192.168.2.4	0xe0ce	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.718657970 CET	1.1.1.1	192.168.2.4	0x198a	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:52.718657970 CET	1.1.1.1	192.168.2.4	0x198a	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:54.893310070 CET	1.1.1.1	192.168.2.4	0x9fab	No error (0)	www.google.com		142.251.40.196	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:54.894737005 CET	1.1.1.1	192.168.2.4	0xdbab	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.40.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.65.246	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.64.86	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		172.217.165.150	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.64.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.81.246	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.40.182	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.35.182	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.40.150	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:55.117753029 CET	1.1.1.1	192.168.2.4	0x3d26	No error (0)	i.ytimg.com		142.251.41.22	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	www.youtube-nocookie.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.905900002 CET	1.1.1.1	192.168.2.4	0xeb6	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:57.906246901 CET	1.1.1.1	192.168.2.4	0x12e3	No error (0)	www.youtube-nocookie.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:57.906246901 CET	1.1.1.1	192.168.2.4	0x12e3	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Feb 22, 2024 13:07:57.944637060 CET	1.1.1.1	192.168.2.4	0xd446	No error (0)	x5qohxtiidpyczoxhekq-f-3f33cf437-clientnsv4-s.akamaihd.net	x5qohxtiidpyczoxhekq-f-3f33cf437.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:57.944637060 CET	1.1.1.1	192.168.2.4	0xd446	No error (0)	x5qohxtiidpyczoxhekq-f-3f33cf437.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:58.011250973 CET	1.1.1.1	192.168.2.4	0xe8ea	No error (0)	x5qohxtiidpyczoxhekq-f-3f33cf437-clientnsv4-s.akamaihd.net	x5qohxtiidpyczoxhekq-f-3f33cf437.ipv4-only.cname.clienttons.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:58.011250973 CET	1.1.1.1	192.168.2.4	0xe8ea	No error (0)	x5qohxtiidpyczoxhekq-f-3f33cf437.ipv4-only.cname.clienttons.com	a248.b.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:58.431721926 CET	1.1.1.1	192.168.2.4	0xb43	No error (0)	173bf109.akstat.io	wildcard46.akstat.io.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:58.432243109 CET	1.1.1.1	192.168.2.4	0xe431	No error (0)	173bf109.akstat.io	wildcard46.akstat.io.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:59.686513901 CET	1.1.1.1	192.168.2.4	0xf675	No error (0)	v7event.stats.avast.com	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:59.686513901 CET	1.1.1.1	192.168.2.4	0xf675	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:07:59.686513901 CET	1.1.1.1	192.168.2.4	0xf675	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:07:59.696512938 CET	1.1.1.1	192.168.2.4	0x721d	No error (0)	iavs9x.u.avcdn.net	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:04.028862000 CET	1.1.1.1	192.168.2.4	0x38b1	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:04.028862000 CET	1.1.1.1	192.168.2.4	0x38b1	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:04.028862000 CET	1.1.1.1	192.168.2.4	0x38b1	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:06.270459890 CET	1.1.1.1	192.168.2.4	0x8d59	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:06.270459890 CET	1.1.1.1	192.168.2.4	0x8d59	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:06.360413074 CET	1.1.1.1	192.168.2.4	0xb184	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:06.481020927 CET	1.1.1.1	192.168.2.4	0x5e4b	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:06.481020927 CET	1.1.1.1	192.168.2.4	0x5e4b	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:08.706057072 CET	1.1.1.1	192.168.2.4	0x2da1	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:08.706057072 CET	1.1.1.1	192.168.2.4	0x2da1	No error (0)	clients.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Feb 22, 2024 13:08:08.706957102 CET	1.1.1.1	192.168.2.4	0x3b6a	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.436677933 CET	8.8.8.8	192.168.2.4	0x5eb5	No error (0)	b8003600.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.438153982 CET	8.8.8.8	192.168.2.4	0x1ecc	No error (0)	b8003600.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.438978910 CET	8.8.8.8	192.168.2.4	0x9d05	No error (0)	n4291289.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.443325996 CET	8.8.8.8	192.168.2.4	0x75cf	No error (0)	p1043812.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.444710970 CET	8.8.8.8	192.168.2.4	0x5fe2	No error (0)	n4291289.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.445645094 CET	8.8.8.8	192.168.2.4	0x2379	No error (0)	p1043812.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.446115017 CET	8.8.8.8	192.168.2.4	0x8355	No error (0)	r9319236.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.447084904 CET	8.8.8.8	192.168.2.4	0x28f5	No error (0)	r9319236.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.449050903 CET	8.8.8.8	192.168.2.4	0x4d02	No error (0)	s-iavs9x.avcdn.net	fallbackupdates.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.450201035 CET	8.8.8.8	192.168.2.4	0xe7a1	No error (0)	y9830512.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.454452991 CET	8.8.8.8	192.168.2.4	0x7940	No error (0)	y9830512.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.455573082 CET	8.8.8.8	192.168.2.4	0xdf10	No error (0)	s-iavs9x.avcdn.net	fallbackupdates.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.626856089 CET	8.8.8.8	192.168.2.4	0x2f40	No error (0)	b8003600.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.627087116 CET	8.8.8.8	192.168.2.4	0xb465	No error (0)	b8003600.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.627563000 CET	8.8.8.8	192.168.2.4	0xbdb9	No error (0)	n4291289.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.631280899 CET	8.8.8.8	192.168.2.4	0x7bd8	No error (0)	n4291289.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.632447958 CET	8.8.8.8	192.168.2.4	0x2fb8	No error (0)	p1043812.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.632931948 CET	8.8.8.8	192.168.2.4	0x8e93	No error (0)	r9319236.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.635288000 CET	8.8.8.8	192.168.2.4	0x8aa3	No error (0)	r9319236.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.635535955 CET	8.8.8.8	192.168.2.4	0xecfd	No error (0)	s-iavs9x.avcdn.net	fallbackupdates.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.635973930 CET	8.8.8.8	192.168.2.4	0x1e5e	No error (0)	y9830512.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.636917114 CET	8.8.8.8	192.168.2.4	0xf3af	No error (0)	p1043812.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.637172937 CET	8.8.8.8	192.168.2.4	0xd2af	No error (0)	s-iavs9x.avcdn.net	fallbackupdates.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 22, 2024 13:08:09.641740084 CET	8.8.8.8	192.168.2.4	0xf0ec	No error (0)	y9830512.iavs9x.u.avast.com	iavs9x4.u.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50331	34.117.223.223	80	5336	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe

Timestamp	Bytes transferred	Direction	Data
Feb 22, 2024 13:07:59.825218916 CET	177	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: Avast Microstub/2.1 Content-Length: 267 Host: v7event.stats.avast.com
Feb 22, 2024 13:07:59.825254917 CET	267	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 0a 65 64 69 74 69 6f 6e 3d 31 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 73 74 61 72 74 0a 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31 46 36 41 43 Data Ascii: cookie=mmm_ava_esg_000_361_medition=1event=microstub-startmidex=3F5C7CD44D1F6AC769934CADA267B4DFC777705D72F58523FF8B390E5CC9035Bstat_session=c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1estatsSendTime=1708603678os=win,10,0,2,19045,0,AMD64exe_vers
Feb 22, 2024 13:07:59.988372087 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 22 Feb 2024 12:07:59 GMT Via: 1.1 google
Feb 22, 2024 13:08:01.780812979 CET	177	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: Avast Microstub/2.1 Content-Length: 281 Host: v7event.stats.avast.com
Feb 22, 2024 13:08:01.780812979 CET	281	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 0a 65 64 69 74 69 6f 6e 3d 31 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 64 6f 77 6e 6c 6f 61 64 0a 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31 46 Data Ascii: cookie=mmm_ava_esg_000_361_medition=1event=microstub-downloadmidex=3F5C7CD44D1F6AC769934CADA267B4DFC777705D72F58523FF8B390E5CC9035Bstat_session=c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1estatsSendTime=1708603710os=win,10,0,2,19045,0,AMD64exe_v
Feb 22, 2024 13:08:01.945929050 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 22 Feb 2024 12:08:01 GMT Via: 1.1 google

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	142.250.80.110	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:39 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:39 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-gucNdkeposnTAN4Siyjsig' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 22 Feb 2024 12:06:39 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6261 X-Daystart: 14799 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:39 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 36 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 34 37 39 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6261" elapsed_seconds="14799"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-02-22 12:06:39 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-02-22 12:06:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	172.253.122.84	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:39 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:39 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-22 12:06:39 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 22 Feb 2024 12:06:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-iwyObs-gFH4xw8qN7xd2Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQBiIR6O8x_vrGMT-NA0YT8TALqLF_A" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:39 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-22 12:06:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:42 UTC	573	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:42 UTC	901	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:42 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85971ac25f9a43e7-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 2550 Cache-Control: public, max-age=86400 Expires: Fri, 23 Feb 2024 12:06:42 GMT Last-Modified: Thu, 20 Apr 2023 14:56:08 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: nZV4I5/fwHZhZNKDDJa7QA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 13b42d61-d01e-002c-3e0e-15d52c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-22 12:06:42 UTC	468	IN	Data Raw: 37 63 31 63 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 64 29 7b 66 6f 72 28 76 61 72 20 66 2c 61 2c 67 2c 62 2c 63 3d 5b 5d 2c 65 3d 30 3b 65 3c 78 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 68 3d 78 5b 65 5d 3b 69 66 28 68 2e 54 61 67 3d 3d 3d 64 29 7b 63 3d 68 2e 43 61 74 65 67 6f 72 79 49 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 28 66 3d 68 2e 54 61 67 2c 62 3d 67 3d 61 3d 76 6f 69 64 20 30 2c 61 3d 2d 31 21 3d 3d 28 62 3d 66 29 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 62 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 62 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 67 3d 61 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 61 2e 72 65 70 6c 61 63 65 Data Ascii: 7c1c!function(){function n(d){for(var f,a,g,b,c=[],e=0;e<x.length;e++){var h=x[e];if(h.Tag===d){c=h.CategoryId;break}var l=(f=h.Tag,b=g=a=void 0,a=-1!==(b=f).indexOf("http:")?b.replace("http:",""):b.replace("https:",""),-1!==(g=a.indexOf("?"))?a.replace
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 6b 2e 6c 65 6e 67 74 68 3f 6b 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 0a 76 2e 68 6f 73 74 6e 61 6d 65 7d 28 64 29 3b 41 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 6b 3d 3d 3d 72 7d 29 26 26 28 63 3d 5b 22 43 30 30 30 34 22 5d 29 7d 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 64 29 7b 72 65 74 75 72 6e 20 64 26 26 77 69 6e 64 6f 77 2e 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 26 26 64 2e 65 76 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 2d 31 21 3d 3d 77 69 6e 64 6f 77 2e 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 66 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 64 29 Data Ascii: exOf("www")\|\|2<k.length?k.slice(1).join("."):v.hostname}(d);A.some(function(k){return k===r})&&(c=["C0004"])}return c}function m(d){return d&&window.OptanonActiveGroups&&d.every(function(f){return-1!==window.OptanonActiveGroups.indexOf(f)})}function p(d)
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4b 51 5a 47 64 69 39 79 62 33 41 46 30 58 63 43 6f 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 62 68 2e 63 6f 6e 74 65 78 74 77 65 62 2e 63 6f 6d 2f 62 68 2f 72 74 73 65 74 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f Data Ascii: m.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEKQZGdi9yb3AF0XcCoAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://bh.contextweb.com/bh/rtset","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 44 62 4d 47 58 77 39 43 67 77 45 67 7a 72 5a 65 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 2e 74 72 69 62 61 6c 66 75 73 69 6f 6e 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 65 6d 62 65 64 2f 34 47 Data Ascii: "],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKDbMGXw9CgwEgzrZeAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s.tribalfusion.com/visitor","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/embed/4G
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 65 6d 69 75 6d 2d 73 65 63 75 72 69 74 79 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4c 5f 6a 44 4c 69 67 69 5f 39 51 45 49 73 6f 7a 6a 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 61 64 73 2e 73 74 69 63 6b 79 61 64 73 74 76 2e 63 6f 6d 2f 75 73 65 72 2d 72 65 67 69 73 74 Data Ascii: emium-security","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEL_jDLigi_9QEIsozjAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ads.stickyadstv.com/user-regist
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4c 5f 6a 44 4c 6f 42 4f 47 6c 41 45 37 4d 30 38 64 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 6c 2f 37 33 34 36 32 2f 32 30 32 30 2d 30 36 2d 30 31 2f 39 78 77 34 36 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 Data Ascii: C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEL_jDLoBOGlAE7M08dAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www3.avast.com/l/73462/2020-06-01/9xw46g","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://match
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4b 54 55 6a 36 33 6c 35 68 38 77 45 47 77 43 5a 5a 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 4e 53 42 43 48 33 42 75 71 67 46 70 31 55 31 6a 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 Data Ascii: tps://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEKTUj63l5h8wEGwCZZAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKNSBCH3BuqgFp1U1jAQA8kgE","CategoryId":["C0004"],"Vendor":nu
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4c 39 59 68 74 30 45 59 65 65 67 46 6f 64 37 62 69 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 69 62 2e 61 64 6e 78 73 2e 63 6f 6d 2f 73 65 74 75 69 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 Data Ascii: ryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEL9Yht0EYeegFod7biAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersy
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4c 39 59 68 74 37 78 62 57 79 67 46 65 55 4a 78 70 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 47 76 6e 61 4b 70 4f 5a 52 51 45 4a 54 6f 77 4a 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d Data Ascii: ://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEL9Yht7xbWygFeUJxpAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKGvnaKpOZRQEJTowJAQA8kgE","CategoryId":["C0004"],"Vendor":null}
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 6c 2f 37 33 34 36 32 2f 32 30 32 31 2d 30 31 2d 30 38 2f 63 37 72 74 6e 70 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 31 30 30 30 32 34 34 30 2f 77 65 62 2f 6a 2f 6a 71 75 65 72 79 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 33 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 Data Ascii: ":["C0004"],"Vendor":null},{"Tag":"https://www3.avast.com/l/73462/2021-01-08/c7rtnp","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static3.avast.com/10002440/web/j/jquery.js","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://dpm.demdex.net/ibs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:42 UTC	542	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:42 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:42 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: jEXNH7qItSS8Y+G7eM2k2w== Last-Modified: Wed, 21 Feb 2024 19:21:22 GMT x-ms-request-id: 5cf5fd61-301e-0046-343c-650d04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 12299 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971ac33963c47f-EWR
2024-02-22 12:06:42 UTC	554	IN	Data Raw: 35 32 36 63 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 2c 6f 2c 70 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 Data Ascii: 526cvar OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIAB
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d 5d 22 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 44 6f 6d 61 69 6e 49 64 3d 22 5b 5b 4e 65 77 44 6f 6d 61 69 6e 49 64 5d 5d 22 2c 74 68 Data Ascii: HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",th
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 65 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 74 2c 65 5d 29 2c 22 73 74 79 6c 65 Data Ascii: his.camelize(a[0])]=a[1].trim()}return e},e);function e(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=function(t,e){if("style"!==t.toLowerCase()&&o.apply(this,[t,e]),"style
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 28 69 3d 73 2e 77 69 6e 29 3f Data Ascii: oveGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];var i=null==(i=s.win)?
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 28 69 3d 6e 29 26 26 69 2e 6c 61 73 74 49 64 7c 7c 28 6e 2e 6c 61 73 74 49 64 3d 30 29 2c 6e 2e 6c 61 73 74 49 64 2b 2b 2c 6e 2e 65 76 65 6e 74 73 2e 70 Data Ascii: name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],null!=(i=n)&&i.lastId\|\|(n.lastId=0),n.lastId++,n.events.p
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 Data Ascii: ce=function(){this.nonce=p.stubScriptElement.nonce\|\|p.stubScriptElement.getAttribute("nonce")\|\|null},h.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL(),this.crossOrigin=p.stubScriptElement.getAttribute("crossorigin")\|\|null,this.pr
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 69 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 69 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 28 69 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 74 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 Data Ascii: ponse,this.setGeoLocation(i.countryCode,i.stateCode),this.addBannerSDKScript(t)):(i=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam))\|\|t.SkipGeolocation?(e=i.split(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScri
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 65 29 7b 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 3d 7b 63 6f 75 6e 74 72 79 3a 74 2c 73 74 61 74 65 3a 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 2c 6e 2c 61 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f Data Ascii: e){p.userLocation={country:t,state:e=void 0===e?"":e}},h.prototype.otFetch=function(t,i,e,n,a){void 0===e&&(e=!1),void 0===n&&(n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.o
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 6f 6e 2c 6f 3d 74 2e 52 75 6c 65 53 65 74 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 74 2e 44 65 66 61 75 6c 74 7d 29 3b 69 66 28 21 61 2e 63 6f 75 6e 74 72 79 26 26 21 61 2e 73 74 61 74 65 29 72 65 74 75 72 6e 20 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 3f 6f 5b 30 5d 3a 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 6c 3d 74 2e 52 75 Data Ascii: on,o=t.RuleSet.filter(function(t){return!0===t.Default});if(!a.country&&!a.state)return o&&0<o.length?o[0]:null;for(var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var l=t.Ru
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 74 43 6f 6f 6b 69 65 28 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 29 29 3a 70 2e 69 73 53 74 75 62 52 65 61 64 79 3d 21 31 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 69 64 61 74 65 49 41 42 47 44 50 52 41 70 70 6c 69 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 3b 74 3f 74 68 69 73 2e 69 73 42 6f 6f 6c 65 61 6e 28 74 29 3f 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 22 74 72 75 65 22 3d 3d 3d 74 3a 70 2e 6f 6e 65 Data Ascii: tCookie(p.oneTrustIABCookieName)):p.isStubReady=!1},h.prototype.validateIABGDPRApplied=function(){var t=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam).split(";")[0];t?this.isBoolean(t)?p.oneTrustIABgdprAppliesGlobally="true"===t:p.one

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49755	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:42 UTC	627	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:42 UTC	901	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:42 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85971ac61cca4257-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 1115 Cache-Control: public, max-age=86400 Expires: Fri, 23 Feb 2024 12:06:42 GMT Last-Modified: Thu, 20 Apr 2023 14:56:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 3nuR7fmf31a38AgcBfw1VQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a6cd087c-001e-0096-2cba-173052000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-22 12:06:42 UTC	468	IN	Data Raw: 31 39 36 65 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 36 2e 33 33 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 62 36 38 30 65 39 61 38 Data Ascii: 196e{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 22 49 64 22 3a 22 39 34 30 34 64 61 36 66 2d 65 31 62 32 2d 34 61 34 36 2d 39 34 37 36 2d 32 33 34 66 31 63 64 64 63 65 34 36 22 2c 22 4e 61 6d 65 22 3a 22 42 72 61 7a 69 6c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 62 72 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 Data Ascii: "Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"u
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 Data Ascii: i":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro"
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 6d 65 22 3a 22 41 76 61 73 74 20 e2 80 93 20 52 45 4a 45 43 54 20 41 4c 4c 20 e2 80 93 20 54 65 6d 70 6c 61 74 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 2c 7b 22 49 64 22 3a 22 34 36 61 37 31 64 37 36 2d 30 36 36 35 2d 34 62 66 34 2d 38 34 64 38 2d 33 35 34 63 36 30 33 35 35 39 39 37 22 2c 22 4e 61 6d 65 22 3a 22 47 4c 4f 42 41 4c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 6f 75 74 2c 20 4d 61 72 6b 65 74 69 6e 67 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 61 Data Ascii: me":"Avast REJECT ALL Template","Conditions":[],"GCEnable":false,"IsGPPEnabled":false},{"Id":"46a71d76-0665-4bf4-84d8-354c60355997","Name":"GLOBAL All Opt-out, Marketing Opt-in","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","a
2024-02-22 12:06:42 UTC	1369	IN	Data Raw: 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 3a 22 72 6f 22 2c 22 68 65 22 3a 22 68 65 22 2c 22 64 61 22 3a 22 64 61 22 2c 22 74 72 22 3a 22 74 72 22 2c 22 6e 6c 22 3a 22 6e 6c 22 7d 2c 22 42 61 Data Ascii: CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"Ba
2024-02-22 12:06:42 UTC	574	IN	Data Raw: 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 7d 2c 22 49 73 53 75 70 70 72 65 73 73 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 49 73 53 75 70 70 72 65 73 73 50 43 22 3a 66 61 6c 73 65 2c 22 50 75 62 6c 69 73 68 65 72 43 43 22 3a 22 44 45 22 2c Data Ascii: GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true},"IsSuppressBanner":false,"IsSuppressPC":false,"PublisherCC":"DE",
2024-02-22 12:06:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:43 UTC	559	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:43 UTC	699	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1098 x-amz-id-2: /l2vXuJ96Gxd78jQ3f/Fgh2kiqjAxlz0DDng1PUJwyowjHc5WcNtAttruM2p5WlL0B/Wle9077U= x-amz-request-id: 7Y3TQ0BS7F9HVRCN Last-Modified: Sun, 13 Aug 2023 08:54:50 GMT ETag: "9975a534a66e6e60fea127a62c73d6c7" x-amz-server-side-encryption: AES256 Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Cache-Control: max-age=0,must-revalidate Accept-Ranges: bytes Date: Thu, 22 Feb 2024 12:06:43 GMT Via: 1.1 varnish Age: 0 X-Served-By: cache-lga21936-LGA X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1708603603.402452,VS0,VE348 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600
2024-02-22 12:06:43 UTC	1098	IN	Data Raw: 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 4b 41 4d 50 59 4c 45 5f 45 4d 42 45 44 29 7b 77 69 6e 64 6f 77 2e 4b 41 4d 50 59 4c 45 5f 45 4d 42 45 44 3d 7b 6b 61 6d 70 79 6c 65 49 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 74 2e 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 74 2e 61 73 79 6e 63 3d 74 72 75 65 3b 74 2e 73 72 63 3d 4b 41 4d 50 59 4c 45 5f 45 4d 42 45 44 2e 67 65 74 47 65 6e 65 72 69 63 4c 6f 63 61 74 69 6f 6e 28 29 3b 74 2e 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 3b 7d 2c 6b 61 6d 70 Data Ascii: (function(){if(!window.KAMPYLE_EMBED){window.KAMPYLE_EMBED={kampyleInit:function(){var t=document.createElement('script');t.type='text/javascript';t.async=true;t.src=KAMPYLE_EMBED.getGenericLocation();t.charset='UTF-8';document.body.appendChild(t);},kamp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49767	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:44 UTC	593	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:44 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:44 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971acd88aa42c6-EWR
2024-02-22 12:06:44 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49778	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:44 UTC	551	OUT	GET /scripttemplates/6.33.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:44 UTC	814	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:44 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: snqI9a2h7X2bbSiony0guw== Last-Modified: Wed, 13 Apr 2022 01:38:27 GMT x-ms-request-id: 80039c49-c01e-0089-5a19-158356000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1459 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971ad10f7d8ca8-EWR
2024-02-22 12:06:44 UTC	555	IN	Data Raw: 37 63 37 33 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 36 2e 33 33 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 6f 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 29 Data Ascii: 7c73/** * onetrust-banner-sdk * v6.33.0 * by OneTrust LLC * Copyright 2022 */!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 72 28 6c 2e 6e 65 78 74 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 74 72 79 7b 72 28 6c 2e 74 68 72 6f 77 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 74 29 7b 74 2e 64 6f 6e 65 3f 65 28 74 2e 76 61 6c 75 65 29 3a 6e 65 77 20 61 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 2e 76 61 6c 75 65 29 7d 29 2e 74 68 65 6e 28 6f 2c 6e 29 7d 72 28 28 6c 3d 6c 2e 61 70 70 6c 79 28 73 2c 69 7c 7c 5b 5d 29 29 2e 6e 65 78 74 28 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 6f 2c 6e 29 7b 76 61 72 20 72 2c 73 2c 69 2c 65 2c 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 Data Ascii: (function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(s,i\|\|[])).next())})}function h(o,n){var r,s,i,e,a={label:0,se
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 2c 72 3d 30 3b 66 6f 72 28 74 3d 30 3b 74 3c 6f 3b 74 2b 2b 29 66 6f 72 28 76 61 72 20 73 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 2c 69 3d 30 2c 61 3d 73 2e 6c 65 6e 67 74 68 3b 69 3c 61 3b 69 2b 2b 2c 72 2b 2b 29 6e 5b 72 5d 3d 73 5b 69 5d 3b 72 65 74 75 72 6e 20 6e 7d 28 65 3d 76 3d 76 7c 7c 7b 7d 29 5b 65 2e 41 43 54 49 56 45 3d 30 5d 3d 22 41 43 54 49 56 45 22 2c 65 5b 65 2e 41 4c 57 41 59 53 5f 41 43 54 49 56 45 3d 31 5d 3d 22 41 4c 57 41 59 53 5f 41 43 54 49 56 45 22 2c 65 5b 65 2e 45 58 50 49 52 45 44 3d 32 5d 3d 22 45 58 50 49 52 45 44 22 2c 65 5b 65 2e 4e 4f 5f 43 4f 4e 53 45 4e 54 3d 33 5d 3d 22 4e 4f 5f 43 4f 4e 53 45 4e 54 22 2c 65 5b 65 2e 4f 50 54 5f 4f 55 54 3d 34 5d 3d 22 4f 50 54 5f 4f 55 54 22 2c 65 5b 65 2e 50 45 4e 44 49 4e 47 3d 35 5d Data Ascii: ,r=0;for(t=0;t<o;t++)for(var s=arguments[t],i=0,a=s.length;i<a;i++,r++)n[r]=s[i];return n}(e=v=v\|\|{})[e.ACTIVE=0]="ACTIVE",e[e.ALWAYS_ACTIVE=1]="ALWAYS_ACTIVE",e[e.EXPIRED=2]="EXPIRED",e[e.NO_CONSENT=3]="NO_CONSENT",e[e.OPT_OUT=4]="OPT_OUT",e[e.PENDING=5]
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 64 69 61 74 65 46 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 68 61 6e 64 6c 65 64 7c 7c 73 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 28 65 2e 5f 76 61 6c 75 65 29 7d 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6f 3d 65 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 69 28 65 2c 65 2e 5f 64 65 66 65 72 72 65 64 73 5b 74 5d 29 3b 65 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6f 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 6e 75 6c 6c 2c 74 68 69 73 2e 6f 6e 52 65 6a 65 63 74 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 6e 75 6c 6c 2c Data Ascii: diateFn(function(){e._handled\|\|s._unhandledRejectionFn(e._value)});for(var t=0,o=e._deferreds.length;t<o;t++)i(e,e._deferreds[t]);e._deferreds=null}function p(e,t,o){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null,
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 63 28 72 29 29 72 65 74 75 72 6e 20 74 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 6f 3d 30 2c 6e 3d 72 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 73 2e 72 65 73 6f 6c 76 65 28 72 5b 6f 5d 29 2e 74 68 65 6e 28 65 2c 74 29 7d 29 7d 2c 73 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 65 74 49 6d 6d 65 64 69 61 74 65 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 65 2c 30 29 7d 2c 73 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f Data Ascii: unction(e,t){if(!c(r))return t(new TypeError("Promise.race accepts an array"));for(var o=0,n=r.length;o<n;o++)s.resolve(r[o]).then(e,t)})},s._immediateFn="function"==typeof setImmediate?function(e){setImmediate(e)}:function(e){t(e,0)},s._unhandledRejectio
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 43 6c 6f 73 65 73 74 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 7c 7c 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 Data Ascii: ith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable:!0,configurable:!0})},y.prototype.initClosestPolyfill=function(){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototyp
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 6e 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 6e 2c 6f 29 2c 73 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 76 6f 69 64 20 30 3d 3d 3d 73 3f 6f 3a 73 3e 3e 30 2c 61 3d 69 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 69 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 69 2c 6f 29 3b 72 3c 61 3b 29 74 5b 72 5d 3d 65 2c 72 2b 2b 3b 72 65 74 75 72 6e 20 74 7d 7d 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 Data Ascii: hrow new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max(o+n,0):Math.min(n,o),s=arguments[2],i=void 0===s?o:s>>0,a=i<0?Math.max(o+i,0):Math.min(i,o);r<a;)t[r]=e,r++;return t}})},y.prototype.i
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 2e 42 61 6e 6e 65 72 3d 30 5d 3d 22 42 61 6e 6e 65 72 22 2c 49 5b 49 2e 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 3d 31 5d 3d 22 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 22 2c 49 5b 49 2e 56 65 6e 64 6f 72 4c 69 73 74 3d 32 5d 3d 22 56 65 6e 64 6f 72 4c 69 73 74 22 2c 49 5b 49 2e 43 6f 6f 6b 69 65 4c 69 73 74 3d 33 5d 3d 22 43 6f 6f 6b 69 65 4c 69 73 74 22 2c 28 5f 3d 4c 3d 4c 7c 7c 7b 7d 29 5b 5f 2e 52 69 67 68 74 41 72 72 6f 77 3d 33 39 5d 3d 22 52 69 67 68 74 41 72 72 6f 77 22 2c 5f 5b 5f 2e 4c 65 66 74 41 72 72 6f 77 3d 33 37 5d 3d 22 4c 65 66 74 41 72 72 6f 77 22 2c 28 77 3d 45 3d 45 7c 7c 7b 7d 29 2e 41 66 74 65 72 54 69 74 6c 65 3d 22 41 66 74 65 72 54 69 74 6c 65 22 2c 77 2e 41 66 74 65 72 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 41 66 74 65 72 44 Data Ascii: .Banner=0]="Banner",I[I.PrefCenterHome=1]="PrefCenterHome",I[I.VendorList=2]="VendorList",I[I.CookieList=3]="CookieList",(_=L=L\|\|{})[_.RightArrow=39]="RightArrow",_[_.LeftArrow=37]="LeftArrow",(w=E=E\|\|{}).AfterTitle="AfterTitle",w.AfterDescription="AfterD
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 6f 72 3d 31 5d 3d 22 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 22 2c 5a 5b 5a 2e 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 3d 32 5d 3d 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 22 2c 28 74 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 74 65 2e 44 61 79 73 3d 31 5d 3d 22 44 61 79 73 22 2c 74 65 5b 74 65 2e 57 65 65 6b 73 3d 37 5d 3d 22 57 65 65 6b 73 22 2c 74 65 5b 74 65 2e 4d 6f 6e 74 68 73 3d 33 30 5d 3d 22 4d 6f 6e 74 68 73 22 2c 74 65 5b 74 65 2e 59 65 61 72 73 3d 33 36 35 5d 3d 22 59 65 61 72 73 22 2c 28 6e 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 43 68 65 63 6b 62 6f 78 3d 22 43 68 65 63 6b 62 6f 78 22 2c 6e 65 2e 54 6f 67 67 6c 65 3d 22 54 6f 67 67 6c 65 22 2c 28 73 65 3d 72 65 3d 72 65 7c 7c 7b 7d 29 2e 53 6c 69 64 65 49 6e 3d 22 53 6c 69 64 65 5f 49 6e 22 2c 73 65 Data Ascii: or=1]="GoogleVendor",Z[Z.GeneralVendor=2]="GeneralVendor",(te=ee=ee\|\|{})[te.Days=1]="Days",te[te.Weeks=7]="Weeks",te[te.Months=30]="Months",te[te.Years=365]="Years",(ne=oe=oe\|\|{}).Checkbox="Checkbox",ne.Toggle="Toggle",(se=re=re\|\|{}).SlideIn="Slide_In",se
2024-02-22 12:06:44 UTC	1369	IN	Data Raw: 3d 22 54 45 53 54 22 2c 48 65 3d 22 4c 4f 43 41 4c 5f 54 45 53 54 22 2c 46 65 3d 22 64 61 74 61 2d 6c 61 6e 67 75 61 67 65 22 2c 52 65 3d 22 6f 74 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 42 75 74 74 6f 6e 2e 6a 73 6f 6e 22 2c 71 65 3d 22 6f 74 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 42 75 74 74 6f 6e 52 74 6c 2e 6a 73 6f 6e 22 2c 4d 65 3d 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 55 65 3d 22 6f 74 46 6c 61 74 22 2c 6a 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 43 6f 72 6e 65 72 22 2c 7a 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 46 6c 61 74 22 2c 4b 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 49 63 6f 6e 22 2c 57 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 22 2c 4a 65 3d 22 6f 74 43 68 6f 69 63 Data Ascii: ="TEST",He="LOCAL_TEST",Fe="data-language",Re="otCookieSettingsButton.json",qe="otCookieSettingsButtonRtl.json",Me="otCenterRounded",Ue="otFlat",je="otFloatingRoundedCorner",ze="otFloatingFlat",Ke="otFloatingRoundedIcon",We="otFloatingRounded",Je="otChoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49780	3.225.167.6	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:44 UTC	713	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1708603603112 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:44 UTC	816	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:44 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: 1806FexMRQQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.avast.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-2-v055-0b2d65edf.edge-va6.demdex.com 1 ms set-cookie: demdex=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:44 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-22 12:06:44 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 36 31 38 35 36 39 34 36 32 34 35 36 31 36 31 30 39 36 34 32 32 39 32 35 31 38 35 30 34 39 30 35 32 36 31 35 33 33 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"61856946245616109642292518504905261533","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	20.50.2.44	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	1039	OUT	GET /api/mhubc.js HTTP/1.1 Host: mstatic.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CvVersion%7C5.5.0; apex__avastLocale=en-us; sourceCodeCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; trafficSourceCodeCookie=006_a8b; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m
2024-02-22 12:06:45 UTC	304	IN	HTTP/1.1 200 OK Content-Length: 280364 Connection: close Content-Type: application/javascript; charset=utf-8 Date: Thu, 22 Feb 2024 12:06:44 GMT Cache-Control: public, max-age=86400, private Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Robots-Tag: noindex,nofollow
2024-02-22 12:06:45 UTC	3595	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 61 70 69 55 72 6c 29 7b 0d 0a 77 69 6e 64 6f 77 2e 6d 68 75 62 63 3d 7b 61 64 73 3a 5b 5d 2c 70 75 73 68 3a 66 75 6e 63 74 69 6f 6e 28 75 29 7b 77 69 6e 64 6f 77 2e 6d 68 75 62 63 2e 71 75 65 75 65 2e 70 75 73 68 28 75 29 7d 2c 71 75 65 75 65 3a 77 69 6e 64 6f 77 2e 6d 68 75 62 63 26 26 77 69 6e 64 6f 77 2e 6d 68 75 62 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 77 69 6e 64 6f 77 2e 6d 68 75 62 63 3a 5b 5d 7d 3b 76 61 72 20 75 74 69 6c 3d 7b 64 65 66 69 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 75 2c 6f 2c 74 29 7b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 74 69 6c 2e 6d 6f 64 75 6c 65 73 5b 75 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 6f 2e Data Ascii: (function(apiUrl){window.mhubc={ads:[],push:function(u){window.mhubc.queue.push(u)},queue:window.mhubc&&window.mhubc instanceof Array?window.mhubc:[]};var util={define:function(u,o,t){window.setTimeout((function(){var e=util.modules[u]=function(){},i=o.
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 79 2e 63 61 6c 6c 28 6f 2c 65 29 3f 74 3d 6f 5b 65 5d 3a 72 26 26 76 6f 69 64 20 30 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 65 29 26 26 28 74 3d 72 5b 65 5d 29 7d 72 65 74 75 72 6e 20 74 7d 2c 67 6f 6f 67 2e 46 45 41 54 55 52 45 53 45 54 5f 59 45 41 52 3d 32 30 31 32 2c 67 6f 6f 67 2e 44 45 42 55 47 3d 21 30 2c 67 6f 6f 67 2e 4c 4f 43 41 4c 45 3d 22 65 6e 22 2c 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 53 49 54 45 3d 21 30 2c 67 6f 6f 67 2e 53 54 52 49 43 54 5f 4d 4f 44 45 5f 43 4f 4d 50 41 54 49 42 4c 45 3d 21 31 2c 67 6f 6f 67 2e 44 49 53 41 4c 4c 4f 57 5f 54 45 53 54 5f 4f 4e 4c 59 5f 43 4f 44 45 3d 43 4f 4d 50 49 4c 45 44 26 26 21 67 Data Ascii: y.call(o,e)?t=o[e]:r&&void 0===r.nodeType&&Object.prototype.hasOwnProperty.call(r,e)&&(t=r[e])}return t},goog.FEATURESET_YEAR=2012,goog.DEBUG=!0,goog.LOCALE="en",goog.TRUSTED_SITE=!0,goog.STRICT_MODE_COMPATIBLE=!1,goog.DISALLOW_TEST_ONLY_CODE=COMPILED&&!g
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 6f 72 77 61 72 64 44 65 63 6c 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 7d 2c 43 4f 4d 50 49 4c 45 44 7c 7c 28 67 6f 6f 67 2e 69 73 50 72 6f 76 69 64 65 64 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 20 67 6f 6f 67 2e 6c 6f 61 64 65 64 4d 6f 64 75 6c 65 73 5f 7c 7c 21 67 6f 6f 67 2e 69 6d 70 6c 69 63 69 74 4e 61 6d 65 73 70 61 63 65 73 5f 5b 65 5d 26 26 6e 75 6c 6c 21 3d 67 6f 6f 67 2e 67 65 74 4f 62 6a 65 63 74 42 79 4e 61 6d 65 28 65 29 7d 2c 67 6f 6f 67 2e 69 6d 70 6c 69 63 69 74 4e 61 6d 65 73 70 61 63 65 73 5f 3d 7b 22 67 6f 6f 67 2e 6d 6f 64 75 6c 65 22 3a 21 30 7d 29 2c 67 6f 6f 67 2e 67 65 74 4f 62 6a 65 63 74 42 79 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 65 2e 73 70 6c 69 74 28 22 2e 22 Data Ascii: orwardDeclare=function(e){},COMPILED\|\|(goog.isProvided_=function(e){return e in goog.loadedModules_\|\|!goog.implicitNamespaces_[e]&&null!=goog.getObjectByName(e)},goog.implicitNamespaces_={"goog.module":!0}),goog.getObjectByName=function(e,t){e=e.split("."
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 72 65 74 75 72 6e 22 61 72 72 61 79 22 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 29 72 65 74 75 72 6e 20 74 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 57 69 6e 64 6f 77 5d 22 3d 3d 6f 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 6f 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 65 2e 73 70 6c 69 63 65 26 26 76 6f 69 64 20 30 21 3d 3d 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 26 26 21 65 2e 70 72 6f Data Ascii: f(e instanceof Array)return"array";if(e instanceof Object)return t;var o=Object.prototype.toString.call(e);if("[object Window]"==o)return"object";if("[object Array]"==o\|\|"number"==typeof e.length&&void 0!==e.splice&&void 0!==e.propertyIsEnumerable&&!e.pro
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 65 2e 73 75 70 65 72 43 6c 61 73 73 5f 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 6f 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 2c 65 2e 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 72 29 7b 66 6f 72 28 76 61 72 20 73 3d 41 72 72 61 79 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 32 29 2c 6e 3d 32 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 73 5b 6e 2d 32 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 5b 6f 5d 2e 61 70 70 6c 79 28 65 2c 73 29 7d 7d 2c 67 Data Ascii: e,t){function o(){}o.prototype=t.prototype,e.superClass_=t.prototype,e.prototype=new o,e.prototype.constructor=e,e.base=function(e,o,r){for(var s=Array(arguments.length-2),n=2;n<arguments.length;n++)s[n-2]=arguments[n];return t.prototype[o].apply(e,s)}},g
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 75 72 6e 21 21 74 68 69 73 2e 72 65 71 75 69 72 65 73 54 72 61 6e 73 70 69 6c 61 74 69 6f 6e 5f 5b 65 5d 7c 7c 21 28 21 67 6f 6f 67 2e 69 6e 48 74 6d 6c 44 6f 63 75 6d 65 6e 74 5f 28 29 7c 7c 22 65 73 36 22 21 3d 74 7c 7c 22 6e 6f 4d 6f 64 75 6c 65 22 69 6e 20 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 6b 6e 6f 77 6e 20 6c 61 6e 67 75 61 67 65 20 6d 6f 64 65 3a 20 22 2b 65 29 7d 2c 67 6f 6f 67 2e 54 72 61 6e 73 70 69 6c 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 61 6e 73 70 69 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 67 6f 6f 67 2e 74 72 61 6e 73 70 69 6c 65 5f 28 65 2c 74 2c 74 68 69 Data Ascii: urn!!this.requiresTranspilation_[e]\|\|!(!goog.inHtmlDocument_()\|\|"es6"!=t\|\|"noModule"in goog.global.document.createElement("script"));throw Error("Unknown language mode: "+e)},goog.Transpiler.prototype.transpile=function(e,t){return goog.transpile_(e,t,thi
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 68 5f 3f 74 68 69 73 2e 69 64 54 6f 50 61 74 68 5f 5b 65 5d 3a 65 20 69 6e 20 74 68 69 73 2e 64 65 70 65 6e 64 65 6e 63 69 65 73 5f 3f 65 3a 6e 75 6c 6c 7d 2c 67 6f 6f 67 2e 44 65 62 75 67 4c 6f 61 64 65 72 5f 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 66 65 72 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 64 65 66 65 72 72 65 64 43 61 6c 6c 62 61 63 6b 73 5f 5b 65 2e 70 61 74 68 5d 3d 74 2c 74 68 69 73 2e 64 65 66 65 72 72 65 64 51 75 65 75 65 5f 2e 70 75 73 68 28 65 2e 70 61 74 68 29 7d 2c 67 6f 6f 67 2e 4c 6f 61 64 43 6f 6e 74 72 6f 6c 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 67 6f 6f 67 2e 4c 6f 61 64 43 6f 6e 74 72 6f 6c 6c 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 70 61 75 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 67 6f 6f Data Ascii: h_?this.idToPath_[e]:e in this.dependencies_?e:null},goog.DebugLoader_.prototype.defer_=function(e,t){this.deferredCallbacks_[e.path]=t,this.deferredQueue_.push(e.path)},goog.LoadController=function(){},goog.LoadController.prototype.pause=function(){},goo
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 77 72 69 74 65 28 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 3f 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 2e 63 72 65 61 74 65 48 54 4d 4c 28 65 29 3a 65 29 7d 3b 67 6f 6f 67 2e 44 65 70 65 6e 64 65 6e 63 79 2e 64 65 66 65 72 5f 3d 21 30 7d 65 6c 73 65 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 29 7b 76 61 72 20 72 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 64 65 66 65 72 3d 21 30 2c 72 2e 61 73 79 6e 63 3d 21 31 2c 72 2e 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 2c 72 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 2c 21 30 29 3b 76 61 72 20 73 3d 67 6f 6f 67 2e 67 65 74 53 63 72 69 70 74 4e 6f 6e 63 65 28 29 Data Ascii: write(goog.TRUSTED_TYPES_POLICY_?goog.TRUSTED_TYPES_POLICY_.createHTML(e):e)};goog.Dependency.defer_=!0}else r=function(e,o){var r=t.createElement("script");r.defer=!0,r.async=!1,r.type="module",r.setAttribute("crossorigin",!0);var s=goog.getScriptNonce()
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 74 72 61 6e 73 66 6f 72 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 65 64 73 54 72 61 6e 73 70 69 6c 65 5f 26 26 28 65 3d 74 68 69 73 2e 74 72 61 6e 73 70 69 6c 65 72 5f 2e 74 72 61 6e 73 70 69 6c 65 28 65 2c 74 68 69 73 2e 67 65 74 50 61 74 68 4e 61 6d 65 28 29 29 29 2c 67 6f 6f 67 2e 4c 4f 41 44 5f 4d 4f 44 55 4c 45 5f 55 53 49 4e 47 5f 45 56 41 4c 26 26 76 6f 69 64 20 30 21 3d 3d 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 4a 53 4f 4e 3f 22 67 6f 6f 67 2e 6c 6f 61 64 4d 6f 64 75 6c 65 28 22 2b 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 2b 22 5c 6e 2f 2f 23 20 73 6f 75 72 63 65 55 52 4c 3d 22 2b 74 68 69 73 2e 70 61 74 68 2b 22 5c 6e 22 29 2b 22 29 3b 22 3a Data Ascii: ototype.transform=function(e){return this.needsTranspile_&&(e=this.transpiler_.transpile(e,this.getPathName())),goog.LOAD_MODULE_USING_EVAL&&void 0!==goog.global.JSON?"goog.loadModule("+goog.global.JSON.stringify(e+"\n//# sourceURL="+this.path+"\n")+");":
2024-02-22 12:06:45 UTC	4096	IN	Data Raw: 5d 3a 65 5b 74 5d 3d 6f 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 73 65 74 57 69 74 68 52 65 74 75 72 6e 56 61 6c 75 65 49 66 4e 6f 74 53 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 65 5b 74 5d 3a 28 6f 3d 6f 28 29 2c 65 5b 74 5d 3d 6f 29 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 65 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 65 29 69 66 28 21 28 6f 20 69 6e 20 74 29 7c 7c 65 5b 6f 5d 21 3d 3d 74 5b 6f 5d 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 29 69 66 28 21 28 72 20 69 6e 20 65 29 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 63 6c 6f 6e 65 3d 66 75 6e 63 74 69 6f Data Ascii: ]:e[t]=o},goog.object.setWithReturnValueIfNotSet=function(e,t,o){return t in e?e[t]:(o=o(),e[t]=o)},goog.object.equals=function(e,t){for(var o in e)if(!(o in t)\|\|e[o]!==t[o])return!1;for(var r in t)if(!(r in e))return!1;return!0},goog.object.clone=functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49782	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	630	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:45 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:45 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85971ad5ec6e0c94-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 77929 Cache-Control: public, max-age=86400 Expires: Fri, 23 Feb 2024 12:06:45 GMT Last-Modified: Thu, 20 Apr 2023 14:56:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: TxtfAP2G8zKYHm9R69+ggQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: dd7841d4-b01e-0048-63f2-1d24b4000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-22 12:06:45 UTC	467	IN	Data Raw: 37 63 31 62 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 50 72 69 76 61 63 79 20 70 72 65 Data Ascii: 7c1b{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy pre
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 20 59 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 73 65 74 74 69 6e 67 73 20 62 65 6c 6f 77 2e 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 9c 43 6f 6e 66 69 72 6d 20 73 65 6c 65 63 74 69 6f 6e e2 80 9d 20 79 6f 75 20 61 67 72 65 65 20 77 69 74 68 20 74 68 65 20 63 75 72 72 65 6e 74 20 73 65 74 74 69 6e 67 73 2e 20 53 65 65 26 6e 62 73 70 3b 22 2c 22 41 62 6f 75 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 70 6f 6c 69 63 79 22 2c 22 41 62 6f 75 74 43 6f 6f 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 63 63 65 70 74 20 61 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 Data Ascii: You can manage cookie settings below. By clicking Confirm selection you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUse
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 44 65 74 61 69 6c 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6e 73 65 6e 74 20 73 65 74 74 69 6e 67 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 49 6e 66 6f 53 63 72 65 65 6e 52 65 61 64 65 72 22 3a 22 4f 70 65 6e 73 20 69 6e 20 61 20 6e 65 77 20 54 61 62 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 54 69 74 6c 65 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 47 72 6f 75 70 73 22 3a 5b 7b 22 53 68 6f 77 49 6e 50 6f 70 75 70 22 3a 74 72 75 Data Ascii: endors","ThirdPartyCookieListText":"Cookies Details","PreferenceCenterManagePreferencesText":"Manage consent settings","PreferenceCenterMoreInfoScreenReader":"Opens in a new Tab","CookieListTitle":"","CookieListDescription":"","Groups":[{"ShowInPopup":tru
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 73 73 61 72 79 20 74 6f 20 73 75 70 70 6f 72 74 20 43 6c 6f 75 64 66 6c 61 72 65 20 42 6f 74 20 4d 61 6e 61 67 65 6d 65 6e 74 2c 20 63 75 72 72 65 6e 74 6c 79 20 69 6e 20 70 72 69 76 61 74 65 20 62 65 74 61 2e 20 41 73 20 70 61 72 74 20 6f 66 20 6f 75 72 20 62 6f 74 20 6d 61 6e 61 67 65 6d 65 6e 74 20 73 65 72 76 69 63 65 2c 20 74 68 69 73 20 63 6f 6f 6b 69 65 20 68 65 6c 70 73 20 6d 61 6e 61 67 65 20 69 6e 63 6f 6d 69 6e 67 20 74 72 61 66 66 69 63 20 74 68 61 74 20 6d 61 74 63 68 65 73 20 63 72 69 74 65 72 69 61 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 62 6f 74 73 2e 5c 6e 54 68 69 73 20 69 73 20 61 20 43 6c 6f 75 64 46 6f 75 6e 64 72 79 20 63 6f 6f 6b 69 65 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 Data Ascii: ssary to support Cloudflare Bot Management, currently in private beta. As part of our bot management service, this cookie helps manage incoming traffic that matches criteria associated with bots.\nThis is a CloudFoundry cookie","DurationType":1,"category"
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 38 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 43 6f 6f 6b 69 65 61 6b 5f 62 6d 73 63 22 2c 22 69 64 22 3a 22 63 33 62 61 63 64 32 30 2d 61 35 39 37 2d 34 66 37 37 2d 61 36 39 33 2d 35 30 32 33 37 31 39 62 35 36 33 65 22 2c 22 4e 61 6d 65 Data Ascii: sSession":false,"Length":"89","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieak_bmsc","id":"c3bacd20-a597-4f77-a693-5023719b563e","Name
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 66 37 32 39 34 66 2d 30 63 63 64 2d 34 66 65 30 2d 38 66 62 66 2d 63 32 66 63 34 30 39 38 31 31 32 38 22 2c 22 4e 61 6d 65 22 3a 22 62 69 2d 63 61 72 74 4f 70 65 6e 22 2c 22 48 6f 73 74 22 3a 22 63 68 65 63 6b 6f 75 74 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c Data Ascii: f7294f-0ccd-4fe0-8fbf-c2fc40981128","Name":"bi-cartOpen","Host":"checkout.avast.com","IsSession":true,"Length":"0","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 36 36 32 37 61 33 32 33 2d 32 37 34 33 2d 34 64 63 33 2d 61 37 38 38 2d 65 37 31 30 36 61 33 37 61 62 31 30 22 2c 22 4e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 50 6f 6c 69 63 79 22 2c 22 48 6f 73 74 22 3a 22 70 61 72 74 6e 65 72 73 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 Data Ascii: urationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"6627a323-2743-4dc3-a788-e7106a37ab10","Name":"CookieConsentPolicy","Host":"partners.avast.com","IsSession":f
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 39 39 34 33 38 35 64 2d 30 30 31 32 2d 34 35 38 62 2d 61 38 37 33 2d 61 30 30 36 35 37 39 65 33 38 32 34 22 2c 22 4e 61 6d 65 22 3a 22 45 47 41 49 4e 5f 41 56 5f 43 48 41 54 5f 53 54 41 54 45 5f 44 41 54 41 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 49 66 20 Data Ascii: isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4994385d-0012-458b-a873-a006579e3824","Name":"EGAIN_AV_CHAT_STATE_DATA","Host":"norton.com","IsSession":true,"Length":"0","description":"If
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 38 61 37 65 35 37 38 66 2d 66 39 65 31 2d 34 36 39 32 2d 38 66 35 64 2d 33 64 34 33 38 34 39 65 65 36 39 37 22 2c 22 4e 61 6d 65 22 3a 22 65 67 42 61 64 67 65 43 6f 75 6e 74 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 Data Ascii: null,"thirdPartyKey":null,"firstPartyKey":null,"id":"8a7e578f-f9e1-4692-8f5d-3d43849ee697","Name":"egBadgeCount","Host":"norton.com","IsSession":true,"Length":"0","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDes
2024-02-22 12:06:45 UTC	1369	IN	Data Raw: 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 34 34 31 64 65 32 63 2d 35 65 38 39 2d 34 62 61 39 2d 62 64 36 36 2d 39 62 32 64 64 33 37 31 39 62 32 31 22 2c 22 4e 61 6d 65 22 3a 22 65 67 43 68 61 74 53 74 61 74 65 42 65 66 6f 72 65 55 6e 6c 6f 61 64 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c Data Ascii: ationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4441de2c-5e89-4ba9-bd66-9b2dd3719b21","Name":"egChatStateBeforeUnload","Host":"norton.com","IsSession":true,"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49788	184.29.132.67	443

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-22 12:06:45 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=26397 Date: Thu, 22 Feb 2024 12:06:45 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49786	63.140.39.15	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	1610	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s42186399204533?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A43%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aothers%3Alp-safe-emailing&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=others&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aothers%3Alp-safe-emailing&v59=D%3Dc59&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:45 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:06:45 GMT expires: Wed, 21 Feb 2024 12:06:45 GMT last-modified: Fri, 23 Feb 2024 12:06:45 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198302814437376-4617771531424208994 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:06:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49783	108.138.106.49	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	537	OUT	GET /c/hotjar-470805.js?sv=7 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:45 UTC	633	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Thu, 22 Feb 2024 12:06:45 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin ETag: W/7aa25d5c5a008bd4a96eb7daf3924659 Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 877f105eccbc5cf798a3a34d16fc0c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: FBkE-FOxtfIaPvm2dxAlpe4T5aIhesgOALh9Zn2DlPs-5YF9cv49-A==
2024-02-22 12:06:45 UTC	16384	IN	Data Raw: 34 36 33 30 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 34 37 30 38 30 35 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 30 2e 30 37 39 31 38 39 31 38 39 31 38 39 31 38 39 31 39 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 61 75 74 6f 6d 61 74 69 63 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 66 61 6c 73 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 Data Ascii: 4630window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":470805,"rec_value":0.07918918918918919,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_c
2024-02-22 12:06:45 UTC	1592	IN	Data Raw: 6e 3a 22 62 6f 74 22 7d 7d 29 2c 76 6f 69 64 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 48 6f 74 6a 61 72 20 6e 6f 74 20 6c 61 75 6e 63 68 69 6e 67 20 64 75 65 20 74 6f 20 73 75 73 70 69 63 69 6f 75 73 20 75 73 65 72 41 67 65 6e 74 3a 22 2c 61 29 3b 76 61 72 20 6f 3d 22 68 74 74 70 3a 22 3d 3d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2c 73 3d 42 6f 6f 6c 65 61 6e 28 77 69 6e 64 6f 77 2e 5f 68 6a 53 65 74 74 69 6e 67 73 2e 70 72 65 76 69 65 77 29 3b 69 66 28 6f 26 26 21 73 29 72 65 74 75 72 6e 20 68 6a 2e 6d 65 74 72 69 63 73 2e 63 6f 75 6e 74 28 22 73 65 73 73 69 6f 6e 2d 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 74 61 67 3a 7b 72 65 61 73 6f 6e 3a 22 68 74 74 70 73 22 7d 7d 29 2c 76 6f 69 64 20 63 6f 6e 73 6f 6c 65 2e 77 61 Data Ascii: n:"bot"}}),void console.warn("Hotjar not launching due to suspicious userAgent:",a);var o="http:"===window.location.protocol,s=Boolean(window._hjSettings.preview);if(o&&!s)return hj.metrics.count("session-rejection",{tag:{reason:"https"}}),void console.wa
2024-02-22 12:06:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49787	3.219.97.208	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	753	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: symantec.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=61662999391982255092277607603117149548
2024-02-22 12:06:45 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:45 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: DGAJQUTuQXc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Wed, 21 Feb 2024 08:20:00 GMT DCS: dcs-prod-va6-1-v055-07e891059.edge-va6.demdex.com 0 ms
2024-02-22 12:06:45 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	1388	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:45 UTC	2350	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"5683113434513388650","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:06:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 22-Feb-2024 12:21:45 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49789	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:45 UTC	427	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85971ada48d342d8-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 37974 Cache-Control: public, max-age=86400 Expires: Fri, 23 Feb 2024 12:06:46 GMT Last-Modified: Thu, 20 Apr 2023 14:56:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 3nuR7fmf31a38AgcBfw1VQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 23a4800b-c01e-000f-4f62-0d4fef000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-22 12:06:46 UTC	467	IN	Data Raw: 31 39 36 65 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 36 2e 33 33 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 62 36 38 30 65 39 61 38 Data Ascii: 196e{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 7b 22 49 64 22 3a 22 39 34 30 34 64 61 36 66 2d 65 31 62 32 2d 34 61 34 36 2d 39 34 37 36 2d 32 33 34 66 31 63 64 64 63 65 34 36 22 2c 22 4e 61 6d 65 22 3a 22 42 72 61 7a 69 6c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 62 72 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 Data Ascii: {"Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 66 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f Data Ascii: fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 61 6d 65 22 3a 22 41 76 61 73 74 20 e2 80 93 20 52 45 4a 45 43 54 20 41 4c 4c 20 e2 80 93 20 54 65 6d 70 6c 61 74 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 2c 7b 22 49 64 22 3a 22 34 36 61 37 31 64 37 36 2d 30 36 36 35 2d 34 62 66 34 2d 38 34 64 38 2d 33 35 34 63 36 30 33 35 35 39 39 37 22 2c 22 4e 61 6d 65 22 3a 22 47 4c 4f 42 41 4c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 6f 75 74 2c 20 4d 61 72 6b 65 74 69 6e 67 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 Data Ascii: ame":"Avast REJECT ALL Template","Conditions":[],"GCEnable":false,"IsGPPEnabled":false},{"Id":"46a71d76-0665-4bf4-84d8-354c60355997","Name":"GLOBAL All Opt-out, Marketing Opt-in","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 3a 22 72 6f 22 2c 22 68 65 22 3a 22 68 65 22 2c 22 64 61 22 3a 22 64 61 22 2c 22 74 72 22 3a 22 74 72 22 2c 22 6e 6c 22 3a 22 6e 6c 22 7d 2c 22 42 Data Ascii: -CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"B
2024-02-22 12:06:46 UTC	575	IN	Data Raw: 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 7d 2c 22 49 73 53 75 70 70 72 65 73 73 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 49 73 53 75 70 70 72 65 73 73 50 43 22 3a 66 61 6c 73 65 2c 22 50 75 62 6c 69 73 68 65 72 43 43 22 3a 22 44 45 22 Data Ascii: 2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true},"IsSuppressBanner":false,"IsSuppressPC":false,"PublisherCC":"DE"
2024-02-22 12:06:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49795	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	591	OUT	GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	808	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: Lm+fnsoMFVqoUbgeDGGjrQ== Last-Modified: Wed, 13 Apr 2022 01:38:18 GMT x-ms-request-id: e5bae359-d01e-0013-15e6-1d1d8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6582 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971add1edf4390-EWR
2024-02-22 12:06:46 UTC	561	IN	Data Raw: 32 35 32 33 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 51 32 56 75 64 47 56 79 55 6d 39 31 62 6d 52 6c 5a 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 52 72 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 75 5a 58 Data Ascii: 2523 { "name": "otCenterRounded", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZX
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 61 58 52 73 5a 53 49 2b 56 47 6c 30 62 47 55 38 4c 32 67 79 50 6a 78 77 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 56 34 64 44 78 68 49 47 68 79 5a 57 59 39 49 69 4d 69 50 6e 42 76 62 47 6c 6a 65 54 77 76 59 54 34 38 4c 33 41 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 50 6a 78 77 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 5a 47 56 7a 59 79 49 2b 50 43 39 77 50 6a 77 Data Ascii: aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjw
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6a 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 7b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 35 3b 74 6f 70 3a 31 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 36 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 2e 35 70 Data Ascii: j48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otCenterRounded{z-index:2147483645;top:10%;position:fixed;right:0;background-color:#fff;width:60%;max-width:650px;border-radius:2.5p
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 33 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e Data Ascii: dding:0;border:0;height:auto;width:auto}#onetrust-banner-sdk .ot-b-addl-desc{display:block}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 30px;text-align:center}#onetrust-banner-sdk #onetrust-button-group-parent:not(.has-reject-all-button
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2e 63 6f 6f 6b 69 65 2d 73 65 74 74 69 6e 67 2d 6c 69 6e 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 2e 62 61 6e 6e 65 72 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 36 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 34 34 70 78 3b 68 65 69 67 68 74 3a 34 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 38 70 78 Data Ascii: t-pc-btn-handler.cookie-setting-link{text-align:left;margin-right:0}#onetrust-banner-sdk .has-reject-all-button .banner-actions-container{max-width:60%;width:auto}#onetrust-banner-sdk .ot-close-icon{width:44px;height:44px;background-size:12px;margin:-18px
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 36 70 Data Ascii: ebkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#onetrust-banner-sdk .ot-arrow-container{display:inline-block;border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:6p
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 31 35 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 72 69 67 68 74 3a 31 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 77 72 61 70 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 66 6f 6e 74 Data Ascii: ose-btn-link #onetrust-close-btn-container{top:15px;transform:none;right:15px}#onetrust-banner-sdk.ot-close-btn-link #onetrust-close-btn-container button{padding:0;white-space:pre-wrap;border:none;height:auto;line-height:1.5;text-decoration:underline;font
2024-02-22 12:06:46 UTC	740	IN	Data Raw: 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 73 7b 70 61 64 64 69 6e 67 3a 30 20 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 Data Ascii: 2px;width:calc(100% - 44px)}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 22px}#onetrust-banner-sdk #banner-options{padding:0 22px;width:calc(100% - 44px)}#onetrust-banner-sdk .banner-option{margin-bottom:6px}#onetrust-banner-sdk .has-re
2024-02-22 12:06:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49796	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	588	OUT	GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	809	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: A7tMInCwvuWCqK9nIJa+YQ== Last-Modified: Wed, 13 Apr 2022 01:38:20 GMT x-ms-request-id: 7af008c2-501e-0050-0d90-13fbd3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84869 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971add0fefc463-EWR
2024-02-22 12:06:46 UTC	560	IN	Data Raw: 37 63 37 39 0d 0a 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 50 63 50 61 6e 65 6c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 4d 74 63 32 52 72 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 52 51 59 31 42 68 62 6d 56 73 49 47 39 30 4c 57 68 70 5a 47 55 67 62 33 51 74 5a 6d 46 6b 5a 53 31 70 62 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 62 57 39 6b 59 57 77 39 49 6e 52 79 64 57 55 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 30 4c 58 42 6a 4c 57 52 6c 63 32 4d 69 50 6a 77 68 4c 53 30 67 55 45 4d 67 Data Ascii: 7c79 { "name": "otPcPanel", "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMg
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 79 31 7a 59 33 4a 76 62 47 78 69 59 58 49 69 50 6a 78 6f 4d 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 64 47 6c 30 62 47 55 69 50 6c 6c 76 64 58 49 67 55 48 4a 70 64 6d 46 6a 65 54 77 76 61 44 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 5a 47 56 7a 59 79 49 2b 50 43 39 6b 61 58 59 2b 50 47 4a 31 64 48 52 76 62 69 42 70 5a 44 30 69 59 57 4e 6a 5a 58 42 30 4c 58 4a 6c 59 32 39 74 62 57 56 75 5a 47 56 6b 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 42 59 32 4e 6c 63 48 51 67 51 57 78 73 50 43 39 69 64 58 52 30 62 32 34 2b 50 48 4e 6c 59 33 52 70 62 32 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6b 61 79 31 79 62 33 63 67 62 33 51 74 59 32 46 30 4c 57 64 79 63 43 49 2b 50 47 67 7a 49 47 6c 6b 50 53 4a 76 64 43 31 6a Data Ascii: y1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1j
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 4a 68 59 32 73 74 59 6e 52 75 4c 57 68 68 62 6d 52 73 5a 58 49 69 49 47 46 79 61 57 45 74 62 47 46 69 5a 57 77 39 49 6b 4a 68 59 32 73 69 50 6a 78 7a 64 6d 63 67 61 57 51 39 49 6d 39 30 4c 57 4a 68 59 32 73 74 59 58 4a 33 49 69 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 68 74 62 47 35 7a 4f 6e 68 73 61 57 35 72 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 33 68 73 61 57 35 72 49 69 42 34 50 53 49 77 63 48 67 69 49 48 6b 39 49 6a 42 77 65 43 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 51 30 4e 43 34 31 4d 7a 45 67 4e 44 51 30 4c 6a 55 7a 4d 53 49 67 65 47 31 73 4f 6e 4e 77 59 57 4e 6c 50 Data Ascii: JhY2stYnRuLWhhbmRsZXIiIGFyaWEtbGFiZWw9IkJhY2siPjxzdmcgaWQ9Im90LWJhY2stYXJ3IiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIgdmlld0JveD0iMCAwIDQ0NC41MzEgNDQ0LjUzMSIgeG1sOnNwYWNlP
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 38 63 33 5a 6e 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 4c 33 4e 32 5a 79 49 67 65 47 31 73 62 6e 4d 36 65 47 78 70 62 6d 73 39 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 64 7a 4d 75 62 33 4a 6e 4c 7a 45 35 4f 54 6b 76 65 47 78 70 62 6d 73 69 49 48 67 39 49 6a 42 77 65 43 49 67 65 54 30 69 4d 48 42 34 49 69 42 32 61 57 56 33 51 6d 39 34 50 53 49 77 49 43 30 7a 4d 43 41 78 4d 54 41 67 4d 54 45 77 49 69 42 68 63 6d 6c 68 4c 57 68 70 5a 47 52 6c 62 6a 30 69 64 48 4a 31 5a 53 49 2b 50 48 52 70 64 47 78 6c 50 6c 4e 6c 59 58 4a 6a 61 43 42 4a 59 32 39 75 50 43 39 30 61 58 52 73 5a 54 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 6d 55 7a 4e 6a 51 30 49 69 42 6b 50 53 Data Ascii: 8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB2aWV3Qm94PSIwIC0zMCAxMTAgMTEwIiBhcmlhLWhpZGRlbj0idHJ1ZSI+PHRpdGxlPlNlYXJjaCBJY29uPC90aXRsZT48cGF0aCBmaWxsPSIjMmUzNjQ0IiBkPS
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 4c 54 45 32 4c 6a 67 30 4e 69 77 78 4d 53 34 78 4d 7a 59 4b 49 43 41 67 49 43 41 67 59 79 30 7a 4c 6a 49 7a 4e 43 77 33 4c 6a 67 77 4d 53 30 78 4c 6a 6b 77 4d 79 77 78 4e 43 34 30 4e 6a 63 73 4d 79 34 35 4f 54 6b 73 4d 54 6b 75 4f 54 67 31 62 44 45 30 4d 43 34 33 4e 54 63 73 4d 54 51 77 4c 6a 63 31 4d 33 59 78 4d 7a 67 75 4e 7a 55 31 59 7a 41 73 4e 43 34 35 4e 54 55 73 4d 53 34 34 4d 44 6b 73 4f 53 34 79 4d 7a 49 73 4e 53 34 30 4d 6a 51 73 4d 54 49 75 4f 44 55 30 62 44 63 7a 4c 6a 41 34 4e 53 77 33 4d 79 34 77 4f 44 4d 4b 49 43 41 67 49 43 41 67 59 7a 4d 75 4e 44 49 35 4c 44 4d 75 4e 6a 45 30 4c 44 63 75 4e 7a 45 73 4e 53 34 30 4d 6a 67 73 4d 54 49 75 4f 44 55 78 4c 44 55 75 4e 44 49 34 59 7a 49 75 4d 6a 67 79 4c 44 41 73 4e 43 34 32 4e 69 30 77 4c 6a 51 Data Ascii: LTE2Ljg0NiwxMS4xMzYKICAgICAgYy0zLjIzNCw3LjgwMS0xLjkwMywxNC40NjcsMy45OTksMTkuOTg1bDE0MC43NTcsMTQwLjc1M3YxMzguNzU1YzAsNC45NTUsMS44MDksOS4yMzIsNS40MjQsMTIuODU0bDczLjA4NSw3My4wODMKICAgICAgYzMuNDI5LDMuNjE0LDcuNzEsNS40MjgsMTIuODUxLDUuNDI4YzIuMjgyLDAsNC42Ni0wLjQ
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6d 39 33 49 6a 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 7a 5a 47 73 74 59 32 39 73 64 57 31 75 49 6a 34 38 64 57 77 67 61 57 51 39 49 6d 39 30 4c 57 68 76 63 33 51 74 62 48 4e 30 49 6a 34 38 62 47 6b 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 68 76 63 33 51 74 61 58 52 6c 62 53 49 2b 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 69 62 33 67 69 49 47 46 79 61 57 45 74 5a 58 68 77 59 57 35 6b 5a 57 51 39 49 6d 5a 68 62 48 4e 6c 49 6a 34 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 63 32 56 6a 64 47 6c 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 59 57 4e 6a 4c 57 68 6b 63 69 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 6f 5a 48 49 69 50 6a 78 6f Data Ascii: m93Ij48ZGl2IGNsYXNzPSJvdC1zZGstY29sdW1uIj48dWwgaWQ9Im90LWhvc3QtbHN0Ij48bGkgY2xhc3M9Im90LWhvc3QtaXRlbSI+PGJ1dHRvbiBjbGFzcz0ib3QtaG9zdC1ib3giIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIj48L2J1dHRvbj48c2VjdGlvbiBjbGFzcz0ib3QtYWNjLWhkciI+PGRpdiBjbGFzcz0ib3QtaG9zdC1oZHIiPjxo
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 69 64 47 34 74 59 32 39 75 64 47 46 70 62 6d 56 79 49 6a 34 38 59 6e 56 30 64 47 39 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 77 59 79 31 79 5a 57 5a 31 63 32 55 74 59 57 78 73 4c 57 68 68 62 6d 52 73 5a 58 49 69 50 6c 4a 6c 61 6d 56 6a 64 43 42 42 62 47 77 38 4c 32 4a 31 64 48 52 76 62 6a 34 67 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 63 32 46 32 5a 53 31 77 63 6d 56 6d 5a 58 4a 6c 62 6d 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 47 39 75 5a 58 52 79 64 58 4e 30 4c 57 4e 73 62 33 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 54 59 58 5a 6c 49 46 4e 6c 64 48 52 70 62 6d 64 7a 50 43 39 69 64 58 52 30 62 32 34 2b 50 43 39 6b 61 58 59 2b 50 47 52 70 64 Data Ascii: l2IGNsYXNzPSJvdC1idG4tY29udGFpbmVyIj48YnV0dG9uIGNsYXNzPSJvdC1wYy1yZWZ1c2UtYWxsLWhhbmRsZXIiPlJlamVjdCBBbGw8L2J1dHRvbj4gPGJ1dHRvbiBjbGFzcz0ic2F2ZS1wcmVmZXJlbmNlLWJ0bi1oYW5kbGVyIG9uZXRydXN0LWNsb3NlLWJ0bi1oYW5kbGVyIj5TYXZlIFNldHRpbmdzPC9idXR0b24+PC9kaXY+PGRpd
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 70 5a 43 49 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 33 61 58 52 6a 61 43 31 75 62 32 49 69 49 47 46 79 61 57 45 74 59 32 68 6c 59 32 74 6c 5a 44 30 69 5a 6d 46 73 63 32 55 69 49 48 4a 76 62 47 55 39 49 6e 4e 33 61 58 52 6a 61 43 49 2b 50 43 39 7a 63 47 46 75 50 69 41 38 63 33 42 68 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 47 46 69 5a 57 77 74 64 48 68 30 49 6a 35 54 64 32 6c 30 59 32 67 67 54 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 73 59 57 4a 6c 62 44 34 67 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 68 59 6d 56 73 4c 58 4e 30 59 58 52 31 63 79 49 2b 62 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 6b 61 58 59 2b 50 43 45 74 4c 53 42 44 61 47 56 6a 61 32 4a 76 65 43 Data Ascii: pZCI+PHNwYW4gY2xhc3M9Im90LXN3aXRjaC1ub2IiIGFyaWEtY2hlY2tlZD0iZmFsc2UiIHJvbGU9InN3aXRjaCI+PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGFiZWwtdHh0Ij5Td2l0Y2ggTGFiZWw8L3NwYW4+PC9sYWJlbD4gPHNwYW4gY2xhc3M9Im90LWxhYmVsLXN0YXR1cyI+bGFiZWw8L3NwYW4+PC9kaXY+PCEtLSBDaGVja2JveC
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 49 69 42 76 64 43 31 68 59 32 4e 76 63 6d 52 70 62 32 34 39 49 6e 52 79 64 57 55 69 50 6a 77 76 59 6e 56 30 64 47 39 75 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 6f 5a 48 49 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 6b 61 57 39 75 49 47 68 6c 59 57 52 6c 63 69 42 6a 62 32 35 30 5a 57 35 30 49 43 30 74 50 6a 77 76 5a 47 6c 32 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 30 65 48 51 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 70 5a 47 39 75 49 47 4e 76 62 6e 52 6c 62 6e 51 67 4c 53 30 2b 50 43 39 6b 61 58 59 2b 50 43 39 6b 61 58 59 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6a 63 6d 34 74 63 6d 52 79 49 69 42 68 63 6d 6c 68 4c 57 46 30 62 32 31 Data Ascii: IiBvdC1hY2NvcmRpb249InRydWUiPjwvYnV0dG9uPjxkaXYgY2xhc3M9Im90LWFjYy1oZHIiPjwhLS0gQWNjb3JkaW9uIGhlYWRlciBjb250ZW50IC0tPjwvZGl2PjxkaXYgY2xhc3M9Im90LWFjYy10eHQiPjwhLS0gQWNjb3JpZG9uIGNvbnRlbnQgLS0+PC9kaXY+PC9kaXY+PHNwYW4gY2xhc3M9Im90LXNjcm4tcmRyIiBhcmlhLWF0b21
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 50 63 50 61 6e 65 6c 2e 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7d 40 6d 65 64 69 61 20 70 72 69 6e 74 2c 28 70 72 65 66 65 72 73 2d 72 65 64 75 63 65 64 2d 6d 6f 74 69 6f 6e 29 7b 2e 6f 74 2d 61 6e 69 6d 61 74 65 64 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 69 6e 69 74 Data Ascii: mation-name:ot-slide-in-right;animation-name:ot-slide-in-right}#onetrust-pc-sdk.otPcPanel.ot-slide-out-left{-webkit-animation-name:ot-slide-out-left;animation-name:ot-slide-out-left}@media print,(prefers-reduced-motion){.ot-animated{-webkit-animation:init

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49797	3.225.167.6	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	662	OUT	GET /ibs:dpid=411&dpuuid=Zdc41QAAAI5mXAOj HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=61662999391982255092277607603117149548
2024-02-22 12:06:46 UTC	889	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: aB6glKWyT5w= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v055-01b14286f.edge-va6.demdex.com 2 ms set-cookie: dpm=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:46 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-22 12:06:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49794	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	589	OUT	GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: text/css Content-Length: 21595 Connection: close Content-MD5: SHFDtZO2nDZuiPDW83p1IQ== Last-Modified: Wed, 13 Apr 2022 01:38:32 GMT ETag: 0x8DA1CEE517188DA x-ms-request-id: 3a2f722b-c01e-000f-154e-144fef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 78221 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971addf9fd78d5-EWR
2024-02-22 12:06:46 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 32 5a 58 4a 7a 61 57 39 75 50 53 49 78 4c 6a 45 69 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAw
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 68 74 3a 31 32 70 78 3b 77 69 64 74 68 3a 31 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f Data Ascii: ht:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-logo a,#ot-sync-ntfy .powered-by-logo,#ot-sync-ntfy .ot-pc-footer-logo a{background-size:co
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 6e 6f 74 28 3a 63 68 65 63 6b 65 64 29 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 Data Ascii: :100%}#onetrust-pc-sdk [type="checkbox"]:checked,#onetrust-pc-sdk [type="checkbox"]:not(:checked){pointer-events:initial}#onetrust-pc-sdk [type="checkbox"]:disabled+label::before,#onetrust-pc-sdk [type="checkbox"]:disabled+label:after,#onetrust-pc-sdk [ty
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 74 2d 73 64 6b 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 2c 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 70 74 61 6e 6f 6e 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 7b 63 6f 6c 6f 72 3a 23 36 38 62 36 33 31 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 36 38 62 36 33 31 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 77 6f 72 64 2d 77 72 61 70 3a Data Ascii: t}#onetrust-pc-sdk.ot-hide{display:none !important}.onetrust-pc-dark-filter.ot-hide{display:none !important}#ot-sdk-btn.ot-sdk-show-settings,#ot-sdk-btn.optanon-show-settings{color:#68b631;border:1px solid #68b631;height:auto;white-space:normal;word-wrap:
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 76 65 6e 2d 68 64 72 3e 70 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 0a 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2a 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: ents:initial}#onetrust-pc-sdk .ot-ven-hdr>p a{position:relative;z-index:2;pointer-events:initial}#onetrust-banner-sdk,#onetrust-pc-sdk,#ot-sdk-cookie-policy,#ot-sync-ntfy{font-size:16px}#onetrust-banner-sdk *,#onetrust-banner-sdk ::after,#onetrust-banner
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 35 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 36 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 65 63 74 69 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d Data Ascii: st-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#onetrust-pc-sdk h5,#onetrust-pc-sdk h6,#onetrust-pc-sdk p,#onetrust-pc-sdk img,#onetrust-pc-sdk svg,#onetrust-pc-sdk button,#onetrust-pc-sdk section,#onetrust-
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 70 61 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 31 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 32 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 35 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 70 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 69 6d 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 76 67 2c Data Ascii: dk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy span,#ot-sync-ntfy h1,#ot-sync-ntfy h2,#ot-sync-ntfy h3,#ot-sync-ntfy h4,#ot-sync-ntfy h5,#ot-sync-ntfy h6,#ot-sync-ntfy p,#ot-sync-ntfy img,#ot-sync-ntfy svg,
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 61 66 Data Ascii: st-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#ot-sdk-cookie-policy label:after,#ot-sdk-cookie-policy .checkbox:after,#ot-sdk-cookie-policy .checkbox:before,#ot-sync-ntfy label:before,#ot-sync-ntfy label:af
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b Data Ascii: left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-child,#onetrust-pc-sdk .ot-sdk-column:first-child,#onetrust-pc-sdk .ot-sdk-columns:first-child,#ot-sdk-cookie-policy .ot-sdk-column:first-child,#ot-sdk-cook

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49806	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	430	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85971ade3aee8c36-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 22424 Cache-Control: public, max-age=86400 Expires: Fri, 23 Feb 2024 12:06:46 GMT Last-Modified: Thu, 20 Apr 2023 14:56:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: TxtfAP2G8zKYHm9R69+ggQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 615a70e4-701e-0057-7f77-1397b0000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-22 12:06:46 UTC	467	IN	Data Raw: 37 63 31 62 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 50 72 69 76 61 63 79 20 70 72 65 Data Ascii: 7c1b{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy pre
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 20 59 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 73 65 74 74 69 6e 67 73 20 62 65 6c 6f 77 2e 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 9c 43 6f 6e 66 69 72 6d 20 73 65 6c 65 63 74 69 6f 6e e2 80 9d 20 79 6f 75 20 61 67 72 65 65 20 77 69 74 68 20 74 68 65 20 63 75 72 72 65 6e 74 20 73 65 74 74 69 6e 67 73 2e 20 53 65 65 26 6e 62 73 70 3b 22 2c 22 41 62 6f 75 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 70 6f 6c 69 63 79 22 2c 22 41 62 6f 75 74 43 6f 6f 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 63 63 65 70 74 20 61 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 Data Ascii: You can manage cookie settings below. By clicking Confirm selection you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUse
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 44 65 74 61 69 6c 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6e 73 65 6e 74 20 73 65 74 74 69 6e 67 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 49 6e 66 6f 53 63 72 65 65 6e 52 65 61 64 65 72 22 3a 22 4f 70 65 6e 73 20 69 6e 20 61 20 6e 65 77 20 54 61 62 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 54 69 74 6c 65 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 47 72 6f 75 70 73 22 3a 5b 7b 22 53 68 6f 77 49 6e 50 6f 70 75 70 22 3a 74 72 75 Data Ascii: endors","ThirdPartyCookieListText":"Cookies Details","PreferenceCenterManagePreferencesText":"Manage consent settings","PreferenceCenterMoreInfoScreenReader":"Opens in a new Tab","CookieListTitle":"","CookieListDescription":"","Groups":[{"ShowInPopup":tru
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 73 73 61 72 79 20 74 6f 20 73 75 70 70 6f 72 74 20 43 6c 6f 75 64 66 6c 61 72 65 20 42 6f 74 20 4d 61 6e 61 67 65 6d 65 6e 74 2c 20 63 75 72 72 65 6e 74 6c 79 20 69 6e 20 70 72 69 76 61 74 65 20 62 65 74 61 2e 20 41 73 20 70 61 72 74 20 6f 66 20 6f 75 72 20 62 6f 74 20 6d 61 6e 61 67 65 6d 65 6e 74 20 73 65 72 76 69 63 65 2c 20 74 68 69 73 20 63 6f 6f 6b 69 65 20 68 65 6c 70 73 20 6d 61 6e 61 67 65 20 69 6e 63 6f 6d 69 6e 67 20 74 72 61 66 66 69 63 20 74 68 61 74 20 6d 61 74 63 68 65 73 20 63 72 69 74 65 72 69 61 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 62 6f 74 73 2e 5c 6e 54 68 69 73 20 69 73 20 61 20 43 6c 6f 75 64 46 6f 75 6e 64 72 79 20 63 6f 6f 6b 69 65 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 Data Ascii: ssary to support Cloudflare Bot Management, currently in private beta. As part of our bot management service, this cookie helps manage incoming traffic that matches criteria associated with bots.\nThis is a CloudFoundry cookie","DurationType":1,"category"
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 38 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 43 6f 6f 6b 69 65 61 6b 5f 62 6d 73 63 22 2c 22 69 64 22 3a 22 63 33 62 61 63 64 32 30 2d 61 35 39 37 2d 34 66 37 37 2d 61 36 39 33 2d 35 30 32 33 37 31 39 62 35 36 33 65 22 2c 22 4e 61 6d 65 Data Ascii: sSession":false,"Length":"89","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieak_bmsc","id":"c3bacd20-a597-4f77-a693-5023719b563e","Name
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 66 37 32 39 34 66 2d 30 63 63 64 2d 34 66 65 30 2d 38 66 62 66 2d 63 32 66 63 34 30 39 38 31 31 32 38 22 2c 22 4e 61 6d 65 22 3a 22 62 69 2d 63 61 72 74 4f 70 65 6e 22 2c 22 48 6f 73 74 22 3a 22 63 68 65 63 6b 6f 75 74 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c Data Ascii: f7294f-0ccd-4fe0-8fbf-c2fc40981128","Name":"bi-cartOpen","Host":"checkout.avast.com","IsSession":true,"Length":"0","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 36 36 32 37 61 33 32 33 2d 32 37 34 33 2d 34 64 63 33 2d 61 37 38 38 2d 65 37 31 30 36 61 33 37 61 62 31 30 22 2c 22 4e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 50 6f 6c 69 63 79 22 2c 22 48 6f 73 74 22 3a 22 70 61 72 74 6e 65 72 73 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 Data Ascii: urationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"6627a323-2743-4dc3-a788-e7106a37ab10","Name":"CookieConsentPolicy","Host":"partners.avast.com","IsSession":f
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 39 39 34 33 38 35 64 2d 30 30 31 32 2d 34 35 38 62 2d 61 38 37 33 2d 61 30 30 36 35 37 39 65 33 38 32 34 22 2c 22 4e 61 6d 65 22 3a 22 45 47 41 49 4e 5f 41 56 5f 43 48 41 54 5f 53 54 41 54 45 5f 44 41 54 41 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 49 66 20 Data Ascii: isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4994385d-0012-458b-a873-a006579e3824","Name":"EGAIN_AV_CHAT_STATE_DATA","Host":"norton.com","IsSession":true,"Length":"0","description":"If
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 38 61 37 65 35 37 38 66 2d 66 39 65 31 2d 34 36 39 32 2d 38 66 35 64 2d 33 64 34 33 38 34 39 65 65 36 39 37 22 2c 22 4e 61 6d 65 22 3a 22 65 67 42 61 64 67 65 43 6f 75 6e 74 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 Data Ascii: null,"thirdPartyKey":null,"firstPartyKey":null,"id":"8a7e578f-f9e1-4692-8f5d-3d43849ee697","Name":"egBadgeCount","Host":"norton.com","IsSession":true,"Length":"0","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDes
2024-02-22 12:06:46 UTC	1369	IN	Data Raw: 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 34 34 31 64 65 32 63 2d 35 65 38 39 2d 34 62 61 39 2d 62 64 36 36 2d 39 62 32 64 64 33 37 31 39 62 32 31 22 2c 22 4e 61 6d 65 22 3a 22 65 67 43 68 61 74 53 74 61 74 65 42 65 66 6f 72 65 55 6e 6c 6f 61 64 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c Data Ascii: ationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4441de2c-5e89-4ba9-bd66-9b2dd3719b21","Name":"egChatStateBeforeUnload","Host":"norton.com","IsSession":true,"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49804	142.250.64.70	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 76 61 73 74 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 35 36 38 33 31 31 33 34 33 34 35 31 33 33 38 38 36 35 30 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://avast.com","trigger_debug_key":"5683113434513388650"},"type":"trigger-no-matching-source"}]
2024-02-22 12:06:46 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 22 Feb 2024 12:06:46 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49811	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971ade782143e0-EWR
2024-02-22 12:06:46 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49807	18.164.96.87	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	545	OUT	GET /modules.3ba69200791f16077ba8.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	717	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 233737 Connection: close Date: Thu, 22 Feb 2024 11:39:24 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "085399d9c08a65342fdc858566305c02" Last-Modified: Thu, 22 Feb 2024 11:38:42 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c4d0da6268789cfda9bb5da1f3f8fc58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: 8BVye2jK9n-z-5W5n0jO28JPUyiHIteYrz5y0xTJd8Sbi_p6LnUqPA== Age: 1642
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 33 62 61 36 39 32 30 30 37 39 31 66 31 36 30 37 37 62 61 38 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.3ba69200791f16077ba8.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 6e 2e 64 28 74 2c 7b 65 78 63 65 70 74 69 6f 6e 4c 6f 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 69 6e 69 74 45 72 72 6f 72 4c 6f 67 67 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 38 34 32 32 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 20 6f 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 Data Ascii: n.d(t,{exceptionLogger:function(){return s},initErrorLogging:function(){return c}});var r=n(8422);function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symb
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 65 74 28 22 73 65 73 73 69 6f 6e 2e 73 65 73 73 69 6f 6e 52 65 73 75 6d 65 64 22 29 26 26 69 2e 6c 2e 74 72 61 63 6b 53 65 73 73 69 6f 6e 52 65 73 75 6d 65 64 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 75 2e 79 2e 73 65 74 28 22 61 63 74 69 76 65 22 2c 21 31 29 2c 68 6a 2e 73 65 74 74 69 6e 67 73 2e 72 65 63 6f 72 64 29 7b 76 61 72 20 74 3d 76 6f 69 64 20 30 3d 3d 3d 68 6a 2e 73 65 74 74 69 6e 67 73 2e 72 65 63 6f 72 64 5f 74 61 72 67 65 74 69 6e 67 5f 72 75 6c 65 73 7c 7c 21 68 6a 2e 73 65 74 74 69 6e 67 73 2e 72 65 63 6f 72 64 5f 74 61 72 67 65 74 69 6e 67 5f 72 75 6c 65 73 2e 6c 65 6e 67 74 68 3b 69 2e 6c 2e 73 65 74 52 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 28 6c 2e 51 2e 67 65 74 28 22 73 65 73 73 69 6f 6e 2e 72 65 63 6f 72 64 69 6e Data Ascii: et("session.sessionResumed")&&i.l.trackSessionResumed(),function(e){if(u.y.set("active",!1),hj.settings.record){var t=void 0===hj.settings.record_targeting_rules\|\|!hj.settings.record_targeting_rules.length;i.l.setRecordingEnabled(l.Q.get("session.recordin
2024-02-22 12:06:46 UTC	15220	IN	Data Raw: 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 2c 70 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 6d 28 65 29 7d 28 65 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 6e 75 6c 6c 21 3d 65 5b 53 79 6d 62 6f Data Ascii: typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},p(e)}function v(e){return function(e){if(Array.isArray(e))return m(e)}(e)\|\|function(e){if("undefined"!=typeof Symbol&&null!=e[Symbo
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 6e 28 29 7b 76 61 72 20 65 3d 6f 2c 74 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 74 74 61 63 68 53 68 61 64 6f 77 3b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 74 74 61 63 68 53 68 61 64 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 65 2e 73 68 61 64 6f 77 52 6f 6f 74 73 2e 73 65 74 28 74 68 69 73 2c 6e 29 2c 65 2e 6c 69 73 74 65 6e 54 6f 4d 75 74 61 74 69 6f 6e 73 28 6e 29 2c 65 2e 70 72 6f 70 61 67 61 74 65 4e 6f 6e 43 6f 6d 70 6f 73 65 64 45 76 65 6e 74 73 28 6e 29 2c 6e 7d 7d 29 2c 22 54 72 65 65 4d 69 72 72 6f 72 43 6c 69 65 6e 74 2e 68 6f 6f 6b 41 74 74 61 63 68 53 68 61 64 6f 77 22 29 2c 74 68 69 73 2e 70 72 6f Data Ascii: n(){var e=o,t=Element.prototype.attachShadow;Element.prototype.attachShadow=function(){var n=t.apply(this,arguments);return e.shadowRoots.set(this,n),e.listenToMutations(n),e.propagateNonComposedEvents(n),n}}),"TreeMirrorClient.hookAttachShadow"),this.pro
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 6f 72 28 74 3d 36 34 3b 74 3c 3d 65 2e 6c 65 6e 67 74 68 3b 74 2b 3d 36 34 29 64 28 72 2c 79 28 65 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 36 34 2c 74 29 29 29 3b 65 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 36 34 29 3b 76 61 72 20 6f 3d 5b 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 5d 3b 66 6f 72 28 74 3d 30 3b 74 3c 65 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 6f 5b 74 3e 3e 32 5d 7c 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 3c 3c 28 74 25 34 3c 3c 33 29 3b 69 66 28 6f 5b 74 3e 3e 32 5d 7c 3d 31 32 38 3c 3c 28 74 25 34 3c 3c 33 29 2c 35 35 3c 74 29 66 6f 72 28 64 28 72 2c 6f 29 2c 74 3d 30 3b 31 36 3e 74 3b 74 2b 2b 29 6f 5b 74 5d 3d 30 3b 72 65 74 75 72 6e 20 6f 5b 31 34 5d 3d 38 2a 6e 2c 64 28 72 2c Data Ascii: or(t=64;t<=e.length;t+=64)d(r,y(e.substring(t-64,t)));e=e.substring(t-64);var o=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0];for(t=0;t<e.length;t++)o[t>>2]\|=e.charCodeAt(t)<<(t%4<<3);if(o[t>>2]\|=128<<(t%4<<3),55<t)for(d(r,o),t=0;16>t;t++)o[t]=0;return o[14]=8*n,d(r,
2024-02-22 12:06:46 UTC	16384	IN	Data Raw: 43 61 73 65 28 29 26 26 22 72 65 6c 22 69 6e 20 65 2e 61 74 74 72 69 62 75 74 65 73 26 26 22 73 74 79 6c 65 73 68 65 65 74 22 3d 3d 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2e 72 65 6c 2e 76 61 6c 75 65 26 26 22 68 72 65 66 22 69 6e 20 65 2e 61 74 74 72 69 62 75 74 65 73 26 26 30 3d 3d 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2e 68 72 65 66 2e 76 61 6c 75 65 2e 69 6e 64 65 78 4f 66 28 22 62 6c 6f 62 3a 22 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 72 3d 68 6a 2e 73 65 6c 65 63 74 6f 72 28 29 2e 67 65 74 28 68 6a 2e 68 71 28 65 29 29 2c 6f 3d 68 6a 2e 74 72 65 65 4d 69 72 72 6f 72 2e 67 65 74 4e 6f 64 65 49 64 28 65 29 2c 69 3d 30 2c 61 3d 65 2e 73 68 65 65 74 2e 63 73 73 52 75 6c 65 73 2e 6c 65 6e 67 Data Ascii: Case()&&"rel"in e.attributes&&"stylesheet"===e.attributes.rel.value&&"href"in e.attributes&&0===e.attributes.href.value.indexOf("blob:")&&setTimeout((function(){for(var r=hj.selector().get(hj.hq(e)),o=hj.treeMirror.getNodeId(e),i=0,a=e.sheet.cssRules.leng
2024-02-22 12:06:47 UTC	16384	IN	Data Raw: 53 74 72 65 61 6d 22 69 6e 20 77 69 6e 64 6f 77 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 28 29 3b 28 6e 3d 6e 65 77 20 52 65 61 64 61 62 6c 65 53 74 72 65 61 6d 28 7b 73 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 6e 71 75 65 75 65 28 65 29 2c 74 2e 63 6c 6f 73 65 28 29 7d 7d 29 2e 70 69 70 65 54 68 72 6f 75 67 68 28 6e 65 77 20 54 65 78 74 45 6e 63 6f 64 65 72 53 74 72 65 61 6d 29 2e 70 69 70 65 54 68 72 6f 75 67 68 28 6e 65 77 20 43 6f 6d 70 72 65 73 73 69 6f 6e 53 74 72 65 61 6d 28 22 67 7a 69 70 22 29 29 2c 72 3d 6e 2e 67 65 74 52 65 61 64 65 72 28 29 2c 6f 3d 5b 5d 2c 69 3d 68 6a 2e 6d 65 74 72 69 63 73 2e 74 69 6d 65 57 61 74 63 68 65 72 28 29 2c 72 2e 72 65 61 64 28 29 2e 74 68 65 Data Ascii: Stream"in window}catch(e){return!1}}())return a();(n=new ReadableStream({start:function(t){t.enqueue(e),t.close()}}).pipeThrough(new TextEncoderStream).pipeThrough(new CompressionStream("gzip")),r=n.getReader(),o=[],i=hj.metrics.timeWatcher(),r.read().the
2024-02-22 12:06:47 UTC	16384	IN	Data Raw: 3b 72 65 74 75 72 6e 20 69 28 73 29 26 26 21 72 26 26 74 28 73 2c 61 2e 6f 66 66 28 65 2c 74 29 29 2c 61 2e 6f 66 66 28 65 2c 74 29 7d 2c 6f 66 66 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3b 6f 5b 65 5d 3d 6e 75 6c 6c 3d 3d 3d 28 6e 3d 6f 5b 65 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 21 3d 3d 74 7d 29 29 7d 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 65 6c 65 74 65 20 6e 5b 65 5d 2c 64 65 6c 65 74 65 20 6f 5b 65 5d 7d 2c 72 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 4f 62 6a 65 63 74 2e 63 72 Data Ascii: ;return i(s)&&!r&&t(s,a.off(e,t)),a.off(e,t)},off:function(e,t){return function(){var n;o[e]=null===(n=o[e])\|\|void 0===n?void 0:n.filter((function(e){return e!==t}))}},remove:function(e){delete n[e],delete o[e]},reset:function(e){n=Object.assign(Object.cr
2024-02-22 12:06:47 UTC	16384	IN	Data Raw: 61 6c 75 65 3d 65 29 2c 76 6f 69 64 20 30 3d 3d 3d 74 68 69 73 5b 30 5d 3f 76 6f 69 64 20 30 3a 74 68 69 73 5b 30 5d 3f 74 68 69 73 5b 30 5d 2e 76 61 6c 75 65 3a 22 22 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 74 68 69 73 5b 30 5d 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3a 74 68 69 73 5b 30 5d 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 65 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 65 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 72 29 7b 74 28 6e 2c 65 2c 72 29 7d 29 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e Data Ascii: alue=e),void 0===this[0]?void 0:this[0]?this[0].value:""},o.prototype.text=function(e){return void 0===e?this[0].textContent:this[0].textContent=e},o.prototype.each=function(e,t){Array.prototype.forEach.call(this,(function(e,n,r){t(n,e,r)}))},o.prototype.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49809	34.224.119.52	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	519	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1708603603112 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=61662999391982255092277607603117149548
2024-02-22 12:06:46 UTC	710	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: JehCCwa/TZ8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-va6-1-v055-02830e3a9.edge-va6.demdex.com 2 ms set-cookie: demdex=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-22 12:06:46 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 36 31 38 35 36 39 34 36 32 34 35 36 31 36 31 30 39 36 34 32 32 39 32 35 31 38 35 30 34 39 30 35 32 36 31 35 33 33 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"61856946245616109642292518504905261533","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49803	34.117.39.58	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	532	OUT	GET /active/avastcom.jsp HTTP/1.1 Host: www.upsellit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	406	IN	HTTP/1.1 200 Server: nginx Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Expires: Fri, 23 Feb 2024 12:06:46 GMT Cache-Control: max-age=86400 Strict-Transport-Security: max-age=31536000; includeSubDomains Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:46 UTC	846	IN	Data Raw: 31 65 61 38 0d 0a 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 7c 7c 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 66 28 22 46 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 21 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 3b 76 61 72 20 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6f 3d 6e 65 77 20 41 72 72 61 79 28 72 29 2c 6e 3d 74 68 69 73 2c 6c 3d 30 2c 69 3d 2d 31 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 66 6f 72 28 3b 2b 2b 69 21 3d 3d 72 3b 29 69 20 69 6e 20 74 68 69 73 26 26 74 28 6e 5b 69 5d 2c 69 2c Data Ascii: 1ea8Array.prototype.filter\|\|(Array.prototype.filter=function(t,e){"use strict";if("Function"!=typeof t&&"function"!=typeof t\|\|!this)throw new TypeError;var r=this.length>>>0,o=new Array(r),n=this,l=0,i=-1;if(void 0===e)for(;++i!==r;)i in this&&t(n[i],i,
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 22 74 68 69 73 22 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 27 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6e 3d 6f 2e 6c 65 6e 67 74 68 3e 3e 3e 30 3b 69 66 28 30 3d 3d 3d 6e 29 72 65 74 75 72 6e 2d 31 3b 76 61 72 20 6c 3d 30 7c 65 3b 69 66 28 6c 3e 3d 6e 29 72 65 74 75 72 6e 2d 31 3b 66 6f 72 28 72 3d 4d 61 74 68 2e 6d 61 78 28 6c 3e 3d 30 3f 6c 3a 6e 2d 4d 61 74 68 2e 61 62 73 28 6c 29 2c 30 29 3b 72 3c 6e 3b 29 7b 69 66 28 72 20 69 6e 20 6f 26 26 6f 5b 72 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 72 3b 72 2b 2b 7d 72 65 74 75 72 6e 2d 31 7d 29 2c 64 6f Data Ascii: nction(t,e){var r;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),n=o.length>>>0;if(0===n)return-1;var l=0\|e;if(l>=n)return-1;for(r=Math.max(l>=0?l:n-Math.abs(l),0);r<n;){if(r in o&&o[r]===t)return r;r++}return-1}),do
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 63 74 2e 6b 65 79 73 7c 7c 28 4f 62 6a 65 63 74 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 65 3d 21 7b 74 6f 53 74 72 69 6e 67 3a 6e 75 6c 6c 7d 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 74 6f 53 74 72 69 6e 67 22 29 2c 72 3d 5b 22 74 6f 53 74 72 69 6e 67 22 2c 22 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 22 2c 22 76 61 6c 75 65 4f 66 22 2c 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 22 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 22 2c 22 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 22 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 5d 2c 6f 3d 72 2e 6c 65 6e Data Ascii: ct.keys\|\|(Object.keys=function(){"use strict";var t=Object.prototype.hasOwnProperty,e=!{toString:null}.propertyIsEnumerable("toString"),r=["toString","toLocaleString","valueOf","hasOwnProperty","isPrototypeOf","propertyIsEnumerable","constructor"],o=r.len
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 65 2c 20 61 72 67 75 6d 65 6e 74 73 29 3b 0d 0a 09 09 09 09 09 7d 0d 0a 09 09 09 09 7d 20 63 61 74 63 68 28 65 72 72 29 20 7b 0d 0a 09 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 5f 6e 6f 5f 63 6f 6e 73 6f 6c 65 28 65 72 72 29 3b 0d 0a 09 09 09 09 7d 0d 0a 09 09 09 7d 0d 0a 09 09 7d 2c 0d 0a 09 09 6c 6f 67 5f 65 72 72 6f 72 3a 20 66 75 6e 63 74 69 6f 6e 28 6d 73 67 29 20 7b 0d 0a 09 09 09 69 66 20 28 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 64 65 62 75 67 29 20 7b 0d 0a 09 09 09 09 74 72 79 20 7b 0d 0a 09 09 09 09 09 69 66 20 28 6d 73 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 29 20 7b 0d 0a 09 09 09 09 09 09 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 25 63 20 55 53 49 20 45 72 72 6f 72 3a 27 2c 20 75 73 69 5f 63 Data Ascii: e, arguments);}} catch(err) {usi_commons.report_error_no_console(err);}}},log_error: function(msg) {if (usi_commons.debug) {try {if (msg instanceof Error) {console.log('%c USI Error:', usi_c
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 20 3f 20 27 6d 6f 62 69 6c 65 27 20 3a 20 27 64 65 73 6b 74 6f 70 27 2c 0d 0a 09 09 67 75 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 61 6d 65 29 20 7b 0d 0a 09 09 09 74 72 79 20 7b 0d 0a 09 09 09 09 6e 61 6d 65 20 3d 20 6e 61 6d 65 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 5b 5d 2f 2c 20 22 5c 5c 5c 5b 22 29 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 5d 5d 2f 2c 20 22 5c 5c 5c 5d 22 29 3b 0d 0a 09 09 09 09 76 61 72 20 72 65 67 65 78 53 20 3d 20 22 5b 5c 5c 3f 26 5d 22 20 2b 20 6e 61 6d 65 20 2b 20 22 3d 28 5b 5e 26 23 5c 5c 3f 5d 2a 29 22 3b 0d 0a 09 09 09 09 76 61 72 20 72 65 67 65 78 20 3d 20 6e 65 77 20 52 65 67 45 78 70 28 72 65 67 65 78 53 29 3b 0d 0a 09 09 Data Ascii: est(navigator.userAgent.toLowerCase()) ? 'mobile' : 'desktop',gup:function(name) {try {name = name.replace(/[\[]/, "\\\[").replace(/[\]]/, "\\\]");var regexS = "[\\?&]" + name + "=([^&#\\?]*)";var regex = new RegExp(regexS);
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 28 73 6f 75 72 63 65 2e 69 6e 64 65 78 4f 66 28 22 70 76 32 2e 6a 73 22 29 20 21 3d 20 2d 31 29 20 75 73 69 5f 61 70 70 65 6e 64 65 72 20 3d 20 22 25 37 43 22 3b 0d 0a 09 09 09 09 09 75 73 69 5f 61 70 70 65 6e 64 65 72 20 2b 3d 20 22 73 69 3d 22 20 2b 20 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 67 65 74 5f 73 65 73 73 28 29 3b 0d 0a 09 09 09 09 7d 0d 0a 09 09 09 09 6e 65 77 53 63 72 69 70 74 2e 73 72 63 20 3d 20 73 6f 75 72 63 65 20 2b 20 75 73 69 5f 61 70 70 65 6e 64 65 72 3b 0d 0a 09 09 09 09 69 66 20 28 74 79 70 65 6f 66 20 63 61 6c 6c 62 61 63 6b 20 3d 3d 20 22 66 75 6e 63 74 69 6f 6e 22 29 20 7b 0d 0a 09 09 09 09 09 6e 65 77 53 63 72 69 70 74 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 09 09 09 09 09 09 74 72 79 20 7b 0d 0a 09 Data Ascii: (source.indexOf("pv2.js") != -1) usi_appender = "%7C";usi_appender += "si=" + usi_commons.get_sess();}newScript.src = source + usi_appender;if (typeof callback == "function") {newScript.onload = function() {try {
2024-02-22 12:06:46 UTC	750	IN	Data Raw: 29 3b 0d 0a 09 09 09 09 09 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 75 73 69 5f 63 6f 6f 6b 69 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 20 26 26 20 75 73 69 5f 63 6f 6f 6b 69 65 73 2e 67 65 74 28 22 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 22 29 20 21 3d 20 6e 75 6c 6c 29 20 75 73 69 5f 61 70 70 65 6e 64 20 3d 20 22 26 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 3d 22 20 2b 20 75 73 69 5f 63 6f 6f 6b 69 65 73 2e 67 65 74 28 22 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 22 29 3b 0d 0a 09 09 09 09 09 69 66 20 28 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 64 65 62 75 67 29 20 75 73 69 5f 61 70 70 65 6e 64 20 2b 3d 20 22 26 75 73 69 5f 72 65 66 65 72 72 65 72 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6c 6f 63 61 74 69 6f 6e Data Ascii: );else if (typeof usi_cookies !== 'undefined' && usi_cookies.get("usi_force_date") != null) usi_append = "&usi_force_date=" + usi_cookies.get("usi_force_date");if (usi_commons.debug) usi_append += "&usi_referrer="+encodeURIComponent(location
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 32 30 30 30 0d 0a 70 6f 72 74 5f 65 72 72 6f 72 28 65 29 3b 0d 0a 09 09 09 7d 0d 0a 09 09 7d 2c 0d 0a 09 09 72 65 6d 6f 76 65 5f 6c 6f 61 64 73 3a 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 09 09 09 74 72 79 20 7b 0d 0a 09 09 09 09 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 75 73 69 5f 6f 62 6a 22 29 20 21 3d 20 6e 75 6c 6c 29 20 7b 0d 0a 09 09 09 09 09 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 75 73 69 5f 6f 62 6a 22 29 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 75 73 69 5f 6f 62 6a 22 29 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3b 0d 0a 09 09 09 09 Data Ascii: 2000port_error(e);}},remove_loads:function() {try {if (document.getElementById("usi_obj") != null) {document.getElementById("usi_obj").parentNode.parentNode.removeChild(document.getElementById("usi_obj").parentNode);
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 22 20 2b 20 75 73 69 48 61 73 68 20 2b 20 22 26 73 69 74 65 49 44 3d 22 20 2b 20 75 73 69 53 69 74 65 49 44 20 2b 20 22 26 6b 65 79 73 3d 22 20 2b 20 75 73 69 4b 65 79 20 2b 20 75 73 69 5f 61 70 70 65 6e 64 3b 0d 0a 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 6c 6f 61 64 5f 73 63 72 69 70 74 28 73 6f 75 72 63 65 2c 20 63 61 6c 6c 62 61 63 6b 29 3b 0d 0a 09 09 09 09 69 66 20 28 74 79 70 65 6f 66 28 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 75 73 69 5f 6c 6f 61 64 73 29 20 3d 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 20 7b 0d 0a 09 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 75 73 69 5f 6c 6f 61 64 73 20 3d 20 7b 7d 3b 0d 0a 09 09 09 09 7d 0d 0a 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 75 73 69 5f 6c 6f 61 64 73 5b 75 73 69 53 69 74 65 49 44 5d Data Ascii: " + usiHash + "&siteID=" + usiSiteID + "&keys=" + usiKey + usi_append;usi_commons.load_script(source, callback);if (typeof(usi_commons.usi_loads) === "undefined") {usi_commons.usi_loads = {};}usi_commons.usi_loads[usiSiteID]
2024-02-22 12:06:46 UTC	1252	IN	Data Raw: 63 69 61 74 69 6f 6e 5f 73 69 74 65 49 44 27 2c 20 27 70 69 64 27 2c 20 27 6c 65 73 73 5f 65 78 70 65 6e 73 69 76 65 27 2c 20 27 72 6f 77 73 27 2c 20 27 64 61 79 73 5f 62 61 63 6b 27 2c 20 27 66 6f 72 63 65 5f 65 78 61 63 74 27 2c 20 27 6d 61 74 63 68 27 2c 20 27 6e 6f 6d 61 74 63 68 27 2c 20 27 6e 61 6d 65 5f 66 72 6f 6d 27 2c 20 27 69 6d 61 67 65 5f 66 72 6f 6d 27 2c 20 27 70 72 69 63 65 5f 66 72 6f 6d 27 2c 20 27 75 72 6c 5f 66 72 6f 6d 27 2c 20 27 65 78 74 72 61 5f 66 72 6f 6d 27 2c 20 27 63 75 73 74 6f 6d 5f 63 61 6c 6c 62 61 63 6b 27 2c 20 27 61 6c 6c 6f 77 5f 64 75 70 65 5f 6e 61 6d 65 73 27 2c 20 27 65 78 70 69 72 65 5f 73 65 63 6f 6e 64 73 27 2c 20 27 6e 61 6d 65 27 5d 3b 0d 0a 09 09 09 09 70 61 72 61 6d 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 Data Ascii: ciation_siteID', 'pid', 'less_expensive', 'rows', 'days_back', 'force_exact', 'match', 'nomatch', 'name_from', 'image_from', 'price_from', 'url_from', 'extra_from', 'custom_callback', 'allow_dupe_names', 'expire_seconds', 'name'];params.forEach(func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49814	142.251.40.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	1129	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; test_cookie=CheckForPermission
2024-02-22 12:06:47 UTC	2519	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"5683113434513388650","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:06:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUnvA1VWlW_otC7R9Y3IFpBga56vkdaCplK6U1sUB7DcafNrVJ9NQ7m7Mz7H; expires=Sat, 21-Feb-2026 12:06:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49798	184.29.132.67	443

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-22 12:06:46 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=26368 Date: Thu, 22 Feb 2024 12:06:46 GMT Content-Length: 55 Connection: close X-CID: 2
2024-02-22 12:06:46 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49813	63.140.39.150	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:46 UTC	1377	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s42186399204533?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A43%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aothers%3Alp-safe-emailing&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=others&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aothers%3Alp-safe-emailing&v59=D%3Dc59&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:46 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:06:46 GMT expires: Wed, 21 Feb 2024 12:06:46 GMT last-modified: Fri, 23 Feb 2024 12:06:46 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198305582317568-4617795268062116814 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:06:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49747	69.147.82.60	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:47 UTC	516	OUT	GET /wi/ytc.js HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:47 UTC	945	IN	HTTP/1.1 200 OK x-amz-id-2: kkBQ0VDrMcNTkWglqZ8e5t4NaKckjav3YmglvFBhwZ4F9dGmhTntcXA+RXIfM47B5dz8bqoclSs= x-amz-request-id: BDA1TKZXF4FRSH0C Date: Thu, 22 Feb 2024 11:52:30 GMT Last-Modified: Mon, 26 Jun 2023 09:26:35 GMT x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle" ETag: "5c6ed25dce803fd84288922b8928409e" x-amz-server-side-encryption: AES256 Cache-Control: public,max-age=3600 x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW Accept-Ranges: bytes Content-Type: application/javascript Server: ATS Content-Length: 18187 Referrer-Policy: no-referrer-when-downgrade Vary: Origin Age: 858 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 6e 2e 6d 3d 65 2c 6e 2e 63 3d 74 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 6e 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 6e 2e 72 3d 66 75 6e Data Ascii: !function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=fun
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 41 74 28 61 29 29 3e 3d 35 36 33 32 30 26 26 6f 3c 3d 35 37 33 34 33 29 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 33 39 2c 72 5b 6e 2b 3d 31 5d 3d 31 39 31 2c 72 5b 6e 2b 3d 31 5d 3d 31 38 39 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 61 2b 3d 31 2c 28 69 3d 31 30 32 34 2a 28 69 2d 35 35 32 39 36 29 2b 6f 2d 35 36 33 32 30 2b 36 35 35 33 36 29 3e 36 35 35 33 35 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 34 30 7c 69 3e 3e 3e 31 38 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 31 32 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 36 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 36 33 26 69 3b 63 6f 6e 74 69 6e 75 65 7d 7d 69 3c 3d 31 32 37 3f 72 5b 6e 2b 3d 31 5d 3d 30 7c 69 3a 69 3c 3d 32 30 34 37 3f 28 72 5b 6e 2b 3d 31 5d 3d 31 39 32 7c 69 3e 3e 3e 36 2c 72 Data Ascii: At(a))>=56320&&o<=57343)){r[n+=1]=239,r[n+=1]=191,r[n+=1]=189;continue}if(a+=1,(i=1024*(i-55296)+o-56320+65536)>65535){r[n+=1]=240\|i>>>18,r[n+=1]=128\|i>>>12&63,r[n+=1]=128\|i>>>6&63,r[n+=1]=128\|63&i;continue}}i<=127?r[n+=1]=0\|i:i<=2047?(r[n+=1]=192\|i>>>6,r
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 61 29 7b 69 66 28 21 74 28 61 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 72 61 79 2e 66 72 6f 6d 3a 20 77 68 65 6e 20 70 72 6f 76 69 64 65 64 2c 20 74 68 65 20 73 65 63 6f 6e 64 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 28 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 66 6f 72 28 76 61 72 20 73 2c 75 3d 72 28 69 2e 6c 65 6e 67 74 68 29 2c 64 3d 74 28 6e 29 3f 4f 62 6a 65 63 74 28 6e 65 77 20 6e 28 75 29 29 3a 6e 65 77 20 41 72 72 61 79 28 75 29 2c 63 3d 30 3b 63 3c 75 3b 29 73 3d 69 5b 63 5d 2c 64 5b 63 5d 3d 61 3f 76 Data Ascii: arguments[1]:void 0;if(void 0!==a){if(!t(a))throw new TypeError("Array.from: when provided, the second argument must be a function");arguments.length>2&&(o=arguments[2])}for(var s,u=r(i.length),d=t(n)?Object(new n(u)):new Array(u),c=0;c<u;)s=i[c],d[c]=a?v
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 63 68 28 65 29 7b 7d 69 66 28 6e 3d 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 62 72 65 61 6b 3b 6e 3d 6e 2e 70 61 72 65 6e 74 7d 72 65 74 75 72 6e 20 74 7d 28 74 29 3b 69 66 28 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 76 28 65 29 3b 76 61 72 20 6f 3d 7b 7d 2c 61 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 22 22 3b 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 3d 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 77 69 6e 64 6f 77 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 7b 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3a 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 61 2c 76 65 72 73 69 6f 6e 3a 69 2c 63 61 6c 6c 49 64 3a 72 7d 7d 3b 6e 5b 72 5d 3d 6f 2c 6c 28 74 2c 73 2c 22 2a 22 29 Data Ascii: ch(e){}if(n===window.top)break;n=n.parent}return t}(t);if(!i)return void v(e);var o={},a=Math.random()+"";"__tcfapiLocator"===t?function(e,t,n,r){window[e]=function(e,i,o,a){var s={__tcfapiCall:{command:e,parameter:a,version:i,callId:r}};n[r]=o,l(t,s,"*")
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 6e 67 3a 6e 2e 75 73 70 53 74 72 69 6e 67 2c 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 3a 6e 2e 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 7d 2c 21 30 29 3a 65 28 76 6f 69 64 20 30 2c 21 31 29 7d 29 29 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3b 6d 28 22 5f 5f 74 63 66 61 70 69 22 2c 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 2c 22 5f 5f 74 63 66 61 70 69 43 61 6c 6c 22 2c 22 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3f 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 3f 28 68 28 65 29 2c 76 28 22 5f 5f 74 63 66 61 70 69 22 29 29 3a 67 28 29 7d 2c 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 76 6f 69 64 20 30 2c 21 Data Ascii: ng:n.uspString,isOathFirstParty:n.isOathFirstParty},!0):e(void 0,!1)})))},y=function(){var e,t;m("__tcfapi","__tcfapiLocator","__tcfapiCall","__tcfapiReturn"),window.__tcfapi?(e=function(e,t){t?(h(e),v("__tcfapi")):g()},t=setTimeout((function(){e(void 0,!
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 3a 22 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 2d 4a 61 6e 2d 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 22 2c 6e 3d 65 2e 6e 61 6d 65 2b 22 3d 22 2b 65 2e 76 61 6c 75 65 2b 74 2b 22 3b 20 70 61 74 68 3d 22 2b 65 2e 70 61 74 68 2b 28 22 22 21 3d 3d 65 2e 64 6f 6d 61 69 6e 3f 22 3b 20 64 6f 6d 61 69 6e 3d 2e 22 2b 65 2e 64 6f 6d 61 69 6e 3a 22 22 29 2b 22 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 7d 28 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 74 2c 65 78 70 69 72 79 4f 66 66 73 65 74 3a 6e 2c 64 6f 6d 61 69 6e 3a 61 28 29 2c 70 61 74 68 3a 22 2f 22 7d 29 3b 76 61 72 20 72 3d 7b 69 64 3a 74 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 Data Ascii: .toGMTString():"; expires=Thu, 01-Jan-1970 00:00:01 GMT",n=e.name+"="+e.value+t+"; path="+e.path+(""!==e.domain?"; domain=."+e.domain:"")+"; SameSite=Lax",document.cookie=n}({name:e,value:t,expiryOffset:n,domain:a(),path:"/"});var r={id:t,timestamp:(new D
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 29 7d 7d 76 61 72 20 48 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 67 65 2e 70 6c 61 69 6e 41 75 69 64 73 29 7b 76 61 72 20 72 3d 41 72 72 61 79 2e 66 72 6f 6d 28 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 65 5b 74 5d 29 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 70 61 64 53 74 61 72 74 28 32 2c 22 30 22 29 7d 29 29 3b 67 65 2e 68 61 73 68 65 64 41 75 69 64 73 5b 6e 5d 3d 72 2e 6a 6f 69 6e 28 22 22 29 2c 74 2b 2b 7d 67 65 2e 61 75 69 64 73 41 72 65 48 61 73 68 65 64 3d 21 30 2c 79 65 28 29 7d 2c 4d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 Data Ascii: )}}var H=function(e){var t=0;for(var n in ge.plainAuids){var r=Array.from(new Uint8Array(e[t])).map((function(e){return e.toString(16).padStart(2,"0")}));ge.hashedAuids[n]=r.join(""),t++}ge.auidsAreHashed=!0,ye()},M=function(e,t){var n=function(n){t.push(
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 3b 72 65 74 75 72 6e 28 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2e 73 75 62 74 6c 65 2e 64 69 67 65 73 74 28 22 53 48 41 2d 32 35 36 22 2c 74 29 7d 3b 76 61 72 20 56 2c 7a 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 59 28 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2c 6e 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 77 69 2f 63 6f 6e 66 69 67 2f 22 2b 65 2b 22 2e 6a 73 6f 6e 22 3b 74 2e 6f 70 65 6e 28 22 47 45 54 22 2c 6e 2c 21 30 29 2c 74 2e 74 69 6d 65 6f 75 74 3d 32 65 33 2c 74 2e 6f 6e 74 69 6d 65 6f 75 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 71 2d 2d 2c 79 65 28 29 7d 2c 74 2e 73 65 6e 64 28 29 2c 74 2e Data Ascii: ;return(window.crypto\|\|window.msCrypto).subtle.digest("SHA-256",t)};var V,z=!1;function Y(e){if(void 0!==e){var t=new XMLHttpRequest,n="https://s.yimg.com/wi/config/"+e+".json";t.open("GET",n,!0),t.timeout=2e3,t.ontimeout=function(e){q--,ye()},t.send(),t.
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 6d 61 69 6c 26 26 28 74 2e 75 73 65 72 45 6d 61 69 6c 3d 67 65 2e 65 6d 61 69 6c 73 5b 74 2e 70 69 78 65 6c 49 64 5d 29 2c 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 26 26 28 49 65 28 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7c 7c 64 65 6c 65 74 65 20 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7d 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 6e 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 2c 74 2e 6c 65 6e 67 74 68 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 5a 28 74 29 7d 3b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 65 29 65 5b 72 5d 2e 6f 6e 63 6f 6d 70 6c 65 74 65 3d 6e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b Data Ascii: mail&&(t.userEmail=ge.emails[t.pixelId]),t.userHashedEmail&&(Ie(t.userHashedEmail)\|\|delete t.userHashedEmail)}var $=function(e,t){var n=function(n){t.push(n.target.result),t.length===e.length&&Z(t)};for(var r in e)e[r].oncomplete=n},Z=function(e){var t=0;
2024-02-22 12:06:47 UTC	1300	IN	Data Raw: 6f 6d 70 6f 6e 65 6e 74 28 70 61 72 73 65 49 6e 74 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 2f 36 30 2c 31 30 29 2b 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 3c 74 2e 79 77 61 53 74 61 6e 64 61 72 64 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 3f 22 64 22 3a 22 22 29 29 29 2c 65 2e 6a 6f 69 6e 28 22 22 29 7d 28 29 29 2c 72 2e 6a 6f 69 6e 28 22 22 29 7d 76 61 72 20 72 65 3d 5b 7b 6e 61 6d 65 3a 22 74 65 61 6c 69 75 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 75 74 61 67 5f 64 61 74 61 22 7d 2c 7b 6e 61 6d 65 3a 22 67 74 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 67 6f 6f 67 6c 65 5f 74 61 67 5f 6d 61 6e 61 67 65 72 22 7d 2c 7b 6e 61 6d 65 3a 22 61 64 6f 62 65 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 5f 73 61 74 65 Data Ascii: omponent(parseInt(t.getTimezoneOffset()/60,10)+(t.getTimezoneOffset()<t.ywaStandardTimezoneOffset?"d":""))),e.join("")}()),r.join("")}var re=[{name:"tealium",interface:"utag_data"},{name:"gtm",interface:"google_tag_manager"},{name:"adobe",interface:"_sate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49818	157.240.241.1	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	534	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:48 UTC	2013	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy" permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin
2024-02-22 12:06:48 UTC	615	IN	Data Raw: 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 65 6d 62 65 64 64 65 72 2d 70 6f 6c 69 63 79 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 3a 20 72 65 71 75 69 72 65 2d 63 6f 72 70 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 65 70 5f 72 65 70 6f 72 74 22 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 6f 70 65 6e 65 72 2d 70 6f 6c 69 63 79 3a 20 73 61 6d 65 2d 6f 72 69 67 69 6e 2d 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 0d 0a 50 72 61 67 6d 61 3a 20 70 75 62 6c 69 63 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 31 32 30 30 0d 0a 45 78 70 69 72 65 73 3a 20 53 61 74 2c 20 30 31 20 4a 61 6e 20 32 30 30 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 58 2d 43 6f Data Ascii: cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"Pragma: publicCache-Control: public, max-age=1200Expires: Sat, 01 Jan 2000 00:00:00 GMTX-Co
2024-02-22 12:06:48 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-02-22 12:06:48 UTC	15051	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-02-22 12:06:48 UTC	16384	IN	Data Raw: 47 4c 4f 42 41 4c 5f 56 41 52 49 41 42 4c 45 22 29 72 65 74 75 72 6e 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 63 2c 65 76 65 6e 74 5f 74 79 70 65 3a 64 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 22 47 4c 4f 42 41 4c 5f 56 41 52 49 41 42 4c 45 22 2c 69 64 3a 62 7d 3b 69 66 28 66 3d 3d 3d 22 47 54 4d 22 29 72 65 74 75 72 6e 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 63 2c 65 76 65 6e 74 5f 74 79 70 65 3a 64 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 22 47 54 4d 22 2c 69 64 3a 62 7d 3b 69 66 28 66 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 29 72 65 74 75 72 6e 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 63 2c 65 76 65 6e 74 5f 74 79 70 65 3a 64 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 22 4a 53 4f 4e 5f 4c 44 22 2c 69 64 3a 62 7d 3b 69 66 28 66 3d 3d 3d 22 4d 45 54 41 Data Ascii: GLOBAL_VARIABLE")return{domain_uri:c,event_type:d,extractor_type:"GLOBAL_VARIABLE",id:b};if(f==="GTM")return{domain_uri:c,event_type:d,extractor_type:"GTM",id:b};if(f==="JSON_LD")return{domain_uri:c,event_type:d,extractor_type:"JSON_LD",id:b};if(f==="META
2024-02-22 12:06:48 UTC	16384	IN	Data Raw: 50 72 69 76 61 63 79 53 61 6e 64 62 6f 78 3a 5b 22 70 72 69 76 61 63 79 73 61 6e 64 62 6f 78 22 5d 2c 43 6c 69 65 6e 74 48 69 6e 74 3a 5b 22 63 6c 69 65 6e 74 68 69 6e 74 22 5d 2c 43 43 52 75 6c 65 45 76 61 6c 75 61 74 6f 72 3a 5b 22 63 63 72 75 6c 65 65 76 61 6c 75 61 74 6f 72 22 5d 2c 50 72 6f 68 69 62 69 74 65 64 50 69 78 65 6c 73 3a 5b 22 70 72 6f 68 69 62 69 74 65 64 70 69 78 65 6c 73 22 5d 2c 4c 61 73 74 45 78 74 65 72 6e 61 6c 52 65 66 65 72 72 65 72 3a 5b 22 6c 61 73 74 65 78 74 65 72 6e 61 6c 72 65 66 65 72 72 65 72 22 5d 2c 43 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 3a 5b 22 63 6f 6f 6b 69 65 64 65 70 72 65 63 61 74 69 6f 6e 6c 61 62 65 6c 22 5d 2c 55 6e 77 61 6e 74 65 64 45 76 65 6e 74 73 3a 5b 22 75 6e 77 61 6e 74 65 64 Data Ascii: PrivacySandbox:["privacysandbox"],ClientHint:["clienthint"],CCRuleEvaluator:["ccruleevaluator"],ProhibitedPixels:["prohibitedpixels"],LastExternalReferrer:["lastexternalreferrer"],CookieDeprecationLabel:["cookiedeprecationlabel"],UnwantedEvents:["unwanted
2024-02-22 12:06:48 UTC	16384	IN	Data Raw: 64 26 26 67 2e 68 65 61 64 2e 66 69 72 73 74 43 68 69 6c 64 26 26 67 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 6a 2e 65 78 70 6f 72 74 73 3d 7b 43 4f 4e 46 49 47 3a 61 2c 6c 6f 61 64 4a 53 46 69 6c 65 3a 65 7d 7d 29 28 29 3b 72 65 74 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4c 65 67 61 63 79 45 78 70 65 72 69 6d 65 6e 74 47 72 6f 75 70 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 6a 2c 6b 29 7b 76 61 72 20 6c 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6c 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 Data Ascii: d&&g.head.firstChild&&g.head.appendChild(d)}j.exports={CONFIG:a,loadJSFile:e}})();return j.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsLegacyExperimentGroupsTypedef",function(){return function(g,h,j,k){var l={exports:{}};l.exports;(functi
2024-02-22 12:06:48 UTC	1500	IN	Data Raw: 45 72 72 6f 72 28 22 45 6d 70 74 79 20 63 6f 6f 6b 69 65 20 70 61 79 6c 6f 61 64 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 61 28 7b 63 72 65 61 74 69 6f 6e 54 69 6d 65 3a 69 2c 70 61 79 6c 6f 61 64 3a 66 2c 73 75 62 64 6f 6d 61 69 6e 49 6e 64 65 78 3a 68 7d 29 7d 63 61 74 63 68 28 61 29 7b 62 28 61 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 7d 5d 29 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 6d 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6d 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: Error("Empty cookie payload");return new a({creationTime:i,payload:f,subdomainIndex:h})}catch(a){b(a);return null}}}]);return a}();m.exports=a})();return m.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsPixelTypedef",function(){return functi
2024-02-22 12:06:48 UTC	14884	IN	Data Raw: 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4c 6f 67 67 69 6e 67 22 29 3b 76 61 72 20 65 3d 62 2e 6c 6f 67 45 72 72 6f 72 2c 67 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 6c 75 67 69 6e 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6a 28 61 29 7b 72 65 74 75 72 6e 22 66 62 65 76 65 6e 74 73 2e 70 6c 75 67 69 6e 73 2e 22 2b 61 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 22 66 62 65 76 65 6e 74 73 22 29 72 65 74 75 72 6e 20 6e 65 77 20 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 67 29 72 65 74 75 72 6e 20 62 3b 69 66 28 62 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 62 3d 3d 3d 22 75 6e 64 65 66 Data Ascii: les("SignalsFBEventsLogging");var e=b.logError,g=f.getFbeventsModules("SignalsFBEventsPlugin");function j(a){return"fbevents.plugins."+a}function k(a,b){if(a==="fbevents")return new g(function(){});if(b instanceof g)return b;if(b==null\|\|(typeof b==="undef
2024-02-22 12:06:48 UTC	16384	IN	Data Raw: 6a 3b 69 66 28 68 7c 7c 69 2e 6c 65 6e 67 74 68 3c 65 29 7b 6a 3d 6e 65 77 20 49 6d 61 67 65 28 29 3b 66 21 3d 6e 75 6c 6c 26 26 66 2e 65 72 72 6f 72 48 61 6e 64 6c 65 72 21 3d 6e 75 6c 6c 26 26 28 6a 2e 6f 6e 65 72 72 6f 72 3d 66 2e 65 72 72 6f 72 48 61 6e 64 6c 65 72 29 3b 68 3d 62 2e 74 72 69 67 67 65 72 28 63 29 3b 64 28 68 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 29 26 26 28 6a 2e 72 65 66 65 72 72 65 72 50 6f 6c 69 63 79 3d 22 6f 72 69 67 69 6e 22 29 3b 67 26 26 6a 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 74 74 72 69 62 75 74 69 6f 6e 73 72 63 22 2c 22 22 29 3b 6a 2e 73 72 63 3d 69 3b 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 31 7d 63 61 74 63 68 28 61 29 7b 72 65 74 75 72 6e 21 31 7d 7d 6b 2e 65 78 70 6f 72 74 Data Ascii: j;if(h\|\|i.length<e){j=new Image();f!=null&&f.errorHandler!=null&&(j.onerror=f.errorHandler);h=b.trigger(c);d(h,function(a){return a})&&(j.referrerPolicy="origin");g&&j.setAttribute("attributionsrc","");j.src=i;return!0}return!1}catch(a){return!1}}k.export
2024-02-22 12:06:48 UTC	16384	IN	Data Raw: 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 63 3d 62 2e 63 6f 65 72 63 65 2c 64 3d 62 2e 54 79 70 65 64 2c 65 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 3b 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 Data Ascii: xports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsTyped"),c=b.coerce,d=b.Typed,e=f.getFbeventsModules("SignalsFBEventsPixelTypedef");b=f.getFbeventsModules("SignalsF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49817	142.250.65.194	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	1464	OUT	GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; test_cookie=CheckForPermission
2024-02-22 12:06:48 UTC	967	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM; expires=Sat, 21-Feb-2026 12:06:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:48 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-22 12:06:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49821	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	1453	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; test_cookie=CheckForPermission
2024-02-22 12:06:48 UTC	1374	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://4711400.fls.doubleclick.net/activityi;dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49826	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	660	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9975a534a66e6e60fea127a62c73d6c7" If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
2024-02-22 12:06:48 UTC	364	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:06:48 GMT Via: 1.1 varnish Cache-Control: max-age=0,must-revalidate ETag: "9975a534a66e6e60fea127a62c73d6c7" Age: 5 X-Served-By: cache-lga21924-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1708603609.683556,VS0,VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49823	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	606	OUT	GET /logos/static/powered_by_logo.svg HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:48 UTC	829	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:48 GMT Content-Type: image/svg+xml Content-Length: 5194 Connection: close Content-MD5: Y+c301RBZNK39PvKQWrIBw== Last-Modified: Thu, 22 Feb 2024 03:32:39 GMT ETag: 0x8DC3356EBC9CD17 x-ms-request-id: 5d0ab5da-301e-0046-2543-650d04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8708 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971aea4aff5e7e-EWR
2024-02-22 12:06:48 UTC	540	IN	Data Raw: 3c 73 76 67 20 68 65 69 67 68 74 3d 22 31 36 22 20 77 69 64 74 68 3d 22 31 33 36 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 36 20 31 34 2e 36 22 3e 3c 64 65 66 73 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 64 3d 22 4d 35 33 2e 37 36 20 30 48 31 33 36 76 31 34 2e 36 48 35 33 2e 37 36 7a 22 2f 3e 3c 2f 63 6c 69 70 50 61 74 68 3e 3c 2f 64 65 66 73 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 31 32 2e 33 56 35 2e 35 39 68 32 2e 32 37 61 32 2e 36 32 20 32 2e 36 32 20 30 20 30 31 31 2e 32 39 2e 32 38 20 31 2e 38 33 20 31 2e 38 33 20 Data Ascii: <svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83
2024-02-22 12:06:48 UTC	1369	IN	Data Raw: 32 2e 32 39 20 30 20 30 31 2d 2e 38 2d 2e 39 31 20 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 38 2d 31 2e 33 36 20 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 2e 32 38 2d 31 2e 33 37 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 2d 31 2e 32 34 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 20 31 2e 32 34 41 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 31 30 20 39 2e 38 31 61 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 39 20 31 2e 33 36 20 32 2e 31 31 20 32 2e 31 31 20 30 20 30 31 2d 32 20 31 2e 32 33 7a 6d 30 2d 2e 36 39 61 31 2e 33 31 20 31 2e 33 31 20 30 20 30 30 2e 38 35 2d 2e 32 37 20 31 2e 36 20 31 2e 36 20 30 20 30 30 2e 35 2d 2e 36 39 20 32 2e 39 20 32 2e 39 20 30 20 30 30 2e 31 36 2d 2e 39 34 20 32 2e 38 35 20 32 2e 38 35 20 30 20 30 Data Ascii: 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.6 0 00.5-.69 2.9 2.9 0 00.16-.94 2.85 2.85 0 0
2024-02-22 12:06:48 UTC	1369	IN	Data Raw: 20 30 31 2e 38 2d 2e 39 32 41 32 2e 30 35 20 32 2e 30 35 20 30 20 30 31 32 39 20 37 2e 32 61 32 2e 35 34 20 32 2e 35 34 20 30 20 30 31 2e 37 37 2e 31 33 20 31 2e 39 20 31 2e 39 20 30 20 30 31 2e 37 2e 34 33 20 31 2e 39 34 20 31 2e 39 34 20 30 20 30 31 2e 35 2e 37 37 20 33 2e 31 39 20 33 2e 31 39 20 30 20 30 31 2e 31 39 20 31 2e 31 39 56 31 30 68 2d 33 2e 38 35 76 2d 2e 36 32 68 33 2e 30 39 61 31 2e 35 35 20 31 2e 35 35 20 30 20 30 30 2d 2e 31 37 2d 2e 37 36 20 31 2e 32 38 20 31 2e 32 38 20 30 20 30 30 2d 2e 34 37 2d 2e 35 33 41 31 2e 33 35 20 31 2e 33 35 20 30 20 30 30 32 39 20 37 2e 39 61 31 2e 33 39 20 31 2e 33 39 20 30 20 30 30 2d 2e 38 2e 32 32 20 31 2e 37 33 20 31 2e 37 33 20 30 20 30 30 2d 2e 35 32 2e 35 39 20 31 2e 37 38 20 31 2e 37 38 20 30 20 30 Data Ascii: 01.8-.92A2.05 2.05 0 0129 7.2a2.54 2.54 0 01.77.13 1.9 1.9 0 01.7.43 1.94 1.94 0 01.5.77 3.19 3.19 0 01.19 1.19V10h-3.85v-.62h3.09a1.55 1.55 0 00-.17-.76 1.28 1.28 0 00-.47-.53A1.35 1.35 0 0029 7.9a1.39 1.39 0 00-.8.22 1.73 1.73 0 00-.52.59 1.78 1.78 0 0
2024-02-22 12:06:48 UTC	1369	IN	Data Raw: 2e 35 39 20 30 20 31 2e 34 36 20 31 2e 34 36 20 30 20 30 30 2e 34 39 2d 2e 36 39 20 32 2e 35 35 20 32 2e 35 35 20 30 20 30 30 2e 31 37 2d 31 20 32 2e 35 39 20 32 2e 35 39 20 30 20 30 30 2d 2e 31 36 2d 2e 39 35 20 31 2e 34 35 20 31 2e 34 35 20 30 20 30 30 2d 2e 34 39 2d 2e 36 38 41 31 2e 32 39 20 31 2e 32 39 20 30 20 30 30 34 33 20 37 2e 39 61 31 2e 33 36 20 31 2e 33 36 20 30 20 30 30 2d 2e 37 39 2e 32 33 20 31 2e 34 37 20 31 2e 34 37 20 30 20 30 30 2d 2e 34 38 2e 36 37 20 32 2e 36 38 20 32 2e 36 38 20 30 20 30 30 2d 2e 31 38 2e 39 38 7a 6d 35 2e 31 38 20 34 2e 34 61 31 2e 39 20 31 2e 39 20 30 20 30 31 2d 2e 33 35 20 30 6c 2d 2e 32 31 2d 2e 30 36 2e 32 2d 2e 36 38 61 31 2e 32 39 20 31 2e 32 39 20 30 20 30 30 2e 35 2e 30 35 2e 35 36 2e 35 36 20 30 20 30 30 Data Ascii: .59 0 1.46 1.46 0 00.49-.69 2.55 2.55 0 00.17-1 2.59 2.59 0 00-.16-.95 1.45 1.45 0 00-.49-.68A1.29 1.29 0 0043 7.9a1.36 1.36 0 00-.79.23 1.47 1.47 0 00-.48.67 2.68 2.68 0 00-.18.98zm5.18 4.4a1.9 1.9 0 01-.35 0l-.21-.06.2-.68a1.29 1.29 0 00.5.05.56.56 0 00
2024-02-22 12:06:48 UTC	547	IN	Data Raw: 34 2e 34 36 20 38 33 2e 35 34 20 34 2e 34 36 7a 4d 31 30 35 2e 35 38 20 33 76 32 2e 33 35 63 2d 2e 37 38 20 30 2d 31 2e 30 39 2d 2e 30 37 2d 31 2e 33 36 2d 2e 30 37 2d 31 2e 36 35 20 30 2d 32 2e 37 31 2e 37 32 2d 33 2e 30 36 20 32 2e 37 38 61 37 2e 38 35 20 37 2e 38 35 20 30 20 30 30 2d 2e 30 39 20 31 2e 31 39 76 35 2e 31 34 68 2d 32 2e 33 33 56 33 68 32 2e 31 32 76 33 2e 35 38 61 31 34 2e 39 20 31 34 2e 39 20 30 20 30 31 2e 37 39 2d 32 41 32 2e 35 39 20 32 2e 35 39 20 30 20 30 31 31 30 34 20 33 7a 6d 32 37 2e 34 39 20 38 2e 38 35 63 30 20 2e 37 35 2e 32 37 20 31 20 31 20 31 68 31 2e 39 31 76 31 2e 34 39 68 2d 32 2e 37 32 61 32 2e 32 36 20 32 2e 32 36 20 30 20 30 31 2d 32 2e 34 38 2d 32 2e 34 39 56 34 2e 36 33 68 2d 32 2e 32 37 56 33 2e 33 31 68 31 2e 31 Data Ascii: 4.46 83.54 4.46zM105.58 3v2.35c-.78 0-1.09-.07-1.36-.07-1.65 0-2.71.72-3.06 2.78a7.85 7.85 0 00-.09 1.19v5.14h-2.33V3h2.12v3.58a14.9 14.9 0 01.79-2A2.59 2.59 0 01104 3zm27.49 8.85c0 .75.27 1 1 1h1.91v1.49h-2.72a2.26 2.26 0 01-2.48-2.49V4.63h-2.27V3.31h1.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49824	69.147.82.60	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	557	OUT	GET /wi/config/10156543.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:48 UTC	776	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id: Y1E5MDR76HRQZ6X3 x-amz-id-2: /uqjVoiAzcWd99KJFnCn9MW0fn4A+92Stq051jZuWjO+BLWEWKgbml16DYjoMVQL8DT7f+GeZvpJ/yCztpgeNq0X7LIBU7PpI7x0ocwvxvI= Content-Type: application/json Date: Thu, 22 Feb 2024 12:03:10 GMT Server: ATS Referrer-Policy: no-referrer-when-downgrade Cache-Control: public,max-age=3600 Content-Length: 2 Age: 218 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-02-22 12:06:48 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49828	18.164.96.97	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:48 UTC	580	OUT	GET /sessions/470805?s=0.25&r=0.20568012387113743 HTTP/1.1 Host: vc.hotjar.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:48 UTC	371	IN	HTTP/1.1 204 No Content Connection: close Access-Control-Allow-Origin: * Cache-Control: no-store Date: Thu, 22 Feb 2024 12:06:48 GMT Server: Python/3.8 aiohttp/3.9.3 X-Cache: Miss from cloudfront Via: 1.1 0ac640943c2918c03a0350f4e8b083a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: j9cwU1aGzhgh1hka4dUrlpYa2wuP4d0pCfRzQZHPBrJCGlzqqKTeQQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49829	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:49 UTC	1528	OUT	GET /activityi;dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:49 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:49 GMT Expires: Thu, 22 Feb 2024 12:06:49 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:49 UTC	589	IN	Data Raw: 33 36 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 49 6d 68 6a 4c 6e 30 76 6f 51 44 46 54 Data Ascii: 362<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CImhjLn0voQDFT
2024-02-22 12:06:49 UTC	284	IN	Data Raw: 6d 69 75 6d 25 33 42 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 65 6e 2d 75 73 25 32 46 6c 70 2d 73 61 66 65 2d 65 6d 61 69 6c 69 6e 67 25 33 46 66 75 6c 6c 5f 74 72 53 72 63 25 33 44 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 25 32 36 75 74 6d 5f 6d 65 64 69 75 6d 25 33 44 65 6d 61 69 6c 25 32 36 75 74 6d 5f 73 6f 75 72 63 65 25 33 44 6c 69 6e 6b 25 32 36 75 74 6d 5f 63 61 6d 70 61 69 67 6e 25 33 44 73 69 67 2d 65 6d 61 69 6c 25 32 36 75 74 6d 5f 63 6f 6e 74 65 6e 74 25 33 44 65 Data Ascii: mium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3De
2024-02-22 12:06:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49832	157.240.241.1	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:49 UTC	1275	OUT	GET /signals/config/334783782127169?v=2.9.147&r=stable&domain=www.avast.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:49 UTC	2013	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy" permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin
2024-02-22 12:06:49 UTC	640	IN	Data Raw: 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 65 6d 62 65 64 64 65 72 2d 70 6f 6c 69 63 79 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 3a 20 72 65 71 75 69 72 65 2d 63 6f 72 70 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 65 70 5f 72 65 70 6f 72 74 22 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 6f 70 65 6e 65 72 2d 70 6f 6c 69 63 79 3a 20 73 61 6d 65 2d 6f 72 69 67 69 6e 2d 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 0d 0a 50 72 61 67 6d 61 3a 20 70 75 62 6c 69 63 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 31 32 30 30 0d 0a 45 78 70 69 72 65 73 3a 20 53 61 74 2c 20 30 31 20 4a 61 6e 20 32 30 30 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 58 2d 43 6f Data Ascii: cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"Pragma: publicCache-Control: public, max-age=1200Expires: Sat, 01 Jan 2000 00:00:00 GMTX-Co
2024-02-22 12:06:49 UTC	860	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 46 4f 52 20 41 4e 59 20 43 4c 41 49 4d 2c 20 44 41 4d 41 47 45 53 20 4f 52 20 4f 54 48 45 52 20 4c 49 41 42 49 4c 49 54 59 2c 20 57 48 45 54 48 45 52 0a 2a 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f 52 20 4f 54 48 45 52 57 49 53 45 2c 20 41 52 49 53 49 4e 47 20 46 52 4f 4d 2c 20 4f 55 54 20 4f 46 20 4f 52 20 49 4e 0a 2a 20 43 4f 4e 4e 45 43 54 49 4f 4e 20 57 49 54 48 20 54 48 45 20 53 4f 46 54 57 41 52 45 20 4f 52 20 54 48 45 20 55 53 45 20 4f 52 20 4f 54 48 45 52 20 44 45 41 4c 49 4e 47 53 20 49 4e 20 54 48 45 20 53 4f 46 54 57 41 52 45 2e 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 2e 65 78 70 6f 72 74 73 3b 28 66 Data Ascii: FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.*/(function(a,b,c,d){var e={exports:{}};e.exports;(f
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 29 72 65 74 75 72 6e 20 62 3b 65 6c 73 65 20 69 66 28 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 69 6e 20 4f 62 6a 65 63 74 28 62 29 29 72 65 74 75 72 6e 20 61 28 62 2c 63 29 3b 65 6c 73 65 20 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 64 65 73 74 72 75 63 74 75 72 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 22 29 7d 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 6a 28 61 2c 62 29 7b 69 66 28 21 61 29 74 68 72 6f 77 20 6e 65 77 20 52 65 Data Ascii: function(b,c){if(Array.isArray(b))return b;else if((typeof Symbol==="function"?Symbol.iterator:"@@iterator")in Object(b))return a(b,c);else throw new TypeError("Invalid attempt to destructure non-iterable instance")}}();function j(a,b){if(!a)throw new Re
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 65 74 75 72 6e 20 61 7d 3b 66 75 6e 63 74 69 6f 6e 20 62 28 62 2c 63 29 7b 69 66 28 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 62 29 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 63 2c 61 29 26 26 62 5b 61 5d 21 3d 3d 63 5b 61 5d 7d 29 3b 72 65 74 75 72 6e 20 64 3f 6e 75 6c 6c 3a 61 28 7b 7d 2c 62 2c 63 29 7d 6a 2e 65 78 70 6f 72 74 73 3d 62 7d 29 28 29 3b 72 65 74 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 Data Ascii: eturn a};function b(b,c){if(b==null)return null;var d=Object.keys(b).some(function(a){return Object.prototype.hasOwnProperty.call(c,a)&&b[a]!==c[a]});return d?null:a({},b,c)}j.exports=b})();return j.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFB
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 48 54 4d 4c 54 65 78 74 41 72 65 61 45 6c 65 6d 65 6e 74 29 29 7b 63 3d 62 28 64 2c 61 29 3b 63 21 3d 6e 75 6c 6c 26 26 28 65 3d 63 29 7d 7d 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 42 75 74 74 6f 6e 45 6c 65 6d 65 6e 74 3d 3d 3d 21 31 26 26 61 2e 76 61 6c 75 65 3d 3d 3d 22 22 26 26 28 64 2e 76 61 6c 75 65 4d 65 61 6e 69 6e 67 3d 22 65 6d 70 74 79 22 29 3b 72 65 74 75 72 6e 5b 64 2c 65 5d 7d 6b 2e 65 78 70 6f 72 74 73 3d 63 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 74 72 61 63 74 46 72 6f 6d 49 6e 70 75 74 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 Data Ascii: HTMLTextAreaElement)){c=b(d,a);c!=null&&(e=c)}}a instanceof HTMLButtonElement===!1&&a.value===""&&(d.valueMeaning="empty");return[d,e]}k.exports=c})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsExtractFromInputs",function(){re
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 46 65 61 74 75 72 65 43 6f 75 6e 74 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 6c 28 74 68 69 73 2c 61 29 2c 74 68 69 73 2e 5f 66 65 61 74 75 72 65 73 3d 7b 7d 7d 68 28 61 2c 5b 7b 6b 65 79 3a 22 69 6e 63 72 65 6d 65 6e 74 41 6e 64 47 65 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: )});f.ensureModuleRegistered("SignalsFBEventsFeatureCounter",function(){return function(f,g,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=function(){function a(){l(this,a),this._features={}}h(a,[{key:"incrementAndGet",value:function(a
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 2e 6c 65 6e 67 74 68 29 26 26 61 2e 70 75 73 68 28 62 29 29 2c 62 2e 65 6e 64 21 3d 6e 75 6c 6c 26 26 28 62 3d 6e 75 6c 6c 29 29 3b 63 28 61 2e 72 65 76 65 72 73 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 73 74 61 72 74 3b 61 3d 61 2e 65 6e 64 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 64 3d 64 2e 73 6c 69 63 65 28 30 2c 62 29 2b 22 40 22 2b 64 2e 73 6c 69 63 65 28 61 2b 31 29 7d 29 3b 72 65 74 75 72 6e 20 64 7d 76 61 72 20 6a 3d 2f 5b 5c 64 5d 2b 28 5c 2e 5b 5c 64 5d 2b 29 3f 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 61 29 7b 61 3d 61 3b 77 68 69 6c 65 28 2f 5c 64 5c 2e 5c 64 2f 2e 74 65 73 74 28 61 29 29 61 3d 61 2e 72 65 70 6c 61 63 65 28 6a 2c 22 30 22 29 3b 61 3d 61 2e 72 65 70 6c 61 63 65 28 6a 2c 22 30 22 Data Ascii: .length)&&a.push(b)),b.end!=null&&(b=null));c(a.reverse(),function(a){var b=a.start;a=a.end;if(a==null)return;d=d.slice(0,b)+"@"+d.slice(a+1)});return d}var j=/[\d]+(\.[\d]+)?/g;function l(a){a=a;while(/\d\.\d/.test(a))a=a.replace(j,"0");a=a.replace(j,"0"
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 69 72 65 64 2c 64 3d 62 2e 70 69 69 41 75 74 6f 6d 61 74 63 68 65 64 2c 6d 3d 62 2e 70 69 69 43 6f 6e 66 6c 69 63 74 69 6e 67 2c 6e 3d 62 2e 65 78 74 72 61 63 74 50 69 69 3b 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 68 61 72 65 64 22 29 3b 76 61 72 20 6f 3d 62 2e 73 69 67 6e 61 6c 73 43 6f 6e 76 65 72 74 4e 6f 64 65 54 6f 48 54 4d 4c 45 6c 65 6d 65 6e 74 2c 70 3d 62 2e 73 69 67 6e 61 6c 73 45 78 74 72 61 63 74 46 6f 72 6d 2c 71 3d 62 2e 73 69 67 6e 61 6c 73 49 73 49 57 4c 45 6c 65 6d 65 6e 74 2c 72 3d 62 2e 73 69 67 6e 61 6c 73 45 78 74 72 61 63 74 42 75 74 74 6f 6e 46 65 61 74 75 72 65 73 2c 73 3d 62 2e 73 69 67 6e 61 6c 73 47 65 74 54 72 75 6e 63 61 74 65 64 42 75 74 74 6f 6e Data Ascii: ired,d=b.piiAutomatched,m=b.piiConflicting,n=b.extractPii;b=f.getFbeventsModules("SignalsFBEventsShared");var o=b.signalsConvertNodeToHTMLElement,p=b.signalsExtractForm,q=b.signalsIsIWLElement,r=b.signalsExtractButtonFeatures,s=b.signalsGetTruncatedButton
2024-02-22 12:06:49 UTC	1500	IN	Data Raw: 6c 3a 63 2c 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3a 67 7d 29 3b 6a 3d 69 28 65 2c 32 29 3b 6b 3d 6a 5b 30 5d 3b 68 3d 6a 5b 31 5d 3b 66 26 26 28 6b 3d 7b 7d 29 3b 68 3d 3d 6e 75 6c 6c 26 26 6d 2e 74 72 69 67 67 65 72 28 63 29 3b 67 26 26 68 21 3d 6e 75 6c 6c 26 26 46 28 62 2c 63 2c 68 29 3b 69 66 28 66 26 26 28 63 2e 75 73 65 72 44 61 74 61 46 6f 72 6d 46 69 65 6c 64 73 3d 3d 6e 75 6c 6c 7c 7c 41 28 63 2e 75 73 65 72 44 61 74 61 46 6f 72 6d 46 69 65 6c 64 73 29 2e 6c 65 6e 67 74 68 3d 3d 3d 30 29 29 72 65 74 75 72 6e 3b 62 2e 74 72 61 63 6b 53 69 6e 67 6c 65 53 79 73 74 65 6d 28 22 61 75 74 6f 6d 61 74 69 63 22 2c 63 2c 22 53 75 62 73 63 72 69 62 65 64 42 75 74 74 6f 6e 43 6c 69 63 6b 22 2c 6b 29 7d 29 7d 7d 7d 66 75 6e 63 74 69 Data Ascii: l:c,shouldExtractUserData:g});j=i(e,2);k=j[0];h=j[1];f&&(k={});h==null&&m.trigger(c);g&&h!=null&&F(b,c,h);if(f&&(c.userDataFormFields==null\|\|A(c.userDataFormFields).length===0))return;b.trackSingleSystem("automatic",c,"SubscribedButtonClick",k)})}}}functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49830	142.250.176.206	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:49 UTC	942	OUT	POST /v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM HTTP/1.1 Host: ampcid.google.com Connection: keep-alive Content-Length: 33 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.avast.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:49 UTC	33	OUT	Data Raw: 7b 22 6f 72 69 67 69 6e 53 63 6f 70 65 22 3a 22 41 4d 50 5f 45 43 49 44 5f 47 4f 4f 47 4c 45 22 7d Data Ascii: {"originScope":"AMP_ECID_GOOGLE"}
2024-02-22 12:06:49 UTC	592	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Thu, 22 Feb 2024 12:06:49 GMT Server: ESF Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://www.avast.com Access-Control-Expose-Headers: vary,vary,vary,content-encoding,date,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:49 UTC	8	IN	Data Raw: 33 0d 0a 7b 7d 0a 0d 0a Data Ascii: 3{}
2024-02-22 12:06:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49833	142.251.40.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:50 UTC	1507	OUT	GET /ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://4711400.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:51 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49837	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	391	OUT	GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	809	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: Lm+fnsoMFVqoUbgeDGGjrQ== Last-Modified: Wed, 13 Apr 2022 01:38:18 GMT x-ms-request-id: ffcd08aa-101e-0051-3ae6-1da40f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64190 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971afa4bff5e60-EWR
2024-02-22 12:06:51 UTC	560	IN	Data Raw: 32 35 32 33 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 51 32 56 75 64 47 56 79 55 6d 39 31 62 6d 52 6c 5a 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 52 72 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 75 5a 58 Data Ascii: 2523 { "name": "otCenterRounded", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZX
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 30 61 58 52 73 5a 53 49 2b 56 47 6c 30 62 47 55 38 4c 32 67 79 50 6a 78 77 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 56 34 64 44 78 68 49 47 68 79 5a 57 59 39 49 69 4d 69 50 6e 42 76 62 47 6c 6a 65 54 77 76 59 54 34 38 4c 33 41 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 50 6a 78 77 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 5a 47 56 7a 59 79 49 2b 50 43 39 77 50 6a Data Ascii: 0aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPj
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 64 6a 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 7b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 35 3b 74 6f 70 3a 31 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 36 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 2e 35 Data Ascii: dj48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otCenterRounded{z-index:2147483645;top:10%;position:fixed;right:0;background-color:#fff;width:60%;max-width:650px;border-radius:2.5
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 33 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f Data Ascii: adding:0;border:0;height:auto;width:auto}#onetrust-banner-sdk .ot-b-addl-desc{display:block}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 30px;text-align:center}#onetrust-banner-sdk #onetrust-button-group-parent:not(.has-reject-all-butto
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2e 63 6f 6f 6b 69 65 2d 73 65 74 74 69 6e 67 2d 6c 69 6e 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 2e 62 61 6e 6e 65 72 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 36 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 34 34 70 78 3b 68 65 69 67 68 74 3a 34 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 38 70 Data Ascii: st-pc-btn-handler.cookie-setting-link{text-align:left;margin-right:0}#onetrust-banner-sdk .has-reject-all-button .banner-actions-container{max-width:60%;width:auto}#onetrust-banner-sdk .ot-close-icon{width:44px;height:44px;background-size:12px;margin:-18p
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 36 Data Ascii: webkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#onetrust-banner-sdk .ot-arrow-container{display:inline-block;border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:6
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 31 35 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 72 69 67 68 74 3a 31 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 77 72 61 70 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 66 6f 6e Data Ascii: lose-btn-link #onetrust-close-btn-container{top:15px;transform:none;right:15px}#onetrust-banner-sdk.ot-close-btn-link #onetrust-close-btn-container button{padding:0;white-space:pre-wrap;border:none;height:auto;line-height:1.5;text-decoration:underline;fon
2024-02-22 12:06:51 UTC	741	IN	Data Raw: 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 73 7b 70 61 64 64 69 6e 67 3a 30 20 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 Data Ascii: 22px;width:calc(100% - 44px)}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 22px}#onetrust-banner-sdk #banner-options{padding:0 22px;width:calc(100% - 44px)}#onetrust-banner-sdk .banner-option{margin-bottom:6px}#onetrust-banner-sdk .has-r
2024-02-22 12:06:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49836	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	388	OUT	GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	809	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: A7tMInCwvuWCqK9nIJa+YQ== Last-Modified: Wed, 13 Apr 2022 01:38:20 GMT x-ms-request-id: e878fd63-901e-0084-3300-224b82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 57053 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971afa49d44406-EWR
2024-02-22 12:06:51 UTC	560	IN	Data Raw: 37 63 37 39 0d 0a 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 50 63 50 61 6e 65 6c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 4d 74 63 32 52 72 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 52 51 59 31 42 68 62 6d 56 73 49 47 39 30 4c 57 68 70 5a 47 55 67 62 33 51 74 5a 6d 46 6b 5a 53 31 70 62 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 62 57 39 6b 59 57 77 39 49 6e 52 79 64 57 55 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 30 4c 58 42 6a 4c 57 52 6c 63 32 4d 69 50 6a 77 68 4c 53 30 67 55 45 4d 67 Data Ascii: 7c79 { "name": "otPcPanel", "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMg
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 79 31 7a 59 33 4a 76 62 47 78 69 59 58 49 69 50 6a 78 6f 4d 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 64 47 6c 30 62 47 55 69 50 6c 6c 76 64 58 49 67 55 48 4a 70 64 6d 46 6a 65 54 77 76 61 44 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 5a 47 56 7a 59 79 49 2b 50 43 39 6b 61 58 59 2b 50 47 4a 31 64 48 52 76 62 69 42 70 5a 44 30 69 59 57 4e 6a 5a 58 42 30 4c 58 4a 6c 59 32 39 74 62 57 56 75 5a 47 56 6b 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 42 59 32 4e 6c 63 48 51 67 51 57 78 73 50 43 39 69 64 58 52 30 62 32 34 2b 50 48 4e 6c 59 33 52 70 62 32 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6b 61 79 31 79 62 33 63 67 62 33 51 74 59 32 46 30 4c 57 64 79 63 43 49 2b 50 47 67 7a 49 47 6c 6b 50 53 4a 76 64 43 31 6a Data Ascii: y1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1j
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 4a 68 59 32 73 74 59 6e 52 75 4c 57 68 68 62 6d 52 73 5a 58 49 69 49 47 46 79 61 57 45 74 62 47 46 69 5a 57 77 39 49 6b 4a 68 59 32 73 69 50 6a 78 7a 64 6d 63 67 61 57 51 39 49 6d 39 30 4c 57 4a 68 59 32 73 74 59 58 4a 33 49 69 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 68 74 62 47 35 7a 4f 6e 68 73 61 57 35 72 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 33 68 73 61 57 35 72 49 69 42 34 50 53 49 77 63 48 67 69 49 48 6b 39 49 6a 42 77 65 43 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 51 30 4e 43 34 31 4d 7a 45 67 4e 44 51 30 4c 6a 55 7a 4d 53 49 67 65 47 31 73 4f 6e 4e 77 59 57 4e 6c 50 Data Ascii: JhY2stYnRuLWhhbmRsZXIiIGFyaWEtbGFiZWw9IkJhY2siPjxzdmcgaWQ9Im90LWJhY2stYXJ3IiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIgdmlld0JveD0iMCAwIDQ0NC41MzEgNDQ0LjUzMSIgeG1sOnNwYWNlP
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 38 63 33 5a 6e 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 4c 33 4e 32 5a 79 49 67 65 47 31 73 62 6e 4d 36 65 47 78 70 62 6d 73 39 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 64 7a 4d 75 62 33 4a 6e 4c 7a 45 35 4f 54 6b 76 65 47 78 70 62 6d 73 69 49 48 67 39 49 6a 42 77 65 43 49 67 65 54 30 69 4d 48 42 34 49 69 42 32 61 57 56 33 51 6d 39 34 50 53 49 77 49 43 30 7a 4d 43 41 78 4d 54 41 67 4d 54 45 77 49 69 42 68 63 6d 6c 68 4c 57 68 70 5a 47 52 6c 62 6a 30 69 64 48 4a 31 5a 53 49 2b 50 48 52 70 64 47 78 6c 50 6c 4e 6c 59 58 4a 6a 61 43 42 4a 59 32 39 75 50 43 39 30 61 58 52 73 5a 54 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 6d 55 7a 4e 6a 51 30 49 69 42 6b 50 53 Data Ascii: 8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB2aWV3Qm94PSIwIC0zMCAxMTAgMTEwIiBhcmlhLWhpZGRlbj0idHJ1ZSI+PHRpdGxlPlNlYXJjaCBJY29uPC90aXRsZT48cGF0aCBmaWxsPSIjMmUzNjQ0IiBkPS
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 4c 54 45 32 4c 6a 67 30 4e 69 77 78 4d 53 34 78 4d 7a 59 4b 49 43 41 67 49 43 41 67 59 79 30 7a 4c 6a 49 7a 4e 43 77 33 4c 6a 67 77 4d 53 30 78 4c 6a 6b 77 4d 79 77 78 4e 43 34 30 4e 6a 63 73 4d 79 34 35 4f 54 6b 73 4d 54 6b 75 4f 54 67 31 62 44 45 30 4d 43 34 33 4e 54 63 73 4d 54 51 77 4c 6a 63 31 4d 33 59 78 4d 7a 67 75 4e 7a 55 31 59 7a 41 73 4e 43 34 35 4e 54 55 73 4d 53 34 34 4d 44 6b 73 4f 53 34 79 4d 7a 49 73 4e 53 34 30 4d 6a 51 73 4d 54 49 75 4f 44 55 30 62 44 63 7a 4c 6a 41 34 4e 53 77 33 4d 79 34 77 4f 44 4d 4b 49 43 41 67 49 43 41 67 59 7a 4d 75 4e 44 49 35 4c 44 4d 75 4e 6a 45 30 4c 44 63 75 4e 7a 45 73 4e 53 34 30 4d 6a 67 73 4d 54 49 75 4f 44 55 78 4c 44 55 75 4e 44 49 34 59 7a 49 75 4d 6a 67 79 4c 44 41 73 4e 43 34 32 4e 69 30 77 4c 6a 51 Data Ascii: LTE2Ljg0NiwxMS4xMzYKICAgICAgYy0zLjIzNCw3LjgwMS0xLjkwMywxNC40NjcsMy45OTksMTkuOTg1bDE0MC43NTcsMTQwLjc1M3YxMzguNzU1YzAsNC45NTUsMS44MDksOS4yMzIsNS40MjQsMTIuODU0bDczLjA4NSw3My4wODMKICAgICAgYzMuNDI5LDMuNjE0LDcuNzEsNS40MjgsMTIuODUxLDUuNDI4YzIuMjgyLDAsNC42Ni0wLjQ
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6d 39 33 49 6a 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 7a 5a 47 73 74 59 32 39 73 64 57 31 75 49 6a 34 38 64 57 77 67 61 57 51 39 49 6d 39 30 4c 57 68 76 63 33 51 74 62 48 4e 30 49 6a 34 38 62 47 6b 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 68 76 63 33 51 74 61 58 52 6c 62 53 49 2b 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 69 62 33 67 69 49 47 46 79 61 57 45 74 5a 58 68 77 59 57 35 6b 5a 57 51 39 49 6d 5a 68 62 48 4e 6c 49 6a 34 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 63 32 56 6a 64 47 6c 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 59 57 4e 6a 4c 57 68 6b 63 69 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 6f 5a 48 49 69 50 6a 78 6f Data Ascii: m93Ij48ZGl2IGNsYXNzPSJvdC1zZGstY29sdW1uIj48dWwgaWQ9Im90LWhvc3QtbHN0Ij48bGkgY2xhc3M9Im90LWhvc3QtaXRlbSI+PGJ1dHRvbiBjbGFzcz0ib3QtaG9zdC1ib3giIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIj48L2J1dHRvbj48c2VjdGlvbiBjbGFzcz0ib3QtYWNjLWhkciI+PGRpdiBjbGFzcz0ib3QtaG9zdC1oZHIiPjxo
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 69 64 47 34 74 59 32 39 75 64 47 46 70 62 6d 56 79 49 6a 34 38 59 6e 56 30 64 47 39 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 77 59 79 31 79 5a 57 5a 31 63 32 55 74 59 57 78 73 4c 57 68 68 62 6d 52 73 5a 58 49 69 50 6c 4a 6c 61 6d 56 6a 64 43 42 42 62 47 77 38 4c 32 4a 31 64 48 52 76 62 6a 34 67 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 63 32 46 32 5a 53 31 77 63 6d 56 6d 5a 58 4a 6c 62 6d 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 47 39 75 5a 58 52 79 64 58 4e 30 4c 57 4e 73 62 33 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 54 59 58 5a 6c 49 46 4e 6c 64 48 52 70 62 6d 64 7a 50 43 39 69 64 58 52 30 62 32 34 2b 50 43 39 6b 61 58 59 2b 50 47 52 70 64 Data Ascii: l2IGNsYXNzPSJvdC1idG4tY29udGFpbmVyIj48YnV0dG9uIGNsYXNzPSJvdC1wYy1yZWZ1c2UtYWxsLWhhbmRsZXIiPlJlamVjdCBBbGw8L2J1dHRvbj4gPGJ1dHRvbiBjbGFzcz0ic2F2ZS1wcmVmZXJlbmNlLWJ0bi1oYW5kbGVyIG9uZXRydXN0LWNsb3NlLWJ0bi1oYW5kbGVyIj5TYXZlIFNldHRpbmdzPC9idXR0b24+PC9kaXY+PGRpd
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 70 5a 43 49 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 33 61 58 52 6a 61 43 31 75 62 32 49 69 49 47 46 79 61 57 45 74 59 32 68 6c 59 32 74 6c 5a 44 30 69 5a 6d 46 73 63 32 55 69 49 48 4a 76 62 47 55 39 49 6e 4e 33 61 58 52 6a 61 43 49 2b 50 43 39 7a 63 47 46 75 50 69 41 38 63 33 42 68 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 47 46 69 5a 57 77 74 64 48 68 30 49 6a 35 54 64 32 6c 30 59 32 67 67 54 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 73 59 57 4a 6c 62 44 34 67 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 68 59 6d 56 73 4c 58 4e 30 59 58 52 31 63 79 49 2b 62 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 6b 61 58 59 2b 50 43 45 74 4c 53 42 44 61 47 56 6a 61 32 4a 76 65 43 Data Ascii: pZCI+PHNwYW4gY2xhc3M9Im90LXN3aXRjaC1ub2IiIGFyaWEtY2hlY2tlZD0iZmFsc2UiIHJvbGU9InN3aXRjaCI+PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGFiZWwtdHh0Ij5Td2l0Y2ggTGFiZWw8L3NwYW4+PC9sYWJlbD4gPHNwYW4gY2xhc3M9Im90LWxhYmVsLXN0YXR1cyI+bGFiZWw8L3NwYW4+PC9kaXY+PCEtLSBDaGVja2JveC
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 49 69 42 76 64 43 31 68 59 32 4e 76 63 6d 52 70 62 32 34 39 49 6e 52 79 64 57 55 69 50 6a 77 76 59 6e 56 30 64 47 39 75 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 6f 5a 48 49 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 6b 61 57 39 75 49 47 68 6c 59 57 52 6c 63 69 42 6a 62 32 35 30 5a 57 35 30 49 43 30 74 50 6a 77 76 5a 47 6c 32 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 30 65 48 51 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 70 5a 47 39 75 49 47 4e 76 62 6e 52 6c 62 6e 51 67 4c 53 30 2b 50 43 39 6b 61 58 59 2b 50 43 39 6b 61 58 59 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6a 63 6d 34 74 63 6d 52 79 49 69 42 68 63 6d 6c 68 4c 57 46 30 62 32 31 Data Ascii: IiBvdC1hY2NvcmRpb249InRydWUiPjwvYnV0dG9uPjxkaXYgY2xhc3M9Im90LWFjYy1oZHIiPjwhLS0gQWNjb3JkaW9uIGhlYWRlciBjb250ZW50IC0tPjwvZGl2PjxkaXYgY2xhc3M9Im90LWFjYy10eHQiPjwhLS0gQWNjb3JpZG9uIGNvbnRlbnQgLS0+PC9kaXY+PC9kaXY+PHNwYW4gY2xhc3M9Im90LXNjcm4tcmRyIiBhcmlhLWF0b21
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 50 63 50 61 6e 65 6c 2e 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7d 40 6d 65 64 69 61 20 70 72 69 6e 74 2c 28 70 72 65 66 65 72 73 2d 72 65 64 75 63 65 64 2d 6d 6f 74 69 6f 6e 29 7b 2e 6f 74 2d 61 6e 69 6d 61 74 65 64 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 69 6e 69 74 Data Ascii: mation-name:ot-slide-in-right;animation-name:ot-slide-in-right}#onetrust-pc-sdk.otPcPanel.ot-slide-out-left{-webkit-animation-name:ot-slide-out-left;animation-name:ot-slide-out-left}@media print,(prefers-reduced-motion){.ot-animated{-webkit-animation:init

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49840	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	389	OUT	GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: text/css Content-Length: 21595 Connection: close Content-MD5: SHFDtZO2nDZuiPDW83p1IQ== Last-Modified: Wed, 13 Apr 2022 01:38:32 GMT ETag: 0x8DA1CEE517188DA x-ms-request-id: 3a2fa97c-c01e-000f-3b4e-144fef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15087 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971afa7fdf431b-EWR
2024-02-22 12:06:51 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 32 5a 58 4a 7a 61 57 39 75 50 53 49 78 4c 6a 45 69 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAw
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 68 74 3a 31 32 70 78 3b 77 69 64 74 68 3a 31 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f Data Ascii: ht:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-logo a,#ot-sync-ntfy .powered-by-logo,#ot-sync-ntfy .ot-pc-footer-logo a{background-size:co
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 6e 6f 74 28 3a 63 68 65 63 6b 65 64 29 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 Data Ascii: :100%}#onetrust-pc-sdk [type="checkbox"]:checked,#onetrust-pc-sdk [type="checkbox"]:not(:checked){pointer-events:initial}#onetrust-pc-sdk [type="checkbox"]:disabled+label::before,#onetrust-pc-sdk [type="checkbox"]:disabled+label:after,#onetrust-pc-sdk [ty
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 74 2d 73 64 6b 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 2c 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 70 74 61 6e 6f 6e 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 7b 63 6f 6c 6f 72 3a 23 36 38 62 36 33 31 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 36 38 62 36 33 31 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 77 6f 72 64 2d 77 72 61 70 3a Data Ascii: t}#onetrust-pc-sdk.ot-hide{display:none !important}.onetrust-pc-dark-filter.ot-hide{display:none !important}#ot-sdk-btn.ot-sdk-show-settings,#ot-sdk-btn.optanon-show-settings{color:#68b631;border:1px solid #68b631;height:auto;white-space:normal;word-wrap:
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 76 65 6e 2d 68 64 72 3e 70 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 0a 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2a 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: ents:initial}#onetrust-pc-sdk .ot-ven-hdr>p a{position:relative;z-index:2;pointer-events:initial}#onetrust-banner-sdk,#onetrust-pc-sdk,#ot-sdk-cookie-policy,#ot-sync-ntfy{font-size:16px}#onetrust-banner-sdk *,#onetrust-banner-sdk ::after,#onetrust-banner
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 35 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 36 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 65 63 74 69 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d Data Ascii: st-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#onetrust-pc-sdk h5,#onetrust-pc-sdk h6,#onetrust-pc-sdk p,#onetrust-pc-sdk img,#onetrust-pc-sdk svg,#onetrust-pc-sdk button,#onetrust-pc-sdk section,#onetrust-
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 70 61 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 31 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 32 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 35 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 70 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 69 6d 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 76 67 2c Data Ascii: dk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy span,#ot-sync-ntfy h1,#ot-sync-ntfy h2,#ot-sync-ntfy h3,#ot-sync-ntfy h4,#ot-sync-ntfy h5,#ot-sync-ntfy h6,#ot-sync-ntfy p,#ot-sync-ntfy img,#ot-sync-ntfy svg,
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 61 66 Data Ascii: st-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#ot-sdk-cookie-policy label:after,#ot-sdk-cookie-policy .checkbox:after,#ot-sdk-cookie-policy .checkbox:before,#ot-sync-ntfy label:before,#ot-sync-ntfy label:af
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b Data Ascii: left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-child,#onetrust-pc-sdk .ot-sdk-column:first-child,#onetrust-pc-sdk .ot-sdk-columns:first-child,#ot-sdk-cookie-policy .ot-sdk-column:first-child,#ot-sdk-cook

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49835	34.224.119.52	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	473	OUT	GET /ibs:dpid=411&dpuuid=Zdc41QAAAI5mXAOj HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=61662999391982255092277607603117149548; dpm=61662999391982255092277607603117149548
2024-02-22 12:06:51 UTC	889	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: wXcB0Cr2QQ0= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v055-066a00438.edge-va6.demdex.com 1 ms set-cookie: dpm=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:51 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=61662999391982255092277607603117149548; Max-Age=15552000; Expires=Tue, 20 Aug 2024 12:06:51 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-22 12:06:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49838	104.18.130.236	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	373	OUT	GET /logos/static/powered_by_logo.svg HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	830	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: image/svg+xml Content-Length: 5194 Connection: close Content-MD5: Y+c301RBZNK39PvKQWrIBw== Last-Modified: Thu, 22 Feb 2024 03:32:39 GMT ETag: 0x8DC3356EBC9CD17 x-ms-request-id: 5d0ab5da-301e-0046-2543-650d04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 19379 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85971afa6a170f97-EWR
2024-02-22 12:06:51 UTC	539	IN	Data Raw: 3c 73 76 67 20 68 65 69 67 68 74 3d 22 31 36 22 20 77 69 64 74 68 3d 22 31 33 36 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 36 20 31 34 2e 36 22 3e 3c 64 65 66 73 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 64 3d 22 4d 35 33 2e 37 36 20 30 48 31 33 36 76 31 34 2e 36 48 35 33 2e 37 36 7a 22 2f 3e 3c 2f 63 6c 69 70 50 61 74 68 3e 3c 2f 64 65 66 73 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 31 32 2e 33 56 35 2e 35 39 68 32 2e 32 37 61 32 2e 36 32 20 32 2e 36 32 20 30 20 30 31 31 2e 32 39 2e 32 38 20 31 2e 38 33 20 31 2e 38 33 20 Data Ascii: <svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 20 32 2e 32 39 20 30 20 30 31 2d 2e 38 2d 2e 39 31 20 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 38 2d 31 2e 33 36 20 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 2e 32 38 2d 31 2e 33 37 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 2d 31 2e 32 34 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 20 31 2e 32 34 41 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 31 30 20 39 2e 38 31 61 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 39 20 31 2e 33 36 20 32 2e 31 31 20 32 2e 31 31 20 30 20 30 31 2d 32 20 31 2e 32 33 7a 6d 30 2d 2e 36 39 61 31 2e 33 31 20 31 2e 33 31 20 30 20 30 30 2e 38 35 2d 2e 32 37 20 31 2e 36 20 31 2e 36 20 30 20 30 30 2e 35 2d 2e 36 39 20 32 2e 39 20 32 2e 39 20 30 20 30 30 2e 31 36 2d 2e 39 34 20 32 2e 38 35 20 32 2e 38 35 20 30 20 Data Ascii: 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.6 0 00.5-.69 2.9 2.9 0 00.16-.94 2.85 2.85 0
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 30 20 30 31 2e 38 2d 2e 39 32 41 32 2e 30 35 20 32 2e 30 35 20 30 20 30 31 32 39 20 37 2e 32 61 32 2e 35 34 20 32 2e 35 34 20 30 20 30 31 2e 37 37 2e 31 33 20 31 2e 39 20 31 2e 39 20 30 20 30 31 2e 37 2e 34 33 20 31 2e 39 34 20 31 2e 39 34 20 30 20 30 31 2e 35 2e 37 37 20 33 2e 31 39 20 33 2e 31 39 20 30 20 30 31 2e 31 39 20 31 2e 31 39 56 31 30 68 2d 33 2e 38 35 76 2d 2e 36 32 68 33 2e 30 39 61 31 2e 35 35 20 31 2e 35 35 20 30 20 30 30 2d 2e 31 37 2d 2e 37 36 20 31 2e 32 38 20 31 2e 32 38 20 30 20 30 30 2d 2e 34 37 2d 2e 35 33 41 31 2e 33 35 20 31 2e 33 35 20 30 20 30 30 32 39 20 37 2e 39 61 31 2e 33 39 20 31 2e 33 39 20 30 20 30 30 2d 2e 38 2e 32 32 20 31 2e 37 33 20 31 2e 37 33 20 30 20 30 30 2d 2e 35 32 2e 35 39 20 31 2e 37 38 20 31 2e 37 38 20 30 20 Data Ascii: 0 01.8-.92A2.05 2.05 0 0129 7.2a2.54 2.54 0 01.77.13 1.9 1.9 0 01.7.43 1.94 1.94 0 01.5.77 3.19 3.19 0 01.19 1.19V10h-3.85v-.62h3.09a1.55 1.55 0 00-.17-.76 1.28 1.28 0 00-.47-.53A1.35 1.35 0 0029 7.9a1.39 1.39 0 00-.8.22 1.73 1.73 0 00-.52.59 1.78 1.78 0
2024-02-22 12:06:51 UTC	1369	IN	Data Raw: 31 2e 35 39 20 30 20 31 2e 34 36 20 31 2e 34 36 20 30 20 30 30 2e 34 39 2d 2e 36 39 20 32 2e 35 35 20 32 2e 35 35 20 30 20 30 30 2e 31 37 2d 31 20 32 2e 35 39 20 32 2e 35 39 20 30 20 30 30 2d 2e 31 36 2d 2e 39 35 20 31 2e 34 35 20 31 2e 34 35 20 30 20 30 30 2d 2e 34 39 2d 2e 36 38 41 31 2e 32 39 20 31 2e 32 39 20 30 20 30 30 34 33 20 37 2e 39 61 31 2e 33 36 20 31 2e 33 36 20 30 20 30 30 2d 2e 37 39 2e 32 33 20 31 2e 34 37 20 31 2e 34 37 20 30 20 30 30 2d 2e 34 38 2e 36 37 20 32 2e 36 38 20 32 2e 36 38 20 30 20 30 30 2d 2e 31 38 2e 39 38 7a 6d 35 2e 31 38 20 34 2e 34 61 31 2e 39 20 31 2e 39 20 30 20 30 31 2d 2e 33 35 20 30 6c 2d 2e 32 31 2d 2e 30 36 2e 32 2d 2e 36 38 61 31 2e 32 39 20 31 2e 32 39 20 30 20 30 30 2e 35 2e 30 35 2e 35 36 2e 35 36 20 30 20 30 Data Ascii: 1.59 0 1.46 1.46 0 00.49-.69 2.55 2.55 0 00.17-1 2.59 2.59 0 00-.16-.95 1.45 1.45 0 00-.49-.68A1.29 1.29 0 0043 7.9a1.36 1.36 0 00-.79.23 1.47 1.47 0 00-.48.67 2.68 2.68 0 00-.18.98zm5.18 4.4a1.9 1.9 0 01-.35 0l-.21-.06.2-.68a1.29 1.29 0 00.5.05.56.56 0 0
2024-02-22 12:06:51 UTC	548	IN	Data Raw: 20 34 2e 34 36 20 38 33 2e 35 34 20 34 2e 34 36 7a 4d 31 30 35 2e 35 38 20 33 76 32 2e 33 35 63 2d 2e 37 38 20 30 2d 31 2e 30 39 2d 2e 30 37 2d 31 2e 33 36 2d 2e 30 37 2d 31 2e 36 35 20 30 2d 32 2e 37 31 2e 37 32 2d 33 2e 30 36 20 32 2e 37 38 61 37 2e 38 35 20 37 2e 38 35 20 30 20 30 30 2d 2e 30 39 20 31 2e 31 39 76 35 2e 31 34 68 2d 32 2e 33 33 56 33 68 32 2e 31 32 76 33 2e 35 38 61 31 34 2e 39 20 31 34 2e 39 20 30 20 30 31 2e 37 39 2d 32 41 32 2e 35 39 20 32 2e 35 39 20 30 20 30 31 31 30 34 20 33 7a 6d 32 37 2e 34 39 20 38 2e 38 35 63 30 20 2e 37 35 2e 32 37 20 31 20 31 20 31 68 31 2e 39 31 76 31 2e 34 39 68 2d 32 2e 37 32 61 32 2e 32 36 20 32 2e 32 36 20 30 20 30 31 2d 32 2e 34 38 2d 32 2e 34 39 56 34 2e 36 33 68 2d 32 2e 32 37 56 33 2e 33 31 68 31 2e Data Ascii: 4.46 83.54 4.46zM105.58 3v2.35c-.78 0-1.09-.07-1.36-.07-1.65 0-2.71.72-3.06 2.78a7.85 7.85 0 00-.09 1.19v5.14h-2.33V3h2.12v3.58a14.9 14.9 0 01.79-2A2.59 2.59 0 01104 3zm27.49 8.85c0 .75.27 1 1 1h1.91v1.49h-2.72a2.26 2.26 0 01-2.48-2.49V4.63h-2.27V3.31h1.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49842	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	985	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49841	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	1095	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger=navigation-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:51 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:51 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:06:51 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49848	69.147.82.61	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	357	OUT	GET /wi/config/10156543.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	598	IN	HTTP/1.1 200 OK x-amz-request-id: QJPJED0ENK2HT1CT x-amz-id-2: iuNF3vH31ZL9ofp79g/Hjm027Cz4gYj2S1gAv+GSrhsLa1KkVSQGWWtq8LQxuPWnwfbPjzAno7A= Content-Type: application/json Date: Thu, 22 Feb 2024 12:06:50 GMT Server: ATS Referrer-Policy: no-referrer-when-downgrade Vary: Origin Cache-Control: public,max-age=3600 Age: 1 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-02-22 12:06:51 UTC	12	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49843	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	1103	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49844	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	1195	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:51 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:51 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:06:51 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49849	142.251.40.142	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	695	OUT	GET /v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM HTTP/1.1 Host: ampcid.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:51 UTC	297	IN	HTTP/1.1 404 Not Found Date: Thu, 22 Feb 2024 12:06:51 GMT Content-Type: text/html; charset=UTF-8 Server: ESF Content-Length: 1629 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:51 UTC	955	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-se
2024-02-22 12:06:51 UTC	674	IN	Data Raw: 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 Data Ascii: 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelog

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49851	142.250.80.66	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	1260	OUT	GET /ddm/fls/z/dc_pre=CImhjLn0voQDFTqtfwQdvxQIVg;src=4711400;type=globa0;cat=avast0;ord=1;num=8335831678169;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Flp-safe-emailing;u8=;u17=undefined;ps=1;pcor=997927414;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:51 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49852	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	752	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49853	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	870	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49854	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	789	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609726&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:51 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:51 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49855	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	574	OUT	GET /wdceu/82320/onsite/generic1691916888878.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	694	IN	HTTP/1.1 200 OK Connection: close Content-Length: 367898 x-amz-id-2: Kfxj0HXMMO7VsxXVHwp7V4kvoDI2Rt4YJZAiMk+e0C81xWvJBai4PyDQT05wjFf3RgoKxgS9hzM= x-amz-request-id: EW0ZDA49PY3PYX8G Last-Modified: Sun, 13 Aug 2023 08:54:49 GMT ETag: "f84eec5e0086474e06fafa81e736eabc" x-amz-server-side-encryption: AES256 Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Cache-Control: max-age=31622400 Accept-Ranges: bytes Date: Thu, 22 Feb 2024 12:06:51 GMT Via: 1.1 varnish Age: 576285 X-Served-By: cache-lga21973-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1708603612.782340,VS0,VE3 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 0a 28 66 75 6e 63 74 69 6f 6e 28 77 69 6e 64 6f 77 29 7b 77 69 6e 64 6f 77 2e 4d 44 49 47 49 54 41 4c 3d 77 69 6e 64 6f 77 2e 4d 44 49 47 49 54 41 4c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 44 49 47 49 54 41 4c 2e 76 65 72 73 69 6f 6e 3d 27 32 2e 35 32 2e 30 27 3b 7d 29 28 77 69 6e 64 6f 77 29 3b 77 69 6e 64 6f 77 2e 4b 41 4d 50 59 4c 45 5f 43 4f 4e 53 54 41 4e 54 3d 7b 50 4c 41 43 45 48 4f 4c 44 45 52 53 3a 7b 55 52 4c 5f 50 52 45 46 49 58 3a 27 68 74 74 70 73 3a 2f 2f 72 65 73 6f 75 72 63 65 73 2e 64 69 67 69 74 61 6c 2d 63 6c 6f 75 64 2e 6d 65 64 61 6c 6c 69 61 2e 65 75 2f 27 2c 55 53 45 52 53 4e 41 50 5f 43 44 4e 5f 55 52 4c 3a 27 2f 2f 73 63 72 65 65 6e 63 61 70 74 75 65 2d 63 64 6e 2e 6b 61 6d 70 79 6c 65 2e 63 6f 6d 2f 27 2c 55 53 45 52 53 4e 41 50 Data Ascii: (function(window){window.MDIGITAL=window.MDIGITAL\|\|{};window.MDIGITAL.version='2.52.0';})(window);window.KAMPYLE_CONSTANT={PLACEHOLDERS:{URL_PREFIX:'https://resources.digital-cloud.medallia.eu/',USERSNAP_CDN_URL:'//screencaptue-cdn.kampyle.com/',USERSNAP
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 55 55 49 44 3a 27 66 65 65 64 62 61 63 6b 43 6f 72 72 65 6c 61 74 69 6f 6e 55 55 49 44 27 2c 46 45 45 44 42 41 43 4b 5f 55 55 49 44 3a 27 66 65 65 64 62 61 63 6b 55 55 49 44 27 7d 2c 45 56 45 4e 54 5f 4e 41 4d 45 3a 7b 4e 45 42 5f 4c 4f 41 44 5f 46 4f 52 4d 3a 27 6e 65 62 5f 6c 6f 61 64 46 6f 72 6d 27 7d 2c 46 45 41 54 55 52 45 5f 46 4c 41 47 53 3a 7b 57 43 41 47 3a 27 57 43 41 47 27 2c 45 58 45 4d 50 54 5f 42 55 54 54 4f 4e 5f 46 4f 52 4d 53 5f 46 52 4f 4d 5f 51 55 41 52 41 4e 54 49 4e 45 3a 27 65 78 65 6d 70 74 42 75 74 74 6f 6e 46 6f 72 6d 73 46 72 6f 6d 51 75 61 72 61 6e 74 69 6e 65 27 2c 45 58 45 4d 50 54 5f 45 4d 42 45 44 44 45 44 5f 46 4f 52 4d 53 5f 46 52 4f 4d 5f 51 55 41 52 41 4e 54 49 4e 45 3a 27 65 78 65 6d 70 74 45 6d 62 65 64 64 65 64 46 6f Data Ascii: UUID:'feedbackCorrelationUUID',FEEDBACK_UUID:'feedbackUUID'},EVENT_NAME:{NEB_LOAD_FORM:'neb_loadForm'},FEATURE_FLAGS:{WCAG:'WCAG',EXEMPT_BUTTON_FORMS_FROM_QUARANTINE:'exemptButtonFormsFromQuarantine',EXEMPT_EMBEDDED_FORMS_FROM_QUARANTINE:'exemptEmbeddedFo
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 72 32 5f 4d 50 43 33 32 39 36 5f 65 6e 61 62 6c 65 5f 75 73 65 72 73 6e 61 70 4f 6e 70 72 65 6d 43 53 50 27 2c 44 59 4e 41 4d 49 43 5f 4f 4e 53 49 54 45 5f 45 56 45 4e 54 53 3a 27 64 79 6e 61 6d 69 63 4f 6e 73 69 74 65 45 76 65 6e 74 73 27 2c 43 53 50 5f 52 55 4c 45 53 3a 27 43 53 50 52 65 6d 6f 76 65 49 6e 6c 69 6e 65 53 74 79 6c 69 6e 67 27 2c 43 52 45 41 54 45 5f 53 45 53 53 49 4f 4e 3a 27 63 6f 6f 6c 61 64 61 74 61 43 72 65 61 74 65 53 65 73 73 69 6f 6e 45 76 65 6e 74 27 2c 46 4f 52 4d 5f 54 45 4d 50 4c 41 54 45 53 5f 57 43 41 47 3a 27 66 6f 72 6d 54 65 6d 70 6c 61 74 65 73 57 43 41 47 27 2c 50 52 45 56 45 4e 54 5f 49 46 52 41 4d 45 5f 53 43 52 4f 4c 4c 42 41 52 5f 46 4c 49 43 4b 45 52 49 4e 47 3a 27 32 30 64 63 72 33 32 5f 4e 4d 31 31 31 34 36 5f 50 Data Ascii: r2_MPC3296_enable_usersnapOnpremCSP',DYNAMIC_ONSITE_EVENTS:'dynamicOnsiteEvents',CSP_RULES:'CSPRemoveInlineStyling',CREATE_SESSION:'cooladataCreateSessionEvent',FORM_TEMPLATES_WCAG:'formTemplatesWCAG',PREVENT_IFRAME_SCROLLBAR_FLICKERING:'20dcr32_NM11146_P
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 65 72 62 61 74 69 6d 51 75 65 73 74 69 6f 6e 73 49 6e 43 75 73 74 6f 6d 45 76 65 6e 74 27 2c 45 58 54 45 4e 53 49 4f 4e 5f 45 4e 41 42 4c 45 44 3a 27 32 31 64 63 72 36 5f 4d 50 43 34 30 34 32 5f 65 6e 61 62 6c 65 5f 65 78 6d 64 65 78 74 65 6e 73 69 6f 6e 27 2c 4c 49 56 45 5f 46 4f 52 4d 5f 56 32 3a 27 32 31 64 63 72 32 5f 4d 50 43 32 37 34 33 5f 65 6e 61 62 6c 65 5f 6e 65 77 4c 69 76 65 46 6f 72 6d 27 2c 45 4e 41 42 4c 45 5f 46 49 58 5f 46 4f 52 5f 53 50 41 5f 54 49 4d 45 5f 4f 4e 5f 50 41 47 45 3a 27 32 31 44 43 52 35 5f 4d 50 43 34 30 33 30 5f 45 6e 61 62 6c 65 46 69 78 46 6f 72 53 70 61 54 69 6d 65 4f 6e 50 61 67 65 27 2c 45 4e 41 42 4c 45 5f 55 42 54 5f 49 44 45 4e 54 49 46 49 45 52 5f 48 41 53 48 3a 27 32 31 64 63 72 36 5f 4d 50 43 34 32 39 36 5f 65 Data Ascii: erbatimQuestionsInCustomEvent',EXTENSION_ENABLED:'21dcr6_MPC4042_enable_exmdextension',LIVE_FORM_V2:'21dcr2_MPC2743_enable_newLiveForm',ENABLE_FIX_FOR_SPA_TIME_ON_PAGE:'21DCR5_MPC4030_EnableFixForSpaTimeOnPage',ENABLE_UBT_IDENTIFIER_HASH:'21dcr6_MPC4296_e
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 5f 4c 41 42 45 4c 3a 27 46 65 65 64 62 61 63 6b 5f 55 55 49 44 27 2c 46 45 45 44 42 41 43 4b 5f 43 4f 4e 54 45 4e 54 5f 4c 41 42 45 4c 3a 27 43 6f 6e 74 65 6e 74 27 2c 46 4f 52 4d 5f 4c 41 4e 47 55 41 47 45 5f 4c 41 42 45 4c 3a 27 46 6f 72 6d 5f 4c 61 6e 67 75 61 67 65 27 2c 7d 2c 4c 41 4e 47 5f 4d 45 4d 4f 52 59 5f 44 41 54 41 5f 4b 45 59 5f 50 52 45 46 49 58 3a 27 66 6f 72 6d 4c 61 6e 67 75 61 67 65 3a 27 2c 46 4f 52 4d 5f 4a 53 4f 4e 5f 44 41 54 41 5f 4b 45 59 5f 50 52 45 46 49 58 3a 27 66 6f 72 6d 4a 73 6f 6e 44 61 74 61 3a 27 2c 49 4e 56 49 54 45 5f 4a 53 4f 4e 5f 44 41 54 41 5f 4b 45 59 5f 50 52 45 46 49 58 3a 27 69 6e 76 69 74 65 4a 73 6f 6e 44 61 74 61 3a 27 2c 46 4f 52 4d 5f 42 55 54 54 4f 4e 3a 27 62 75 74 74 6f 6e 27 2c 46 4f 52 4d 5f 49 4e 56 Data Ascii: _LABEL:'Feedback_UUID',FEEDBACK_CONTENT_LABEL:'Content',FORM_LANGUAGE_LABEL:'Form_Language',},LANG_MEMORY_DATA_KEY_PREFIX:'formLanguage:',FORM_JSON_DATA_KEY_PREFIX:'formJsonData:',INVITE_JSON_DATA_KEY_PREFIX:'inviteJsonData:',FORM_BUTTON:'button',FORM_INV
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 68 61 73 65 45 6e 64 65 64 27 2c 4d 44 49 47 49 54 41 4c 5f 54 41 52 47 45 54 49 4e 47 5f 52 55 4c 45 5f 45 56 41 4c 55 41 54 45 44 3a 27 4d 44 69 67 69 74 61 6c 5f 74 61 72 67 65 74 69 6e 67 52 75 6c 65 45 76 61 6c 75 61 74 65 64 27 2c 4d 44 49 47 49 54 41 4c 5f 53 43 52 45 45 4e 5f 43 41 50 54 55 52 45 5f 4c 4f 41 44 45 44 3a 27 6e 65 62 5f 73 63 72 65 65 6e 43 61 70 74 75 72 65 4c 6f 61 64 65 64 27 2c 4d 44 49 47 49 54 41 4c 5f 53 44 4b 5f 50 41 47 45 5f 56 49 45 57 3a 27 6e 65 62 5f 73 64 6b 50 61 67 65 56 69 65 77 27 2c 4d 44 49 47 49 54 41 4c 5f 57 41 52 4e 49 4e 47 3a 27 4d 44 69 67 69 74 61 6c 5f 77 61 72 6e 69 6e 67 27 2c 4d 44 49 47 49 54 41 4c 5f 43 4f 55 4c 44 5f 4e 4f 54 5f 46 45 54 43 48 5f 44 41 54 41 3a 27 4d 44 69 67 69 74 61 6c 5f 63 6f Data Ascii: haseEnded',MDIGITAL_TARGETING_RULE_EVALUATED:'MDigital_targetingRuleEvaluated',MDIGITAL_SCREEN_CAPTURE_LOADED:'neb_screenCaptureLoaded',MDIGITAL_SDK_PAGE_VIEW:'neb_sdkPageView',MDIGITAL_WARNING:'MDigital_warning',MDIGITAL_COULD_NOT_FETCH_DATA:'MDigital_co
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 5c 6e 20 74 68 65 20 63 6f 6e 74 65 78 74 20 69 73 20 3a 7b 7b 43 4f 4e 54 45 58 54 7d 7d 2e 20 5c 6e 20 74 68 65 20 6f 70 74 69 6f 6e 73 20 61 72 65 20 3a 20 7b 7b 4f 50 54 49 4f 4e 53 7d 7d 2e 5c 6e 27 2c 45 52 52 4f 52 5f 4c 4f 47 5f 54 45 4d 50 4c 41 54 45 3a 27 45 72 72 6f 72 20 4d 65 73 73 61 67 65 20 69 73 20 7b 7b 45 52 52 4f 52 5f 4d 45 53 53 41 47 45 7d 7d 27 2c 45 52 52 4f 52 5f 44 59 4e 41 4d 49 43 5f 4f 4e 53 49 54 45 5f 49 4e 49 54 49 41 4c 49 5a 41 54 49 4f 4e 3a 27 46 61 69 6c 65 64 20 74 6f 20 66 65 74 63 68 20 6f 6e 73 69 74 65 20 64 61 74 61 2e 27 2c 45 52 52 4f 52 5f 4f 4e 53 49 54 45 5f 53 44 4b 5f 43 4f 4e 46 49 47 55 52 41 54 49 4f 4e 5f 4d 49 53 53 49 4e 47 3a 27 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 4b 41 4d 50 59 Data Ascii: \n the context is :{{CONTEXT}}. \n the options are : {{OPTIONS}}.\n',ERROR_LOG_TEMPLATE:'Error Message is {{ERROR_MESSAGE}}',ERROR_DYNAMIC_ONSITE_INITIALIZATION:'Failed to fetch onsite data.',ERROR_ONSITE_SDK_CONFIGURATION_MISSING:'Failed to execute KAMPY
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 45 44 42 41 43 4b 5f 43 4f 52 52 45 4c 41 54 49 4f 4e 5f 55 55 49 44 3a 27 66 65 65 64 62 61 63 6b 43 6f 72 72 65 6c 61 74 69 6f 6e 55 55 49 44 27 2c 49 53 5f 42 55 54 54 4f 4e 5f 43 4f 4e 54 41 49 4e 45 52 5f 43 52 45 41 54 45 44 3a 27 69 73 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 43 72 65 61 74 65 64 27 2c 52 45 47 49 4f 4e 3a 27 72 65 67 69 6f 6e 27 2c 46 45 45 44 42 41 43 4b 5f 42 55 54 54 4f 4e 5f 50 4f 53 49 54 49 4f 4e 5f 53 54 59 4c 45 3a 27 62 75 74 74 6f 6e 50 6f 73 69 74 69 6f 6e 53 74 79 6c 65 27 2c 4c 49 56 45 5f 46 4f 52 4d 5f 56 32 5f 44 45 42 55 47 5f 4d 4f 44 45 3a 27 6d 64 5f 6c 69 76 65 46 6f 72 6d 56 32 5f 69 73 44 65 62 75 67 4d 6f 64 65 27 2c 44 4f 4d 5f 45 56 45 4e 54 5f 48 41 4e 44 4c 45 52 53 3a 27 64 6f 6d 45 76 65 6e 74 48 Data Ascii: EDBACK_CORRELATION_UUID:'feedbackCorrelationUUID',IS_BUTTON_CONTAINER_CREATED:'isButtonContainerCreated',REGION:'region',FEEDBACK_BUTTON_POSITION_STYLE:'buttonPositionStyle',LIVE_FORM_V2_DEBUG_MODE:'md_liveFormV2_isDebugMode',DOM_EVENT_HANDLERS:'domEventH
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 41 5f 49 4e 53 54 41 4e 43 45 5f 4e 41 4d 45 3a 22 63 6f 6f 6c 61 64 61 74 61 5f 69 6e 73 74 61 6e 63 65 5f 66 6f 72 5f 6d 65 64 61 6c 6c 69 61 5f 64 69 67 69 74 61 6c 22 2c 53 43 52 45 45 4e 5f 43 41 50 54 55 52 45 3a 7b 44 4f 4d 5f 53 45 4c 45 43 54 49 4f 4e 3a 22 44 4f 4d 5f 53 45 4c 45 43 54 49 4f 4e 22 2c 44 4f 4d 5f 53 45 4c 45 43 54 49 4f 4e 5f 56 41 4c 55 45 3a 22 64 6f 6d 53 65 6c 65 63 74 6f 72 22 2c 41 52 45 41 5f 53 45 4c 45 43 54 49 4f 4e 5f 56 41 4c 55 45 3a 22 68 69 67 68 6c 69 67 68 74 22 2c 7d 2c 43 4f 4f 4c 41 44 41 54 41 5f 48 54 54 50 5f 45 56 45 4e 54 53 5f 42 59 5f 4d 45 54 48 4f 44 3a 7b 42 45 46 4f 52 45 3a 7b 50 4f 53 54 3a 27 6e 65 62 5f 62 65 66 6f 72 65 48 74 74 70 50 6f 73 74 52 65 71 75 65 73 74 27 7d 2c 41 46 54 45 52 3a 7b Data Ascii: A_INSTANCE_NAME:"cooladata_instance_for_medallia_digital",SCREEN_CAPTURE:{DOM_SELECTION:"DOM_SELECTION",DOM_SELECTION_VALUE:"domSelector",AREA_SELECTION_VALUE:"highlight",},COOLADATA_HTTP_EVENTS_BY_METHOD:{BEFORE:{POST:'neb_beforeHttpPostRequest'},AFTER:{
2024-02-22 12:06:51 UTC	1378	IN	Data Raw: 66 69 67 2e 72 65 67 69 6f 6e 7c 7c 4b 41 4d 50 59 4c 45 5f 43 4f 4e 53 54 41 4e 54 2e 52 45 47 49 4f 4e 53 2e 44 45 56 3b 4b 41 4d 50 59 4c 45 5f 44 41 54 41 2e 73 65 74 4d 65 6d 6f 72 79 44 61 74 61 28 4b 41 4d 50 59 4c 45 5f 43 4f 4e 53 54 41 4e 54 2e 4d 45 4d 4f 52 59 5f 44 41 54 41 5f 46 49 45 4c 44 53 2e 52 45 47 49 4f 4e 2c 72 65 67 69 6f 6e 29 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 69 73 4f 6e 73 69 74 65 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4d 69 73 73 69 6e 67 28 29 7b 72 65 74 75 72 6e 21 4b 41 4d 50 59 4c 45 5f 44 41 54 41 2e 67 65 74 4d 65 6d 6f 72 79 44 61 74 61 28 4b 41 4d 50 59 4c 45 5f 43 4f 4e 53 54 41 4e 54 2e 4d 45 4d 4f 52 59 5f 44 41 54 41 5f 46 49 45 4c 44 53 2e 48 41 53 5f 4f 4e 53 49 54 45 5f 43 4f 4e 46 49 47 55 52 41 54 49 4f 4e Data Ascii: fig.region\|\|KAMPYLE_CONSTANT.REGIONS.DEV;KAMPYLE_DATA.setMemoryData(KAMPYLE_CONSTANT.MEMORY_DATA_FIELDS.REGION,region);}function isOnsiteConfigurationMissing(){return!KAMPYLE_DATA.getMemoryData(KAMPYLE_CONSTANT.MEMORY_DATA_FIELDS.HAS_ONSITE_CONFIGURATION

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49857	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:51 UTC	907	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Flp-safe-emailing%3Ffull_trSrc%3Dmmm_ava_esg_000_361_m%26utm_medium%3Demail%26utm_source%3Dlink%26utm_campaign%3Dsig-email%26utm_content%3Demailclient%23pc&rl=&if=false&ts=1708603609736&cd[content_ids]=%5B%27FAV-ONLINE-361%27%2C%27MAC-FREE-ONLINE-361%27%2C%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603607667&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:51 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:51 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:51 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49865	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:52 UTC	656	OUT	POST /v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive Content-Length: 2111 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:52 UTC	2111	OUT	Data Raw: 64 61 74 61 3d 25 37 42 25 32 32 65 76 65 6e 74 73 25 32 32 25 33 41 25 32 30 25 35 42 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 37 42 25 32 32 73 65 73 73 69 6f 6e 5f 73 63 72 65 65 6e 5f 73 69 7a 65 25 32 32 25 33 41 25 32 30 25 32 32 31 32 38 30 78 31 30 32 34 25 32 32 25 32 43 25 32 32 73 65 73 73 69 6f 6e 5f 64 75 61 25 32 32 25 33 41 25 32 30 25 32 32 4d 6f 7a 69 6c 6c 61 25 32 46 35 2e 30 25 32 30 28 57 69 6e 64 6f 77 73 25 32 30 4e 54 25 32 30 31 30 2e 30 25 33 42 25 32 30 57 69 6e 36 34 25 33 42 25 32 30 78 36 34 29 25 32 30 41 70 70 6c 65 57 65 62 4b 69 74 25 32 46 35 33 37 2e 33 36 25 32 30 28 4b 48 54 4d 4c 25 32 43 25 32 30 6c 69 6b 65 25 32 30 47 65 63 6b 6f 29 25 32 30 43 68 72 6f 6d 65 25 32 46 31 31 37 2e 30 2e 30 2e 30 25 32 30 53 Data Ascii: data=%7B%22events%22%3A%20%5B%0A%20%20%20%20%7B%22session_screen_size%22%3A%20%221280x1024%22%2C%22session_dua%22%3A%20%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20S
2024-02-22 12:06:52 UTC	548	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:52 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.avast.com Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-w0w1 X-Application-Context: application:9090 Content-Type: text/plain;charset=ISO-8859-1 Content-Length: 59 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-22 12:06:52 UTC	59	IN	Data Raw: 7b 22 65 76 65 6e 74 73 5f 63 6f 75 6e 74 22 3a 31 2c 22 76 65 72 73 69 6f 6e 22 3a 22 35 22 2c 22 72 65 73 75 6c 74 73 22 3a 7b 7d 2c 22 73 74 61 74 75 73 22 3a 74 72 75 65 7d Data Ascii: {"events_count":1,"version":"5","results":{},"status":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49867	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:52 UTC	384	OUT	GET /v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:53 UTC	537	IN	HTTP/1.1 400 Bad Request Date: Thu, 22 Feb 2024 12:06:53 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-w0t1 X-Application-Context: application:9090 Content-Type: text/plain;charset=ISO-8859-1 Content-Length: 91 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-22 12:06:53 UTC	91	IN	Data Raw: 7b 22 72 65 61 73 6f 6e 22 3a 22 49 6e 76 61 6c 69 64 20 61 72 67 75 6d 65 6e 74 73 22 2c 22 65 76 65 6e 74 73 5f 63 6f 75 6e 74 22 3a 22 30 22 2c 22 72 65 73 75 6c 74 73 22 3a 7b 7d 2c 22 76 65 72 73 69 6f 6e 22 3a 22 35 22 2c 22 73 74 61 74 75 73 22 3a 66 61 6c 73 65 7d Data Ascii: {"reason":"Invalid arguments","events_count":"0","results":{},"version":"5","status":false}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49886	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:54 UTC	593	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:54 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:54 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971b0dfbc88cda-EWR
2024-02-22 12:06:54 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49891	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:54 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:54 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:54 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971b10bc824327-EWR
2024-02-22 12:06:54 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49884	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:54 UTC	660	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9975a534a66e6e60fea127a62c73d6c7" If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
2024-02-22 12:06:55 UTC	365	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:06:54 GMT Via: 1.1 varnish Cache-Control: max-age=0,must-revalidate ETag: "9975a534a66e6e60fea127a62c73d6c7" Age: 11 X-Served-By: cache-lga21936-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1708603615.994936,VS0,VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49901	104.17.25.14	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	562	OUT	GET /ajax/libs/apexcharts/3.45.2/apexcharts.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:55 UTC	949	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:55 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"65ad649f-20da3" Last-Modified: Sun, 21 Jan 2024 18:38:23 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Tue, 11 Feb 2025 12:06:55 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BeENdpx0Ux8wahQy6DO%2FXZ5Gv%2FNyGPnfqmc605x2Zsc3bX0kZ80nepAwwaMWqmIXedxdOkQZGKWV1ZiWjV%2FkuWq58aDFaflyXhxPfoIvKSR71OhIr8hUTST8Aue8fWFvVvUTACjE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 85971b13ef5f433d-EWR alt-svc: h3=":443"; ma=86400
2024-02-22 12:06:55 UTC	420	IN	Data Raw: 37 62 66 35 0d 0a 2f 2a 21 0a 20 2a 20 41 70 65 78 43 68 61 72 74 73 20 76 33 2e 34 35 2e 32 0a 20 2a 20 28 63 29 20 32 30 31 38 2d 32 30 32 34 20 41 70 65 78 43 68 61 72 74 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 65 29 3a 28 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f Data Ascii: 7bf5/! ApexCharts v3.45.2 * (c) 2018-2024 ApexCharts * Released under the MIT License. */!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeo
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 74 29 3b 65 26 26 28 61 3d 61 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 74 2c 65 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 69 2e 70 75 73 68 2e 61 70 70 6c 79 28 69 2c 61 29 7d 72 65 74 75 72 6e 20 69 7d 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 61 3d 6e 75 6c 6c 21 3d 61 72 67 75 6d 65 6e 74 73 5b 69 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 69 5d 3a 7b 7d 3b 69 25 32 3f 74 28 4f 62 6a 65 63 74 28 61 29 2c 21 30 29 2e 66 6f 72 45 61 63 68 28 Data Ascii: OwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),i.push.apply(i,a)}return i}function e(e){for(var i=1;i<arguments.length;i++){var a=null!=arguments[i]?arguments[i]:{};i%2?t(Object(a),!0).forEach(
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 30 7d 7d 29 2c 65 26 26 68 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 74 29 7b 72 65 74 75 72 6e 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 29 7d 2c 6c 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 68 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 2c 74 7d 2c 68 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 74 29 7b 69 66 28 Data Ascii: 0}}),e&&h(t,e)}function l(t){return l=Object.setPrototypeOf?Object.getPrototypeOf:function(t){return t.__proto__\|\|Object.getPrototypeOf(t)},l(t)}function h(t,e){return h=Object.setPrototypeOf\|\|function(t,e){return t.__proto__=e,t},h(t,e)}function c(t){if(
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 64 65 73 74 72 75 63 74 75 72 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e 5c 6e 49 6e 20 6f 72 64 65 72 20 74 6f 20 62 65 20 69 74 65 72 61 62 6c 65 2c 20 6e 6f 6e 2d 61 72 72 61 79 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 28 29 20 6d 65 74 68 6f 64 2e 22 29 7d 28 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 29 72 65 74 75 72 6e 20 66 28 74 29 7d 28 74 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 75 6e 64 Data Ascii: ){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function u(t){return function(t){if(Array.isArray(t))return f(t)}(t)\|\|function(t){if("und
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 36 35 35 33 36 2a 28 4d 61 74 68 2e 72 6f 75 6e 64 28 28 61 2d 72 29 2a 73 29 2b 72 29 2b 32 35 36 2a 28 4d 61 74 68 2e 72 6f 75 6e 64 28 28 61 2d 6f 29 2a 73 29 2b 6f 29 2b 28 4d 61 74 68 2e 72 6f 75 6e 64 28 28 61 2d 6e 29 2a 73 29 2b 6e 29 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 73 6c 69 63 65 28 31 29 7d 7d 2c 7b 6b 65 79 3a 22 73 68 61 64 65 43 6f 6c 6f 72 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 72 65 74 75 72 6e 20 74 2e 69 73 43 6f 6c 6f 72 48 65 78 28 69 29 3f 74 68 69 73 2e 73 68 61 64 65 48 65 78 43 6f 6c 6f 72 28 65 2c 69 29 3a 74 68 69 73 2e 73 68 61 64 65 52 47 42 43 6f 6c 6f 72 28 65 2c 69 29 7d 7d 5d 2c 5b 7b 6b 65 79 3a 22 62 69 6e 64 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 Data Ascii: 65536(Math.round((a-r)s)+r)+256(Math.round((a-o)s)+o)+(Math.round((a-n)*s)+n)).toString(16).slice(1)}},{key:"shadeColor",value:function(e,i){return t.isColorHex(i)?this.shadeHexColor(e,i):this.shadeRGBColor(e,i)}}],[{key:"bind",value:function(t,e){ret
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 65 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 74 2e 69 73 28 22 44 61 74 65 22 2c 65 29 29 72 65 74 75 72 6e 20 65 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 69 28 65 29 29 7b 76 61 72 20 72 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 65 29 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6f 29 26 26 28 72 5b 6f 5d 3d 74 68 69 73 2e 63 6c 6f 6e 65 28 65 5b 6f 5d 29 29 3b 72 65 74 75 72 6e 20 72 7d 72 65 74 75 72 6e 20 65 7d 7d 2c 7b 6b 65 79 3a 22 6c 6f 67 31 30 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 6c 6f 67 28 74 29 2f 4d 61 74 68 2e 4c 4e 31 30 7d 7d 2c 7b 6b 65 79 3a 22 72 6f 75 6e 64 54 6f 42 61 73 65 31 30 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 Data Ascii: e))return null;if(t.is("Date",e))return e;if("object"===i(e)){var r={};for(var o in e)e.hasOwnProperty(o)&&(r[o]=this.clone(e[o]));return r}return e}},{key:"log10",value:function(t){return Math.log(t)/Math.LN10}},{key:"roundToBase10",value:function(t){ret
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 65 6e 74 48 65 69 67 68 74 2c 78 3a 65 2e 6c 65 66 74 2c 79 3a 65 2e 74 6f 70 7d 7d 7d 2c 7b 6b 65 79 3a 22 67 65 74 4c 61 72 67 65 73 74 53 74 72 69 6e 67 46 72 6f 6d 41 72 72 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 26 26 28 65 3d 65 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 6c 65 6e 67 74 68 3e 65 2e 6c 65 6e 67 74 68 3f 74 3a 65 7d 29 29 29 2c 74 2e 6c 65 6e 67 74 68 3e 65 2e 6c 65 6e 67 74 68 3f 74 3a 65 7d 29 2c 30 29 7d 7d 2c 7b 6b 65 79 3a 22 68 65 78 54 6f 52 67 62 61 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e Data Ascii: entHeight,x:e.left,y:e.top}}},{key:"getLargestStringFromArr",value:function(t){return t.reduce((function(t,e){return Array.isArray(e)&&(e=e.reduce((function(t,e){return t.length>e.length?t:e}))),t.length>e.length?t:e}),0)}},{key:"hexToRgba",value:function
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 3a 65 2b 69 2a 4d 61 74 68 2e 73 69 6e 28 73 29 7d 7d 7d 2c 7b 6b 65 79 3a 22 65 73 63 61 70 65 53 74 72 69 6e 67 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 22 78 22 2c 69 3d 74 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 6c 69 63 65 28 29 3b 72 65 74 75 72 6e 20 69 3d 69 2e 72 65 70 6c 61 63 65 28 2f 5b 60 20 7e 21 40 23 24 25 5e 26 2a 28 29 7c 2b 5c 3d 3f 3b 3a 27 22 2c 2e 3c 3e 7b 7d 5b 5c 5d 5c 5c 2f 5d 2f 67 69 2c 65 29 7d 7d 2c 7b 6b 65 79 3a 22 6e 65 67 54 6f 5a 65 72 6f 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c Data Ascii: :e+iMath.sin(s)}}},{key:"escapeString",value:function(t){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"x",i=t.toString().slice();return i=i.replace(/[` ~!@#$%^&()\|+\=?;:'",.<>{}[\]\\/]/gi,e)}},{key:"negToZero",value:function(t){return t<
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 74 2f 22 29 3e 30 29 7b 76 61 72 20 69 3d 74 2e 69 6e 64 65 78 4f 66 28 22 72 76 3a 22 29 3b 72 65 74 75 72 6e 20 70 61 72 73 65 49 6e 74 28 74 2e 73 75 62 73 74 72 69 6e 67 28 69 2b 33 2c 74 2e 69 6e 64 65 78 4f 66 28 22 2e 22 2c 69 29 29 2c 31 30 29 7d 76 61 72 20 61 3d 74 2e 69 6e 64 65 78 4f 66 28 22 45 64 67 65 2f 22 29 3b 72 65 74 75 72 6e 20 61 3e 30 26 26 70 61 72 73 65 49 6e 74 28 74 2e 73 75 62 73 74 72 69 6e 67 28 61 2b 35 2c 74 2e 69 6e 64 65 78 4f 66 28 22 2e 22 2c 61 29 29 2c 31 30 29 7d 7d 5d 29 2c 74 7d 28 29 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 61 28 74 68 69 73 2c 74 29 2c 74 68 69 73 2e 63 74 78 3d 65 2c 74 68 69 73 2e 77 3d 65 2e 77 2c 74 68 69 73 2e 73 65 74 45 61 73 69 6e 67 46 75 6e 63 Data Ascii: t/")>0){var i=t.indexOf("rv:");return parseInt(t.substring(i+3,t.indexOf(".",i)),10)}var a=t.indexOf("Edge/");return a>0&&parseInt(t.substring(a+5,t.indexOf(".",a)),10)}}]),t}(),b=function(){function t(e){a(this,t),this.ctx=e,this.w=e.w,this.setEasingFunc
2024-02-22 12:06:55 UTC	1369	IN	Data Raw: 65 79 3a 22 61 6e 69 6d 61 74 65 50 61 74 68 73 47 72 61 64 75 61 6c 6c 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 65 6c 2c 69 3d 74 2e 72 65 61 6c 49 6e 64 65 78 2c 61 3d 74 2e 6a 2c 73 3d 74 2e 66 69 6c 6c 2c 72 3d 74 2e 70 61 74 68 46 72 6f 6d 2c 6f 3d 74 2e 70 61 74 68 54 6f 2c 6e 3d 74 2e 73 70 65 65 64 2c 6c 3d 74 2e 64 65 6c 61 79 2c 68 3d 74 68 69 73 2e 77 2c 63 3d 30 3b 68 2e 63 6f 6e 66 69 67 2e 63 68 61 72 74 2e 61 6e 69 6d 61 74 69 6f 6e 73 2e 61 6e 69 6d 61 74 65 47 72 61 64 75 61 6c 6c 79 2e 65 6e 61 62 6c 65 64 26 26 28 63 3d 68 2e 63 6f 6e 66 69 67 2e 63 68 61 72 74 2e 61 6e 69 6d 61 74 69 6f 6e 73 2e 61 6e 69 6d 61 74 65 47 72 61 64 75 61 6c 6c 79 2e 64 65 6c 61 79 29 2c 68 2e 63 6f 6e 66 69 67 Data Ascii: ey:"animatePathsGradually",value:function(t){var e=t.el,i=t.realIndex,a=t.j,s=t.fill,r=t.pathFrom,o=t.pathTo,n=t.speed,l=t.delay,h=this.w,c=0;h.config.chart.animations.animateGradually.enabled&&(c=h.config.chart.animations.animateGradually.delay),h.config

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49908	142.250.65.194	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	1346	OUT	GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:55 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:55 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:55 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-22 12:06:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49911	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	1317	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source=navigation-source, trigger Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:55 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:55 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"2991059669951776714","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:06:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49906	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	1335	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:55 UTC	1215	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:55 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://4711400.fls.doubleclick.net/activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49919	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	626	OUT	POST /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive Content-Length: 1407 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.avast.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:55 UTC	1407	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 38 31 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 30 38 36 30 33 36 31 34 33 35 30 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 69 64 22 3a 32 34 30 2c 22 76 65 72 73 69 6f 6e 5f 67 75 69 22 3a 22 32 30 32 33 2e 30 31 2e 31 33 22 2c 22 76 65 72 73 69 6f 6e 5f 61 70 70 22 3a 22 31 2e 30 2e 30 22 2c 22 65 64 69 74 69 6f 6e 22 3a 32 2c 22 69 70 6d 5f 70 72 6f 64 75 63 74 22 3a 6e 75 6c 6c 7d 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 7b 22 6f 73 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 73 65 63 63 68 75 61 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 Data Ascii: {"record":[{"event":{"type":81,"subtype":1,"time":1708603614350},"product":{"id":240,"version_gui":"2023.01.13","version_app":"1.0.0","edition":2,"ipm_product":null},"platform":{"os":0},"browser":{"secchua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
2024-02-22 12:06:56 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:06:56 GMT Content-Type: application/json Content-Length: 19 Access-Control-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:56 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49923	63.140.39.15	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:55 UTC	1514	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s44976451605232?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A54%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Ahomepage%3Aindex-t1&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Ahomepage%3Aindex-t1&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=homepage&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Ahomepage%3Aindex-t1&v59=D%3Dc59&c60=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex&v118=avast.com%3Aothers%3Alp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:56 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:06:56 GMT expires: Wed, 21 Feb 2024 12:06:56 GMT last-modified: Fri, 23 Feb 2024 12:06:56 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198328263278592-4617945164480727209 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:06:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49930	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	1369	OUT	GET /activityi;dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:56 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:56 GMT Expires: Thu, 22 Feb 2024 12:06:56 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:06:56 UTC	589	IN	Data Raw: 32 63 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 47 30 31 72 7a 30 76 6f 51 44 46 63 Data Ascii: 2c3<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COG01rz0voQDFc
2024-02-22 12:06:56 UTC	125	IN	Data Raw: 33 38 2e 31 33 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 65 6e 2d 75 73 25 32 46 69 6e 64 65 78 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 38.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex"/></body></html>
2024-02-22 12:06:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49931	142.251.40.166	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:56 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 76 61 73 74 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 32 39 39 31 30 35 39 36 36 39 39 35 31 37 37 36 37 31 34 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://avast.com","trigger_debug_key":"2991059669951776714"},"type":"trigger-no-matching-source"}]
2024-02-22 12:06:56 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 22 Feb 2024 12:06:56 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49933	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	839	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A06%3A54%20GMT&n=-1&b=Avast%20%7C%20Download%20Free%20Antivirus%20%26%20VPN%20%7C%20100%25%20Free%20%26%20Easy&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:56 UTC	909	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:56 GMT Expires: Thu, 22 Feb 2024 12:06:56 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:06:56 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-02-22 12:06:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49949	63.140.39.150	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	1281	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s44976451605232?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A6%3A54%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Ahomepage%3Aindex-t1&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Ahomepage%3Aindex-t1&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=homepage&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Ahomepage%3Aindex-t1&v59=D%3Dc59&c60=avast.com%3Aus%3Aothers%3Alp-safe-emailing&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex&v118=avast.com%3Aothers%3Alp-safe-emailing&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:56 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:06:56 GMT expires: Wed, 21 Feb 2024 12:06:56 GMT last-modified: Fri, 23 Feb 2024 12:06:56 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198327463575552-4617865322720389894 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:06:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49945	142.251.40.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	1011	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:57 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"2991059669951776714","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:06:56 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49951	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	2306	OUT	GET /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=1&tt=7xs&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A54+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:06:57 UTC	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 22 Feb 2024 12:06:57 GMT Content-Type: text/plain Content-Length: 18 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:57 UTC	18	IN	Data Raw: 4e 6f 20 55 52 4c 20 6d 61 74 63 68 20 66 6f 75 6e 64 Data Ascii: No URL match found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49953	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:56 UTC	713	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A06%3A54%20GMT&n=-1&b=Avast%20%7C%20Download%20Free%20Antivirus%20%26%20VPN%20%7C%20100%25%20Free%20%26%20Easy&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
2024-02-22 12:06:57 UTC	923	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:56 GMT Expires: Thu, 22 Feb 2024 12:06:56 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:06:56 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49955	142.251.40.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	1348	OUT	GET /ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://4711400.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:57 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49960	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	803	OUT	GET /trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	650	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 2144 Connection: close Date: Thu, 22 Feb 2024 12:06:58 GMT Last-Modified: Mon, 08 May 2023 11:44:09 GMT ETag: "1307e3fd5846bacc989c2fd05996f010" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-Cache: Miss from cloudfront Via: 1.1 d3fbeb74a503a5fcf3e4ca458c365012.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: w6PoXvjdrc3dnEE8_Cb7xXIJnJeIu-lgYWUUVAQG8yydYTburdCgBA==
2024-02-22 12:06:57 UTC	2144	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cd 59 6d 8f e3 b6 11 fe 7e bf 82 f1 21 c0 6e 4b ed da de d7 c8 be 43 9b 34 45 02 04 6d 81 04 28 fa 69 41 49 94 c4 5b 4a d4 92 94 77 1d c3 ff 3d 43 8a 92 29 59 b6 77 ef ae 68 e1 db 13 c5 97 e1 33 cf 0c c9 19 6a f9 cd df fe f9 c3 6f ff f9 d7 8f 28 d7 05 ff f8 6e d9 3c 10 5a e6 94 24 a6 00 45 cd 34 a7 1f 7f 93 b5 d2 15 e3 42 a3 1f a0 24 0a f4 6f 96 64 54 2f 2f 9b f6 a6 6f 41 35 41 71 4e a4 a2 fa c3 a4 d6 69 70 3f 41 97 7e 63 49 0a fa 61 22 45 24 b4 9a a0 58 94 9a 96 d0 b5 14 ac 4c e8 cb ae b3 d2 6b 23 d5 00 c2 91 48 d6 38 61 2b ac 2a 52 62 52 55 9c 6a 2c a2 4f 34 d6 98 a5 12 24 e2 7c 86 f3 39 ce af 70 7e 8d f3 1b 9c df e2 0a 47 5c c4 8f 4f b5 d0 14 57 92 62 82 49 14 49 4c 62 29 ca 75 81 49 92 48 aa 14 8e 58 86 63 06 7d 62 91 50 Data Ascii: Ym~!nKC4Em(iAI[Jw=C)Ywh3jo(n<Z$E4B$odT//oA5AqNip?A~cIa"E$XLk#H8a+*RbRUj,O4$\|9p~G\OWbIILb)uIHXc}bP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49966	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	841	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49968	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	951	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger;navigation-source, event-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:57 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:57 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:06:57 UTC	73	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`
2024-02-22 12:06:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49967	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	1034	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49969	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	1144	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger=navigation-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:57 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:57 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:06:57 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49981	142.250.80.66	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	1101	OUT	GET /ddm/fls/z/dc_pre=COG01rz0voQDFceLfwQdHLUCWw;src=4711400;type=globa0;cat=avast0;ord=1;num=8310233809327;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Findex;u8=;u17=link;ps=1;pcor=1323087041;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:06:57 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:06:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49983	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:57 UTC	608	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:57 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49987	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	692	OUT	GET /trustboxes/5419b6ffb0d04a076446a9af/main.js HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	666	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 17136 Connection: close Date: Thu, 22 Feb 2024 12:06:59 GMT Last-Modified: Mon, 08 May 2023 11:44:11 GMT ETag: "dc592904280a455012599b68215eae0f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-Cache: Miss from cloudfront Via: 1.1 7a1287aac11cb484d13c7a9cbd2585b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: 6FwyD4JzR69F3Qef5x2vGEB0aT6s4aRAuUsMzJT-WV1yj06s4KlxAA==
2024-02-22 12:06:58 UTC	16384	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd eb 76 dc 46 96 2e f8 ff 3c 45 0a d5 47 4a 14 91 20 ee 97 a4 d2 6c 59 65 1f a9 0f 65 79 2c d9 dd 63 16 5b 0b cc 04 49 94 33 01 36 80 24 45 93 b9 d6 3c c8 bc c9 f9 71 de 65 5e 60 5e 61 be bd 23 02 97 4c 90 d6 cd 55 9e b5 4a 55 cb 4c 04 02 11 3b f6 7d ef d8 40 fc bf ff eb 7f 3f 3a 5b e7 f3 3a 2b f2 51 39 2e 8c cc 48 f4 db a6 a5 1a d7 46 aa df 66 67 e3 47 d9 71 7d 22 7e 15 fc eb 2a 29 47 f9 4c 53 5d b5 d9 ac be b9 4c 8b b3 51 99 fe d7 3a 2b d3 c7 8f e5 8f 03 7a 06 97 b9 5e a6 f5 ba cc 47 39 06 7d 64 e9 d4 be 54 6d 4b d9 56 5f 94 c5 f5 38 9f e5 e9 f5 e8 9b b2 2c ca b1 f6 3c c9 f3 a2 1e 9d 65 f9 62 b4 2a 16 eb 65 3a 7a a2 ed d5 7b da 13 4d d7 cd 79 b1 48 67 da ab d7 7f f9 f1 e8 9b 77 df bd 7e fb ee db d7 3f 7e f7 17 cd c8 37 Data Ascii: vF.<EGJ lYeey,c[I36$E<qe^`^a#LUJUL;}@?:[:+Q9.HFfgGq}"~)GLS]LQ:+z^G9}dTmKV_8,<ebe:z{MyHgw~?~7
2024-02-22 12:06:58 UTC	752	IN	Data Raw: b8 a7 1b f7 1d e8 5c 52 ca df 28 f5 8d 52 35 9f ea e7 b4 ab 4c 7e 8f 83 b9 45 31 ca b8 1c 2f 11 02 f2 59 f0 8b 62 25 15 eb c0 29 f0 ca 87 98 89 73 bb 17 f7 5a b6 54 10 37 6d 8e 98 97 25 3b 3b 63 a6 bc 5f 9b ed 96 f4 f0 d1 df 0d 2c 63 9d ab cd da c1 c8 46 3f 34 98 b0 e1 1f 32 98 a8 03 1a 58 2c 0f b5 5d 25 b4 3d 92 38 7f 7d d9 a1 13 9f 26 96 88 13 cf 97 f2 c4 f3 6c 31 4b 19 d7 eb d9 d6 69 c9 b4 3f dc d0 e3 91 ca 9e 81 f7 29 07 fb 88 4e 32 1e a4 ed 9b 35 38 6d 94 be 57 4a 6d b4 02 43 8d 52 d8 23 34 9f a6 23 7a 7a 54 94 1d 62 1b 23 62 06 6d 4f cd a0 1f 74 64 4b 45 0a f3 32 85 65 19 63 fa 8e 5b 6f dc 42 24 20 e3 eb 39 1c 86 a9 94 df b4 77 50 b9 dd 3d 98 7c fb d0 f2 0d 85 4f 10 1d 39 07 88 f3 bd 1a fa f5 d9 e1 60 2b e3 66 4a 7e 2a 43 f1 ee 1d f0 b0 19 cf 8d 8a Data Ascii: \R(R5L~E1/Yb%)sZT7m%;;c_,cF?42X,]%=8}&l1Ki?)N258mWJmCR#4#zzTb#bmOtdKE2ec[oB$ 9wP=\|O9`+fJ~*C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49995	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	645	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616061&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:58 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:58 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49994	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	801	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:06:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49998	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	838	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&rl=&if=false&ts=1708603616066&cd[content_ids]=%5B%27FAV-ONLINE-HP%27%2C%27MAC-FREE-ONLINE-HP%27%2C%27AMS%27%2C%27IMS%27%2C%27ASB-CROSS-SELL-DIRECT%27%2C%27FAV-ONLINE%27%2C%27AVAST-ONE-FREE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603616041&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:06:58 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:06:58 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50010	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	785	OUT	GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en-us HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	546	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 915 Connection: close Cache-Control: public,max-age=1800 Date: Thu, 22 Feb 2024 12:06:58 GMT ETag: "6dc37b6916858add248ddd84eeac2cb2" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: UeZ2_gSAAYWb9umZh9FOtfflrwZuQFVFKblBOLN9Hz0_XtzqM-CokA==
2024-02-22 12:06:58 UTC	915	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 33 2e 39 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 41 76 61 73 74 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 31 33 38 30 36 2c 22 6f 6e 65 53 74 61 72 22 3a 32 32 37 36 2c 22 74 77 6f 53 74 61 72 73 22 3a 35 32 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 36 38 33 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 31 38 30 31 2c 22 66 69 76 65 53 74 61 72 73 22 3a 38 35 31 39 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50011	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	1157	OUT	GET /stats/TrustboxImpression?cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:06:58 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 11ab138d0b995a9fa4daabbae7fc0b0c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: hNQQ7yVG1KrjVmMEDt5vtUK5BnWp80bstLoe-Dcknq_tCq3rg1To1w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50012	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:58 UTC	1151	OUT	GET /stats/TrustboxView?cmpName=trustpilot&locale=en-us&theme=light&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fen-us%2Findex%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:58 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:06:58 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4d936db4a90ac6e06d19d66ebba832e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: N4VIiEf3urJoL9yJvRS-QkeAFjLT8FZE4gvjv7WHXPdqvOWOgXdI1w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50020	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:59 UTC	2209	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgfCBEb3dubG9hZCBGcmVlIEFudGl2aXJ1cyAmIFZQTiB8IDEwMCUgRnJlZSAmIEVhc3kiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTcwODYwMzYxNzcwNyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMThkZDBiNjE3YmYzOTctMDFkMzViZDNjZTkwN2QtMjYwMzFlNTEtMTQwMDAwLTE4ZGQwYjYxN2MwOTFjIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLWV1IiwiYWNjb3VudElkIjogODIzMTgsInVybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ3ZWJzaXRlSWQiOiA4MjMyMCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJtZF9pc1N1cnZleVN1Ym1pdHRlZEluU2Vzc2lvbiI6ICIiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMmRlZC0xYjEzLTYxNjEtOWRmNS01NzYwLTY5YzAtNzJiNy1mMWY2Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE3MDg2MDM2MTc2OTkiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMjcyNiwia2FtcHlsZV92ZXJzaW9uIjogIjIuNTIuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNTIuMCIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTcwODYwMzYxNzcwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19 HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:59 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:59 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-4l96 X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50026	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:59 UTC	436	OUT	GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en-us HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:59 UTC	553	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 915 Connection: close Cache-Control: public,max-age=1800 Date: Thu, 22 Feb 2024 12:06:58 GMT ETag: "6dc37b6916858add248ddd84eeac2cb2" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Hit from cloudfront Via: 1.1 e6fc68fd040718147cda2e3ef6f63636.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: IdONBEvqjljHuO3S8uyRXMilKZg1JmaYSuYkiMHaGNmncVFdNsbLFA== Age: 1
2024-02-22 12:06:59 UTC	915	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 33 2e 39 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 41 76 61 73 74 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 31 33 38 30 36 2c 22 6f 6e 65 53 74 61 72 22 3a 32 32 37 36 2c 22 74 77 6f 53 74 61 72 73 22 3a 35 32 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 36 38 33 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 31 38 30 31 2c 22 66 69 76 65 53 74 61 72 73 22 3a 38 35 31 39 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50027	172.253.115.156	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:59 UTC	957	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&gjid=2012420660&_gid=1751936064.1708603609&_u=SCCACUABBAAGACAHKgB~&z=1129750105 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.avast.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:06:59 UTC	591	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.avast.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 22 Feb 2024 12:06:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:06:59 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50030	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:59 UTC	1976	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgfCBEb3dubG9hZCBGcmVlIEFudGl2aXJ1cyAmIFZQTiB8IDEwMCUgRnJlZSAmIEVhc3kiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTcwODYwMzYxNzcwNyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMThkZDBiNjE3YmYzOTctMDFkMzViZDNjZTkwN2QtMjYwMzFlNTEtMTQwMDAwLTE4ZGQwYjYxN2MwOTFjIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLWV1IiwiYWNjb3VudElkIjogODIzMTgsInVybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvaW5kZXgjcGMiLCJ3ZWJzaXRlSWQiOiA4MjMyMCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJtZF9pc1N1cnZleVN1Ym1pdHRlZEluU2Vzc2lvbiI6ICIiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMmRlZC0xYjEzLTYxNjEtOWRmNS01NzYwLTY5YzAtNzJiNy1mMWY2Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE3MDg2MDM2MTc2OTkiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMjcyNiwia2FtcHlsZV92ZXJzaW9uIjogIjIuNTIuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNTIuMCIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTcwODYwMzYxNzcwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19 HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:06:59 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:06:59 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-w3p3 X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50034	172.253.63.154	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:06:59 UTC	711	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&gjid=2012420660&_gid=1751936064.1708603609&_u=SCCACUABBAAGACAHKgB~&z=1129750105 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:00 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 22 Feb 2024 12:07:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:00 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50035	142.251.40.196	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:00 UTC	1004	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&_u=SCCACUABBAAGACAHKgB~&z=1034922770 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:00 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50037	142.250.80.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:00 UTC	771	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=704409195.1708603609&jid=404308706&_u=SCCACUABBAAGACAHKgB~&z=1034922770 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:00 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50045	104.16.110.209	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	612	OUT	GET /hs/hsstatic/content_shared_assets/static-1.4092/css/public_common.css HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:32 UTC	1021	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close x-amz-replication-status: COMPLETED Last-Modified: Fri, 20 Sep 2019 17:06:57 GMT x-amz-version-id: 2RFbnFxKy2NGcYAmxD4lhmVtYSdWoTDd ETag: W/"26baf8a457dce1dc1bd0d6b945f4c44a" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3203c4b5504fa019a752072f0419ef6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P3 X-Amz-Cf-Id: 2xuDKpGvWFD7QAlYOUPewGpZTTvNvBpZ7JP0OPPI8D09hKO4mAzO3A== Cache-Control: s-maxage=31536000, max-age=31536000 CF-Cache-Status: HIT Age: 8663169 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VgJjGIrd2q%2F2ugJ8mNP2hBcsV4JtDdWZ1PWSDvuhndgWoNZcuh8qx9CzgbkuDS26F74pg5I3X0xovK98g7%2FMViX25pyOAlcD4YmJAdljYcs3qFZ54oElHQRIEENczU68i%2B4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 85971bfc79f7434b-EWR alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:32 UTC	348	IN	Data Raw: 33 39 31 37 0d 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 40 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 2d 6d 6f 7a 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 2d 6d 73 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 2d 6f 2d 6b 65 79 66 72 61 6d Data Ascii: 3917@charset "UTF-8";@keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-moz-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-ms-keyframes vex-fadein{0%{opacity:0}100%{opacity:1}}@-o-keyfram
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 6f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 2d 6d 6f 7a 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 6f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 2d 6d 73 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 6f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 2d 6f 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 66 61 64 65 6f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 72 6f 74 61 74 69 6f 6e 7b 30 Data Ascii: }}@-webkit-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-moz-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-ms-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@-o-keyframes vex-fadeout{0%{opacity:1}100%{opacity:0}}@keyframes vex-rotation{0
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 28 33 35 39 64 65 67 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 40 2d 6f 2d 6b 65 79 66 72 61 6d 65 73 20 76 65 78 2d 72 6f 74 61 74 69 6f 6e 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d Data Ascii: (359deg);-webkit-transform:rotate(359deg);-moz-transform:rotate(359deg);-ms-transform:rotate(359deg);-o-transform:rotate(359deg)}}@-o-keyframes vex-rotation{0%{transform:rotate(0deg);-webkit-transform:rotate(0deg);-moz-transform:rotate(0deg);-ms-transform
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 6e 3a 76 65 78 2d 66 61 64 65 69 6e 20 30 2e 35 73 3b 2d 6d 73 2d 61 6e 69 6d 61 74 69 6f 6e 3a 76 65 78 2d 66 61 64 65 69 6e 20 30 2e 35 73 3b 2d 6f 2d 61 6e 69 6d 61 74 69 6f 6e 3a 76 65 78 2d 66 61 64 65 69 6e 20 30 2e 35 73 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 76 65 78 2e 76 65 78 2d 63 6c 6f 73 69 6e 67 20 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 76 65 78 2d 66 61 64 65 6f 75 74 20 30 2e 35 73 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 76 65 78 2d 66 61 64 65 6f 75 74 20 30 2e 35 73 3b 2d 6d 6f 7a 2d 61 6e 69 6d 61 74 69 6f 6e 3a 76 65 78 2d 66 61 64 65 6f 75 74 20 30 2e 35 73 3b 2d 6d 73 Data Ascii: n:vex-fadein 0.5s;-ms-animation:vex-fadein 0.5s;-o-animation:vex-fadein 0.5s;-webkit-backface-visibility:hidden;background:#fff}.vex.vex-closing .vex-content{animation:vex-fadeout 0.5s;-webkit-animation:vex-fadeout 0.5s;-moz-animation:vex-fadeout 0.5s;-ms
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 2d 67 61 6c 6c 65 72 79 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 72 2c 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 2d 67 61 6c 6c 65 72 79 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 76 69 65 77 70 6f 72 74 2c 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 2d 67 61 6c 6c 65 72 79 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 7b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 2d 67 61 6c 6c 65 72 79 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 20 6c 69 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 Data Ascii: 100%;height:100%}.vex-content.hs-gallery .hs_cos_flex-slider,.vex-content.hs-gallery .hs_cos_flex-viewport,.vex-content.hs-gallery .hs_cos_flex-slides{height:100%}.vex-content.hs-gallery .hs_cos_flex-slides li{height:100%;visibility:hidden}.vex-content.hs
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 7d 2e 76 65 78 2d 63 6f 6e 74 65 6e 74 2e 68 73 2d 67 61 6c 6c 65 72 79 20 2e 76 65 78 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 7d 40 Data Ascii: m:rotate(45deg);-o-transform:rotate(45deg);transform:rotate(45deg)}.vex-content.hs-gallery .vex-close:before{-webkit-transform:rotate(135deg);-moz-transform:rotate(135deg);-ms-transform:rotate(135deg);-o-transform:rotate(135deg);transform:rotate(135deg)}@
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 20 6c 69 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 73 6c 69 64 65 72 2d 6d 6f 64 65 2d 6c 69 67 68 74 62 6f 78 2e 68 73 2d 63 6f 73 2d 66 6c 65 78 2d 73 6c 69 64 65 72 2d 63 6f 6e 74 72 6f 6c 2d 70 61 6e 65 6c 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 20 6c 69 20 61 20 69 6d 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 75 6c 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 2d 6d 61 69 6e 20 69 6d 67 5b 64 61 74 61 2d 73 72 63 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 68 74 Data Ascii: _cos_flex-slides li a{position:absolute;top:0;left:0;width:100%;height:100%}.slider-mode-lightbox.hs-cos-flex-slider-control-panel .hs_cos_flex-slides li a img{display:inline;vertical-align:middle}ul.hs_cos_flex-slides-main img[data-src]{background:url(ht
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 34 30 34 30 34 30 2c 20 23 33 33 33 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 6d 6f 7a 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 34 30 34 30 34 30 2c 20 23 33 33 33 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 61 62 61 63 61 63 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 36 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 3a 30 70 78 20 Data Ascii: ;background-image:-webkit-linear-gradient(top, #404040, #333) !important;background-image:-moz-linear-gradient(top, #404040, #333) !important;color:#abacac !important;min-width:160px !important;min-height:40px !important;padding:0px !important;margin:0px
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 73 2d 74 6f 6f 6c 73 2d 6d 65 6e 75 20 61 3a 68 6f 76 65 72 2c 2e 68 73 2d 74 6f 6f 6c 73 2d 6d 65 6e 75 20 61 3a 61 63 74 69 76 65 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 37 66 38 66 38 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 34 34 34 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 73 2d 74 6f 6f 6c 73 2d 6d 65 6e 75 20 6c 69 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 20 21 Data Ascii: ine-height:inherit !important;font-weight:inherit !important}.hs-tools-menu a:hover,.hs-tools-menu a:active{text-decoration:none !important;color:#f7f8f8 !important;background:#444 !important}.hs-tools-menu li{text-align:left !important;line-height:18px !
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 73 2d 74 6f 6f 6c 73 2d 6d 65 6e 75 20 69 6d 67 2e 68 73 2d 73 70 72 6f 63 6b 65 74 3a 61 63 74 69 76 65 7b 6f 70 61 63 69 74 79 3a 30 2e 35 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 31 31 31 2c 20 23 33 30 33 30 33 30 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 6d 6f 7a 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 31 31 31 2c 20 23 33 30 33 30 33 30 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 70 78 20 31 70 78 20 33 70 78 20 72 67 62 Data Ascii: x !important}.hs-tools-menu img.hs-sprocket:active{opacity:0.5 !important;background-image:-webkit-linear-gradient(top, #111, #303030) !important;background-image:-moz-linear-gradient(top, #111, #303030) !important;-webkit-box-shadow:inset 0px 1px 3px rgb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50044	104.16.110.209	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	586	OUT	GET /hs/hsstatic/jquery-libs/static-1.1/jquery/jquery-1.7.1.js HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:32 UTC	979	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 25 Nov 2014 17:03:30 GMT x-amz-version-id: null ETag: W/"ddb84c1587287b2df08966081ef063bf" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P3 X-Amz-Cf-Id: DFtBlvkhLUKWxoRq6FAVVuQhAgLoLR_SiKUX32wTfmfoFTyUGMJLcA== Cache-Control: s-maxage=31536000, max-age=31536000 CF-Cache-Status: HIT Age: 8823859 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PuMrxlY7Ow7Qz0dXpBlveX6jjoSMkJJTFuNqPdrFZGiti5BTi8CfoopduOBiZ88vaMz18kH67ozNLz8IGvySoYegoWWn8U91uFfHauu9vTyHFLSFNipGdjad1hiqhjKTQO4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 85971bfc988d7d0e-EWR alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:32 UTC	390	IN	Data Raw: 37 62 65 31 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 37 2e 31 20 6a 71 75 65 72 79 2e 63 6f 6d 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 79 28 61 29 7b 72 65 74 75 72 6e 20 66 2e 69 73 57 69 6e 64 6f 77 28 61 29 3f 61 3a 61 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 39 3f 61 2e 64 65 66 61 75 6c 74 56 69 65 77 7c 7c 61 2e 70 61 72 65 6e 74 57 69 6e 64 6f 77 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 63 76 28 61 29 7b 69 66 28 21 63 6b 5b 61 5d 29 7b 76 61 72 20 62 3d 63 2e 62 6f 64 79 2c 64 3d 66 28 22 3c 22 2b 61 2b 22 3e 22 29 2e 61 70 70 65 6e 64 54 6f 28 62 29 2c 65 3d 64 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 29 3b 64 2e 72 65 6d 6f 76 65 28 29 Data Ascii: 7be1/! jQuery v1.7.1 jquery.com \| jquery.org/license /(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView\|\|a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove()
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 65 6e 74 29 63 6d 3d 28 63 6c 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 7c 7c 63 6c 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 29 2e 64 6f 63 75 6d 65 6e 74 2c 63 6d 2e 77 72 69 74 65 28 28 63 2e 63 6f 6d 70 61 74 4d 6f 64 65 3d 3d 3d 22 43 53 53 31 43 6f 6d 70 61 74 22 3f 22 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 22 3a 22 22 29 2b 22 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 22 29 2c 63 6d 2e 63 6c 6f 73 65 28 29 3b 64 3d 63 6d 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 61 29 2c 63 6d 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 2c 65 3d 66 2e 63 73 73 28 64 2c 22 64 69 73 70 6c 61 79 22 29 2c 62 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 63 6c 29 7d 63 6b 5b 61 5d 3d 65 7d 72 65 74 75 72 6e 20 63 6b 5b 61 5d 7d 66 75 6e 63 74 69 6f 6e Data Ascii: ent)cm=(cl.contentWindow\|\|cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"")+"<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 66 5b 30 5d 7c 7c 61 2e 63 6f 6e 76 65 72 74 65 72 73 5b 69 2b 22 20 22 2b 66 5b 30 5d 5d 29 7b 6a 3d 69 3b 62 72 65 61 6b 7d 6b 7c 7c 28 6b 3d 69 29 7d 6a 3d 6a 7c 7c 6b 7d 69 66 28 6a 29 7b 6a 21 3d 3d 66 5b 30 5d 26 26 66 2e 75 6e 73 68 69 66 74 28 6a 29 3b 72 65 74 75 72 6e 20 64 5b 6a 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 63 61 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 66 2e 69 73 41 72 72 61 79 28 62 29 29 66 2e 65 61 63 68 28 62 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 65 29 7b 63 7c 7c 62 45 2e 74 65 73 74 28 61 29 3f 64 28 61 2c 65 29 3a 63 61 28 61 2b 22 5b 22 2b 28 74 79 70 65 6f 66 20 65 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 66 2e 69 73 41 72 72 61 79 28 65 29 3f 62 3a 22 22 29 2b 22 5d 22 2c 65 2c 63 2c 64 29 7d 29 3b 65 6c 73 65 20 69 66 28 21 63 26 26 Data Ascii: f[0]\|\|a.converters[i+" "+f[0]]){j=i;break}k\|\|(k=i)}j=j\|\|k}if(j){j!==f[0]&&f.unshift(j);return d[j]}}function ca(a,b,c,d){if(f.isArray(b))f.each(b,function(b,e){c\|\|bE.test(a)?d(a,e):ca(a+"["+(typeof e=="object"\|\|f.isArray(e)?b:"")+"]",e,c,d)});else if(!c&&
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 2c 22 70 61 64 64 69 6e 67 22 2b 65 5b 67 5d 29 29 7c 7c 30 2c 63 21 3d 3d 22 70 61 64 64 69 6e 67 22 26 26 28 64 2b 3d 70 61 72 73 65 46 6c 6f 61 74 28 66 2e 63 73 73 28 61 2c 22 62 6f 72 64 65 72 22 2b 65 5b 67 5d 2b 22 57 69 64 74 68 22 29 29 7c 7c 30 29 2c 63 3d 3d 3d 22 6d 61 72 67 69 6e 22 26 26 28 64 2b 3d 70 61 72 73 65 46 6c 6f 61 74 28 66 2e 63 73 73 28 61 2c 63 2b 65 5b 67 5d 29 29 7c 7c 30 29 3b 72 65 74 75 72 6e 20 64 2b 22 70 78 22 7d 66 75 6e 63 74 69 6f 6e 20 62 70 28 61 2c 62 29 7b 62 2e 73 72 63 3f 66 2e 61 6a 61 78 28 7b 75 72 6c 3a 62 2e 73 72 63 2c 61 73 79 6e 63 3a 21 31 2c 64 61 74 61 54 79 70 65 3a 22 73 63 72 69 70 74 22 7d 29 3a 66 2e 67 6c 6f 62 61 6c 45 76 61 6c 28 28 62 2e 74 65 78 74 7c 7c 62 2e 74 65 78 74 43 6f 6e 74 65 6e Data Ascii: ,"padding"+e[g]))\|\|0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+e[g]+"Width"))\|\|0),c==="margin"&&(d+=parseFloat(f.css(a,c+e[g]))\|\|0);return d+"px"}function bp(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text\|\|b.textConten
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 3d 3d 3d 31 26 26 21 21 66 2e 68 61 73 44 61 74 61 28 61 29 29 7b 76 61 72 20 63 2c 64 2c 65 2c 67 3d 66 2e 5f 64 61 74 61 28 61 29 2c 68 3d 66 2e 5f 64 61 74 61 28 62 2c 67 29 2c 69 3d 67 2e 65 76 65 6e 74 73 3b 69 66 28 69 29 7b 64 65 6c 65 74 65 20 68 2e 68 61 6e 64 6c 65 2c 68 2e 65 76 65 6e 74 73 3d 7b 7d 3b 66 6f 72 28 63 20 69 6e 20 69 29 66 6f 72 28 64 3d 30 2c 65 3d 69 5b 63 5d 2e 6c 65 6e 67 74 68 3b 64 3c 65 3b 64 2b 2b 29 66 2e 65 76 65 6e 74 2e 61 64 64 28 62 2c 63 2b 28 69 5b 63 5d 5b 64 5d 2e 6e 61 6d 65 73 70 61 63 65 3f 22 2e 22 3a 22 22 29 2b 69 5b 63 5d 5b 64 5d 2e 6e 61 6d 65 73 70 61 63 65 2c 69 5b 63 5d 5b 64 5d 2c 69 5b 63 5d 5b 64 5d 2e 64 61 74 61 29 7d 68 2e 64 61 74 61 26 26 28 68 2e 64 61 74 61 3d 66 2e 65 78 74 65 6e 64 28 7b Data Ascii: ===1&&!!f.hasData(a)){var c,d,e,g=f._data(a),h=f._data(b,g),i=g.events;if(i){delete h.handle,h.events={};for(c in i)for(d=0,e=i[c].length;d<e;d++)f.event.add(b,c+(i[c][d].namespace?".":"")+i[c][d].namespace,i[c][d],i[c][d].data)}h.data&&(h.data=f.extend({
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 6e 6f 64 65 54 79 70 65 3d 3d 3d 31 29 7b 76 61 72 20 65 3d 22 64 61 74 61 2d 22 2b 63 2e 72 65 70 6c 61 63 65 28 6b 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 64 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 65 29 3b 69 66 28 74 79 70 65 6f 66 20 64 3d 3d 22 73 74 72 69 6e 67 22 29 7b 74 72 79 7b 64 3d 64 3d 3d 3d 22 74 72 75 65 22 3f 21 30 3a 64 3d 3d 3d 22 66 61 6c 73 65 22 3f 21 31 3a 64 3d 3d 3d 22 6e 75 6c 6c 22 3f 6e 75 6c 6c 3a 66 2e 69 73 4e 75 6d 65 72 69 63 28 64 29 3f 70 61 72 73 65 46 6c 6f 61 74 28 64 29 3a 6a 2e 74 65 73 74 28 64 29 3f 66 2e 70 61 72 73 65 4a 53 4f 4e 28 64 29 3a 64 7d 63 61 74 63 68 28 67 29 7b 7d 66 2e 64 61 74 61 28 61 2c 63 2c 64 29 7d 65 6c 73 65 20 64 3d 62 7d 72 65 74 75 72 6e 20 64 7d 66 75 Data Ascii: nodeType===1){var e="data-"+c.replace(k,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNumeric(d)?parseFloat(d):j.test(d)?f.parseJSON(d):d}catch(g){}f.data(a,c,d)}else d=b}return d}fu
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 22 62 6f 64 79 22 26 26 21 64 26 26 63 2e 62 6f 64 79 29 7b 74 68 69 73 2e 63 6f 6e 74 65 78 74 3d 63 2c 74 68 69 73 5b 30 5d 3d 63 2e 62 6f 64 79 2c 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 3d 61 2c 74 68 69 73 2e 6c 65 6e 67 74 68 3d 31 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 22 73 74 72 69 6e 67 22 29 7b 61 2e 63 68 61 72 41 74 28 30 29 21 3d 3d 22 3c 22 7c 7c 61 2e 63 68 61 72 41 74 28 61 2e 6c 65 6e 67 74 68 2d 31 29 21 3d 3d 22 3e 22 7c 7c 61 2e 6c 65 6e 67 74 68 3c 33 3f 67 3d 69 2e 65 78 65 63 28 61 29 3a 67 3d 5b 6e 75 6c 6c 2c 61 2c 6e 75 6c 6c 5d 3b 69 66 28 67 26 26 28 67 5b 31 5d 7c 7c 21 64 29 29 7b 69 66 28 67 5b 31 5d 29 7b 64 3d 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 64 5b 30 5d 3a 64 2c 6b 3d 64 Data Ascii: "body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"\|\|a.charAt(a.length-1)!==">"\|\|a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]\|\|!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 20 74 68 69 73 7d 2c 65 71 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 2b 61 3b 72 65 74 75 72 6e 20 61 3d 3d 3d 2d 31 3f 74 68 69 73 2e 73 6c 69 63 65 28 61 29 3a 74 68 69 73 2e 73 6c 69 63 65 28 61 2c 61 2b 31 29 7d 2c 66 69 72 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 30 29 7d 2c 6c 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 46 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 2c 22 73 6c 69 63 65 22 2c 46 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 2e 6a 6f 69 6e 28 22 2c 22 29 29 7d 2c 6d 61 70 3a 66 75 6e 63 Data Ascii: this},eq:function(a){a=+a;return a===-1?this.slice(a):this.slice(a,a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:func
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 22 63 6f 6d 70 6c 65 74 65 22 29 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 65 2e 72 65 61 64 79 2c 31 29 3b 69 66 28 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 2c 21 31 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 65 2e 72 65 61 64 79 2c 21 31 29 3b 65 6c 73 65 20 69 66 28 63 2e 61 74 74 61 63 68 45 76 65 6e 74 29 7b 63 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 42 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 65 2e 72 65 61 64 79 29 3b 76 61 72 20 62 3d 21 31 3b 74 72 79 7b 62 3d 61 2e 66 Data Ascii: "complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.f
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 4f 4d 22 29 2c 64 2e 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 2c 64 2e 6c 6f 61 64 58 4d 4c 28 63 29 29 7d 63 61 74 63 68 28 67 29 7b 64 3d 62 7d 28 21 64 7c 7c 21 64 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 7c 7c 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 70 61 72 73 65 72 65 72 72 6f 72 22 29 2e 6c 65 6e 67 74 68 29 26 26 65 2e 65 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 58 4d 4c 3a 20 22 2b 63 29 3b 72 65 74 75 72 6e 20 64 7d 2c 6e 6f 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 26 26 6a 2e 74 65 73 74 28 62 29 26 26 28 61 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 61 2e 65 76 61 6c 2e 63 61 6c 6c 28 61 2c 62 29 Data Ascii: OM"),d.async="false",d.loadXML(c))}catch(g){d=b}(!d\|\|!d.documentElement\|\|d.getElementsByTagName("parsererror").length)&&e.error("Invalid XML: "+c);return d},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript\|\|function(b){a.eval.call(a,b)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50047	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	2645	OUT	GET /hubfs/Avast/Academy/assets/css/redesign.min.css HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
2024-02-22 12:07:32 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: text/css Content-Length: 329514 Connection: close CF-Ray: 85971bfc8fec8ca8-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 83614 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "59a868f97ac39676df6770d33420d3c2" Last-Modified: Wed, 21 Feb 2024 12:40:46 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c38cfac20df9757e670e782ca61768aa.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51096171557,FD-21313821950,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51096171557,FD-21313821950,P-4650993,FLS-ALL X-Amz-Cf-Id: nRZ2jBWnMDSg1jAjmeKCUbqN17c3-8bSrqpWKKEgRFdu7HYG3nF4hg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: 5mCoSgzNuXHIDT6dSTL91xWx1Rv9fuq8MVPWeWzHk94Vb0tTknuynjbEIlY+qrftdF2PY0pgu3U= x-amz-meta-cache-tag: F-51096171557,FD-21313821950,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1626703031505 x-amz-meta-index-tag: all x-amz-replication-status: PENDING x-amz-request-id: FZX6QP56E81N6DP6 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Uxp0aDWbvskSNCyR20gMFw72ViTD_Ox1 X-Cache: RefreshHit from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:32 UTC	913	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 35 79 62 5f 42 4e 6b 5f 76 7a 52 34 53 43 59 55 43 78 70 63 52 34 71 76 46 76 6f 32 34 2e 64 30 68 48 53 59 61 7a 64 56 6a 6c 4d 2d 31 37 30 38 36 30 33 36 35 32 2d 31 2e 30 2d 41 56 6b 54 70 70 61 34 41 61 5a 49 57 6c 4c 5a 39 36 37 33 4e 4a 6e 74 74 7a 41 6f 30 55 46 4d 36 76 5a 59 32 59 34 64 38 36 75 55 4b 70 44 46 47 76 38 6f 75 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8ou
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 75 74 66 2d 38 22 3b 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4d 69 65 72 20 42 22 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4d 69 65 72 20 42 22 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 6f 2f 66 2f 34 30 30 2f 4d 69 65 72 42 30 33 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 75 72 6c 28 2e 2e 2f 6f 2f 66 2f 34 30 30 2f 4d 69 65 72 42 30 33 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 Data Ascii: @charset "utf-8";body{font-family:"Mier B"}@font-face{font-family:"Mier B";src:url(../o/f/400/MierB03-Regular.woff2) format('woff2'),url(../o/f/400/MierB03-Regular.woff) format('woff');font-style:normal;font-weight:400;font-display:swap}@font-face{font-fa
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 30 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 6d 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 39 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 64 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6c 69 6e 65 2d 74 68 72 6f 75 67 68 7d 61 62 62 72 5b 74 69 74 6c 65 5d 2c 64 66 6e 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 74 65 64 3b 63 75 72 73 6f 72 3a 68 65 6c 70 7d 74 61 62 6c 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 63 6f 6c 6c 61 70 73 65 3b 62 6f 72 64 65 72 2d 73 70 61 63 69 6e 67 3a 30 7d 68 72 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 Data Ascii: 00;text-decoration:none}mark{background-color:#ff9;color:#000;font-style:italic;font-weight:700}del{text-decoration:line-through}abbr[title],dfn[title]{border-bottom:1px dotted;cursor:help}table{border-collapse:collapse;border-spacing:0}hr{display:block;h
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 74 68 3a 31 31 35 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 33 39 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 33 36 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 70 78 7d 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 7b 70 61 64 64 69 6e 67 2d 72 Data Ascii: th:1150px}}@media (min-width:1390px){.container{width:1360px;padding-left:20px;padding-right:20px}}.container-fluid{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media only screen and (max-width:767px){.container-fluid{padding-r
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 7b 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 78 73 2d 32 7b 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 73 2d 31 7b 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 31 32 7b 72 69 67 68 74 3a 31 30 30 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 31 31 7b 72 69 67 68 74 3a 39 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 31 30 7b 72 69 67 68 74 3a 38 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 39 7b 72 69 67 68 74 3a 37 35 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 38 7b 72 69 67 68 74 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 37 7b 72 69 67 68 74 3a 35 38 2e 33 33 33 33 33 33 33 Data Ascii: {width:25%}.col-xs-2{width:16.66666667%}.col-xs-1{width:8.33333333%}.col-xs-pull-12{right:100%}.col-xs-pull-11{right:91.66666667%}.col-xs-pull-10{right:83.33333333%}.col-xs-pull-9{right:75%}.col-xs-pull-8{right:66.66666667%}.col-xs-pull-7{right:58.3333333
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 7b 2e 63 6f 6c 2d 73 6d 2d 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 30 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 32 2c 2e 63 6f 6c 2d 73 6d 2d 33 2c 2e 63 6f 6c 2d 73 6d 2d 34 2c 2e 63 6f 6c 2d 73 6d 2d 35 2c 2e 63 6f 6c 2d 73 6d 2d 36 2c 2e 63 6f 6c 2d 73 6d 2d 37 2c 2e 63 6f 6c 2d 73 6d 2d 38 2c 2e 63 6f 6c 2d 73 6d 2d 39 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 63 6f 6c 2d 73 6d 2d 31 32 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 63 6f 6c 2d 73 6d 2d 31 31 7b 77 69 64 74 68 3a 39 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 31 30 7b 77 69 64 74 68 3a 38 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 39 7b 77 69 64 74 68 3a 37 35 25 7d 2e 63 6f 6c Data Ascii: n-width:768px){.col-sm-1,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9{float:left}.col-sm-12{width:100%}.col-sm-11{width:91.66666667%}.col-sm-10{width:83.33333333%}.col-sm-9{width:75%}.col
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 6f 66 66 73 65 74 2d 33 Data Ascii: 333%}.col-sm-offset-9{margin-left:75%}.col-sm-offset-8{margin-left:66.66666667%}.col-sm-offset-7{margin-left:58.33333333%}.col-sm-offset-6{margin-left:50%}.col-sm-offset-5{margin-left:41.66666667%}.col-sm-offset-4{margin-left:33.33333333%}.col-sm-offset-3
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 39 7b 6c 65 66 74 3a 37 35 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 38 7b 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 37 7b 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 36 7b 6c 65 66 74 3a 35 30 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 35 7b 6c 65 66 74 3a 34 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 34 7b 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 33 7b 6c 65 66 74 3a 32 35 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 32 7b 6c 65 66 74 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 31 7b 6c 65 66 74 3a 38 2e 33 33 33 33 33 33 33 33 25 Data Ascii: 9{left:75%}.col-md-push-8{left:66.66666667%}.col-md-push-7{left:58.33333333%}.col-md-push-6{left:50%}.col-md-push-5{left:41.66666667%}.col-md-push-4{left:33.33333333%}.col-md-push-3{left:25%}.col-md-push-2{left:16.66666667%}.col-md-push-1{left:8.33333333%
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 39 7b 72 69 67 68 74 3a 37 35 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 38 7b 72 69 67 68 74 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 37 7b 72 69 67 68 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 36 7b 72 69 67 68 74 3a 35 30 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 35 7b 72 69 67 68 74 3a 34 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 34 7b 72 69 67 68 74 3a 33 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 33 7b 72 69 67 68 74 3a 32 35 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 32 7b 72 69 67 68 74 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 31 7b 72 69 67 68 74 3a 38 2e Data Ascii: 9{right:75%}.col-lg-pull-8{right:66.66666667%}.col-lg-pull-7{right:58.33333333%}.col-lg-pull-6{right:50%}.col-lg-pull-5{right:41.66666667%}.col-lg-pull-4{right:33.33333333%}.col-lg-pull-3{right:25%}.col-lg-pull-2{right:16.66666667%}.col-lg-pull-1{right:8.
2024-02-22 12:07:32 UTC	1369	IN	Data Raw: 6e 65 72 2d 66 6c 75 69 64 3a 61 66 74 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 3a 61 66 74 65 72 2c 2e 72 6f 77 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 63 65 6e 74 65 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 7d 2e 70 75 6c 6c 2d 72 69 67 68 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 75 6c 6c 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 68 6f 77 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 6e 76 69 73 69 62 6c 65 7b 76 Data Ascii: ner-fluid:after,.container:after,.row:after{clear:both}.center-block{display:block;margin-right:auto;margin-left:auto}.pull-right{float:right!important}.pull-left{float:left!important}.hide{display:none!important}.show{display:block!important}.invisible{v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50046	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	2642	OUT	GET /hubfs/Avast/Academy/assets/css/subset_en.css HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
2024-02-22 12:07:32 UTC	1339	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: text/css Content-Length: 761 Connection: close CF-Ray: 85971bfc8e770cc2-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506589 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "8c9694be9f1de5fc67043560f34ad558" Last-Modified: Wed, 02 Feb 2022 14:09:21 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 cedbf7a51c689bd1e26af4b73768d270.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-65324589915,FD-21313821950,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-65324589915,FD-21313821950,P-4650993,FLS-ALL X-Amz-Cf-Id: xirj_MYCYOj3SsyMr1ZsYJrfEv87j7W_xby1wiV5di_e6kKwxCzPWg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: O2U+B76rzTLeGWcSBGUf3awMwWYO2du+hbZmv/wwv4BM/q0GBFTPkDVK6vjP1qx0qmV8vYDLTXiaCsYtLsSBQg== x-amz-meta-cache-tag: F-65324589915,FD-21313821950,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1643810960919 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 06KYK7HT4YT1QZQM x-amz-server-side-encryption: AES256 x-amz-version-id: N5SRmisjZM3NuRP_8zu4bCnD5gkGnXbh X-Cache: RefreshHit from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:32 UTC	921	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 75 31 62 53 78 68 33 57 46 6b 63 73 4b 63 54 41 6b 78 33 4e 4c 68 64 37 6b 4c 65 44 41 59 37 46 6f 4c 45 64 73 72 6e 64 33 67 34 2d 31 37 30 38 36 30 33 36 35 32 2d 31 2e 30 2d 41 58 35 6d 44 51 79 4c 70 6e 2b 32 30 32 37 61 7a 48 59 47 51 66 70 50 4d 2b 2b 63 4a 69 56 57 6a 77 2f 67 6b 4e 59 47 62 53 71 59 6e 54 67 56 47 49 6c 68 6d Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=u1bSxh3WFkcsKcTAkx3NLhd7kLeDAY7FoLEdsrnd3g4-1708603652-1.0-AX5mDQyLpn+2027azHYGQfpPM++cJiVWjw/gkNYGbSqYnTgVGIlhm
2024-02-22 12:07:32 UTC	478	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 4d 69 65 72 20 42 22 3b 0a 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 4d 69 65 72 20 42 22 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 6f 2f 66 2f 34 30 30 2f 4d 69 65 72 42 30 33 2d 53 75 62 73 65 74 45 6e 67 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 6f 2f 66 2f 34 30 30 2f 4d 69 65 72 42 30 33 2d 53 75 62 73 65 74 45 6e 67 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 Data Ascii: body { font-family: "Mier B";}@font-face { font-family: "Mier B"; src: url('../o/f/400/MierB03-SubsetEng-Regular.woff2') format('woff2'), url('../o/f/400/MierB03-SubsetEng-Regular.woff') format('woff'); font-style: normal; font-weight: 400;
2024-02-22 12:07:32 UTC	283	IN	Data Raw: 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 4d 69 65 72 20 42 22 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 6f 2f 66 2f 38 30 30 2f 4d 69 65 72 42 30 33 2d 53 75 62 73 65 74 45 6e 67 2d 45 78 74 72 61 42 6f 6c 64 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 6f 2f 66 2f 38 30 30 2f 4d 69 65 72 42 30 33 2d 53 75 62 73 65 74 45 6e 67 2d 45 78 74 72 61 42 6f 6c 64 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 38 Data Ascii: eight: 700; font-display: swap;}@font-face { font-family: "Mier B"; src: url('../o/f/800/MierB03-SubsetEng-ExtraBold.woff2') format('woff2'), url('../o/f/800/MierB03-SubsetEng-ExtraBold.woff') format('woff'); font-style: normal; font-weight: 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50048	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	609	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:32 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971bfd7af20f53-EWR
2024-02-22 12:07:32 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50050	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	2705	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/hamburguer-menu-bars.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
2024-02-22 12:07:32 UTC	1359	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: image/webp Content-Length: 176 Connection: close CF-Ray: 85971bfe797c32fc-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506885 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="hamburguer-menu-bars.webp" ETag: "08995dda6060de8163d3375dfaf58cfc" Last-Modified: Mon, 18 Nov 2019 16:10:12 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 cedbf7a51c689bd1e26af4b73768d270.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=416 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: FQ1fhUHhWDzSFChdB59hMjrIxYDhx7CkRtq7gwcz6oGrbHvwwgnx5Q== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: zC/8QwwEjCwa/zQLxBtMUc69H6KR4KTja/vLdFSeU+u4XuoDLdF4yO6lpZIso4yzhqtUG9JtZK8= x-amz-meta-cache-tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL x-amz-request-id: GB02VRDY2NCQ7VKY x-amz-version-id: 6gZ.Sl4OgwcBJUO05J0c7QNaVPaZ6DJ9 X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-02-22 12:07:32 UTC	792	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 45 5a 35 32 74 63 68 31 72 41 41 69 67 6d 43 4f 68 51 59 54 59 51 58 58 72 41 49 79 6d 61 64 72 36 44 4a 51 57 31 69 66 34 53 51 2d 31 37 30 38 36 30 33 36 35 32 2d 31 2e 30 2d 41 55 62 46 67 74 38 44 46 45 43 6e 47 2b 62 36 77 53 38 72 53 63 73 44 70 7a 55 64 4c 66 33 44 50 67 61 4b 37 41 58 73 61 6c 68 56 52 51 4f 56 34 2b 56 2f 33 2f 37 45 76 47 62 51 6d 69 79 63 59 76 56 6b 78 63 69 64 54 4d 6d 57 30 56 63 58 66 57 66 33 74 2f 77 3d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 32 32 2d 46 65 62 2d 32 34 20 31 32 3a 33 37 3a 33 32 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 61 63 61 64 65 6d 79 2e 61 76 61 73 74 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 Data Ascii: Set-Cookie: __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=; path=/; expires=Thu, 22-Feb-24 12:37:32 GMT; domain=.academy.avast.com; HttpOnly; Secu
2024-02-22 12:07:32 UTC	176	IN	Data Raw: 52 49 46 46 a8 00 00 00 57 45 42 50 56 50 38 4c 9c 00 00 00 2f 2f c0 0b 10 6f a0 90 8d 24 68 36 39 7f 8b 1f e6 94 56 c3 40 da 36 d9 7f 2f f7 af 70 66 da b6 71 bb a1 1d ff 7f 8a 22 49 6a 2e c8 08 80 15 44 a0 15 2d 48 e0 9d d3 23 00 ae f8 f9 a2 9b 02 4d e4 fc 23 27 01 12 fd 65 24 a6 d1 b7 15 6c 23 db 56 72 3f 16 13 51 c0 93 df 08 92 43 5b d4 42 ac 15 d0 97 7d cb 48 22 fa af b0 6d db c6 ce 4e 77 bf 40 32 ac 87 b6 71 c3 48 34 19 27 58 22 aa 9c 20 44 54 00 cb f9 c1 0b 4c 44 39 b0 7e 61 76 37 f7 b2 fb 34 f7 77 4b 9a bf c5 ff 02 Data Ascii: RIFFWEBPVP8L//o$h69V@6/pfq"Ij.D-H#M#'e$l#Vr?QC[B}H"mNw@2qH4'X" DTLD9~av74wK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50049	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	2690	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/check.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1
2024-02-22 12:07:32 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:32 GMT Content-Type: image/svg+xml Content-Length: 238 Connection: close CF-Ray: 85971bfe7fcc42cb-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506619 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "621d00062d3edb4f262dd755a8e4821a" Last-Modified: Thu, 19 Oct 2023 13:56:50 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 86a640712a72b4264f1681744fa48612.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: ZmeEjjgXAO6_kti4R3yACpsa-8omQBd50aDi8mrYRW4HSeGYC2qOCw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: Y1WllsRH4guE2YvREzgYh9/XRPLq6GzNEPLJ31U7+QQcvQoSVI61Lgw9bIvHLUx6v/K6Gxs1zEg= x-amz-meta-cache-tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1581436745119 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: D0NFFJ5CF854YKKB x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: _7YrTAOAwJYm1x8kGDyumYsAyaMKL_sR X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:32 UTC	925	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 43 61 59 68 6b 63 4a 45 6e 4c 48 54 6e 74 4d 77 31 6a 78 68 5f 50 48 6a 63 36 34 67 44 4b 4a 7a 69 32 37 44 54 30 7a 77 39 34 6f 2d 31 37 30 38 36 30 33 36 35 32 2d 31 2e 30 2d 41 64 37 4d 36 4b 7a 6e 4e 43 30 31 56 55 67 66 35 6e 6a 76 63 33 33 78 2b 39 47 4d 6a 61 50 36 6b 61 42 64 4b 54 6e 61 5a 55 64 4b 6d 49 4c 70 2f 36 45 76 74 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6Evt
2024-02-22 12:07:32 UTC	238	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 46 46 46 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 32 20 38 6c 34 2e 31 32 35 20 34 4c 31 34 20 34 22 2f 3e 0d 0a 3c 2f 73 76 67 3e 0d 0a Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"> <path fill="none" fill-rule="evenodd" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2 8l4.125 4L14 4"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50051	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:32 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c001a327cff-EWR
2024-02-22 12:07:33 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50053	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2944	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/arrow.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
2024-02-22 12:07:33 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/svg+xml Content-Length: 272 Connection: close CF-Ray: 85971c011dab429e-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506660 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "72b10ea8b9be2e07f04bfe67cea21e99" Last-Modified: Thu, 19 Oct 2023 13:56:46 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 7bf47dc1c691ee43f7c8db83aa03a3cc.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: 5RQIfGm-ZYlb2uLC-yA0sgQ3zmxaoPbO_cbBuAOT9TX-Y0SSmnPIzg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: FlsZpdIVmjMyquj+w1mwQXk86vuntOyFAE4EdO+38GojRNIe6C6L4tuEi177MpXyCbGGrD2qz28= x-amz-meta-cache-tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1626958981556 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: V7YPA1CTBMKCBVB2 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Howqd8PjzYS5POG0YWF3u77pIV0i.rEt X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	544	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 37 78 65 6c 6f 4f 4d 6c 36 44 77 72 69 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xeloOMl6Dwri
2024-02-22 12:07:33 UTC	272	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 30 22 20 68 65 69 67 68 74 3d 22 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 20 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 39 20 31 4c 35 2e 34 37 30 34 33 20 34 2e 34 34 31 33 34 43 35 2e 31 35 34 30 31 20 34 2e 37 34 39 38 35 20 34 2e 36 34 37 33 37 20 34 2e 37 34 33 33 35 20 34 2e 33 33 38 39 36 20 34 2e 34 32 36 38 33 4c 31 20 31 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 44 32 42 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 Data Ascii: <svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50055	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2850	OUT	GET /hubfs/_global/assets/js/prebuild/hubspot.min.js HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
2024-02-22 12:07:33 UTC	1350	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/javascript Content-Length: 23654 Connection: close CF-Ray: 85971c014f0d42f5-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506202 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "0735c0d8548ca4ed5fa324be613d0b5f" Last-Modified: Wed, 14 Oct 2020 10:00:56 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 1d45cc40d1dd29d2b3aaefb9f85bceee.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-21411459337,FD-21416950195,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-21411459337,FD-21416950195,P-4650993,FLS-ALL X-Amz-Cf-Id: e0umt130PWH7fRkthnIzie17SW_yXHmYAngQqkfFYzjx79Pb1S1qRg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: XF4fbeKQOuK47QZDMZo0GQtHN5E4esh90/9YE0lMaI3TpBeMZeYgd49LXthYDW/DVZEnsedXcR0= x-amz-meta-cache-tag: F-21411459337,FD-21416950195,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1574078827803 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: E6QCMRBEEQE7W70B x-amz-server-side-encryption: AES256 x-amz-version-id: IxBVbXZmWHD0Y70bEMKIFvUueVT44HPL X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3
2024-02-22 12:07:33 UTC	457	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 61 6f 6b 57 69 42 6f 77 65 66 66 47 25 32 46 6e 33 76 39 4a 30 59 68 6d 59 31 69 35 48 44 6f 56 58 37 38 25 32 46 4d 58 52 48 70 36 59 49 34 34 54 55 6f 67 32 35 37 39 25 32 42 49 4e 57 36 5a 44 30 48 68 72 6e 49 7a 61 32 54 76 71 73 6e 78 31 4f 4d 72 6b 53 56 44 4a 54 76 5a 6e 30 54 42 6d 38 76 31 47 57 Data Ascii: X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aokWiBoweffG%2Fn3v9J0YhmY1i5HDoVX78%2FMXRHp6YI44TUog2579%2BINW6ZD0HhrnIza2Tvqsnx1OMrkSVDJTvZn0TBm8v1GW
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 2f 2a 21 20 40 61 70 70 20 41 76 61 73 74 20 48 75 62 73 70 6f 74 20 4a 53 20 6c 69 62 72 61 72 79 2e 20 48 61 73 68 3a 20 37 66 33 31 61 31 65 30 30 32 62 62 34 35 65 62 63 65 30 62 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 61 29 7b 69 66 28 65 5b 61 5d 29 72 65 74 75 72 6e 20 65 5b 61 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6e 3d 65 5b 61 5d 3d 7b 69 3a 61 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 61 5d 2e 63 61 6c 6c 28 6e 2e 65 78 70 6f 72 74 73 2c 6e 2c 6e 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 6e 2e 6c 3d 21 30 2c 6e 2e 65 78 70 6f 72 74 73 7d 6f 2e 6d 3d 74 2c 6f 2e 63 3d 65 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 6f 2e 6f Data Ascii: /! @app Avast Hubspot JS library. Hash: 7f31a1e002bb45ebce0b /!function(t){var e={};function o(a){if(e[a])return e[a].exports;var n=e[a]={i:a,l:!1,exports:{}};return t[a].call(n.exports,n,n.exports,o),n.l=!0,n.exports}o.m=t,o.c=e,o.d=function(t,e,a){o.o
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 28 74 2c 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 76 6f 69 64 20 30 21 3d 3d 65 29 7b 66 6f 72 28 76 61 72 20 6f 2c 73 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 2c 69 3d 73 2e 6c 65 6e 67 74 68 2c 72 3d 69 2d 31 2c 6c 3d 6e 2c 63 3d 30 3b 63 3c 69 3b 63 2b 2b 29 69 66 28 6f 3d 73 5b 63 5d 2c 63 3c 72 26 26 28 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3d 3d 3d 61 2e 63 61 6c 6c 28 6c 5b 6f 5d 29 26 26 6e 75 6c 6c 21 3d 3d 6c 5b 6f 5d 7c 7c 21 28 6f 20 69 6e 20 6c 29 29 29 6c 3d 6c 5b 6f 5d 3d 6c 5b 6f 5d 7c 7c 7b 7d 3b 65 6c 73 65 7b 69 66 28 63 21 3d 3d 72 7c 7c 6f 20 69 6e 20 6c 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4d 6f 64 75 6c 65 20 22 2b 74 2b 22 20 61 6c 72 65 61 64 79 20 65 78 69 73 74 73 Data Ascii: (t,e){if("string"==typeof t&&void 0!==e){for(var o,s=t.split("."),i=s.length,r=i-1,l=n,c=0;c<i;c++)if(o=s[c],c<r&&("[object Object]"===a.call(l[o])&&null!==l[o]\|\|!(o in l)))l=l[o]=l[o]\|\|{};else{if(c!==r\|\|o in l)throw new Error("Module "+t+" already exists
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6c 65 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 74 3d 22 69 73 43 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 22 3b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 74 2b 22 3d 31 22 2c 2d 31 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 69 6e 64 65 78 4f 66 28 74 2b 22 3d 31 22 29 26 26 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 74 2b 22 3d 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 22 2c 21 30 29 7d 28 29 29 2c 75 2e 64 65 66 69 6e 65 28 22 61 76 61 73 74 2e 73 74 6f 72 61 67 65 2e 69 73 53 74 6f 72 61 67 65 45 6e 61 62 6c 65 64 22 Data Ascii: led",function(){if(navigator.cookieEnabled)return!0;var t="isCookieEnabled";return document.cookie=t+"=1",-1!==document.cookie.indexOf(t+"=1")&&(document.cookie=t+"=; expires=Thu, 01 Jan 1970 00:00:00 GMT",!0)}()),u.define("avast.storage.isStorageEnabled"
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6f 78 3a 7b 6e 61 6d 65 3a 2f 66 69 72 65 66 6f 78 7c 69 63 65 77 65 61 73 65 6c 2f 2c 76 65 72 73 69 6f 6e 3a 2f 28 3f 3a 66 69 72 65 66 6f 78 7c 69 63 65 77 65 61 73 65 6c 29 5c 2f 28 5c 64 2b 28 3f 3a 5c 2e 5c 64 2b 29 2b 29 2f 7d 2c 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 3a 7b 6e 61 6d 65 3a 2f 6d 73 69 65 7c 74 72 69 64 65 6e 74 2f 2c 76 65 72 73 69 6f 6e 3a 2f 28 3f 3a 72 76 3a 7c 6d 73 69 65 5c 73 29 28 5c 64 2b 28 3f 3a 5c 2e 5c 64 2b 29 2b 29 2f 7d 2c 53 61 66 61 72 69 3a 7b 6e 61 6d 65 3a 2f 73 61 66 61 72 69 2f 2c 76 65 72 73 69 6f 6e 3a 2f 28 3f 3a 76 65 72 73 69 6f 6e 7c 73 61 66 61 72 69 29 5c 2f 28 5c 64 2b 28 3f 3a 5c 2e 5c 64 2b 29 2b 29 2f 7d 7d 2c 6f 73 3a 7b 57 69 6e 64 6f 77 73 50 68 6f 6e 65 3a 7b 6e 61 6d 65 3a 2f 77 69 6e Data Ascii: ox:{name:/firefox\|iceweasel/,version:/(?:firefox\|iceweasel)\/(\d+(?:\.\d+)+)/},InternetExplorer:{name:/msie\|trident/,version:/(?:rv:\|msie\s)(\d+(?:\.\d+)+)/},Safari:{name:/safari/,version:/(?:version\|safari)\/(\d+(?:\.\d+)+)/}},os:{WindowsPhone:{name:/win
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 63 74 5d 22 3d 3d 3d 73 2e 63 61 6c 6c 28 6f 29 29 66 6f 72 28 76 61 72 20 66 20 69 6e 20 6f 29 21 75 26 26 69 2e 63 61 6c 6c 28 6f 2c 66 29 26 26 28 61 3d 6f 5b 66 5d 2c 22 5b 6f 62 6a 65 63 74 20 52 65 67 45 78 70 5d 22 3d 3d 3d 73 2e 63 61 6c 6c 28 61 29 26 26 61 2e 74 65 73 74 28 72 2e 62 72 6f 77 73 65 72 2e 75 73 65 72 41 67 65 6e 74 29 26 26 28 65 2e 76 65 72 73 69 6f 6e 3d 66 2c 75 3d 21 30 29 29 3b 63 3d 21 30 7d 65 6c 73 65 20 65 5b 6c 5d 3d 21 31 7d 3b 72 65 74 75 72 6e 20 6c 28 6f 2e 62 72 6f 77 73 65 72 2c 72 2e 62 72 6f 77 73 65 72 29 2c 6c 28 6f 2e 6f 73 2c 72 2e 6f 73 29 2c 72 7d 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 6d 65 74 68 6f 64 20 61 72 67 75 6d 65 6e 74 73 20 74 6f 20 61 76 61 73 74 2e 64 65 74 Data Ascii: ct]"===s.call(o))for(var f in o)!u&&i.call(o,f)&&(a=o[f],"[object RegExp]"===s.call(a)&&a.test(r.browser.userAgent)&&(e.version=f,u=!0));c=!0}else e[l]=!1};return l(o.browser,r.browser),l(o.os,r.os),r}throw new Error("Invalid method arguments to avast.det
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 22 70 63 22 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3d 65 7d 29 7d 2c 63 6c 6f 73 65 4f 76 65 72 6c 61 79 42 6f 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 72 2e 74 72 69 67 67 65 72 28 22 63 6c 69 63 6b 22 29 7d 29 7d 2c 73 68 6f 77 42 75 74 74 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 64 64 43 6c 61 73 73 28 22 6a 73 2d 73 68 6f 77 2d 62 75 74 74 6f 6e 73 22 29 7d 7d 7d 28 29 29 2c 75 2e 64 65 66 69 6e 65 28 22 61 76 61 73 74 2e 77 65 62 2e 6f 76 65 72 6c 61 79 50 6f 70 75 70 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 75 2e 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 2c 65 Data Ascii: "pc",window.location.hash=e})},closeOverlayBox:function(){i.on("click",function(t){t.preventDefault(),r.trigger("click")})},showButtons:function(){n.addClass("js-show-buttons")}}}()),u.define("avast.web.overlayPopup",function(){var t=u.require("jquery"),e
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 69 74 28 22 26 22 29 2c 6e 3d 61 2e 6c 65 6e 67 74 68 2c 73 3d 5b 5d 2c 69 3d 30 3b 69 3c 6e 3b 69 2b 2b 29 73 3d 61 5b 69 5d 2e 73 70 6c 69 74 28 22 3d 22 29 2c 65 5b 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 73 5b 30 5d 29 5d 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 73 5b 31 5d 7c 7c 22 22 29 3b 72 65 74 75 72 6e 20 65 7d 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 6d 65 74 68 6f 64 20 61 72 67 75 6d 65 6e 74 73 20 74 6f 20 61 76 61 73 74 2e 75 72 6c 2e 75 6e 73 65 72 69 61 6c 69 7a 65 22 29 7d 29 2c 65 2e 64 65 66 61 75 6c 74 3d 75 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 72 28 65 29 3b 6c 65 74 20 61 3d 7b 63 6f 6e 66 69 67 3a 7b Data Ascii: it("&"),n=a.length,s=[],i=0;i<n;i++)s=a[i].split("="),e[decodeURIComponent(s[0])]=decodeURIComponent(s[1]\|\|"");return e}throw new Error("Invalid method arguments to avast.url.unserialize")}),e.default=u},function(t,e,o){"use strict";o.r(e);let a={config:{
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6a 61 78 28 7b 61 63 63 65 70 74 73 3a 7b 63 75 73 74 6f 6d 54 79 70 65 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 22 2b 6f 7d 2c 63 6f 6e 76 65 72 74 65 72 73 3a 61 2c 75 72 6c 3a 74 2c 64 61 74 61 54 79 70 65 3a 6f 2c 6d 65 74 68 6f 64 3a 22 47 45 54 22 2c 64 61 74 61 3a 65 2c 68 65 61 64 65 72 73 3a 7b 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 22 2b 6f 7d 7d 29 2e 64 6f 6e 65 28 74 3d 3e 7b 6e 28 74 29 7d 29 2e 66 61 69 6c 28 28 74 2c 65 2c 6f 29 3d 3e 7b 7d 29 7d 2c 67 65 74 55 72 6c 50 61 72 61 6d 3a 74 3d 3e 7b 6c 65 74 20 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5b 3f 26 5d 22 2b 74 2b 22 3d 28 5b 5e 26 23 5d 2a 29 22 29 2e 65 78 65 63 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: jax({accepts:{customType:"application/x-"+o},converters:a,url:t,dataType:o,method:"GET",data:e,headers:{"Content-Type":"application/x-"+o}}).done(t=>{n(t)}).fail((t,e,o)=>{})},getUrlParam:t=>{let e=new RegExp("[?&]"+t+"=([^&#]*)").exec(window.location.hre
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 62 72 22 2c 22 68 6d 61 2d 65 6e 2d 74 65 73 74 22 2c 22 72 75 22 2c 22 6e 65 77 73 2f 66 72 2d 66 72 22 2c 22 6e 65 77 73 2f 66 72 2d 66 72 22 2c 22 6e 65 77 73 2f 65 6e 2d 75 73 22 2c 22 65 6e 2d 74 65 73 74 22 2c 22 6e 65 77 73 2f 70 74 2d 62 72 22 2c 22 69 74 22 2c 22 70 6c 22 2c 22 6e 65 77 73 2f 65 6e 2d 67 62 22 2c 22 65 73 22 2c 22 6e 65 77 2d 62 6c 6f 67 2d 65 6e 22 2c 22 64 65 22 2c 22 63 73 22 2c 22 62 6c 6f 67 2d 75 61 22 2c 22 6a 70 22 5d 2c 65 76 65 6e 74 73 3a 7b 53 65 61 72 63 68 51 75 65 72 79 3a 22 53 65 61 72 63 68 51 75 65 72 79 22 2c 53 65 61 72 63 68 52 65 73 75 6c 74 54 69 74 6c 65 3a 22 53 65 61 72 63 68 52 65 73 75 6c 74 54 69 74 6c 65 22 2c 53 65 61 72 63 68 52 65 73 75 6c 74 43 6f 75 6e 74 3a 22 53 65 61 72 63 68 52 65 73 75 6c Data Ascii: br","hma-en-test","ru","news/fr-fr","news/fr-fr","news/en-us","en-test","news/pt-br","it","pl","news/en-gb","es","new-blog-en","de","cs","blog-ua","jp"],events:{SearchQuery:"SearchQuery",SearchResultTitle:"SearchResultTitle",SearchResultCount:"SearchResul

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50054	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2844	OUT	GET /hubfs/Avast/Academy/assets/js/main.min.js HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
2024-02-22 12:07:33 UTC	1362	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/javascript Content-Length: 23531 Connection: close CF-Ray: 85971c012c6c0f43-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 869218 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "a0a2958db926b2069cf68ec0f9a7da84" Last-Modified: Mon, 12 Feb 2024 10:36:09 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 079cd4553da15b2329bffae6abe6157e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-31633214832,FD-21417554736,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-31633214832,FD-21417554736,P-4650993,FLS-ALL X-Amz-Cf-Id: doLczOylX9ZdiUp_m4ZbdEtlw4vHJPUimEWbZIImHtiKsWDP272rVg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: R9b83Z/kiRsy8oASVgcmrwPD+6rs7nBkFM1cPWHlDalwyh32dcNhy9siQ1tOH5Z483i3UZhznE5rF/SRh472jU6dU9snxgVW x-amz-meta-cache-tag: F-31633214832,FD-21417554736,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1593687505163 x-amz-meta-index-tag: all x-amz-replication-status: PENDING x-amz-request-id: 8K998W5H72C6YT0P x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: nytzmz.M4UNw_VBgN8RttRJRSjq5fNcv X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	505	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 58 43 34 74 69 66 54 31 71 51 47 5a 34 59 35 6c 50 48 4b 58 71 65 6f 53 25 32 42 34 79 56 37 25 32 46 37 63 64 53 39 36 31 75 61 47 65 4f 4f 69 70 4a 70 25 32 46 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XC4tifT1qQGZ4Y5lPHKXqeoS%2B4yV7%2F7cdS961uaGeOOipJp%2F
2024-02-22 12:07:33 UTC	871	IN	Data Raw: 2f 2a 21 20 40 61 70 70 20 41 76 61 73 74 20 4a 53 20 6c 69 62 72 61 72 79 20 28 6d 61 69 6e 2e 6a 73 29 2e 20 48 61 73 68 3a 20 65 33 61 62 66 66 66 62 31 63 66 62 61 61 36 65 66 35 31 62 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 76 61 72 20 73 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 73 5b 65 5d 29 72 65 74 75 72 6e 20 73 5b 65 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 73 5b 65 5d 3d 7b 69 3a 65 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6f 5b 65 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 61 29 2c 74 2e 6c 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 61 2e 6d 3d 6f 2c 61 2e 63 3d 73 2c 61 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 61 Data Ascii: /! @app Avast JS library (main.js). Hash: e3abfffb1cfbaa6ef51b /!function(o){var s={};function a(e){if(s[e])return s[e].exports;var t=s[e]={i:e,l:!1,exports:{}};return o[e].call(t.exports,t,t.exports,a),t.l=!0,t.exports}a.m=o,a.c=s,a.d=function(e,t,o){a
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 74 75 72 6e 20 61 2e 64 28 74 2c 22 61 22 2c 74 29 2c 74 7d 2c 61 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 61 2e 70 3d 22 22 2c 61 28 61 2e 73 3d 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6f 28 31 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 47 3d 77 69 6e 64 6f 77 2e 61 76 61 73 74 48 75 62 73 70 6f 74 3b 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 47 2e 6f 73 2e 61 74 74 61 63 68 4f 73 54 6f 42 6f 64 79 28 29 2c 24 28 22 2e 73 69 64 65 62 61 72 2d 63 61 74 65 67 6f 72 79 2d 74 61 62 20 Data Ascii: turn a.d(t,"a",t),t},a.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},a.p="",a(a.s=0)}([function(e,t,o){e.exports=o(1)},function(e,t){var G=window.avastHubspot;$(document).ready(function(){G.os.attachOsToBody(),$(".sidebar-category-tab
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 65 66 74 2e 61 63 74 69 76 65 22 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 24 28 22 2e 62 75 6c 6c 65 74 73 20 75 6c 20 6c 69 22 29 2e 6c 65 6e 67 74 68 3b 32 3c 3d 24 28 22 2e 62 75 6c 6c 65 74 73 20 2e 61 63 74 69 76 65 22 29 2e 64 61 74 61 28 22 62 75 6c 6c 65 74 2d 69 64 22 29 26 26 28 24 28 22 2e 62 75 6c 6c 65 74 73 20 75 6c 20 6c 69 2e 61 63 74 69 76 65 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2e 70 72 65 76 28 29 2e 61 64 64 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 61 28 29 2c 74 28 29 29 7d 29 2c 24 28 22 2e 61 72 72 6f 77 73 20 2e 61 72 72 6f 77 2e 72 69 67 68 74 2e 61 63 74 69 76 65 22 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 24 Data Ascii: eft.active").on("click",function(){$(".bullets ul li").length;2<=$(".bullets .active").data("bullet-id")&&($(".bullets ul li.active").removeClass("active").prev().addClass("active"),a(),t())}),$(".arrows .arrow.right.active").on("click",function(){var e=$
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 22 2e 72 65 6c 2d 62 6c 6f 67 73 2d 62 69 67 22 29 2e 61 6e 69 6d 61 74 65 28 7b 73 63 72 6f 6c 6c 4c 65 66 74 3a 22 2d 3d 33 30 30 70 78 22 7d 2c 35 30 30 29 2c 65 3d 32 29 7d 29 2c 24 28 22 23 62 74 6e 2d 33 22 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 33 21 3d 65 26 26 28 24 28 22 2e 72 65 6c 2d 62 6c 6f 67 73 2d 62 69 67 22 29 2e 61 6e 69 6d 61 74 65 28 7b 73 63 72 6f 6c 6c 4c 65 66 74 3a 22 2b 3d 37 37 35 70 78 22 7d 2c 35 30 30 29 2c 65 3d 33 29 7d 29 2c 24 28 22 23 62 74 6e 2d 34 22 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 31 21 3d 65 26 26 28 24 28 22 Data Ascii: ".rel-blogs-big").animate({scrollLeft:"-=300px"},500),e=2)}),$("#btn-3").on("click",function(){event.preventDefault(),3!=e&&($(".rel-blogs-big").animate({scrollLeft:"+=775px"},500),e=3)}),$("#btn-4").on("click",function(){event.preventDefault(),1!=e&&($("
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 22 61 63 74 69 76 65 22 29 2c 65 3d 32 29 3a 6e 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 61 72 64 2d 33 22 29 29 26 26 28 24 28 22 23 62 75 6c 6c 65 74 5f 31 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 24 28 22 23 62 75 6c 6c 65 74 5f 32 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 24 28 22 23 62 75 6c 6c 65 74 5f 33 22 29 2e 61 64 64 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 65 3d 33 29 7d 29 3b 76 61 72 20 69 3d 22 2e 6a 73 2d 63 61 72 6f 75 73 65 6c 2d 77 72 61 70 70 65 72 22 2c 6c 3d 22 2e 68 73 5f 63 6f 73 5f 77 72 61 70 70 65 72 5f 77 69 64 67 65 74 5f 63 6f 6e 74 61 69 6e 65 72 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 65 29 7b Data Ascii: "active"),e=2):n(document.getElementById("card-3"))&&($("#bullet_1").removeClass("active"),$("#bullet_2").removeClass("active"),$("#bullet_3").addClass("active"),e=3)});var i=".js-carousel-wrapper",l=".hs_cos_wrapper_widget_container";function n(e){if(e){
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 2e 72 69 67 68 74 3c 61 2e 6c 65 66 74 7c 7c 74 2e 6c 65 66 74 3e 61 2e 72 69 67 68 74 29 7d 2c 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 24 28 77 69 6e 64 6f 77 29 2e 77 69 64 74 68 28 29 3c 39 36 30 26 26 30 3c 24 28 22 23 70 6f 73 74 2d 62 6f 64 79 22 29 2e 6c 65 6e 67 74 68 29 7b 69 66 28 30 3c 24 28 22 2e 61 77 61 72 64 73 2d 63 6f 6c 6c 65 63 74 69 6f 6e 22 29 2e 6c 65 6e 67 74 68 29 76 61 72 20 65 3d 24 28 22 2e 61 77 61 72 64 73 2d 63 6f 6c 6c 65 63 74 69 6f 6e 22 29 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2b 24 28 77 69 6e 64 6f 77 29 2e 69 6e 6e 65 72 48 65 69 67 68 74 28 29 2d 33 30 3b 65 6c 73 65 20 65 3d 24 28 22 23 70 6f 73 74 2d 62 6f 64 79 22 29 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2b 24 Data Ascii: .right<a.left\|\|t.left>a.right)},$(window).scroll(function(){if($(window).width()<960&&0<$("#post-body").length){if(0<$(".awards-collection").length)var e=$(".awards-collection").offset().top+$(window).innerHeight()-30;else e=$("#post-body").offset().top+$
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 65 77 22 29 2e 68 65 69 67 68 74 28 29 3b 65 6c 73 65 20 24 28 22 2e 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 22 29 2e 68 65 69 67 68 74 28 29 3b 24 28 22 2e 68 65 72 6f 2d 62 61 6e 6e 65 72 22 29 2e 6c 65 6e 67 74 68 26 26 24 28 22 2e 68 65 72 6f 2d 62 61 6e 6e 65 72 22 29 2e 6f 75 74 65 72 48 65 69 67 68 74 28 29 2c 24 28 22 2e 68 65 72 6f 2d 62 61 6e 6e 65 72 22 29 2e 6c 65 6e 67 74 68 26 26 24 28 22 2e 6a 73 2d 73 74 69 63 6b 79 2d 74 72 69 67 67 65 72 22 29 2e 6c 65 6e 67 74 68 26 26 24 28 22 2e 6a 73 2d 73 74 69 63 6b 79 2d 74 72 69 67 67 65 72 22 29 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2b 24 28 22 2e 6a 73 2d 73 74 69 63 6b 79 2d 74 72 69 67 67 65 72 22 29 2e 69 6e 6e 65 72 48 65 69 67 68 74 28 29 2d 35 30 2c 65 3d 24 28 22 2e 68 65 72 6f 2d 62 61 Data Ascii: ew").height();else $(".header-mobile").height();$(".hero-banner").length&&$(".hero-banner").outerHeight(),$(".hero-banner").length&&$(".js-sticky-trigger").length&&$(".js-sticky-trigger").offset().top+$(".js-sticky-trigger").innerHeight()-50,e=$(".hero-ba
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 22 29 3b 24 28 77 69 6e 64 6f 77 29 2e 77 69 64 74 68 28 29 3c 31 30 35 35 3f 28 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 3c 74 26 26 73 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 63 6f 6e 74 61 69 6e 65 72 2d 62 75 62 62 6c 65 2d 65 78 70 61 6e 64 65 64 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 63 6f 6e 74 61 69 6e 65 72 2d 62 75 62 62 6c 65 2d 6c 61 73 74 22 29 2e 63 73 73 28 22 7a 2d 69 6e 64 65 78 22 2c 22 32 30 22 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 2c 74 3c 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 26 26 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 3c 6f 26 26 28 73 2e 61 64 64 43 6c 61 73 73 28 22 63 Data Ascii: ");$(window).width()<1055?($(window).scrollTop()<t&&s.removeClass("container-bubble-expanded").removeClass("container-bubble-last").css("z-index","20").click(function(e){e.preventDefault()}),t<$(window).scrollTop()&&$(window).scrollTop()<o&&(s.addClass("c
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 28 22 2e 63 74 61 2d 67 61 70 22 29 2e 63 73 73 28 22 6d 61 72 67 69 6e 2d 74 6f 70 22 2c 22 31 35 30 70 78 22 29 29 3a 28 63 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 66 69 78 65 64 20 66 69 78 65 64 2d 62 6f 74 74 6f 6d 22 29 2c 24 28 22 2e 63 74 61 2d 67 61 70 22 29 2e 63 73 73 28 22 6d 61 72 67 69 6e 2d 74 6f 70 22 2c 22 36 30 70 78 22 29 29 3b 72 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 2b 74 3e 65 3f 63 2e 61 64 64 43 6c 61 73 73 28 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 22 29 3a 63 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 22 29 7d 65 6c 73 65 20 63 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 66 69 78 65 64 20 66 69 78 65 64 2d 62 6f 74 74 6f 6d 22 29 7d 29 3b 24 28 22 23 6a 73 2d 61 63 63 6f 72 64 69 6f 6e 2d 62 74 6e Data Ascii: (".cta-gap").css("margin-top","150px")):(c.removeClass("fixed fixed-bottom"),$(".cta-gap").css("margin-top","60px"));r.scrollTop()+t>e?c.addClass("fixed-bottom"):c.removeClass("fixed-bottom")}else c.removeClass("fixed fixed-bottom")});$("#js-accordion-btn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50063	13.225.214.29	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	573	OUT	GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	665	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 6759 Connection: close Date: Thu, 22 Feb 2024 12:07:34 GMT Last-Modified: Thu, 26 Oct 2023 12:27:20 GMT ETag: "15864ce88fa79a3e954417d0c3396798" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-Cache: Miss from cloudfront Via: 1.1 64142199656297b56ef863f9ccc0c102.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: LoEUO9cPhjLIUaOlHKbylkDpqW_1iAVSWBw77Arc_EF_c0Ya3wxegQ==
2024-02-22 12:07:33 UTC	6759	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 5c eb 52 e3 48 96 fe 3f 4f 61 34 b1 6e 69 49 84 cd 1d b9 14 4c 15 45 4f b3 51 14 15 14 dd bd b3 2c 41 c8 56 da 64 b7 ac f4 48 e9 a2 68 e3 27 db 1f fb 48 fb 0a 7b 4e de 94 b2 25 a0 7a 66 22 66 23 b6 a3 a3 90 f2 9e 27 cf e5 3b 27 8f fc 3f ff f5 df 1b e3 79 3e 12 8c e7 9d dc e7 a4 24 45 b0 b0 25 89 2f 08 0d 16 6c ec 6f 94 37 e2 56 3d 71 f9 f4 25 29 3a 2c f6 4c 53 2f 8e c5 e3 8c f2 71 a7 a0 7f 9d b3 82 76 bb fa 61 80 7d e0 95 05 05 15 f3 22 ef 30 18 74 a3 17 60 79 66 ca 32 5d 26 ee 0b fe e0 d3 38 a7 0f 9d b3 a2 e0 85 ef 9d 26 79 ce 45 67 cc f2 b4 33 e5 e9 3c a3 9d ef bc 4d b1 e9 7d e7 05 41 38 e2 29 8d bd 8b cb f7 3f 7e 38 bb fb 78 79 7d f7 fd e5 8f 1f df 7b 84 2e 59 8c 4b 8e 17 f4 eb 8c 17 a2 8c 16 cb 25 c1 a5 df f4 6e c3 51 Data Ascii: \RH?Oa4niILEOQ,AVdHh'H{N%zf"f#';'?y>$E%/lo7V=q%):,LS/qva}"0t`yf2]&8&yEg3<M}A8)?~8xy}{.YK%nQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50057	104.16.110.209	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	580	OUT	GET /hs/hsstatic/cos-i18n/static-1.10/bundles/project.js HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	1066	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1248 Connection: close x-amz-replication-status: COMPLETED Last-Modified: Wed, 13 Sep 2017 02:51:30 GMT x-amz-version-id: p6iak7Gl9Xyg7crK_8XyTwctOBvKD1DL ETag: "0011aaf4067b097bcbfd9dc99a4b94c0" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P3 X-Amz-Cf-Id: 0a4rp3zAG2B163qSKyHJVFSXyAGOcOSfRBhP8Rr1tqsIzkRML6e8bw== Cache-Control: s-maxage=31536000, max-age=31536000 CF-Cache-Status: HIT Age: 8650941 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zCQcAZstErfbnjZcqoe1R2Rn4tLKJQL2DGJyHksLoLiCMGAQTh%2B3NGCz5m2iP22%2F9avsfmy%2Ffi4oL5ws9BA6P2gnPYZpIleYKQq05bWNOspCgrt8KUhhm%2FAZaXu8SIbHQ98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 85971c015875424c-EWR alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:33 UTC	303	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 68 73 5f 69 31 38 6e 5f 6c 6f 67 28 6e 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 69 31 38 6e 5f 67 65 74 6d 65 73 73 61 67 65 3a 20 22 2b 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 68 73 5f 69 31 38 6e 5f 73 75 62 73 74 69 74 75 74 65 53 74 72 69 6e 67 73 28 6e 2c 65 29 7b 76 61 72 20 6c 3d 6e 2e 6d 61 74 63 68 28 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 24 5b 30 2d 39 5d 2b 22 2c 22 67 22 29 29 3b 69 66 28 6e 75 6c 6c 3d 3d 6c 29 72 65 74 75 72 6e 20 6e 3b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 6c 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 73 3d 6c 5b 72 5d 2c 74 3d 70 61 72 73 65 49 6e 74 28 73 2e 72 65 70 6c 61 63 65 28 22 24 22 2c 22 22 29 29 3b 30 3e 3d 74 7c 7c 6e 75 6c 6c 3d Data Ascii: "use strict";function hs_i18n_log(n){console.log("i18n_getmessage: "+n)}function hs_i18n_substituteStrings(n,e){var l=n.match(new RegExp("\\$[0-9]+","g"));if(null==l)return n;for(var r=0;r<l.length;r++){var s=l[r],t=parseInt(s.replace("$",""));0>=t\|\|null=
2024-02-22 12:07:33 UTC	945	IN	Data Raw: 6e 67 20 61 74 20 69 6e 64 65 78 20 22 2b 74 2b 22 20 66 6f 75 6e 64 20 66 6f 72 20 73 74 72 69 6e 67 20 27 22 2b 6e 2b 22 27 22 29 3a 6e 3d 6e 2e 72 65 70 6c 61 63 65 28 73 2c 65 5b 74 2d 31 5d 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 68 73 5f 69 31 38 6e 5f 69 6e 73 65 72 74 50 6c 61 63 65 68 6f 6c 64 65 72 73 28 6e 2c 65 29 7b 76 61 72 20 6c 3d 6e 2e 6d 65 73 73 61 67 65 2c 72 3d 6c 2e 6d 61 74 63 68 28 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 24 5c 5c 77 2b 5c 5c 24 22 2c 22 67 22 29 29 3b 69 66 28 6e 75 6c 6c 3d 3d 72 29 72 65 74 75 72 6e 20 6c 3b 66 6f 72 28 76 61 72 20 73 3d 30 3b 73 3c 72 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 7b 76 61 72 20 74 3d 72 5b 73 5d 2c 6f 3d 74 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 Data Ascii: ng at index "+t+" found for string '"+n+"'"):n=n.replace(s,e[t-1])}return n}function hs_i18n_insertPlaceholders(n,e){var l=n.message,r=l.match(new RegExp("\\$\\w+\\$","g"));if(null==r)return l;for(var s=0;s<r.length;s++){var t=r[s],o=t.replace(new RegExp(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50059	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2840	OUT	GET /hubfs/Avast/Academy/assets/js/sdl1.js HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
2024-02-22 12:07:33 UTC	1347	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/javascript Content-Length: 11458 Connection: close CF-Ray: 85971c017b157ce8-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 868966 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "7479893859c68fe2cce8594f3af64644" Last-Modified: Mon, 12 Feb 2024 10:36:15 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c70c0d114d0fcf32b9941c29c00266de.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-147954423671,FD-21417554736,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-147954423671,FD-21417554736,P-4650993,FLS-ALL X-Amz-Cf-Id: anCRICVRLO9-dmG8YFv4GbdA-JO3_xOezGmmFydSVPa5PLPT8VfZrQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: MNd/dT8UAnlNj0tpItiOiQw8jBP5WCjKrZ8qqIWdFkB+Rj+0xNrb9Y4YwafMdJ7lMDn08qPkefk= x-amz-meta-cache-tag: F-147954423671,FD-21417554736,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1701353248820 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: XY0589FNSQBE78RN x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: hgUVSJ5L7D9oYyRkItotiCaiP9fWA0e8 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	538	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 51 52 47 56 74 4d 55 37 66 78 48 32 78 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QRGVtMU7fxH2x
2024-02-22 12:07:33 UTC	853	IN	Data Raw: 2f 2a 20 53 69 6e 67 6c 65 20 64 61 74 61 20 6c 61 79 65 72 20 32 20 2a 2f 0a 77 69 6e 64 6f 77 2e 73 64 6c 20 3d 20 77 69 6e 64 6f 77 2e 73 64 6c 20 7c 7c 20 5b 5d 3b 20 2f 2f 49 6e 69 74 69 61 6c 69 73 61 74 69 6f 6e 0a 2f 2a 20 45 6e 64 20 53 69 6e 67 6c 65 20 64 61 74 61 20 6c 61 79 65 72 20 2a 2f 0a 0a 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 20 20 2f 2a 20 2a 0a 20 20 20 20 20 20 20 20 2a 20 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 47 65 74 73 20 74 68 65 20 63 6f 6f 6b 69 65 20 76 61 6c 75 65 20 66 6f 72 20 61 20 73 70 65 63 69 66 69 63 20 6e 61 6d 65 0a 20 20 20 20 20 20 20 20 2a 20 76 61 72 20 6e 61 6d 65 20 28 73 74 72 69 6e 67 29 20 2d 2d 20 74 Data Ascii: /* Single data layer 2 /window.sdl = window.sdl \|\| []; //Initialisation/ End Single data layer /$(document).ready(function () { try { / * * Description: Gets the cookie value for a specific name * var name (string) -- t
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 5d 7b 32 7d 5c 2f 2e 2a 2f 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6e 6f 72 6d 61 6c 4c 6f 63 20 3d 20 2f 5e 5c 2f 5b 61 2d 7a 5d 7b 32 7d 2d 5b 61 2d 7a 5d 7b 32 7d 28 5c 2f 29 3f 2e 2a 2f 67 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6c 6f 63 2e 70 61 74 68 6e 61 6d 65 2e 6d 61 74 63 68 28 73 68 6f 72 74 4c 6f 63 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6c 61 6e 67 20 3d 20 6c 6f 63 2e 70 61 74 68 6e 61 6d 65 2e 6d 61 74 63 68 28 73 68 6f 72 74 4c 6f 63 29 5b 30 5d 2e 73 70 6c 69 74 28 27 2f 27 29 5b 31 5d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 63 61 6c 65 41 6e 64 43 6f 75 6e 74 72 79 2e 6c 6f 63 61 6c 65 20 3d 20 6c 6f 63 61 6c 65 73 5b 6c 61 6e 67 5d 0a 20 20 20 20 20 20 20 Data Ascii: ]{2}\/./g var normalLoc = /^\/[a-z]{2}-[a-z]{2}(\/)?./g if (loc.pathname.match(shortLoc)) { var lang = loc.pathname.match(shortLoc)[0].split('/')[1] localeAndCountry.locale = locales[lang]
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 69 74 28 27 6f 73 2d 27 29 5b 31 5d 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2f 2a 20 44 65 74 65 63 74 69 6e 67 20 69 66 20 6d 6f 62 69 6c 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 76 61 72 20 69 73 4d 6f 62 69 6c 65 20 3d 20 4d 61 74 68 2e 6d 69 6e 28 77 69 6e 64 6f 77 2e 73 63 72 65 65 6e 2e 77 69 64 74 68 2c 20 77 69 6e 64 6f 77 2e 73 63 72 65 65 6e 2e 68 65 69 67 68 74 29 20 3c 20 37 36 38 20 7c 7c 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 69 6e 64 65 78 4f 66 28 22 4d 6f 62 69 22 29 20 3e 20 2d 31 3b 0a 0a 20 20 20 20 20 20 20 20 2f 2a 20 47 65 74 74 69 6e 67 20 73 63 72 65 65 6e 49 64 20 2a 2f 0a 20 20 20 20 20 20 20 20 76 61 72 20 61 72 74 69 63 6c 65 49 64 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 Data Ascii: it('os-')[1] } /* Detecting if mobile / var isMobile = Math.min(window.screen.width, window.screen.height) < 768 \|\| navigator.userAgent.indexOf("Mobi") > -1; / Getting screenId */ var articleId = document.getEle
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6c 61 74 66 6f 72 6d 3a 20 27 77 65 62 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 6e 76 3a 20 27 70 72 6f 64 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 43 65 6e 74 65 72 3a 20 27 2d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 64 6c 56 65 72 73 69 6f 6e 3a 20 27 32 30 32 31 2d 30 35 2d 30 35 2f 76 31 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 65 6e 74 47 72 6f 75 70 73 3a 20 20 63 6d 70 50 61 72 61 6d 73 2e 67 72 6f 75 70 73 20 3f 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 63 6d 70 50 61 72 61 6d 73 2e 67 72 6f 75 70 73 29 20 3a 20 27 43 30 30 30 31 3a 31 27 0a 20 20 20 Data Ascii: , platform: 'web', env: 'prod', dataCenter: '-', sdlVersion: '2021-05-05/v1' }, consentGroups: cmpParams.groups ? decodeURIComponent(cmpParams.groups) : 'C0001:1'
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 64 61 74 65 2d 64 6c 27 29 20 3f 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 64 61 74 65 2d 64 6c 27 29 2e 74 65 78 74 43 6f 6e 74 65 6e 74 20 3a 20 27 27 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 61 75 74 68 6f 72 64 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 61 75 74 68 6f 72 2d 64 6c 27 29 20 3f 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 61 75 74 68 6f 72 2d 64 6c 27 29 2e 74 65 78 74 43 6f 6e 74 65 6e 74 20 3a 20 27 27 3b 0a 0a 20 20 20 20 20 20 20 20 2f 2a 54 4f 44 4f 20 43 68 61 6e 67 65 3f 2a 2f 0a 20 20 20 20 20 20 20 20 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 Data Ascii: ocument.getElementById('date-dl') ? document.getElementById('date-dl').textContent : ''; var authordl = document.getElementById('author-dl') ? document.getElementById('author-dl').textContent : ''; /TODO Change?/ if(document.get
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6c 2e 73 65 61 72 63 68 20 3f 20 4f 62 6a 65 63 74 2e 66 72 6f 6d 45 6e 74 72 69 65 73 28 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 6c 2e 73 65 61 72 63 68 29 29 20 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 63 61 6c 65 3a 20 6c 6f 63 61 6c 65 43 6f 75 6e 74 72 79 2e 6c 6f 63 61 6c 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 63 72 65 65 6e 43 61 74 65 67 6f 72 79 3a 20 27 62 6c 6f 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 3a 20 65 72 72 6f 72 5f 70 61 67 65 5f 34 30 34 20 3f 20 27 34 30 34 27 20 3a 20 28 65 72 72 6f 72 5f 70 61 67 65 5f 35 30 30 20 3f 20 27 35 30 30 27 20 3a 20 73 65 63 74 69 6f 6e Data Ascii: l.search ? Object.fromEntries(new URLSearchParams(wl.search)) : {} }, locale: localeCountry.locale, screenCategory: 'blog', section: error_page_404 ? '404' : (error_page_500 ? '500' : section
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 72 20 3f 20 74 68 69 73 2e 64 61 74 61 73 65 74 2e 63 61 6d 70 61 69 67 6e 4d 61 72 6b 65 72 20 3a 20 27 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 6b 75 3a 20 74 68 69 73 2e 64 61 74 61 73 65 74 2e 64 6f 77 6e 6c 6f 61 64 4e 61 6d 65 20 3f 20 74 68 69 73 2e 64 61 74 61 73 65 74 2e 64 6f 77 6e 6c 6f 61 64 4e 61 6d 65 20 3a 20 27 4e 2f 41 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 72 6f 64 75 63 74 49 64 3a 20 27 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 69 6e 74 65 6e 61 6e 63 65 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: r ? this.dataset.campaignMarker : '', sku: this.dataset.downloadName ? this.dataset.downloadName : 'N/A', productId: '', maintenance: 0,
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6f 72 41 6c 6c 28 27 2e 62 74 6e 3a 6e 6f 74 28 61 5b 64 61 74 61 2d 72 6f 6c 65 3d 22 64 6f 77 6e 6c 6f 61 64 2d 6c 69 6e 6b 22 5d 29 27 29 2e 66 6f 72 45 61 63 68 28 28 62 74 6e 29 20 3d 3e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 74 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 64 6c 2e 70 75 73 68 28 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 22 75 73 65 72 2e 63 6c 69 63 6b 2e 6c 69 6e 6b 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 72 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 69 63 6b 3a 20 7b Data Ascii: orAll('.btn:not(a[data-role="download-link"])').forEach((btn) => { btn.addEventListener('click', function() { sdl.push({ event: "user.click.link", user: { click: {
2024-02-22 12:07:33 UTC	1022	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 22 75 73 65 72 2e 72 65 61 64 2e 61 72 74 69 63 6c 65 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 72 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 61 64 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 72 74 69 63 6c 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3a 20 61 72 74 69 63 6c 65 49 64 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 72 6c 3a 20 77 6c 2e 68 72 65 66 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: event: "user.read.article", user: { read: { article: { id: articleId, url: wl.href,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50056	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2848	OUT	GET /hubfs/Avast/Academy/assets/js/prebuild/nav.js HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=5yb_BNk_vzR4SCYUCxpcR4qvFvo24.d0hHSYazdVjlM-1708603652-1.0-AVkTppa4AaZIWlLZ9673NJnttzAo0UFM6vZY2Y4d86uUKpDFGv8our5Ke3Sp264gDM30CcTbVVTkZS9uj4lM0Ng=
2024-02-22 12:07:33 UTC	1343	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/javascript Content-Length: 5857 Connection: close CF-Ray: 85971c0169558c75-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 867578 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "b8817001660473057b0c5a0bf31bed43" Last-Modified: Wed, 20 Dec 2023 12:37:10 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-21417574341,FD-21417551266,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-21417574341,FD-21417551266,P-4650993,FLS-ALL X-Amz-Cf-Id: VIq--tsvTMMpQc-UMisQX-Qh_cNJDrqnLfWGKAP1v3X83BdRSq8fCw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: 3t9AFs9tq1A8fAgcOC8mf7A8t6HP75DFJ4LAaRHLaKYjo9fAbFFBef7F0WLFH/8qqpdax8DM9q0= x-amz-meta-cache-tag: F-21417574341,FD-21417551266,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1574080028898 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 787WQRRNJMSY4QZX x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: nKkU3I_EqjvjjyJyBV36pcU8UNRfwGNf X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	515	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 76 6a 6f 4c 66 4b 79 25 32 42 5a 4c 67 67 6a 48 25 32 46 6a 72 61 51 6d 32 6c 5a 66 32 71 46 63 33 58 48 56 44 44 78 56 77 75 4a 79 61 66 42 70 69 48 69 36 6b 77 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjoLfKy%2BZLggjH%2FjraQm2lZf2qFc3XHVDDxVwuJyafBpiHi6kw
2024-02-22 12:07:33 UTC	880	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 76 6d 2e 64 65 66 69 6e 65 28 22 6e 61 76 69 67 61 74 69 6f 6e 2d 6f 6f 2d 31 39 37 39 38 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 73 2c 6e 3d 61 76 6d 2e 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 2c 6f 3d 61 76 6d 2e 72 65 71 75 69 72 65 28 22 61 76 61 73 74 2e 75 72 6c 2e 75 6e 73 65 72 69 61 6c 69 7a 65 22 29 2c 69 3d 28 61 76 6d 2e 72 65 71 75 69 72 65 28 22 61 76 61 73 74 2e 75 72 6c 2e 75 6e 73 65 72 69 61 6c 69 7a 65 22 29 2c 6e 28 77 69 6e 64 6f 77 29 29 2c 74 3d 6e 28 22 62 6f 64 79 22 29 2c 61 3d 6e 28 22 2e 6a 73 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6f 6f 2d 31 39 37 39 38 22 29 2c 72 3d 61 2e 66 69 6e 64 28 22 5b 64 61 74 61 2d 66 69 72 73 74 Data Ascii: !function(){"use strict";avm.define("navigation-oo-19798",function(){var e,s,n=avm.require("jquery"),o=avm.require("avast.url.unserialize"),i=(avm.require("avast.url.unserialize"),n(window)),t=n("body"),a=n(".js-navigation-oo-19798"),r=a.find("[data-first
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6d 65 6e 75 2e 62 6c 6f 67 73 22 29 2c 77 3d 61 2e 66 69 6e 64 28 22 2e 6a 73 2d 68 69 6e 74 2d 74 6f 67 67 6c 65 72 22 29 2c 43 3d 61 2e 66 69 6e 64 28 22 2e 6a 73 2d 68 69 6e 74 2d 63 6c 6f 73 65 22 29 2c 4d 3d 28 77 69 6e 64 6f 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 3f 77 69 6e 64 6f 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2c 22 3a 62 65 66 6f 72 65 22 29 2e 67 65 74 50 72 6f 70 65 72 74 79 56 61 6c 75 65 28 22 63 6f 6e 74 65 6e 74 22 29 3a 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 76 69 67 61 74 69 6f 6e 2d 64 65 73 6b 74 6f 70 22 29 3e 2d 31 2c 6a 3d 76 6f 69 64 20 30 21 3d 3d 77 69 6e 64 6f 77 2e 61 76 61 73 74 47 6c 6f 62 61 6c 73 26 26 76 6f 69 64 20 30 21 3d 3d 77 69 6e 64 Data Ascii: menu.blogs"),w=a.find(".js-hint-toggler"),C=a.find(".js-hint-close"),M=(window.getComputedStyle?window.getComputedStyle(document.body,":before").getPropertyValue("content"):"").indexOf("navigation-desktop")>-1,j=void 0!==window.avastGlobals&&void 0!==wind
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 29 2c 63 3d 22 22 3b 6a 26 26 28 63 3d 77 69 6e 64 6f 77 2e 61 76 61 73 74 47 6c 6f 62 61 6c 73 2e 77 65 62 2e 75 6c 6f 63 61 6c 65 2e 72 65 70 6c 61 63 65 28 22 2f 22 2c 22 22 29 2c 65 3d 63 2e 6c 65 6e 67 74 68 3e 30 3f 22 2f 22 3a 22 22 2c 72 3d 22 2f 22 2b 63 2b 65 2b 77 69 6e 64 6f 77 2e 61 76 61 73 74 47 6c 6f 62 61 6c 73 2e 77 65 62 2e 66 69 6c 65 4e 61 6d 65 29 3b 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 69 29 7b 76 61 72 20 73 3d 65 2e 61 74 74 72 28 22 68 72 65 66 22 29 2c 61 3d 28 6d 3d 28 64 3d 73 29 2e 73 70 6c 69 74 28 22 23 22 29 5b 30 5d 2c 76 6f 69 64 20 30 21 3d 3d 28 6d 3d 64 2e 73 70 6c 69 74 28 22 3f 22 29 5b 31 5d 29 3f 6f 28 6d 29 3a 76 6f 69 64 20 30 29 3b 69 66 28 6b 26 Data Ascii: ),c="";j&&(c=window.avastGlobals.web.ulocale.replace("/",""),e=c.length>0?"/":"",r="/"+c+e+window.avastGlobals.web.fileName);s.each(function(){!function(e){if(i){var s=e.attr("href"),a=(m=(d=s).split("#")[0],void 0!==(m=d.split("?")[1])?o(m):void 0);if(k&
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 29 3b 69 66 28 22 62 6c 6f 67 2e 61 76 61 73 74 2e 63 6f 6d 22 3d 3d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 29 7b 76 61 72 20 64 3d 6e 28 22 64 69 76 2e 73 65 63 6f 6e 64 2d 6d 65 6e 75 2e 62 6c 6f 67 22 29 3b 64 2e 61 64 64 43 6c 61 73 73 28 22 69 73 41 63 74 69 76 65 22 29 7d 69 66 28 22 62 6c 6f 67 2e 61 76 61 73 74 2e 63 6f 6d 22 3d 3d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 29 7b 76 61 72 20 6d 3d 6e 28 22 6c 69 2e 6a 73 2d 62 6c 6f 67 73 2e 62 6c 6f 67 73 22 29 3b 6d 2e 61 64 64 43 6c 61 73 73 28 22 69 73 41 63 74 69 76 65 22 29 7d 7d 28 29 2c 6c 2e 6f 6e 28 22 6d 6f 75 73 65 6f 76 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 71 28 6e 28 74 68 69 73 29 29 7d 29 2c 6c 2e 6f 6e 28 Data Ascii: );if("blog.avast.com"===window.location.hostname){var d=n("div.second-menu.blog");d.addClass("isActive")}if("blog.avast.com"===window.location.hostname){var m=n("li.js-blogs.blogs");m.addClass("isActive")}}(),l.on("mouseover",function(){q(n(this))}),l.on(
2024-02-22 12:07:33 UTC	870	IN	Data Raw: 69 61 6c 5f 6d 65 6e 75 22 29 7d 29 29 2c 69 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 73 3d 6e 28 65 2e 74 61 72 67 65 74 29 3b 73 2e 63 6c 6f 73 65 73 74 28 61 29 2e 6c 65 6e 67 74 68 3e 30 3f 21 4d 26 26 73 2e 69 73 28 61 29 26 26 5f 28 22 72 65 73 65 74 22 29 3a 73 2e 69 73 28 22 2e 6a 73 2d 63 6f 6f 6b 69 65 2d 62 61 72 22 29 7c 7c 73 2e 63 6c 6f 73 65 73 74 28 22 2e 6a 73 2d 63 6f 6f 6b 69 65 2d 62 61 72 22 29 2e 6c 65 6e 67 74 68 3e 30 7c 7c 5f 28 22 72 65 73 65 74 22 29 7d 29 2c 63 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 78 28 29 2c 6e 28 74 68 69 73 29 2e 68 61 73 43 6c 61 73 73 28 22 6a 73 2d 62 6c 6f 67 22 29 26 26 74 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 62 6c 6f 67 73 Data Ascii: ial_menu")})),i.on("click",function(e){var s=n(e.target);s.closest(a).length>0?!M&&s.is(a)&&_("reset"):s.is(".js-cookie-bar")\|\|s.closest(".js-cookie-bar").length>0\|\|_("reset")}),c.on("click",function(){x(),n(this).hasClass("js-blog")&&t.removeClass("blogs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50061	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	653	OUT	GET /hubfs/Avast/Academy/assets/o/f/400/MierB03-SubsetEng-Regular.woff2 HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.avast.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	1339	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/font-woff2 Content-Length: 19904 Connection: close CF-Ray: 85971c022f0d41c3-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506767 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "af5c33b17dd160151cf4166481946f10" Last-Modified: Thu, 19 Oct 2023 13:58:50 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c70c0d114d0fcf32b9941c29c00266de.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-67132477039,FD-21313351840,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-67132477039,FD-21313351840,P-4650993,FLS-ALL X-Amz-Cf-Id: aSVLkckUlbLoZWKukd0ZU7UDdF7FywHTEJPSbribVSBLHp3444Gtrg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: cnR7Lrqjso8ixTB1xISm/WI4zLZnzOeGa5LqXUY0JNXOYQkkFVsfhoPY39Dd4p1EjX0qyuKwQjf93GDV+WstPcaiu2VBHCNa18PZ+Siia6A= x-amz-meta-cache-tag: F-67132477039,FD-21313351840,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1645801678185 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: V7YKSPGM8C0F7F7F x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Y9Z5CB84BZiVeWNDDwDU__zF44uUnSPF
2024-02-22 12:07:33 UTC	999	IN	Data Raw: 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 6a 76 58 4e 46 37 6b 52 30 74 4b 74 4b 37 71 74 42 67 66 51 32 75 57 71 64 64 6f 46 47 57 6c 4e 6e 31 Data Ascii: X-Cache: RefreshHit from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=jvXNF7kR0tKtK7qtBgfQ2uWqddoFGWlNn1
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 4d c0 00 11 00 00 00 00 c6 88 00 00 4d 5c 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 5c 1b fe 4c 1c 82 28 06 60 00 85 34 08 81 76 09 9c 0c 11 08 0a 81 c6 78 81 ab 7c 01 36 02 24 03 88 14 0b 84 0c 00 04 20 05 8c 4a 07 20 0c 81 7a 1b db b5 07 d8 36 0d 7a de ed 00 86 bb bb df eb a2 08 36 0e 90 11 ec c3 a3 a2 76 93 56 a5 28 fe ff 4f 48 4e 64 0c f0 c1 be ab 69 9a 76 52 16 81 85 c9 88 67 51 b8 43 e1 24 ee 2e ac 19 b4 69 ae 9d d6 0a 0e ef 88 e8 56 f6 54 19 11 e5 29 f7 93 8d 13 7d d0 97 33 a0 37 7b c8 77 5b 55 d4 09 ab e3 ca a0 98 1b a1 aa 0b 8b 6d ba 39 6c 36 9b f7 14 6a f0 4f 5d f7 fc d8 e7 fd cf 62 57 b9 84 a3 2a b1 4d de 62 0f 6a 2c 65 18 93 d7 65 65 58 bd 35 6b c0 a3 1f fe 21 78 f8 c5 ad fc 39 Data Ascii: wOF2MM\B\L(`4vx\|6$ J z6z6vV(OHNdivRgQC$.iVT)}37{w[Um9l6jO]bW*Mbj,eeeX5k!x9
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 09 69 c0 4e fc 57 be 72 e2 ad 9a 64 eb 66 08 e2 40 18 8e 18 46 21 62 9a 38 eb b0 6c b3 c9 3e 3a 8e 71 11 98 46 64 9b 24 fb c4 38 86 c7 04 8d cc 3e 0a ce 36 18 fb 8c 72 cc 10 62 c5 48 05 d0 0a a4 15 84 31 21 36 82 04 02 3b e2 20 46 cc 08 31 63 64 38 20 60 58 81 03 18 10 2b ce 86 4b c0 d9 71 0e 22 c4 8c 63 3e 9e 1d e1 ac c8 f2 f9 c4 4a 44 c6 7e 99 03 11 68 9a cd a6 49 b6 0e 26 9c 84 b2 88 28 c5 69 81 c8 64 28 c5 9d 2f 00 1d 71 8c 94 ad c0 33 50 c8 48 f0 6b 4c 24 6f 8c bd 2a 73 60 fe 71 70 3e bc 9f f8 27 97 71 b4 e8 c7 08 9b f3 d7 85 6f 60 ba 0f 5f 28 a2 70 f3 e4 6c 5a 39 1c 1e 5b 3e 83 c3 bf 69 00 e8 d5 51 c7 f8 02 f1 f5 e3 10 4d 77 8f 67 d6 56 1f ff 67 e3 ea 2d 4c d3 f7 23 c9 97 b3 3e 95 a5 8d b0 81 bb ad 22 8a f9 cd 98 8a ee 78 c8 4c b0 3d 9e a5 86 2a ac Data Ascii: iNWrdf@F!b8l>:qFd$8>6rbH1!6; F1cd8 `X+Kq"c>JD~hI&(id(/q3PHkL$os`qp>'qo`_(plZ9[>iQMwgVg-L#>"xL=
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 10 8d 7d a8 26 64 89 c5 fb ed 9d 6e 47 2d 52 f2 8d 29 12 55 a3 4c ba 87 f4 71 43 64 bf 68 25 cc a3 95 a1 9e c0 22 db 5a 8a c7 94 34 d0 0a 6d 10 2a a8 37 49 53 5c f1 de 3d 93 10 4d 82 3a 2e 35 e0 41 02 b5 a7 46 3b 35 7b cb 25 f4 02 ff 92 69 e2 f5 74 39 27 a3 da 08 2e ee 52 12 f2 e6 09 64 79 62 e8 83 ab 1c 6b c3 33 78 1f e4 02 2b 2a bf 3a 19 81 92 97 f4 c1 c4 33 4a e5 a4 1c 99 92 53 ec 1d f7 2e a1 7b 01 3d 63 a5 8c 5c 05 26 4b d2 40 42 4b 45 cb 43 0d 40 05 53 36 5d 61 87 71 29 1e e7 84 ab ea bf 93 ac b9 26 9f 16 d2 85 f6 1e e9 1b 5a 2a 55 b7 2b 82 69 df 0d c7 fb d0 c5 2b 6f 83 d6 b9 d7 f4 35 7a e0 9d e8 a9 4c cd 1c 54 3d 73 44 9f 93 ce f0 48 1d d5 d4 5b 7f 33 d6 04 28 03 8d 8b c8 29 1a d9 6a b3 89 a4 f1 b5 4b c7 c1 dd 9d ca cc aa 22 ec fc 40 e1 07 46 cb d7 Data Ascii: }&dnG-R)ULqCdh%"Z4m7IS\=M:.5AF;5{%it9'.Rdybk3x+:3JS.{=c\&K@BKEC@S6]aq)&Z*U+i+o5zLT=sDH[3()jK"@F
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 9a 06 44 bb f3 35 2b be ab 20 62 ca 3e 4d c8 a5 f5 8f 95 58 55 50 64 c9 e4 78 96 7a b1 fe 0c 24 78 34 97 6f 8c 87 d7 c0 53 06 51 9a bf f6 1c 28 9b db e6 e9 bc 2c 8b 54 e8 e2 c5 b4 ae c2 c4 d5 3d 92 bb 95 7c 50 d9 b6 75 82 44 a9 3e 44 ef c8 9b e3 37 2a 20 70 2f 37 15 9f ca e7 ab c0 bd eb a8 4e b1 fb 1d 51 91 d9 26 02 f8 7a dc b1 1d bf 48 7a 4a 0e c0 cb 59 cf ac c3 8f fa 2d 13 86 b9 fb 4c 48 43 2d bf 2f 06 8e a2 4b 77 3d 22 6f 87 9c 1c c7 f4 32 6f 1a c7 f0 a9 9c 60 dc bc 38 93 51 fa d0 88 e2 64 76 0e 8b 78 1f ec 0d 41 9f dd 4c e2 c3 9b 42 d9 d7 c4 7d 13 5c 7a b2 61 53 ce 3c 41 ac a8 06 3f e1 b6 e2 2a 72 b4 a4 16 21 74 5b fb 27 2f 9b 00 bc ec f0 f2 99 5f 82 05 01 8d 3e 26 df 5d 3c a3 4b 10 e1 d1 e1 3e 7e e2 a4 64 e4 c4 00 c6 11 b3 04 1e e8 a0 9d 67 36 22 a6 Data Ascii: D5+ b>MXUPdxz$x4oSQ(,T=\|PuD>D7* p/7NQ&zHzJY-LHC-/Kw="o2o`8QdvxALB}\zaS<A?*r!t['/_>&]<K>~dg6"
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 4f 2d a8 72 3d 50 35 4f 4d 44 8d b5 93 c9 e2 a8 04 9d 12 89 4c 51 67 1e 3c e8 b4 61 9c c0 fe 40 6a 65 30 a6 3c b5 65 e1 44 ae ff df 49 94 6d bb 27 c9 1b 21 ae 9b b4 a9 41 d4 2a 28 ee 02 71 13 1d ff 8c 9e ca 51 05 75 be ea 00 27 9b 68 73 eb e6 05 84 d6 27 e2 d9 84 e8 7b a7 c3 a1 a9 63 1b b0 39 db e1 f8 9c a4 f8 a6 01 c5 44 51 4e 27 f6 db f7 67 a0 d3 97 00 1d f8 97 b6 7c 88 99 5f 4e 86 a5 2a 8a 42 dc 6e 12 8f d6 b6 dc 56 b4 21 b7 21 4b 0b 35 e8 ad 4d 84 2d 42 c9 63 46 5f d3 db 63 4b b1 d8 65 01 46 a5 c4 41 b7 b2 8e ec 05 48 1f 8c cc 6e 8d 58 7d 69 1d 5d 14 dc 78 e4 7f c3 71 47 8a 4d 05 c4 5c 2e ca 91 ee 19 f3 4a ca 82 9f 74 9a 35 c2 a8 66 a1 99 15 e7 24 25 72 5b c9 18 91 ff 52 45 c7 88 cc ea 61 69 3b 14 f2 d3 d7 c7 b4 e7 72 68 13 7f c3 46 58 da 7a 5a c6 6e Data Ascii: O-r=P5OMDLQg<a@je0<eDIm'!A(qQu'hs'{c9DQN'g\|_NBnV!!K5M-BcF_cKeFAHnX}i]xqGM\.Jt5f$%r[REai;rhFXzZn
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 62 0c 8b 0c d2 d8 5b 1b 8f 29 5c b8 c0 d0 c1 d2 4a 26 57 6d 44 96 a4 3d 1f be f5 b0 1c 7a 42 35 42 0d b3 b2 4c cb e8 2c e2 9b 0a 35 38 b5 cd 88 bb e6 46 f3 35 6a 19 46 e9 70 a7 e0 4e a4 c5 95 15 10 42 a8 49 86 90 52 fe 7a 46 36 86 a1 e6 5a 9a f1 31 a7 c6 26 2a 9c 29 93 fc 12 d4 97 11 8f 73 42 7d ca 12 7a 48 dc f3 7d ef 01 3c 3f a1 11 d6 90 ba 53 51 46 66 f3 b4 d1 b5 f8 19 b5 c9 a3 c3 69 7e 09 39 3a 47 4c 5d 2b f3 27 eb fd 76 93 a6 85 43 b8 a2 44 09 d1 b2 32 d2 a9 61 50 aa 36 a3 49 ba 52 45 4b c7 a9 a1 64 62 b9 c4 22 33 d0 ad 5f d8 70 42 bc 3c d6 ce 20 51 6a ab 76 1c 85 14 b4 32 1c 8d 5a 95 59 ea ad 59 d9 ba db ca 74 d2 34 a4 8d 57 a2 ba d3 c2 c6 53 ba fa fb 33 f0 b6 2e 54 7b a4 73 58 d7 7f 07 8e 66 19 02 05 55 b3 55 fd 7f 48 50 f3 14 f6 04 6c 4b fb 34 c9 Data Ascii: b[)\J&WmD=zB5BL,58F5jFpNBIRzF6Z1&*)sB}zH}<?SQFfi~9:GL]+'vCD2aP6IREKdb"3_pB< Qjv2ZYYt4WS3.T{sXfUUHPlK4
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: c6 35 cd 2a 23 8a ed f6 e1 3b e1 59 5c ed 82 4b 5b 16 8e 23 f6 2f ff 75 49 51 62 c1 b8 33 02 fb c5 0c e7 88 10 16 fb 98 49 d8 43 c1 0f 6e ce 42 dc 09 26 2a bb c0 be 6e 9a ad 8f 0e 6a 5e d4 2b eb e9 97 0a b4 8c 81 f8 74 d2 78 8d 5f 41 15 75 93 9d 92 13 32 80 3a b1 5b 81 08 f4 ef 98 29 49 79 0e e5 ab f2 78 5d ce 26 68 58 c4 74 34 c8 ae 05 b5 3b da a5 9c f1 cd 23 7e 15 58 e8 3c 16 2a 62 94 4d 9d d5 87 7b fa a0 77 28 12 07 6f 84 36 25 47 d0 2e 3f e3 c2 3b 94 1a 43 00 db 7a 01 69 3b 18 4e 4f ae ac 06 c1 d1 95 10 f8 0f 13 d5 ae 8b 54 a1 0f bd d2 f3 10 30 77 35 61 f9 34 78 11 db 4e 48 69 6a 6c 66 ba 47 c7 54 ee 6b ab ee 30 6e 9d 0e 0d 31 86 99 48 27 90 17 a2 68 ea 0e 0f 13 90 c3 6a 75 5f 84 3a e2 f9 d2 8a 64 93 57 23 9b ac 71 6c e0 5a c1 f3 b6 ff a7 b2 ad 80 fa Data Ascii: 5#;Y\K[#/uIQb3ICnB&nj^+tx_Au2:[)Iyx]&hXt4;#~X<*bM{w(o6%G.?;Czi;NOT0w5a4xNHijlfGTk0n1H'hju_:dW#qlZ
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 2e fd 1d fe 7a 72 e3 32 bb c3 2e a8 d2 eb 19 94 91 cc 9f d9 58 fe 48 85 63 ee 57 b4 4b a3 8f 99 74 da 96 84 ce fb 5a 0d 07 26 85 fa 83 d5 27 34 36 21 3d 26 d2 76 2f 94 c0 39 01 0d a9 40 ab 7d fa e3 c0 7e 72 4e 9a f9 86 b1 34 18 7b 6d 99 12 f7 79 d5 52 f5 af cf 43 1b 74 8e b9 1f 2d 2d 72 4d d4 68 8b 74 7b f2 2e 18 fb 6e 32 df b3 f2 b4 33 69 fb 35 30 ef 3d 50 9e af eb e1 93 fe 55 f8 82 01 87 93 c6 27 a2 76 93 64 3d 4a f7 95 7a 2b 50 81 00 d7 19 74 e1 b8 cc 8c b4 29 0c a1 76 3c 77 34 e8 22 f4 01 b3 41 bc 6e b0 a6 e4 ef 76 8b 31 d6 0b 28 99 29 ec fd 51 c7 e8 07 18 bb 37 7f e5 d4 de e9 e3 f6 99 e5 c9 45 8d 4d 03 8b 96 cf d8 8f 75 60 1b 56 c0 b5 a3 99 81 bc b3 81 cf e3 94 2f e3 ee aa ea 54 f0 00 41 99 25 9c b3 f8 fc 03 b8 eb b9 b3 de 53 3e ca 29 9f 97 bd 3c fc Data Ascii: .zr2.XHcWKtZ&'46!=&v/9@}~rN4{myRCt--rMht{.n23i50=PU'vd=Jz+Pt)v<w4"Anv1()Q7EMu`V/TA%S>)<
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 3f 55 a7 3a 4b d9 0f 49 d6 7c cb aa ba 67 b9 40 cd 4e c9 c0 77 4a eb b7 63 a1 ef 98 00 5d 48 7a c2 16 a4 03 39 db 7e 4d 71 e1 af 91 d6 07 ad 05 06 56 1f ad c3 40 8c 75 ec 0e 7f 7e 2b e5 5a 3f 9a 83 40 db 45 2c 96 78 1b 94 8b 78 51 e5 c7 f4 b3 05 fb a1 63 2d 55 55 2d c7 a0 fd 05 b3 42 39 fd d5 db 33 d0 a3 b1 aa aa e4 11 68 6b fe 0b c2 0a e9 69 b1 f8 b4 f4 a3 e5 05 7a 3a 95 9a 46 a7 a7 45 d2 75 37 5e 0c d1 fb a8 e8 f4 79 e0 34 52 91 46 4d 53 ca 05 48 6c 3c ac 18 ef 3b 5c 30 6c 36 d6 43 fe 94 95 71 9c b8 07 67 71 6e e2 36 bc b2 b2 fc 7c b4 1c 2c bf 5c 51 78 fd fd 1f 0b d3 e9 12 4e 6d 58 5c f9 e5 f1 6f 9e ab 28 79 a7 92 77 e6 1a 33 8d a9 90 72 b8 4f d5 80 15 c7 fd 0b 78 05 f1 d2 92 7f ff 71 59 4a 98 c2 ad cc 9a 6b 0c da fb c7 a3 b9 fc c2 45 15 fc 4b ef c3 00 Data Ascii: ?U:KI\|g@NwJc]Hz9~MqV@u~+Z?@E,xxQc-UU-B93hkiz:FEu7^y4RFMSHl<;\0l6Cqgqn6\|,\QxNmX\o(yw3rOxqYJkEK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50065	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2676	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/hamburguer-menu-bars.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
2024-02-22 12:07:33 UTC	1304	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/png Content-Length: 227 Connection: close CF-Ray: 85971c0299138ca7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 824236 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "08995dda6060de8163d3375dfaf58cfc" Last-Modified: Mon, 18 Nov 2019 16:10:12 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 c70c0d114d0fcf32b9941c29c00266de.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=416 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: jGleaUfL88cAEmo41pzmSDyn5emMG7N2XPr-ZfKz-SKHIRicbkTtAw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: EjeCqPWPTz4nn10+UPPQNKlTUjPSdX53xHgDmu5hxUL5583i3rMpX1/2zH+wABbYtbCmizn/KI6bix2OLewe2+nk6wZFFmkMeDmfq68QcnI= x-amz-meta-cache-tag: F-21437638165,FD-21313625078,P-4650993,FLS-ALL x-amz-request-id: X1Y53A29ET7BFQKZ x-amz-version-id: 6gZ.Sl4OgwcBJUO05J0c7QNaVPaZ6DJ9 X-Cache: Miss from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-02-22 12:07:33 UTC	382	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 62 75 78 4e 6d 48 51 62 36 25 32 42 78 74 70 35 4e 7a 45 79 72 6b 66 50 59 64 52 6a 50 6b 6d 53 48 55 45 7a 65 4b 32 4f 57 6e 57 79 78 5a 41 33 58 67 55 55 48 69 63 57 37 4d 6f 51 43 6d 73 25 32 46 64 30 48 70 37 51 33 46 25 32 46 6d 32 77 25 32 46 52 76 67 48 4a 6f 44 58 44 55 5a 39 4b 61 64 53 56 36 56 68 43 77 4d 41 48 78 7a 25 32 46 4f 6b 75 46 53 4b 34 65 5a 30 70 4e 75 59 37 54 35 64 31 6e 53 53 50 59 57 4f 56 65 79 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=buxNmHQb6%2Bxtp5NzEyrkfPYdRjPkmSHUEzeK2OWnWyxZA3XgUUHicW7MoQCms%2Fd0Hp7Q3F%2Fm2w%2FRvgHJoDXDUZ9KadSV6VhCwMAHxz%2FOkuFSK4eZ0pNuY7T5d1nSSPYWOVey"}],"group":"cf-nel","max_age":6048
2024-02-22 12:07:33 UTC	227	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 04 03 00 00 00 a5 2c e4 b4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 2a 50 4c 54 45 00 00 00 ff aa 00 2c 1f 70 28 20 6c ff 79 00 26 1e 6a 27 1d 6b ff 78 00 ff 78 00 26 1d 6a 27 1d 6b ff 79 00 ff 78 00 26 1c 6a 24 e5 e0 96 00 00 00 0c 74 52 4e 53 00 03 29 40 76 78 98 bf cc e4 ed f3 80 a7 5f cf 00 00 00 4f 49 44 41 54 78 da 63 60 a0 1e 60 f4 d8 e1 88 55 42 fc cc 99 e3 02 d8 24 7c ce 9c 39 e3 80 4d a2 e7 cc 99 33 0d 0c 0c 9a 77 51 c0 62 06 86 3d 67 ce 9c d9 c0 c0 10 8b 2a 71 0d 8f 0e 9c 76 e0 74 15 4e 7f 0c 4e 30 1a ec a3 c1 3e 62 82 1d 00 4a 2c bd 88 d3 ad fb aa 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR00,sRGBPLTE,p( ly&j'kxx&j'kyx&j$tRNS)@vx_OIDATxc``UB$\|9M3wQb=gqvtNN0>bJ,IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50062	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2982	OUT	GET /hs-fs/hubfs/New_Avast_Academy/Computer%20Virus/Academy-Computer-Virus-Hero.jpg?width=1200&name=Academy-Computer-Virus-Hero.jpg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:33 UTC	1241	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/webp Content-Length: 50560 Connection: close CF-Ray: 85971c0299fc4367-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfWrVxBJpHq2JKG7lWQMCt9Dmnp_JT3RFRkAkfKe_HDQ:b9b99dcc8c840014865601f182f3f206" Last-Modified: Mon, 22 Nov 2021 09:40:52 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) cache-tag: F-60252051518,FD-13936192775,P-4650993,FLS-ALL cf-bgj: imgq:86,h2pri cf-resized: internal=ok/m q=0 n=132+0 c=3+83 v=2024.1.3 l=50560 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DdYfD%2BYcAuZPGkc05961IWIncixGbMNDOLvI4iB5vrUjFtskZhBtUzE3qVyuZvVQKVWphjboONCE%2BDFbTcafqZ86US6SXR5luwPkkYeeVxKibYKemaSN0w%2F%2BSjwLvsBCjB0a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:33 UTC	128	IN	Data Raw: 52 49 46 46 78 c5 00 00 57 45 42 50 56 50 38 20 6c c5 00 00 f0 65 04 9d 01 2a b0 04 b9 01 3e 49 1e 8d 45 22 a1 23 25 27 10 7b f0 a0 09 09 64 6d bc 43 4d ae 59 7c 2b 4b 23 90 b9 9c 0e c2 53 60 7e 83 e5 d7 c9 bf bc ee b7 f6 33 a6 6b fb 9e e8 f4 00 f0 87 e6 df ed 1f 4d 7f 39 2f ae 76 8a f9 f2 09 d0 17 17 fa a7 f7 3f e4 7f 73 7f d0 fe eb fc bb f1 9f 62 7e b5 fb df f9 7f f6 1f e1 3f 6e Data Ascii: RIFFxWEBPVP8 le*>IE"#%'{dmCMY\|+K#S`~3kM9/v?sb~?n
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 7e 69 7f e3 fb 96 f2 b3 b4 7f f3 7d d7 7b fa 79 d7 f0 df f4 3f cb ff a5 ff e5 fe a7 ff ff ff ff b7 5f f1 bf f2 ff ad ff 5d f1 8f f5 97 fd ef f5 7f bd 7f 42 ff ad 7f f1 3f c0 7f a0 ff e7 fe 83 e3 cb d8 3f ef 6f aa 9f db ef db 3f 72 ef fc 9f b7 3f 00 bf a0 ff cf fd bb ff 81 f2 45 fd 2f fd 47 ff 7f f6 bf f8 3e 2e 7d 6c 3f cd ff f4 f6 42 fd df ff ff ec ed ff 8f f7 0f fe 5f cb df f4 cf f8 1f fd bf de 7f bc ff ff f4 3d fd 23 fc 5f fe 8f cf ff ff ff 40 1e 80 1e 80 1e 7f f2 11 6b fa ca ff de b8 df fd 2d 56 7e 85 fc 93 fe 7e a7 7f ea ed 47 fe af 99 17 16 cf 57 e7 3d f5 07 f6 79 25 fb e5 ab a7 d0 d5 e1 33 f4 2f f6 be c1 1f ad 1f ed 3d 73 bd 98 fe e2 fb 2a 7e dd 19 36 b2 f2 ba fa 3b a4 57 80 3c bf 3a 3f 18 c8 d5 80 92 ab 87 1a a6 8a 5a a5 f7 c7 26 aa 38 ef ca 95 bb Data Ascii: ~i}{y?_]B??o?r?E/G>.}l?B_=#_@k-V~~GW=y%3/=s*~6;W<:?Z&8
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 44 23 d3 11 19 45 69 96 31 b9 a8 ea c9 5d de ef ee a4 18 d2 33 41 08 31 cc e7 a6 07 16 4e 4a 23 d8 4e 64 16 1b bd d6 51 b0 3d a1 5b a9 49 0b fe 81 0a 8d 1f d8 a2 c3 5b f2 75 90 ab 22 c6 8c 29 07 d4 5a 4f 03 ac cc fc de 42 90 1c 25 ae c6 fd b4 76 e8 8c 41 ff 9c 45 9f 00 9b 48 80 84 d4 7e fa b1 e5 f8 52 aa d0 81 30 c4 96 d4 fb 2d ba 29 0b 3e 88 26 dd 94 4f 33 98 9f a9 37 5b b5 20 5e e1 27 69 13 01 1e 1a 8c a2 8a da 1b 5e a6 88 c1 3f 31 25 48 d4 89 8b 90 a0 ed c7 8b 0c 5b 43 71 bf f7 1b 4f fe 59 65 09 b9 7d 27 0e bf 4c 3b 23 1a ed 90 f2 6b 66 24 a9 89 d1 58 3c 67 ea e4 28 e6 92 32 21 9b 8e 1c 11 43 5b d7 81 df 59 8d 4c e9 8a 9a 15 d8 3f 9d a2 ad 83 a5 90 a3 7a cd 82 8a a0 b0 7c c9 f9 e7 7b ab 6b 7e 8d 79 4d 15 4e 1e 36 b4 a1 0f 59 b0 1b 06 a6 5b 0e ad 92 43 Data Ascii: D#Ei1]3A1NJ#NdQ=[I[u")ZOB%vAEH~R0-)>&O37[ ^'i^?1%H[CqOYe}'L;#kf$X<g(2!C[YL?z\|{k~yMN6Y[C
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 65 c5 e8 4b 08 fc 15 6d 74 7d 2a b6 35 dc 2d a6 5c 0d 38 d8 30 91 37 29 3f 18 bb cc 85 e5 24 36 5b e8 fe 17 a7 da 7b 93 ad d1 eb 10 85 f6 c1 e2 be 84 e9 55 4b 66 28 97 0f 89 1b d4 4b 31 65 91 5c d2 2a d9 c4 6d 7c b7 9e 6b 3f 12 6a 55 9b c7 39 37 a5 88 2a 02 10 30 ef d4 0c b9 db b6 6b c5 2d 84 12 a0 9e 8d bf f4 3b 91 db 2d a9 75 90 be 63 32 ea 0d 38 22 82 dd b1 f3 8a 3e f3 cb 14 d7 be b2 e5 bb 05 35 09 71 b4 76 b0 60 72 ae 93 c4 d8 05 a5 12 95 a5 7e bb 52 a0 5c f3 89 e8 ac 4b eb be 44 99 53 f5 41 92 d7 f9 57 f9 7d 19 51 08 96 50 73 ec f4 7b 25 64 83 74 23 b1 7b 7c e1 84 14 5d af 2c c4 36 d0 30 b0 74 7e aa b6 4d 4b 8c e4 81 1e 4a 15 f3 ae 03 c7 8d 0c 5a c4 a8 c0 a5 9e fb b8 df 22 d2 12 f3 25 db b4 8f 7e c4 d2 4f 54 45 15 a6 2c 47 71 b5 eb 6a 76 da c4 89 36 Data Ascii: eKmt}5-\807)?$6[{UKf(K1e\m\|k?jU97*0k-;-uc28">5qv`r~R\KDSAW}QPs{%dt#{\|],60t~MKJZ"%~OTE,Gqjv6
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 3b 40 1a d8 0d db 64 ff 7e b0 89 10 1b 1b f9 98 ea 89 1b 79 bb 01 6d 58 76 fd f2 0d a8 79 93 55 5c 48 fa 43 1d 8e f5 b5 b7 3d 6d 1a 15 a8 df 24 a9 93 bf 6c fc 57 19 0c 14 5f fe cc ba be 8d ea 9b ff aa 70 41 16 5d f6 10 3f 3d bc d5 5b 51 12 7c 6c f4 1b 77 5d 31 2d d9 26 50 d9 5e 57 cf 60 a9 c0 d7 67 b8 cb ae d2 7f 55 a2 b5 e1 d8 cc a3 40 77 36 0c e7 1f f1 da 2e 89 aa 7c ff c1 0b 97 07 88 63 53 47 7d 01 96 b2 0b ea 84 83 1f e0 de 99 e2 ec ce 5a 09 52 67 7e 0e cd 80 d0 85 54 76 fe ad 22 83 0e ef 7b e2 fe a8 c1 65 29 a4 ee 82 7e e3 49 26 25 46 de 96 a7 15 98 08 27 a7 69 ee a1 1c 74 ee e0 e2 a7 0f 01 6f 8f 81 e8 52 ac 3f bd e9 88 e3 e4 d7 23 13 fd 1e 0e 0d 6a 84 8e e2 90 9e 38 7b cc 1c 6f 27 ee a6 e9 a3 c1 2b 2c 21 8c c8 6d 66 25 4c 24 9a 8c e6 78 a9 f3 88 e4 Data Ascii: ;@d~ymXvyU\HC=m$lW_pA]?=[Q\|lw]1-&P^W`gU@w6.\|cSG}ZRg~Tv"{e)~I&%F'itoR?#j8{o'+,!mf%L$x
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: fd 5c 33 9b 13 54 2a ff 6f f2 df f3 4c 33 aa 2f 97 51 b8 bf ca 3e 4d 65 6e af 39 2c 60 3d 78 a6 15 52 6f d4 68 bd 78 76 9a b3 e9 af 53 01 39 6b b3 74 7c 83 f2 0b d0 e3 39 c0 51 47 87 fb 9a 60 8c d5 95 21 cf c7 2f 46 cc 33 cb 6a dd c9 b5 b2 ae 97 37 11 a5 b0 df e6 61 bd 04 a7 f9 bb 2c dd 22 1b 2c e5 bd 2b 56 5c 81 be c2 c8 87 98 6c 14 11 2f 16 b8 1c 43 a6 d8 ae 5d 08 cd 65 46 89 58 64 10 3a 5d b3 46 94 b4 c1 c8 d1 44 08 50 8b 74 df a7 36 66 62 3f 2f e4 d9 ba ad 1e cb 9e c1 c5 9d 25 3e 08 55 9f 4c d5 fd b0 3e ac 12 91 13 dd 84 d0 39 18 da b8 4a 87 db 0c b6 2d fc 13 dc 77 a1 71 e6 3a 38 4a 0c 3c c4 dd 5b d7 36 31 b8 ac 16 50 41 59 2a c3 88 66 7f 16 d7 62 11 e8 7e e8 64 b5 de 56 6f 63 21 e4 ee 7d f6 7c 5d ab 01 2d 9a 41 4c 82 91 54 0b 7c 0f 8e 03 f4 9c 1a a4 Data Ascii: \3ToL3/Q>Men9,`=xRohxvS9kt\|9QG`!/F3j7a,",+V\l/C]eFXd:]FDPt6fb?/%>UL>9J-wq:8J<[61PAYfb~dVoc!}\|]-ALT\|
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 62 7b 81 70 1a 6c 20 6d 05 5f 19 9b 61 3e 97 07 44 de 5e 2d 22 a4 7b 73 bd 7a 12 f8 99 7b b7 f5 a3 65 fb db d6 6b 22 7e 48 c1 8a 4a c3 36 b6 f3 fa 41 fe 4f d0 55 9f 93 5b 7d 89 97 bd c9 ec 36 c8 33 aa a7 24 87 bf 5c b6 12 6a 6d 7e 29 90 74 55 fe 91 9e 2e 7b 59 b9 60 23 9b b3 d2 a1 4f 7b 0a 37 44 22 c9 6d 55 a7 e2 47 71 ea b5 dd 6a e2 63 f7 f3 5a ca 4b ef c4 a5 dc e3 d8 43 5e 8f 18 f1 02 ef 91 1b 1e 86 21 45 a4 e9 e0 e1 cf 33 b4 74 04 a0 12 60 ae 0b c4 ad 46 2d 50 97 d0 c3 f8 5c 77 35 1c 24 a5 59 d3 5f 06 02 0e 64 e3 4e 15 1e 6a c5 50 0f 55 64 59 00 57 93 64 f9 4b b3 83 b8 d1 c5 ce ba a0 9c c7 d2 30 da ca 57 7e c8 c7 3e 2b 96 08 21 98 aa 20 c8 e8 28 bf 6b 41 47 b5 2a aa 13 f7 fc 1d 03 32 12 19 94 38 84 b0 98 8f 15 3d 65 c9 37 c5 05 e8 a7 69 b2 6a 8e 87 15 Data Ascii: b{pl m_a>D^-"{sz{ek"~HJ6AOU[}63$\jm~)tU.{Y`#O{7D"mUGqjcZKC^!E3t`F-P\w5$Y_dNjPUdYWdK0W~>+! (kAG*28=e7ij
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 68 39 6d f1 e6 e6 f4 7a e3 7f b5 f4 89 3d 6f f8 c5 f1 a2 77 a8 e3 57 b1 08 44 4f 22 5d 0f c6 a3 c7 c0 33 a0 f9 1a e8 a6 84 8d 24 fc 46 1f da c8 2f 9c 6a 4e f3 13 e9 f6 80 88 a6 39 b5 a9 e6 1e c0 1a 24 88 85 24 de b7 0f e5 f8 7f 38 ca 9d 81 1d d2 30 5b c4 0e 7f f0 9f c6 8e a5 a6 6c 9d d8 b3 34 0e 2c a2 f6 1e 4b 73 74 b0 ed 36 b3 ca 46 f9 ec 2e 59 ed e5 82 cd 15 a5 68 21 0c b2 76 20 dd 47 73 60 2d 0a e8 6b c4 bd 9b 84 75 bf 9b 06 ea 8d 15 ac b2 56 83 a3 63 c0 9e 77 a3 f9 f2 23 50 ba a4 7c c9 da 23 55 18 66 e2 69 cc 7c e7 72 e0 9d 67 57 5f b1 8b 62 4c 42 c9 55 26 65 85 8c 08 f6 ba 6a f5 12 68 0a b5 56 c1 33 5b c1 8f 12 1a c1 a0 12 99 3b 2a 59 2c 41 54 6e c3 73 7d 21 12 5a 15 f6 97 1e cf b8 cc f2 82 87 98 aa 07 1c d2 b2 2e 47 66 27 f2 02 d4 4e 32 f9 d2 70 b2 Data Ascii: h9mz=owWDO"]3$F/jN9$$80[l4,Kst6F.Yh!v Gs`-kuVcw#P\|#Ufi\|rgW_bLBU&ejhV3[;*Y,ATns}!Z.Gf'N2p
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 50 53 c1 9f 10 aa a8 1e 5e 1c 90 8e 9a c0 51 d4 75 71 1c c8 ac 13 0b 18 03 69 30 ab 72 ad e4 cd 30 e6 a0 e5 a2 8d 2b d1 e7 f3 50 f3 dd 22 26 20 d2 22 ad dc 8f a5 b2 1c 82 b7 92 5f 1e 96 8e 7d 2d 9b cf a3 f2 40 20 66 01 b1 d2 35 d9 bb 04 92 d5 ea d0 ca 3b db 5f 24 c4 44 50 b7 f2 03 f7 a0 6b c6 bf 36 f4 1e 1d 3f 08 61 3f de a8 20 c1 28 73 44 b2 d2 c5 1a 34 22 1e 4d 41 2c fa c0 a5 17 77 85 90 49 5d d3 e2 02 76 76 47 f9 31 c0 82 6f 77 7e 23 06 e7 40 25 0e 6d 98 c1 7d a1 c7 94 b4 9c ee a8 67 9a b3 f2 63 ef d7 1e 84 be bf 30 80 dc 44 92 3b 5a b2 0c 5c c7 bd 6e e2 08 08 71 40 b6 69 89 41 7f 90 5c 0d fc d6 17 43 20 88 24 e9 42 71 78 46 66 7c 98 af 70 09 0e 11 a3 07 86 b1 f7 f0 c7 a5 3e aa 97 1f 55 77 8c ac 36 dc ff d6 cf 1b 00 84 f5 19 bb 9e 1b c1 4e d8 4e 7b 07 Data Ascii: PS^Quqi0r0+P"& "_}-@ f5;_$DPk6?a? (sD4"MA,wI]vvG1ow~#@%m}gc0D;Z\nq@iA\C $BqxFf\|p>Uw6NN{
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 22 83 22 fa 30 43 ce e2 62 1a 1b f9 b7 88 73 e3 ba 46 fc 3f c0 8f c5 e2 10 ac ce fc 6e e8 68 49 0b fe 95 22 ff e8 c2 cc ac 2d b0 00 67 8d a8 18 1d 37 cf a1 50 24 c0 41 8f 20 79 ae 6d 31 72 99 06 b8 b0 20 95 9e 95 03 0a b8 9f 4f af ea 24 4e 8b 26 95 02 eb 9a 31 2d 09 47 94 68 4c e1 a5 b1 2e eb 6e b0 5e 03 8a 68 ed 87 d5 22 39 09 94 1d 1f 53 7f e8 e6 f0 67 58 be ea 98 c7 7c 6f 89 31 fb 1e 4d d7 9e ac d4 18 08 f9 43 d0 1f d3 d1 d7 a0 77 62 22 b7 f9 26 26 6f f2 eb dc ad e5 8f 16 45 90 7e f6 46 ec 58 13 fc 45 26 f4 a1 75 e2 86 00 95 f6 c2 a2 e5 4f dd 31 d9 0b 6e c2 ff 27 99 be ee d7 4f 6a 45 02 4f b3 19 e7 ae f5 ae 8f d0 9e 43 4b 83 d3 1b af f4 47 7a 77 31 3a eb 44 a5 89 0b 8f 2b 6f f8 cf e4 1d f3 da 92 a8 fa b7 db 64 6e a9 c7 e0 6e fd f2 77 35 99 4d f2 70 71 Data Ascii: ""0CbsF?nhI"-g7P$A ym1r O$N&1-GhL.n^h"9SgX\|o1MCwb"&&oE~FXE&uO1n'OjEOCKGzw1:D+odnnw5Mpq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50064	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2661	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/check.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=
2024-02-22 12:07:33 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/svg+xml Content-Length: 238 Connection: close CF-Ray: 85971c02deaf8c8f-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506491 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "621d00062d3edb4f262dd755a8e4821a" Last-Modified: Thu, 19 Oct 2023 13:56:50 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 86a640712a72b4264f1681744fa48612.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: ZmeEjjgXAO6_kti4R3yACpsa-8omQBd50aDi8mrYRW4HSeGYC2qOCw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: Y1WllsRH4guE2YvREzgYh9/XRPLq6GzNEPLJ31U7+QQcvQoSVI61Lgw9bIvHLUx6v/K6Gxs1zEg= x-amz-meta-cache-tag: F-25680701402,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1581436745119 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: D0NFFJ5CF854YKKB x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: _7YrTAOAwJYm1x8kGDyumYsAyaMKL_sR X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	505	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 5a 75 53 57 41 37 32 46 6e 34 79 34 63 63 6a 34 6a 52 4d 6f 61 33 69 63 53 46 41 61 79 6f 32 33 35 4c 47 67 66 4f 4e 4e 56 41 4b 25 32 42 35 5a 4e 33 57 70 32 65 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZuSWA72Fn4y4ccj4jRMoa3icSFAayo235LGgfONNVAK%2B5ZN3Wp2e
2024-02-22 12:07:33 UTC	238	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 46 46 46 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 32 20 38 6c 34 2e 31 32 35 20 34 4c 31 34 20 34 22 2f 3e 0d 0a 3c 2f 73 76 67 3e 0d 0a Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"> <path fill="none" fill-rule="evenodd" stroke="#FFF" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2 8l4.125 4L14 4"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50067	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	655	OUT	GET /hubfs/Avast/Academy/assets/o/f/800/MierB03-SubsetEng-ExtraBold.woff2 HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.avast.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	1339	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/font-woff2 Content-Length: 19944 Connection: close CF-Ray: 85971c031d2c727b-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506917 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "f2c718e58af39d28c873adcff1fe9fbf" Last-Modified: Fri, 21 Oct 2022 09:22:51 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-67137001238,FD-46362882315,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-67137001238,FD-46362882315,P-4650993,FLS-ALL X-Amz-Cf-Id: ad-Y5ssbGFfb6EfArGJ5rSPKZA22XWlLCJ_bfCwH3fJ5RBYxQJg5qQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: KGv/UXwMaIazd/j9mrdGbkrNX7EtNJjWlnJBfrCxdE82JxgsSiV2pbSu3BMq0JCrKjWuCEhhe6hGL0d20SNC1Lg6lVdSo1wbT/UCQZvIw08= x-amz-meta-cache-tag: F-67137001238,FD-46362882315,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1645802190038 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: V7YG5GTM3YWHK19R x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: HnmDqzeXDjIS3bZd8Q9SPVI2Tn_MJ_pK
2024-02-22 12:07:33 UTC	999	IN	Data Raw: 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 65 4e 50 47 51 33 46 37 6f 35 68 31 4b 46 57 53 68 71 58 4a 35 67 78 61 42 62 58 73 51 35 5a 6f 2e 6b Data Ascii: X-Cache: RefreshHit from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=eNPGQ3F7o5h1KFWShqXJ5gxaBbXsQ5Zo.k
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 4d e8 00 11 00 00 00 00 c9 a8 00 00 4d 83 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 62 1b fe 4c 1c 82 28 06 60 00 85 34 08 81 76 09 9c 0c 11 08 0a 81 cd 10 81 b2 0c 01 36 02 24 03 88 14 0b 84 0c 00 04 20 05 8c 4a 07 20 0c 81 7a 1b f1 b8 07 d8 36 8d 66 de dd aa 52 12 60 18 7d b3 c1 b4 c7 01 a4 e6 d9 66 47 58 d8 38 cc 3c 58 7e 8d ec ff ff 94 04 39 62 0c a6 1d e3 5f 35 b5 2a 50 55 51 ca d1 a3 3c 2b d9 db 3e b6 19 3d 52 bb 71 93 ca d4 11 3e db ef 51 79 d8 e7 b4 b8 02 71 5b c1 a3 6a 8d 52 f4 92 3d 6e 81 fa cc 52 87 4b f9 68 4b 90 a0 bf bf da d2 35 47 90 f7 20 10 95 c8 64 48 c6 61 dd eb 90 d1 ad 7a 89 95 5f 65 ee 2f fb 8f 4f a0 40 12 28 10 88 3b 91 8a 75 fe cb 4f 08 32 10 d7 9e 5c 98 74 b6 17 1d Data Ascii: wOF2MMBbL(`4v6$ J z6fR`}fGX8<X~9b_5*PUQ<+>=Rq>Qyq[jR=nRKhK5G dHaz_e/O@(;uO2\t
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 95 28 55 a6 dc 60 a3 8c 31 d6 38 e3 4d 30 d1 32 cb ad b0 9f 48 c9 fd a0 f4 1e 29 8b de f2 7b c5 60 ef 98 3b 6d 2c 1e 87 c7 7b 27 dc 0f 26 0e 44 5c 08 8a ed 3f 6b 07 c2 89 e6 c6 87 19 ef 2a d3 7d c0 43 f0 69 61 7a 34 03 86 91 80 e9 be 72 91 23 c6 1d de f8 d3 98 7c 5a 88 1b 82 11 84 f1 fe a2 71 77 92 ed 4e 72 dc 61 ae db c1 7d c7 51 b8 bb c1 71 77 b8 ee 2a f7 3d 80 99 ee 2d d7 fd 45 38 6e 2e d7 cd e2 be 45 10 1b 0a 9f 9e 80 81 88 09 85 43 38 08 39 89 b8 10 6e 32 48 14 02 89 c2 10 20 10 fd 9d 60 b8 6b 8c 30 1b 1e 07 1e 27 01 17 01 37 31 24 0a 0f c6 41 5c 30 c2 06 1b 73 2f 8c bb 17 30 17 9a 1b c1 a7 bf c3 0c 77 87 e9 e6 e0 60 36 02 0e 82 bc 4c 5a 9e 84 00 1a 2c 16 29 37 1f 91 fb f0 0e 7e 85 86 a4 0d ea f1 20 ce 14 83 97 54 56 18 51 3e 8b 05 5c 88 c3 ed 26 06 Data Ascii: (U`18M02H){`;m,{'&D\?k}Ciaz4r#\|ZqwNra}Qqw=-E8n.EC89n2H `k0'71$A\0s/0w`6LZ,)7~ TVQ>\&
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 7f 75 63 44 12 c1 40 74 fb 17 c2 29 5a ac ea 6a 50 8a 17 c1 c5 6d 48 87 57 62 dd 0f c3 03 77 d8 8c 02 1d 9e fb d2 8b 46 86 ca 47 f5 58 6a b0 73 21 ba 41 b7 3a 0a 61 fe d5 74 2d 0b 7b 94 08 45 8d 1f 29 21 a7 33 d3 e3 2e ba 3a 0e 7d d8 0a 58 bd a5 a5 a3 fd 9d 16 aa 9e 36 67 37 17 d4 b7 5d 7c ad a8 62 aa ac 40 8f ae 2c 13 fa 2f d1 4d 65 c6 59 ce 9e d1 bd df 4b 7e 07 a0 c1 17 44 da 27 d1 38 e9 62 0c 97 f2 37 aa 37 f1 ab 56 ef 04 86 d3 f0 92 9f 29 34 a9 12 e4 e7 28 f5 cc 04 32 5e b8 cc 20 ab 85 99 0e da 5d 31 e1 89 2d cb a8 32 dc ed aa 42 64 b7 54 5d 8f e5 65 ce 12 4b 58 30 c8 fe ba 5b 29 f8 66 e4 60 f1 b3 84 28 9b 46 9d 9b 81 72 cd 09 84 76 1f a6 9c 72 50 85 59 61 e7 44 69 e4 0e 9f 30 59 5e 04 4f 88 b3 99 eb 15 c9 90 93 84 ed b0 bb ef 5a 77 1f f5 e0 a1 35 e3 Data Ascii: ucD@t)ZjPmHWbwFGXjs!A:at-{E)!3.:}X6g7]\|b@,/MeYK~D'8b77V)4(2^ ]1-2BdT]eKX0[)f`(FrvrPYaDi0Y^OZw5
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 42 a9 6a 7c 13 74 0f 6b f7 60 01 1b 7e 78 9a 88 a4 06 cb 58 f5 3c 81 ec 0b c7 2d 84 2e e2 43 2e f8 0a 2b a1 67 a5 c0 94 ce 78 7c 68 fc a2 f7 6e ed 4d 4e 3c 3f 66 fc 6c 21 a3 31 52 f0 3b 7f 2f db 5b 5d 7a 23 ff 3e 05 a4 6d 12 5e 3f 0d 09 b9 7e a8 fc 2e 66 f9 ef d4 bb 8a 58 49 e0 c9 dc 84 35 29 b8 67 09 9f 88 d9 d9 9d dd a4 51 5c 76 11 b7 7c 0d 32 89 f0 0e cf 3e 6c b8 bf b3 59 8d 2d 46 3b ad 1a 1a 07 cc 26 c8 19 7a 2e 5b ed 35 5c 32 5a 3a 83 62 b3 7d 48 84 6e e6 99 67 14 92 77 fd 36 19 98 cb bb f6 05 56 1b 38 19 53 4e 4c ea 75 c6 0c 27 45 13 90 4d 04 07 12 c3 16 71 48 cf 61 f6 b1 8a 3d ab 27 0b db e1 a2 55 1b b2 46 89 e0 1d bb 85 07 52 38 df ec 2f 83 03 83 42 9c a2 6d 78 f9 1f ba 0c 35 7a ce e1 6b 6c e5 84 a0 57 e7 5c 4c 5e ae a1 fb 30 ba 85 c5 ba 53 b5 77 Data Ascii: Bj\|tk`~xX<-.C.+gx\|hnMN<?fl!1R;/[]z#>m^?~.fXI5)gQ\v\|2>lY-F;&z.[5\2Z:b}Hngw6V8SNLu'EMqHa='UFR8/Bmx5zklW\L^0Sw
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: aa 65 8d a2 90 95 9e 03 82 8c d5 30 bc 93 d3 74 aa 65 d0 50 ea 5a 75 e7 89 54 7d 3d 6b e4 f5 68 47 31 1f f8 b0 6f e2 a1 7a 51 ab 20 bf f6 9a 9a 9f 89 c6 c7 52 15 15 50 63 b7 00 31 31 52 47 6b c9 09 08 7e 40 24 e9 8d 89 fd 04 95 ee 68 6b 80 a0 a3 2d 36 77 a2 7c 33 52 d0 36 2f 8a 8e 86 7e ba 3b 1d 45 9b 93 87 81 eb 58 a7 41 86 d3 89 0c 93 41 12 43 b8 34 45 0f d9 48 6a 2a 5a 45 5b 90 1a 43 de e5 8f 10 57 56 82 82 57 8d 7e f7 9b 33 68 1a 61 db 81 a1 6e 86 2c 32 9a 51 97 83 19 11 76 4f f6 6c 8d 58 ed d8 8a 36 32 69 ec f2 3b c9 70 45 07 63 00 60 db dc 6c ac 7c ca cd b6 d2 29 e1 8f b1 23 43 84 62 03 85 ec 11 77 a2 7c 9b 9a 4a ca 80 f4 95 91 7c 8a 64 8f 0c 5b c7 3e 8b 83 be 7e e0 60 28 93 02 b9 eb 0e fc d6 d1 65 c4 d8 51 74 8f ed 21 03 e3 49 80 a5 0a 62 75 a4 a1 Data Ascii: e0tePZuT}=khG1ozQ RPc11RGk~@$hk-6w\|3R6/~;EXAAC4EHj*ZE[CWVW~3han,2QvOlX62i;pEc`l\|)#Cbw\|J\|d[>~`(eQt!Ibu
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: af fa 97 5d af 2d 99 12 72 ab 71 67 14 b5 89 07 a1 7a 2d ac d3 c1 8a a4 4a 11 52 a9 8f 49 40 0d b9 42 4e 12 c6 2b 9d 3b 7f d2 8b 1c 32 ed c3 26 fe c9 74 68 9a c5 94 5e 74 84 cb 7d be eb f7 46 44 69 34 ba 1d c8 70 dc f3 2a a2 ac 86 ab 88 c5 98 d5 84 84 0e bd 59 04 14 54 66 a4 7f 86 47 8c 87 da 7a 22 02 37 e3 88 74 18 73 14 92 28 27 61 ea e7 32 a6 77 1b d9 5b 45 11 e9 a6 97 7d 5e 89 d8 b8 19 f6 f2 62 ba 48 50 cc a0 d1 48 4d 71 3e 2f d7 43 f3 9e 19 a4 90 35 d0 91 ed fb bf 5b 3b b1 83 eb 16 0c 5b 27 77 29 86 97 0f 77 bc b8 2d 26 17 dd 83 62 c3 75 9d 6c ca cd cb d7 3d fc c4 a9 c7 f3 0a f7 17 43 d7 c9 d6 f0 4b 7b ea 6e af 5d 45 6f 5a 76 3a a9 49 92 90 8e cf 18 55 06 45 4f 71 92 43 91 e1 6a ca e6 53 d0 5d 94 cf 71 80 c3 6e 3a e8 c7 f3 85 94 de bd 0b fd 31 7a 4e Data Ascii: ]-rqgz-JRI@BN+;2&th^t}FDi4p*YTfGz"7ts('a2w[E}^bHPHMq>/C5[;['w)w-&bul=CK{n]EoZv:IUEOqCjS]qn:1zN
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 6e b9 80 86 d7 c4 12 8a 0f 8c 9e 58 c8 af 7e 18 0b 0d ac 76 2c 50 80 82 b7 ec d4 a4 5d 08 13 7d 50 c3 d9 75 7e b0 91 b8 2b bd bb bc c1 97 69 69 b3 f1 bf 1c b4 a2 0e 99 73 65 2d a7 e7 46 7f 91 d0 e8 2d 71 f3 e5 05 ff d0 c0 22 b6 ec 75 bf f1 28 52 5e 9e 9f 41 0d aa 3b 1d 26 8a 0d 35 e1 86 80 d0 ba 17 7e 64 75 a0 1f 19 7e c8 cc ce 50 e5 78 b4 11 69 2b 50 c8 1c 43 c7 0d 19 b5 e7 b1 a9 33 a4 73 32 f8 76 b9 4f a8 7b d8 4d 1c e4 f8 79 c8 73 ca 8d f3 24 cc d4 3a 6d b6 75 12 02 76 06 8a 66 3e 33 3b 33 fe 4a ff 9c c5 4e 0a 9f 13 b2 da d7 45 6c 90 dc 6f 41 04 34 16 68 8f a4 3b 41 fb 30 2d 1b 58 4e f3 15 5a a7 51 9f 5f 43 89 42 af dd 0f 99 30 c4 c8 e0 a1 8a 0f a6 ad 6a ed 59 64 b8 f8 e5 9d 99 b5 39 fc 65 fa 0f db 38 ca 72 da 92 bc bd 9e c8 0e bd 8b f1 0f 6b d9 e2 29 Data Ascii: nX~v,P]}Pu~+iise-F-q"u(R^A;&5~du~Pxi+PC3s2vO{Mys$:muvf>3;3JNEloA4h;A0-XNZQ_CB0jYd9e8rk)
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: ac 55 48 26 de 46 c3 6d 67 f5 15 19 e4 7a a9 e5 81 10 9f 29 9a 1b be 43 9d a6 de 1d c6 94 03 c3 b3 77 ef dc 3e d5 ef 50 15 ab d4 9a 62 47 ff d4 d6 5d 3b f7 e0 2f 9c fc 7b ee f4 a1 1f 00 87 df 1f 4c 8f 99 db e2 bd f0 bf be 1d 7b d7 5f 58 e1 b9 b0 ff f8 dc 91 2d 4f 00 e1 33 47 30 a7 2e 8e 7d 3f f2 fd c5 2f eb de b6 5e ea 7b 63 dd 1b 97 3e b0 a2 b7 4f c3 17 77 5f de 12 15 35 48 1f bb 73 10 39 d0 7e e3 3e c1 f0 92 6f ca 70 07 f9 d9 10 15 00 31 a1 48 2c 0b 91 aa a6 59 1a 72 cb 10 85 87 10 18 35 26 1d dc bb 23 26 55 dd 6a 74 06 6a fd 1e 6a 84 a9 c4 33 c1 d0 b6 a3 50 c2 c0 b1 cc 45 8b 30 58 21 93 92 ec 98 6a 80 24 3c 3f 06 fc 26 25 83 29 0b 48 c5 cd 11 4b 36 4f cb 62 09 34 3c 9e c0 e1 9e 8d 8d 49 8b de 4e 67 72 de 30 a8 fb 53 2c 93 ab e6 0b b8 6a 26 f6 66 d7 20 Data Ascii: UH&Fmgz)Cw>PbG];/{L{_X-O3G0.}?/^{c>Ow_5Hs9~>op1H,Yr5&#&Ujtjj3PE0X!j$<?&%)HK6Ob4<INgr0S,j&f
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 25 27 66 38 74 9e fd 19 f2 ed 04 aa 3a 3b 97 13 2d d5 3d 89 4f 86 27 ce 46 d4 e2 43 24 d6 22 8e a4 c8 42 a2 bf 93 bd 45 8f 4b c1 26 42 0f 73 2c 3f d3 f8 0a 1c 49 99 5d b5 ae 0c f1 1d 0c bf bc e7 2a 28 3d cb e0 80 5a f5 f7 7b 3c 43 d0 fd d5 40 ea e5 b5 69 c4 fb 46 2b 8b c9 d0 e8 14 20 1d 91 f7 36 34 83 15 c3 cc 72 7d 76 93 b5 ec 7e 7f fa c0 56 f4 d2 b9 eb 1a 22 e4 6a fe e4 0c ba 62 39 90 19 89 9e ec 97 4f de 48 69 0a 36 29 9a ed 11 8b b2 91 98 c9 1e c5 e4 31 64 b1 a7 18 59 5a e2 29 a1 e2 62 34 cd 2a 55 b3 46 a3 6a 22 b4 86 a6 9d 34 19 9a 91 55 7f ab ac 97 2b ea 95 ca 48 eb 15 4a a5 51 8e 20 cf 24 79 56 77 5f 9b 3a 3e a2 8d 89 61 cf 1c 9a 81 82 16 82 2f 83 c8 e8 97 6f bb 90 4f 2f 9f 9c 9b 39 38 43 88 89 31 7e b7 13 cc 42 42 12 52 e0 e9 fb b0 34 23 7e 47 4c Data Ascii: %'f8t:;-=O'FC$"BEK&Bs,?I](=Z{<C@iF+ 64r}v~V"jb9OHi6)1dYZ)b4UFj"4U+HJQ $yVw_:>a/oO/98C1~BBR4#~GL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50066	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	650	OUT	GET /hubfs/Avast/Academy/assets/o/f/700/MierB03-SubsetEng-Bold.woff2 HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.avast.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	1339	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: application/font-woff2 Content-Length: 20864 Connection: close CF-Ray: 85971c03484c9e17-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506695 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "e1b16cb4a3fed5dbfb5b2088f768b391" Last-Modified: Thu, 19 Oct 2023 13:59:46 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 00266a01055b9f1e1ad959f077c1d96a.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-67136795430,FD-21313634738,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-67136795430,FD-21313634738,P-4650993,FLS-ALL X-Amz-Cf-Id: fu0ILK2UowENQ0Y-34ZcPHGt3B3KnEngwLPM9_jv1odL_CSi2wfGJQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: 7YSyQkjUH1DhDCbRhpAcjOPamK0kxx1z425xQTJV4B+gO3CNBbKrlj1c4Pp5SYNVxe/qgczVhmB55yLaeyZTPqymIItebfd92Nopxw9pIvg= x-amz-meta-cache-tag: F-67136795430,FD-21313634738,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1645801935212 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: V7YYE1TS5H9VG846 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: YujzhjuYV2M6pIg7UdQOiUKl.mzume5Q
2024-02-22 12:07:33 UTC	999	IN	Data Raw: 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 4f 56 74 51 47 77 4b 6d 50 34 56 4c 32 65 57 4e 5a 43 70 5a 75 61 64 72 62 49 64 58 59 55 69 51 33 4c Data Ascii: X-Cache: RefreshHit from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=OVtQGwKmP4VL2eWNZCpZuadrbIdXYUiQ3L
2024-02-22 12:07:33 UTC	400	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 51 80 00 11 00 00 00 00 d8 a0 00 00 51 1e 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 5c 1b fe 46 1c 82 28 06 60 00 85 34 08 81 76 09 9c 0c 11 08 0a 81 eb 1c 81 d0 1d 01 36 02 24 03 88 14 0b 84 0c 00 04 20 05 8c 44 07 20 0c 81 7a 1b f0 c7 37 d0 db e6 45 09 b7 0d a0 02 9c bc f2 7f 38 b3 11 36 6c 1c 6c a3 c1 bc d6 d9 88 d8 e3 00 4c bb 74 f6 ff ff 9f 90 9c c8 18 e3 0a ec 79 55 2b a8 1a 89 c3 cc db 5c 9b 85 4a 93 c5 66 36 3e 47 1a 5d 3a ad d9 65 9d c7 75 cc 92 e3 16 ae 46 63 f9 54 0e a8 e6 61 1f ac c1 19 b3 69 b3 d8 41 96 8d 18 6f 77 69 d1 f9 c5 8b 03 0f ce 45 af 01 f1 39 ec f1 9e 44 3d ef e2 6f c9 67 3c d4 1e bf 69 f0 e0 aa fe 19 22 29 aa aa 52 89 82 70 6f 93 b1 c5 ec 81 30 ed 61 ed fc 64 ee 7b Data Ascii: wOF2QQB\F(`4v6$ D z7E86llLtyU+\Jf6>G]:euFcTaiAowiE9D=og<i")Rpo0ad{
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: d1 35 0b 05 ed 4f 8a c3 8a b5 6b 16 5d 46 d5 22 43 96 99 7f 5e 9d bd b1 a3 73 0c 8a 85 06 14 d8 71 1c c0 23 d2 27 1e 61 ee b0 75 fe d3 dc 61 02 cc a5 af 53 3a 35 6b 86 b1 7b 57 a2 95 37 1a b6 00 41 99 dd 86 15 22 39 3d 2b 6e 1c 50 2e 52 40 4e 58 b9 4a ae fd 06 7d 04 61 bd 62 ea 7d e1 0b 47 73 9a d8 82 1c 01 18 59 90 53 76 b1 9b 0d 60 89 f1 f2 3f 40 db 6c 81 be c1 30 70 36 0a 36 25 2d 51 c7 71 44 09 7d 22 02 02 26 a1 a2 18 a8 60 c5 e6 c2 95 3a f7 73 eb cf d4 8f ea ed 7b 91 ff bd ff f6 bf b7 95 ef 39 e7 de fb de eb ee 99 25 9a 95 64 90 3e 49 1f 08 35 e2 fa d5 bf 4d 03 0b b3 6d a2 d0 35 c9 ae 81 a3 8c b0 72 57 ee 2c 77 01 fc 43 ff fd 7e ba 81 1b 38 49 4a 40 c2 c9 6a 09 46 54 fe 37 eb 3f da d4 94 86 09 48 85 a7 fe 4e 06 15 28 70 25 99 5a 3e bb a4 5f 94 e2 8b Data Ascii: 5Ok]F"C^sq#'auaS:5k{W7A"9=+nP.R@NXJ}ab}GsYSv`?@l0p66%-QqD}"&`:s{9%d>I5Mm5rW,wC~8IJ@jFT7?HN(p%Z>_
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: df 85 ea 44 9c b4 52 fc 79 32 5a cd 21 4c e0 46 f5 a2 77 da 47 39 82 0b f5 d6 a9 69 a5 84 35 0d cc 14 cb 51 83 14 c6 08 4d 02 4a 92 24 da de ff 7c 3d dc 96 17 b6 d8 2c 78 26 1d 72 ee 69 de 7e fb f1 e3 ac 2a be 1b 41 8c 02 2f 7d 94 c6 34 98 e0 95 b5 27 15 94 c2 40 5a d1 b5 6e 69 c9 30 54 cc 72 16 c9 0c b0 87 4d 65 5a 7f aa 1b 09 4b 31 07 24 e9 7e 8c 97 40 dd a7 53 6c 1d ee 4a b2 02 58 c3 4a 05 9a 60 a1 ec 85 37 75 ea 49 95 28 2d 43 b5 68 77 f3 8d 49 04 4a 32 28 5e aa 2f b6 c4 51 67 c4 f2 b9 c8 52 6d bb 2b ad 74 e1 74 46 c5 b6 bb 04 a8 20 63 b5 55 48 dd db 8d ef f8 f4 62 21 84 87 d9 ce 73 ef a4 a3 13 14 ff b6 2b 27 d6 67 5e dc 49 b9 21 b1 f0 52 64 8e 8c b7 45 f0 0a f6 2d 83 17 5e 70 1e 36 5e 8b 9a 29 00 24 bd f4 b2 a7 86 40 f4 e5 70 cb 00 e1 b5 d7 d3 e7 22 Data Ascii: DRy2Z!LFwG9i5QMJ$\|=,x&ri~*A/}4'@Zni0TrMeZK1$~@SlJXJ`7uI(-ChwIJ2(^/QgRm+ttF cUHb!s+'g^I!RdE-^p6^)$@p"
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: e0 dd 44 a2 6d e3 7f 1a 10 74 0d f1 c7 34 d0 25 eb 0f 15 87 f6 49 8d 51 fc 4d 01 d3 12 05 c0 0e 95 40 f8 c5 0a ed 96 35 ca 53 2f ae 93 1f fc 3a 1e eb c0 b4 d3 65 27 0f 8b e6 b8 52 8b 33 75 df 3d 31 d7 63 2b dc 2c b0 cf 78 6c c8 e0 86 e4 1e 92 b5 e1 75 8a d1 a8 ee 8a 6b a5 c0 a6 e9 f5 f4 79 6b 30 f5 68 39 14 b7 c1 15 fa 54 55 b6 9b 05 10 17 52 63 c2 7d e0 b2 f0 64 32 06 bd 00 fc 5e 84 4c 0c 66 55 b0 7a cc 62 0a c3 47 2a 78 b8 95 5e 62 77 8d 5d db 31 4d 1f 05 97 4c b0 8a 34 30 a8 53 b7 c6 c8 40 b3 dc 95 63 7a a9 9a 7c 43 52 68 85 34 57 de ca 91 df 5c cb 5f fd 11 79 30 ec da b1 0f 39 07 f2 f2 6b f4 48 2e a7 a2 35 77 c3 0e 6b 98 91 9d f4 90 75 69 1a 32 90 53 6a 41 cf c8 9f 89 43 4b 73 32 b3 66 1e 5e 94 57 54 56 55 d7 d4 d6 d5 37 cc 5f b0 68 f1 ae dd 7b ce 3a Data Ascii: Dmt4%IQM@5S/:e'R3u=1c+,xlukyk0h9TURc}d2^LfUzbG*x^bw]1ML40S@cz\|CRh4W\_y09kH.5wkui2SjACKs2f^WTVU7_h{:
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 01 05 10 d8 84 44 24 10 56 e6 ed 8f 80 6d 05 49 79 82 5e 4a cd 07 df 7f 8f ca 80 ff d0 a3 12 2c be 09 04 a1 45 fb f0 33 d9 c9 64 9b 50 40 b1 e9 11 90 20 88 18 08 10 08 26 11 8c 40 c2 88 16 b7 80 7b cf b9 ee 7a 09 1e d8 58 1a c6 47 fe 8b 35 d3 b9 08 89 20 69 f5 06 23 57 98 01 b3 09 b6 80 b1 42 72 5a fb b2 b0 bd fc 57 0e 16 7b e1 50 b1 a0 34 e1 6d 39 81 9f 5d 3e 69 10 60 fa 60 c0 0c 21 00 0b 80 20 7a 64 9d 75 63 20 5b 54 17 70 19 fc 07 2d 77 1a e0 05 e8 76 34 22 00 d8 f2 29 f0 2c 50 00 5c 74 e5 72 09 3c f1 fe 53 fc 6e 28 b8 b3 0e 84 04 c8 4e 00 e4 17 75 03 07 23 81 02 0b d8 1d 01 01 bb 23 bb 08 78 58 0c 86 30 3c a1 1c 92 f4 d4 df 4c 69 d6 d9 6c 9b 5d f6 bb ee 7b aa 7a bc 77 17 49 70 09 f1 92 2d cd f2 59 c6 95 b0 72 57 cd 5a bd dc eb c0 c1 52 99 cb 5a 6a d9 Data Ascii: D$VmIy^J,E3dP@ &@{zXG5 i#WBrZW{P4m9]>i``! zduc [Tp-wv4"),P\tr<Sn(Nu##xX0<Lil]{zwIp-YrWZRZj
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 4f 91 93 cd d8 c8 84 99 32 33 66 ce 2c 98 25 b3 62 ae 31 6b 4c cd c0 26 d0 38 2b d9 ca 8d 6c 15 8c e4 1d e1 c0 13 d1 1a c2 35 be 8d 29 12 63 a4 bb bf 5e 76 00 cc 60 c9 8c a4 4d 89 ea c5 b7 da 46 72 b2 ab 1f 33 a5 34 b6 0b b6 e3 71 a7 5b b4 2e 4c c2 03 95 50 ec a9 a6 84 f6 81 7d e0 29 d7 bd 07 d8 20 55 76 97 3b 3a 19 7c 60 dd 19 d1 f8 07 00 20 fd 52 36 cb be d6 e5 7c bd 1c 02 0d 66 bc 77 11 37 0d 1d 86 8e e0 ae 36 db 2e 1d 77 8b 93 45 ad 77 fc 09 8a 90 c7 0e a7 53 c4 34 50 86 de e5 cf fb c9 8d 24 84 5d 83 b8 e3 93 af c7 ca 85 4b 3d 91 7b 0a a2 f1 dd 7c 24 94 3f 59 97 85 4b 90 45 c6 ec ef e5 cd 04 34 f9 f8 b6 9a b3 36 b8 a9 e2 34 89 49 99 02 bf c1 93 f1 c5 65 d8 57 76 61 64 d6 91 7c a1 a3 1e 65 b3 9e c8 53 ea b8 4c a7 bd 1a fa aa 1d 91 4e 4f 48 73 28 c6 4e Data Ascii: O23f,%b1kL&8+l5)c^v`MFr34q[.LP}) Uv;:\|` R6\|fw76.wEwS4P$]K={\|$?YKE464IeWvad\|eSLNOHs(N
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: 7a 5b e4 d8 35 02 a0 ff 76 a7 a8 af 3e ce 2b c7 8c 38 35 16 53 e4 8a b3 16 28 46 94 95 8f 8a 93 8b 26 7f 27 de 13 e0 13 23 1c 4a 90 f1 c5 de 76 82 06 be 96 2f 25 75 28 18 5e 8f 1e 44 82 18 15 43 e5 f1 7c 22 c6 49 ac 10 26 7f 5f 67 5c 19 e0 76 c4 8a 86 94 02 63 89 5e a9 1e 6a 5f c5 79 25 4a e7 ae b5 f3 2f 44 f5 ac 2c dd 29 f3 58 06 45 e9 7b 89 54 e2 61 3d f4 04 cb b1 25 51 4c 41 5c 88 36 bf d1 c9 f7 43 a6 b7 18 8b 39 4e 9e 4b 5d 17 4a 09 8c 15 75 8e e3 9d 0d 8e b5 a8 70 c2 7e a2 68 2e 1e 77 78 83 fd 9b dd 2a f3 16 9e 85 b5 be f4 55 e4 91 6d 25 82 89 13 8e d8 6d 14 fe e3 f1 e6 0e 8f 3b 61 bc 77 5e 32 b5 9b 32 cb e9 4c 3c 6f cc 7c f6 39 21 05 4b 09 a1 94 a3 fe 28 3c 57 f3 68 55 44 55 a9 bb ce 7d 38 d1 55 d8 04 2e 3b a1 97 d6 6b 5a 48 46 f3 6e 5a 3d 66 9d f2 Data Ascii: z[5v>+85S(F&'#Jv/%u(^DC\|"I&_g\vc^j_y%J/D,)XE{Ta=%QLA\6C9NK]Jup~h.wx*Um%m;aw^22L<o\|9!K(<WhUDU}8U.;kZHFnZ=f
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: de 4e ed 21 bc 13 95 d8 b6 d7 f2 b0 69 f2 eb 27 75 58 25 f5 bd bc 49 37 4d 4d 69 61 30 83 e4 34 fa 2e c5 71 67 1c d1 18 cd 77 6e 83 a5 1a b1 8a 09 e9 44 3d 75 58 f1 a3 81 30 04 d7 2a 06 0b 9a 79 14 4f 9f 4a b7 0f 88 11 03 44 8f be df bc 9f c2 cb f7 4d 6e 51 9d 1a af 38 85 fd bd cb 44 d4 a5 71 9f da e4 56 91 f9 dd ba dc 6c d7 76 3f 96 eb 95 44 76 bd c1 6e 31 05 e5 5b a0 6c fe 7d 81 5e de b1 b9 ee 7c 6d bf 94 26 cd 08 3c b8 52 6d 7a f3 32 fc c8 2a f4 63 b6 63 24 5e aa 49 5c f5 01 fb be 08 da ff ce 8b bb 21 00 6c c2 64 d0 b6 3b 25 d9 e5 08 e4 b8 33 d3 54 89 4a ff 4e 9a 93 77 ad ab de dc 7e 1b b1 e7 84 15 45 86 62 f5 2d ca 51 09 17 55 bc 21 31 b6 6e 37 72 6c bd c5 7b 5a b1 14 3a 6b 9d b5 f8 80 81 84 b6 37 c7 39 8f a8 bd c6 1a ff c5 b2 bf 57 0e d0 d6 ad 74 5c Data Ascii: N!i'uX%I7MMia04.qgwnD=uX0yOJDMnQ8DqVlv?Dvn1[l}^\|m&<Rmz2cc$^I\!ld;%3TJNw~Eb-QU!1n7rl{Z:k79Wt\
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: a5 14 91 47 c0 0e c4 20 1e 20 67 30 85 72 1e 4f 24 67 32 c4 f2 73 9c f5 78 16 41 5d 45 d6 d9 bd 75 b4 78 3e 7d 4f 05 fe 4e 6a 66 5c f3 28 18 8f c6 37 e2 e7 e3 92 e9 9c 52 be 1b 47 ee 5d 1c 7a 00 49 fc 92 f2 71 fc 5b 5f bd b3 f1 b1 da 69 4e 9f 7d f9 c0 33 1f bf 9b 70 6c fd 97 32 ce fa 61 0e 72 72 bc d8 a5 ab 72 54 a3 a9 a9 b6 4a 4d f9 00 cf f7 72 b7 90 34 04 1a 4b 41 f9 0d d2 53 e9 3a b8 d1 1c b9 72 1d ad d5 24 d8 22 d6 2e a8 b3 7b ec 2d 85 37 8c 50 57 37 1f 92 85 f9 d8 64 d4 43 e1 84 0c 8a df a3 ae 98 1e 90 d7 b2 39 50 2d 20 81 74 1c b6 5c 27 29 af 30 11 9d 49 41 40 6d 8d 9f 8a c8 b6 0c 5b 2a 88 80 6f d1 a4 11 49 0c d6 13 d7 65 1c 2b ec 34 9b fc 8b 03 5b a5 91 53 71 c4 7f ca 26 8d 10 30 5a 4f c7 bf 28 8d fb 39 e7 7a 75 5b 72 a5 44 7c ee a3 51 6f 49 32 13 Data Ascii: G g0rO$g2sxA]Eux>}ONjf\(7RG]zIq[_iN}3pl2arrrTJMr4KAS:r$".{-7PW7dC9P- t\')0IA@m[*oIe+4[Sq&0ZO(9zu[rD\|QoI2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50070	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	1337	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger=navigation-source Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:33 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:33 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"9280082690811707641","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50069	142.250.65.194	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	1366	OUT	GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:33 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:33 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:33 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-22 12:07:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50068	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	1355	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:34 UTC	1219	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:33 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://4711400.fls.doubleclick.net/activityi;dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50077	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2933	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:33 UTC	1338	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/webp Content-Length: 1560 Connection: close CF-Ray: 85971c04ddfa17e1-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 671665 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="AV-Test-Top-product-icon.webp" ETag: "b9ec31f25d243816b9b40fbe06bba666" Last-Modified: Mon, 02 May 2022 10:43:06 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 5773f2f43b989a9f02f459e75620d5f4.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=2376 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: kNrmmN9_DRXHmD_ofyIY6NDSV1dKq65Pl1BwspRqv825xVqvxeJkZA== X-Amz-Cf-Pop: JFK52-P1 x-amz-id-2: qrjn6bvaRiP0UVSzvCaCEtweYTITIcOwdqjGSKgTAAQh8OY1LkhHsUbRT6fWxKG3JoXp70YFnVofV18Mei1sPA== x-amz-meta-cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651058867058 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: DD9PH0S8C33FXDJ9 x-amz-server-side-encryption: AES256
2024-02-22 12:07:33 UTC	631	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 5a 61 7a 38 47 6a 43 4b 6f 6f 6a 73 66 71 64 61 71 50 49 44 68 51 51 71 6b 6c 4e 48 6f 66 6c 32 0d 0a 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 Data Ascii: x-amz-version-id: Zaz8GjCKoojsfqdaqPIDhQQqklNHofl2X-Cache: RefreshHit from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allRe
2024-02-22 12:07:33 UTC	769	IN	Data Raw: 52 49 46 46 10 06 00 00 57 45 42 50 56 50 38 4c 03 06 00 00 2f 55 40 0a 10 27 e5 20 92 24 45 aa 3e e6 f3 6f f3 1e 67 a9 6d 38 6e 24 49 91 a2 8f 61 e1 9e 7b fe db c7 cc 05 b1 91 24 45 52 d4 31 2d f8 6f e6 c1 cf 82 7e 9a 41 24 5b 41 96 04 3c 1a 7c 1a d1 8c 28 68 23 23 d8 80 00 4e dd df ae 7b fe 6f 04 dd bb ee 7f 25 50 7c 4e 8d d1 ac fe a7 ae 66 65 a0 08 71 2e 46 fd af 0c 14 8a 74 2e e5 b7 b2 42 91 2f c5 c8 bf 05 21 df 0b 21 7d 17 04 aa 94 3b 46 7a 2f 50 08 e5 49 bc 16 06 8a 50 5e 10 e2 b9 40 31 10 ed 5d 08 ff 47 63 b4 0f ff 5b 63 f8 8b f1 bb 36 04 ff f9 5e 1a 82 41 88 f3 36 20 d8 52 1c 22 29 49 6f 04 bd 41 20 92 6b 4a 14 04 92 1d e7 68 5f b5 f9 df b5 d9 18 69 f8 53 9b 5d 69 36 69 f8 89 e1 4f 6c 7f d2 f0 63 d4 66 57 9b 1d 7c 92 bf e9 a5 e4 69 e9 ef 3d 9d 8f Data Ascii: RIFFWEBPVP8L/U@' $E>ogm8n$Ia{$ER1-o~A$[A<\|(h##N{o%P\|Nfeq.Ft.B/!!};Fz/PIP^@1]Gc[c6^A6 R")IoA kJh_iS]i6iOlcfW\|i=
2024-02-22 12:07:33 UTC	791	IN	Data Raw: 77 85 f7 1f 15 58 6c bb 6e 08 9d bb a9 a5 6e 44 46 d3 80 2c f3 01 1c cd 47 d4 12 43 14 e5 01 61 7c ca 64 00 eb 29 a2 a6 82 27 50 fd 50 e9 12 17 4e 30 5a b8 0c 00 28 05 00 20 8d b8 3e 80 b8 de 63 f0 92 53 39 3e 8c a2 70 8c 99 54 89 61 02 94 9b 50 8e 1b ca 8d 72 13 60 ad ca 62 d7 57 f4 e4 87 56 e6 0d 4a f6 f7 5a 6a d7 81 7d cc da ce 2c 34 d9 be 5d e1 7d 0c a9 a2 06 f4 d4 1d 0e ea ce 4a c9 be 7d 04 78 a6 b9 ab 1d 62 21 cd 1e 66 46 d8 fa 03 43 7b 8a 90 82 a5 d9 75 96 0f b3 d2 81 53 be 68 42 f9 22 af 7b e5 a9 3d 86 16 83 f5 45 16 0b 69 85 99 0f 03 ca 49 f6 51 ba c7 f9 74 88 75 ea 57 c6 3a 5a d4 c4 0c 0d 23 da e1 83 2d e4 de bf ce 48 57 a1 4f 70 9c ad d7 d9 d3 8e 35 96 de ee 9e 60 3d bb e6 05 e7 88 26 b3 dc af fd a7 b7 cb ca db d7 06 da 11 8d 70 67 0d 2d 6f 92 Data Ascii: wXlnnDF,GCa\|d)'PPN0Z( >cS9>pTaPr`bWVJZj},4]}J}xb!fFC{uShB"{=EiIQtuW:Z#-HWOp5`=&pg-o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50076	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2654	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/arrow.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:33 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/svg+xml Content-Length: 272 Connection: close CF-Ray: 85971c04cdf017e1-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506767 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "72b10ea8b9be2e07f04bfe67cea21e99" Last-Modified: Thu, 19 Oct 2023 13:56:46 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 7bf47dc1c691ee43f7c8db83aa03a3cc.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: 5RQIfGm-ZYlb2uLC-yA0sgQ3zmxaoPbO_cbBuAOT9TX-Y0SSmnPIzg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: FlsZpdIVmjMyquj+w1mwQXk86vuntOyFAE4EdO+38GojRNIe6C6L4tuEi177MpXyCbGGrD2qz28= x-amz-meta-cache-tag: F-51328566147,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1626958981556 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: V7YPA1CTBMKCBVB2 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Howqd8PjzYS5POG0YWF3u77pIV0i.rEt X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:33 UTC	546	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 36 77 67 30 6a 51 4f 63 79 62 54 38 62 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wg0jQOcybT8b
2024-02-22 12:07:33 UTC	272	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 30 22 20 68 65 69 67 68 74 3d 22 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 20 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 39 20 31 4c 35 2e 34 37 30 34 33 20 34 2e 34 34 31 33 34 43 35 2e 31 35 34 30 31 20 34 2e 37 34 39 38 35 20 34 2e 36 34 37 33 37 20 34 2e 37 34 33 33 35 20 34 2e 33 33 38 39 36 20 34 2e 34 32 36 38 33 4c 31 20 31 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 44 32 42 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 Data Ascii: <svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#071D2B" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50078	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2931	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:33 UTC	1325	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/webp Content-Length: 2910 Connection: close CF-Ray: 85971c04ff5f8cdc-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 1760361 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="PC-editors-choice-icon.webp" ETag: "5c90960290145851dc3d17bdf94b91fa" Last-Modified: Thu, 05 May 2022 10:21:41 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 a0be26685e47d6d6220ccd40bc5f0a4e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3877 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: E-Vad9BLznuY88pQfcrTBNUylw3t758yQXL5UDRvK9Tyc1YIja4fRg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: Vsc4bxL1sveyBiUZ+CjYX/aia0n6KNc1NsZMVNu+wLW2R8A6H6rB1hR8lHqbfK2kcBYq/HMkr9I= x-amz-meta-cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651495281049 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: VRVW4M6HFZ86ZQE2 x-amz-server-side-encryption: AES256
2024-02-22 12:07:33 UTC	635	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 7a 31 77 67 67 54 56 6e 47 52 68 71 35 37 73 39 63 75 53 67 4e 35 44 57 67 59 43 41 6f 68 53 6f 0d 0a 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 Data Ascii: x-amz-version-id: z1wggTVnGRhq57s9cuSgN5DWgYCAohSoX-Cache: RefreshHit from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allRe
2024-02-22 12:07:33 UTC	778	IN	Data Raw: 52 49 46 46 56 0b 00 00 57 45 42 50 56 50 38 4c 49 0b 00 00 2f 6f 40 09 10 55 87 82 b6 6d 18 87 3f ec 1d 0c 11 31 01 ca bb ef e2 93 9e 54 86 82 9c da b6 1e bd 51 a7 a5 32 c7 99 fb 46 89 40 ce a1 52 9b b3 28 08 4c 46 20 55 82 a0 3a 97 42 21 00 aa 72 9a f9 de 84 f5 a9 7f 14 c4 1f 84 5a d1 30 0b 63 8a b0 0c c2 b4 bf d6 5c dc 9b cd cf 43 a0 0c 6e 60 18 8b 59 18 81 01 d8 14 cd e3 19 8b 29 39 ad b6 6d 59 be df 25 ff 3b d0 2c 33 c1 9f fe 05 b0 51 98 c0 3d 52 5d 9a eb fb be 9f e0 16 99 05 07 6e db 46 92 d7 db c4 9a 7b e6 ff 8f 0d 1c db b6 4d 4b 9f 91 6d a6 3f 36 ab 1f b6 2b b7 6d db ae 26 b0 03 ec 81 ed c8 ae 35 01 74 a3 ed 5f 6d 2b 85 5c 77 77 77 77 77 77 c7 dd dd dd 9d 83 bb bb bb bb bb bb bb bb 2e 39 07 e9 40 43 e6 c6 b8 47 56 c2 dd 43 05 a4 96 b9 46 44 c4 27 Data Ascii: RIFFVWEBPVP8LI/o@Um?1TQ2F@R(LF U:B!rZ0c\Cn`Y)9mY%;,3Q=R]nF{MKm?6+m&5t_m+\wwwwww.9@CGVCFD'
2024-02-22 12:07:33 UTC	1369	IN	Data Raw: d4 ab 5a 0d b9 a5 8c 9f 95 02 90 b2 c9 45 2e d7 89 25 db 1c 05 9e 2b 00 31 56 97 cb 75 a2 3a 35 79 25 ca ef 72 f1 69 27 3d 6c 87 83 53 55 3a f1 dd 08 e5 4b 60 0f 46 80 85 e8 51 85 36 a8 79 fc c9 64 b2 80 f3 96 8a f3 83 5a c0 9d ac 6d c8 91 51 ac ae 00 be 57 43 a5 7a e0 f4 62 9b 24 9f 4c 46 24 93 35 47 b8 a8 7d 46 46 65 33 a5 d0 2c 91 66 09 47 94 47 b2 2c 7e 3d 58 fa fc ea 11 40 b2 16 70 08 6d c2 94 56 9d 61 e1 7b 0b 0d 17 c5 f9 bb 7d 00 2d 61 71 7c b5 ed 93 e2 5a 1b 96 0b 46 c3 3e df 76 32 d6 3a fc 5c 9d c6 ce c3 2a 95 dd 49 73 50 80 45 2b 1d 5d 6f ae 69 6e 15 c5 dc 1e f7 96 21 2a 95 f6 ee 5e 6d 12 04 b7 87 51 2a ad 7c bc f0 23 69 17 44 9b 30 92 e9 b4 fd db b5 f5 f4 22 0d a6 11 c6 09 a9 35 1a 2a fd c3 1c dc ec 31 d1 7b a6 65 0c f5 f2 ce ee fd ba 3a d9 f6 Data Ascii: ZE.%+1Vu:5y%ri'=lSU:K`FQ6ydZmQWCzb$LF$5G}FFe3,fGG,~=X@pmVa{}-aq\|ZF>v2:\IsPE+]oin!^mQ\|#iD0"51{e:
2024-02-22 12:07:33 UTC	763	IN	Data Raw: 04 8e ad c2 8d 04 1c 37 51 d6 79 e6 33 65 82 04 09 e6 22 13 dc 29 ac ca e2 ec 7c a9 32 13 8c ee ca 70 95 10 72 32 3c 68 d1 45 df 8a d6 17 5d e1 c4 7f 03 56 ba 18 0a 8a b2 a9 a9 a9 e9 71 6c 30 21 f4 78 2a b0 6b 12 0d 69 be bb c1 f3 6e c1 75 29 95 e9 2a 91 4b 13 62 6a 9c 5c ee 9e 7b 46 eb 1d 32 41 a6 c5 a6 dc 52 61 09 3f 62 2a 2c 0c 06 f2 8f 56 fb 40 65 58 3e 3c fe 71 7e 16 bb 0f ef 23 6b 6f 9f ae 00 ec 7f 31 19 9b f9 7f 71 e3 c6 f5 28 28 53 71 9e ad a7 3a bc e9 7f 06 12 78 0c 70 86 51 88 a9 2a 00 6d d0 99 30 3e 01 30 0c 99 20 e9 5c 71 7c af 16 80 fd bb f7 92 10 76 d4 60 f8 5f 32 35 4e 3d d7 27 0b e0 ff 30 e3 65 d8 7c 5a e8 1e 90 3f 8f ce 24 31 75 b2 2c 48 ae c3 34 41 be f1 5e 31 cd ba 99 a9 1d 30 99 16 0f 2f a4 5d 6d 61 70 9d 38 cd 96 69 89 eb e3 8a 0a 0f Data Ascii: 7Qy3e")\|2pr2<hE]Vql0!xkinu)Kbj\{F2ARa?b,V@eX><q~#ko1q((Sq:xpQm0>0 \q\|v`_25N='0e\|Z?$1u,H4A^10/]map8i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50075	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2949	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/arrow-blue.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A06%3A55+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F&ld=djh"; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=EZ52tch1rAAigmCOhQYTYQXXrAIymadr6DJQW1if4SQ-1708603652-1.0-AUbFgt8DFECnG+b6wS8rScsDpzUdLf3DPgaK7AXsalhVRQOV4+V/3/7EvGbQmiycYvVkxcidTMmW0VcXfWf3t/w=
2024-02-22 12:07:34 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Content-Type: image/svg+xml Content-Length: 272 Connection: close CF-Ray: 85971c0528f04310-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506695 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "5ad7a6aa7f2d255641479f2f3fd8a213" Last-Modified: Thu, 19 Oct 2023 13:56:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c38cfac20df9757e670e782ca61768aa.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: Ifh_1mEX-zWBRDmvap90RQP2QIgwbeA0sdTMDEBC_UFBcCAuRHKFHg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: QdQp8cO4rM7B9NfBvAJOO53ssNWQ+dVOqv6as1gAG0G2bGCxTRfwUOGCTdn7v0B/AEvjWzljFBM= x-amz-meta-cache-tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1627032969357 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: E6Q00W832ZACK04Z x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: .JIH2m.PHBDiJgMI8RpBMziLU6THb4If X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:34 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 59 55 69 33 52 75 30 65 50 4e 56 25 32 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YUi3Ru0ePNV%2
2024-02-22 12:07:34 UTC	272	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 30 22 20 68 65 69 67 68 74 3d 22 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 20 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 39 20 31 4c 35 2e 34 37 30 34 33 20 34 2e 34 34 31 33 34 43 35 2e 31 35 34 30 31 20 34 2e 37 34 39 38 35 20 34 2e 36 34 37 33 37 20 34 2e 37 34 33 33 35 20 34 2e 33 33 38 39 36 20 34 2e 34 32 36 38 33 4c 31 20 31 22 20 73 74 72 6f 6b 65 3d 22 23 30 30 37 30 46 36 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 Data Ascii: <svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#0070F6" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50073	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	951	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A32%20GMT&n=-1&b=What%20Is%20a%20Computer%20Virus%3F%20%7C%20Computer%20Virus%20Definition%20%7C%20Avast&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
2024-02-22 12:07:33 UTC	909	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:33 GMT Expires: Thu, 22 Feb 2024 12:07:33 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:07:33 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-02-22 12:07:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50082	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	2946	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/quote-redesign.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.0.1708603615.0.0.0; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _ga=GA1.2.704409195.1708603609; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b
2024-02-22 12:07:34 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 872 Connection: close CF-Ray: 85971c05782c43e7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 499243 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "d3c6807718e415c9fe487ef1ed95df48" Last-Modified: Thu, 19 Oct 2023 13:57:01 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 86a640712a72b4264f1681744fa48612.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: wG2IymylWqftdJUpz-1tHixBidEFVOBphMcTHiCrd-CH9Z5hQKAr-w== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: wjBYPphqu8Jv0RerGvrgGwNbhbwb+arvoDsJpNER/5Oe0clvgPApSs42gBSxtHcEhSsucdp2Eqc= x-amz-meta-cache-tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1627479923876 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: VA45CR8YE0QNPQSS x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: N2IDK.MskiCf_wd0zn9bRegV.QAmqmk9 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:34 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 48 61 50 77 42 32 44 7a 53 36 6d 7a 31 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HaPwB2DzS6mz1
2024-02-22 12:07:34 UTC	872	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 31 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 31 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 33 20 31 31 2e 37 32 36 43 31 33 20 36 2e 38 30 33 35 31 20 31 36 2e 35 36 38 32 20 31 2e 36 36 33 37 36 20 32 32 2e 32 33 33 32 20 30 2e 31 37 37 30 34 34 43 32 32 2e 36 37 39 34 20 30 2e 30 35 39 39 35 35 39 20 32 33 2e 31 33 36 34 20 30 2e 32 39 35 36 34 36 20 32 33 2e 33 33 30 31 20 30 2e 37 31 34 32 35 32 4c 32 33 2e 35 33 32 31 20 31 2e 31 35 30 37 43 32 33 2e 37 37 36 32 20 31 2e 36 37 37 39 37 20 32 33 2e 35 31 36 32 20 32 2e 33 Data Ascii: <svg width="24" height="18" viewBox="0 0 24 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M13 11.726C13 6.80351 16.5682 1.66376 22.2332 0.177044C22.6794 0.0599559 23.1364 0.295646 23.3301 0.714252L23.5321 1.1507C23.7762 1.67797 23.5162 2.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50081	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:33 UTC	642	OUT	POST /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive Content-Length: 1487 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.avast.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:33 UTC	1487	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 38 31 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 30 38 36 30 33 36 35 32 35 37 31 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 69 64 22 3a 32 34 30 2c 22 76 65 72 73 69 6f 6e 5f 67 75 69 22 3a 22 32 30 32 33 2e 30 31 2e 31 33 22 2c 22 76 65 72 73 69 6f 6e 5f 61 70 70 22 3a 22 31 2e 30 2e 30 22 2c 22 65 64 69 74 69 6f 6e 22 3a 32 2c 22 69 70 6d 5f 70 72 6f 64 75 63 74 22 3a 6e 75 6c 6c 7d 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 7b 22 6f 73 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 73 65 63 63 68 75 61 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 Data Ascii: {"record":[{"event":{"type":81,"subtype":1,"time":1708603652571},"product":{"id":240,"version_gui":"2023.01.13","version_app":"1.0.0","edition":2,"ipm_product":null},"platform":{"os":0},"browser":{"secchua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
2024-02-22 12:07:34 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: application/json Content-Length: 19 Access-Control-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:34 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50083	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2978	OUT	GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/Academy-Computer-Virus.png?width=1320&name=Academy-Computer-Virus.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1251	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/webp Content-Length: 13336 Connection: close CF-Ray: 85971c074d747cfc-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfrXTrp2Hh_JPkVSTBE3YqndKG8A5jhgNnwO3kyzELDQ:a5c410ce574f68df077d03d147f26444" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront) cache-tag: F-83104191249,FD-83103412024,P-4650993,FLS-ALL cf-bgj: imgq:100,h2pri cf-resized: internal=ok/m q=0 n=191+129 c=0+0 v=2024.1.3 l=13336 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UID%2FArkhDVynQwMaLUNASfYD2K%2FiOBlIOrRF4G7Tgs4NSjbJBVipzFMK2%2FkC4q982KP%2BPGjZQKzi%2BQ%2FgH92%2Bz%2FQS9eiaPKahSEzCkCvsJX9nnMTRvU91C1Ox8X9tftbm1UuS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:34 UTC	118	IN	Data Raw: 52 49 46 46 10 34 00 00 57 45 42 50 56 50 38 4c 04 34 00 00 2f 27 05 96 10 ea 61 dc b6 91 23 c9 fd 77 3d b3 f1 c2 3b 22 26 80 d7 37 e3 53 aa e7 32 e1 4c 4e 16 66 f6 0b 28 03 4e aa c8 9d b6 5b 5c 47 76 b1 a6 d2 a6 9d 62 21 4c 36 d4 54 6a 7a 20 eb 25 97 02 d9 09 f7 ec e5 97 da 89 b6 4f 76 2f 07 89 d3 95 85 11 19 87 19 98 8b 69 38 dd f7 7d df f7 e5 2e 7f Data Ascii: RIFF4WEBPVP8L4/'a#w=;"&7S2LNf(N[\Gvb!L6Tjz %Ov/i8}.
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 49 dd c7 5f ab bf 40 38 06 c7 44 03 47 3a 2a 67 3a 50 8c c2 3c 9c 39 ed f6 96 f5 f1 86 e5 72 30 0b 43 30 80 fe 95 26 32 0e e3 18 48 0a 74 82 6b 80 03 c5 8b 4a 18 0c c0 00 1c ae 97 cc cd 75 12 a9 54 27 14 87 41 61 12 8e 9c 19 c1 90 90 a8 99 ca d6 a7 ba ca 10 0c c0 18 06 92 bc 71 50 13 49 52 94 5e 7a 7c 32 b0 84 18 52 e4 e0 03 03 78 69 57 11 00 90 55 a0 7d aa c5 02 2d c4 3a ac 89 6d db e6 b3 71 47 98 6d a4 36 8c c3 38 ff 4f 27 40 8f b3 fd af e5 5a ce 48 da 7b ef bd f7 de 7b ef fd 35 6d d8 f2 de b5 f7 25 ef bd f7 de 7b 43 79 ef bd f7 de 7b 69 f9 c5 12 ee de 97 c9 2b 33 85 6b 9a 13 50 74 33 46 94 19 83 06 41 a2 b2 c3 51 ec 98 41 45 1a c0 99 81 a0 98 01 81 3d 03 32 aa 93 54 ac a8 d9 42 05 25 77 80 35 00 06 07 20 65 26 c0 64 05 87 79 83 49 45 85 bb 23 99 01 f4 Data Ascii: I_@8DG:*g:P<9r0C0&2HtkJuT'AaqPIR^z\|2RxiWU}-:mqGm68O'@ZH{{5m%{Cy{i+3kPt3FAQAE=2TB%w5 e&dyIE#
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: e5 fa 5d e5 27 d8 88 e3 7e 80 a1 02 48 b0 c2 26 7b 00 86 ec c4 c7 3a 70 df 0d 04 f7 94 52 6f f8 2a df 84 f7 56 f1 ae 0e d0 33 59 f0 38 db 60 c7 3a 18 77 d8 8a 47 81 c7 b8 21 f3 42 a9 bb de e6 9d 2c e2 c9 cd 40 cf 64 a1 23 5a 60 c7 3a 40 3f 70 cc 56 3c 04 f7 d7 41 f0 46 a9 bb de c6 22 8e 87 80 9e c9 02 87 b7 bf 8e 75 80 de 78 13 6c b1 77 0c ea 5e 29 f5 86 3f c1 22 de 02 f4 4c 16 36 ae d6 d7 b1 0e d0 1b c7 5b 60 b3 bd 18 78 62 57 ee 99 52 3f ff 9d cc e2 5e a0 67 b2 90 71 71 b6 d7 b1 0e d0 1b c7 f1 5e 60 d2 de 0e 78 1c 93 f9 40 bd e1 57 e0 b6 59 dc 0b f4 4c 16 30 b6 b6 d7 e4 0e a0 37 36 ee 80 51 7b 80 f2 e7 1d cc e2 5e a0 a7 80 11 2d af c9 1e a0 37 36 7d ae d1 d5 30 64 6b 14 ea 3e 51 62 16 5f 05 0c c5 71 bc 77 57 ff d0 74 5a cc 5f 93 85 a9 e5 b5 19 e8 8d 4d Data Ascii: ]'~H&{:pRo*V3Y8`:wG!B,@d#Z`:@?pV<AF"uxlw^)?"L6[`xbWR?^gqq^`x@WYL076Q{^-76}0dk>Qb_qwWtZ_M
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: a4 a2 dd 41 96 88 cb 05 b4 6a 85 af 06 6b 0c ff c8 47 c0 75 f6 ce ae 81 85 6e 48 5b 28 6c e4 bd 56 6a cb a0 93 2d bd 83 b5 b8 f4 f0 4d c0 2e 5e db 3f b3 f0 c6 67 1d ae 85 19 af 4e c3 75 fe 3b 40 6f 23 67 a5 5d 42 54 e1 5e c0 7d 69 b9 86 a8 f6 b6 c6 4f af 6f b2 06 5e cd 7f 1a a1 b1 90 a8 b4 73 58 4a d7 01 32 69 79 0a 46 d6 b1 70 a8 5a ad 3e d8 68 71 bf 2f de f8 7b 10 23 48 2d c4 2b ed 3e ac a4 4b 81 5b 61 99 c3 d8 32 3e c4 86 c1 2a e6 f5 19 af 14 b0 d3 c1 4f 84 85 6e 69 0c 73 0b b9 2a 6d 0f 07 f1 0a 70 29 2c 53 58 59 c5 75 af 84 dd e9 9a 47 d3 b0 d6 de 75 c0 a2 57 f7 11 a7 81 c7 aa 9a ba 73 95 b8 b0 8f f7 39 70 4a 07 36 e2 35 82 87 7b 23 2f 07 8b d8 b9 16 e3 5b bc da ab bd f8 8c 45 3f f3 34 30 5d f3 66 0c 4e f7 d9 5a 03 55 e5 d5 3d 86 49 81 d3 6b 7d 77 80 Data Ascii: AjkGunH[(lVj-M.^?gNu;@o#g]BT^}iOo^sXJ2iyFpZ>hq/{#H-+>K[a2>Onismp),SXYuGuWs9pJ65{#/[E?40]fNZU=Ik}w
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: d1 32 d3 4b 53 c0 29 83 d6 ef 3e e4 d1 3a 5b fb a0 ae d4 a6 2b b5 e9 56 6c 76 f6 15 0c bc 6d a6 97 a6 80 53 26 fa 17 6c f2 8f 06 6e fa a5 da 74 69 0a 98 fa 9a ce 9b 53 17 81 b9 7d ba 60 70 b5 ce f4 d2 14 f0 bc be 0e 13 ad 7f e0 4d ae 0d c2 19 47 57 6a d3 7d 07 80 ad 4b 5a eb a5 75 fb b4 8f ad e7 e4 ec 33 bd 34 05 cc 1d 36 d1 fa f7 dd e4 d2 18 4c 39 d2 a6 a7 3a c0 56 bd 0a 5a 8f d8 68 fa dd 00 3a a3 66 5a ff be ab 5d 59 04 d6 b9 b1 74 11 e0 94 2e 40 44 2b ed 94 01 a6 d6 99 69 fd 0b fe cc 4d ce d4 20 4c b9 f0 1e 1d a0 b3 4f 17 22 a6 56 da 56 78 fa b6 f4 00 c0 c5 c3 66 5a eb b7 79 f7 ab 9d 8c 03 67 9c 1c 9e 03 b8 b8 a4 0b 12 7b 2b ed 00 bc c7 d2 e5 18 df ef 90 fe 77 b3 30 be cd ef 7b f9 4d 57 df 64 71 f5 63 8c 76 42 67 c9 de 56 80 ce 19 bd aa 5a 8f b3 d2 00 Data Ascii: 2KS)>:[+VlvmS&lntiS}`pMGWj}KZu346L9:VZh:fZ]Yt.@D+iM LO"VVxfZyg{+w0{MWdqcvBgVZ
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 77 54 e3 9c 88 e4 40 ee 42 aa 86 e0 e4 85 f5 e2 e1 6e 3d 87 94 07 4f b7 4b e6 ee 8e e2 66 06 54 02 69 43 6a 56 81 a3 2e a9 f9 6d 22 92 03 a5 28 ac 00 79 d9 46 18 d4 c8 1d d7 8b e7 b2 ae f0 74 c5 4e 27 c9 e0 9d 70 12 24 c9 4a 63 0d a0 12 88 7c 5a d6 d5 21 2c 8b 48 04 2c b8 a5 d4 79 91 f2 83 e6 da b0 99 96 ad d2 7c 20 1b 2f 13 9f 86 39 98 2e 0e 3a 6d d2 3f f2 ae 10 fb 8d 16 e6 69 20 72 5e cd 00 69 33 cb 81 01 e5 e1 f9 0c fb 25 1b d2 dd dc c9 3e f1 f1 ae 85 92 40 a7 4d 46 ef 32 7b 41 8a f9 3d 84 4a 1a 22 e7 95 aa 4d 63 59 1f f7 62 16 e0 fb fc db 28 4b 02 69 02 36 92 74 37 54 2d c4 e7 a1 06 52 44 4e 9b cc de b0 bd 36 10 56 80 e7 1d dc 24 72 6e 5e 29 55 3b 64 36 30 ae bc 1c 00 ba 04 b1 6c 41 c3 46 92 fa 46 7a 49 fe 3f 36 30 9a 02 a7 4d 66 6f 83 d8 8f a0 29 21 Data Ascii: wT@Bn=OKfTiCjV.m"(yFtN'p$Jc\|Z!,H,y\| /9.:m?i r^i3%>@MF2{A=J"McYb(Ki6t7T-RDN6V$rn^)U;d60lAFFzI?60Mfo)!
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: d3 4e 6a f1 e2 b0 72 c2 ab 10 20 0d 8a 67 7d 0e 22 88 6c ac 34 96 c2 7e 7f 89 24 70 4f e1 b2 30 0c 81 cc 95 46 8a 79 1a 88 9c 57 8b 00 ad b0 05 0c d4 dc 53 2b 20 1f 71 e7 12 2c c3 b0 05 04 76 4a b8 08 56 ee 28 1e 47 18 13 31 0f 12 db 41 71 ea 82 83 2e 01 d2 c4 22 49 61 40 f9 fa 05 a0 22 8f 52 29 82 65 2e ae b6 30 ff bf 2b 8d 89 9c 57 4a 2d 60 59 1f 57 1e ce 02 3c 55 eb fc 9b 79 eb ee 5c 16 91 a0 05 89 9d 54 a1 e5 0c 95 91 61 8f 12 8c 91 58 26 d8 4e 8a 53 1b 1c 94 71 ba df 5f e7 45 1e b1 5c c0 22 0c 5c 69 00 d1 fb 1b dd 09 7c a0 09 3d 22 e7 e6 95 52 6a bc 6a 52 1d 57 5e 56 81 44 2c 9b 10 d9 fa 80 13 b4 6c a0 72 41 bc 0d 52 43 45 8a 69 23 0e 24 73 b0 a0 fc 3d 21 0d e0 ce 49 92 04 e2 6e 02 15 c9 a1 25 22 2b 20 ca bc 36 bb b0 7f 51 79 0b 64 62 b9 d2 58 0a 6d Data Ascii: Njr g}"l4~$pO0FyWS+ q,vJV(G1Aq."Ia@"R)e.0+WJ-`YW<Uy\TaX&NSq_E\"\i\|="RjjRW^VD,lrARCEi#$s=!In%"+ 6QydbXm
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: e4 5f d3 7d 22 c6 1c 0e 39 53 83 58 d7 c7 dd 48 e0 d7 a7 40 25 28 c8 9c 61 52 2b 22 31 98 5b 55 b0 1d 36 9f bc 65 6e 92 24 81 48 90 b4 a3 d0 00 3c 40 ba f1 01 33 cc 90 14 43 46 86 9d 85 98 7e 9f 67 ef 5d 95 1a 1c 3f 46 f5 b8 94 2b f0 be 86 b7 89 9f 4b c0 8d 65 31 4f a0 ea 82 1a ab 9b 4d 8f 2b c7 2b 20 22 5d 02 e4 e5 1c 88 ec 04 9c 6c 60 b2 56 56 06 e4 d9 df 06 ee 74 bb 44 1c b7 f3 7b 89 92 63 be d2 58 31 24 77 72 57 41 c5 90 36 44 da 79 cb d9 ad 7f 3e 54 40 97 20 d6 6d 97 54 6d ec 50 b5 7a 74 bf 72 f1 88 48 0e 91 c8 6e 08 0b 32 1e 26 a5 22 dc 8c a0 24 22 b7 03 2a 81 33 91 e0 65 56 22 34 fc df 76 51 24 77 72 37 d2 68 56 c2 66 59 4c cb 59 14 56 2c c2 f0 2d 6f f5 20 0d 73 02 15 b1 d9 74 cb c3 eb 45 2a 90 88 e4 0e d6 38 b9 c2 24 29 fb 76 f0 7c 43 5a 44 44 32 Data Ascii: _}"9SXH@%(aR+"1[U6en$H<@3CF~g]?F+Ke1OM++ "]l`VVtD{cX1$wrWA6Dy>T@ mTmPztrHn2&"$"3eV"4vQ$wr7hVfYLYV,-o stE8$)v\|CZDD2
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 91 4b 9e d4 c6 aa d5 ea e0 82 3d a5 c6 67 06 ab 1f 6c 76 7f 22 29 24 45 37 7d 83 0b 91 01 c2 3b 8b c8 c4 f9 23 07 2d 6a 75 88 ac 5a 00 bb c5 dd 13 0d 54 3c ec 72 88 44 56 40 bc 58 a8 63 3a 3d 6e cf b8 4d a4 04 5d 42 f1 6d 64 d8 59 08 cf d6 ab 32 05 78 cb 2c 10 11 99 38 7e fd 76 e3 d3 cf ce 04 ca 16 40 65 a5 31 71 f9 8a 0c 95 2b ec 42 48 44 94 87 0b 58 d7 c7 1d 5d 12 89 20 2f be e9 0d ae 24 c1 2b 62 5a ca ca 62 b3 05 a1 55 1a 89 db 17 34 54 4e 0e 76 40 59 8e 7b 30 0b a4 5d 42 92 e4 c0 80 a3 65 91 04 c2 22 9c be e0 46 25 c7 66 2b 8c a2 c4 b8 fb 66 de 5a e0 85 e7 8f 8b 24 40 5e 16 b7 fb 74 61 45 80 52 2a 48 e4 7a 0f a6 a1 12 88 88 64 c0 82 93 79 93 56 31 4e df e0 24 c1 34 fd 29 cd 96 c1 e9 1b 65 ed 14 5e 43 5c 5f 3f 52 60 89 40 49 8a 2d 9b 6c 77 6f 11 28 8b Data Ascii: K=glv")$E7};#-juZT<rDV@Xc:=nM]BmdY2x,8~v@e1q+BHDX] /$+bZbU4TNv@Y{0]Be"F%f+fZ$@^taER*HzdyV1N$4)e^C\_?R`@I-lwo(
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: e4 85 4d b7 c5 4e 65 d3 45 ec e4 85 45 e7 c1 53 19 b7 97 5c ca 8f 90 fb 2f c3 bb 16 98 ef af eb 6d 23 7e d1 c6 dd 2f a8 df 04 a4 2a 3c b7 21 26 d0 fd 5a 18 8d ee e4 8a 4b 87 e8 c6 5c aa 7e 6f ee c4 b2 78 3a 3c 8a dc ad 1a 5d 2c 30 ba 1d 4b 6e ae 52 85 66 a3 9a 16 19 69 fe 9d 8f 3d 4d 72 dc 63 6b 50 62 d0 5a 79 f9 14 d9 f0 45 97 8b d7 18 3e 6f 23 53 9a 15 88 8d 78 8d e0 4c 58 e6 b0 10 af 05 cc 4d e9 50 14 ae e0 20 5e 77 70 29 2c df ed 27 8c c4 6b 04 a9 29 f9 a2 70 1f c6 d2 e5 81 44 58 1a 40 bc 80 c6 94 5c 51 bc 81 a5 74 6d 61 37 13 96 b2 87 ad 70 6d e1 f9 d2 90 df 6b 55 18 6a c0 0b 57 0b 47 71 29 60 24 5c 23 28 4c e9 5c 18 66 3b 58 c9 96 8f 70 26 2e 0d 70 10 ad 03 d0 98 d2 a6 38 9c c3 9d 17 ad 31 ec 66 e2 52 4e 21 78 c9 0a 30 2d 4d d9 17 87 24 83 85 64 7d Data Ascii: MNeEES\/m#~/*<!&ZK\~ox:<],0KnRfi=MrckPbZyE>o#SxLXMP ^wp),'k)pDX@\Qtma7pmkUjWGq)`$\#(L\f;Xp&.p81fRN!x0-M$d}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50084	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2914	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-01.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1368	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 1453 Connection: close CF-Ray: 85971c075af718bc-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 75153 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "66a0fa5dc355b1af8a02c5b6b15440dc" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5503b1530c5d4fe35fc0727878485b7c.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: t4xEp9fLrf4ccXDY0aRuMi02Suw167QbKZU2467_CKufVizWv5BW2g== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: M3/Ax/Ew0DLurT5GhRF22nxnQeshyxctoLzTZ83QnFetCbcZRoCeHB/GYy4H89Eyf1hN7vfO48U= x-amz-meta-cache-tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861391 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: DCM9FWDT27NV6SN6 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: 5YQ7OrSxz85bB4IDokC5EUKfcTHPr_v0 X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:34 UTC	499	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 69 4b 7a 55 67 43 25 32 46 6d 33 67 64 47 57 36 49 59 35 46 5a 52 6a 6c 73 52 5a 43 37 4a 6b 78 33 36 68 67 55 39 42 32 48 66 47 71 56 4c 4d 76 4b 48 6f 25 32 42 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iKzUgC%2Fm3gdGW6IY5FZRjlsRZC7Jkx36hgU9B2HfGqVLMvKHo%2B
2024-02-22 12:07:34 UTC	871	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 2e 32 30 33 32 2c 31 30 2e 32 39 32 34 56 32 38 2e 32 36 30 33 63 30 2c 31 2e 30 34 38 38 2c 2e 35 35 31 35 2c 31 2e 35 37 33 35 2c 31 2e 36 35 36 2c 31 2e 35 37 33 35 68 32 39 2e 38 39 30 37 63 31 2e 30 34 37 39 2c 30 2c 31 2e 35 37 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <g> <path d="M2.2032,10.2924V28.2603c0,1.0488,.5515,1.5735,1.656,1.5735h29.8907c1.0479,0,1.57
2024-02-22 12:07:34 UTC	582	IN	Data Raw: 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 35 2e 31 33 37 2c 31 33 2e 31 37 37 35 56 33 31 2e 31 34 35 34 63 30 2c 31 2e 30 34 38 38 2c 2e 35 35 31 35 2c 31 2e 35 37 33 35 2c 31 2e 36 35 36 2c 31 2e 35 37 33 35 48 33 31 2e 35 35 30 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 31 34 33 33 34 37 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 33 33 2e 37 31 Data Ascii: ound" stroke-width="1.5"/> <path d="M5.137,13.1775V31.1454c0,1.0488,.5515,1.5735,1.656,1.5735H31.5507" fill="none" fill-rule="evenodd" stroke="#143347" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/> </g> <polygon points="33.71

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50086	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2914	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-02.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1353	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 1372 Connection: close CF-Ray: 85971c07aaaa17b9-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 75153 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cd19091c7015abbb49bb204d76711eca" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 6e810acc9d798bdf126180508d1b511e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: TodX-5cBB6-Ehaiq0qWhVT9aA7tW0Wc2mJZ0klLT_w1nwf5xdBze1A== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: STj9ixgP7FqPojBtf7ilkApQS2tXBNvi1E46t2R9Ggfj7ibnYdczdUGId8NFj0PFrzWuLllimaQMDBM3T47JmY3Kxz23HVXy x-amz-meta-cache-tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861350 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: WSVAR59F4N02K2WD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: IGnjSCnaTTw77NGWknAJ9o6fDiPIthh5 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:34 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 58 67 63 70 38 38 46 44 33 44 6c 53 4b Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xgcp88FD3DlSK
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 4d 39 2e 38 32 39 36 2c 31 36 2e 37 37 30 32 6c 36 2e 32 31 37 33 2c 32 33 2e 32 30 34 63 2e 33 33 37 2c 31 2e 31 31 30 39 2c 31 2e 30 37 30 38 2c 31 2e 35 33 37 34 2c 32 2e 32 30 31 35 2c 31 2e 32 37 39 34 6c 31 39 2e 39 39 2d 35 2e 33 35 34 38 63 31 2e 30 37 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <path d="M9.8296,16.7702l6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.071
2024-02-22 12:07:34 UTC	3	IN	Data Raw: 76 67 3e Data Ascii: vg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50085	35.190.80.1	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	540	OUT	OPTIONS /report/v3?s=YaQnl%2B06%2BOl83yPKeo%2Bq9MTAQ8k2FWeSz6Pqtpo6ymZa1CwY8XNRtfOP37KuT9lyXN0e4IsEgvGbPiXxRxzgcGCTDm4g6%2F0EOG0Cs3U6b0YMDtWHwey3wzjAE%2FZ6jdFWKTtl HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://academy.avast.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 22 Feb 2024 12:07:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50087	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2914	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-03.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1356	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 1597 Connection: close CF-Ray: 85971c090ffb8c6f-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "e5b6246059cbaefd13d4aaa720cf8530" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 3ce8b408dfcacf1e62d9fe4b346a6a62.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: k41OFaVrjtIUsg__mrgeQKinku0bT98MzpR-MfDnu4BaGNu6PFyd3g== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: KmklS9rWS5/ZPhz/5hYuDNSn5iZfo64nLDPFciWvGRR56SVN2hUdOd47vkUSw+HDx/gVcuJGtOs= x-amz-meta-cache-tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861352 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: YTZR7A42QERMHSSK x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: .b6budyzH4HWoRHYogMm8XKP5a8WYDYG X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:34 UTC	501	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 56 45 63 51 77 66 4e 49 64 45 5a 34 41 72 25 32 42 69 25 32 46 6c 6b 4b 74 51 64 78 48 50 6b 64 50 70 53 79 79 47 69 31 73 4e 67 32 43 68 61 30 61 54 6b 53 48 6e Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VEcQwfNIdEZ4Ar%2Bi%2FlkKtQdxHPkdPpSyyGi1sNg2Cha0aTkSHn
2024-02-22 12:07:34 UTC	881	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 65 6c 6c 69 70 73 65 20 63 78 3d 22 32 33 2e 36 33 30 36 22 20 63 79 3d 22 32 33 2e 35 33 33 32 22 20 72 78 3d 22 31 37 2e 39 38 39 35 22 20 72 79 3d 22 31 36 2e 34 38 38 35 22 20 66 69 6c 6c 3d 22 23 66 66 64 64 62 66 22 2f 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <ellipse cx="23.6306" cy="23.5332" rx="17.9895" ry="16.4885" fill="#ffddbf"/> <g> <path d="
2024-02-22 12:07:34 UTC	716	IN	Data Raw: 33 2d 2e 30 37 34 33 2c 2e 31 33 35 38 2d 2e 31 33 36 32 2c 2e 31 38 35 35 2d 2e 31 38 35 35 2c 33 2e 35 31 31 34 2d 33 2e 30 31 36 36 2c 37 2e 36 39 30 34 2d 34 2e 35 32 35 33 2c 31 32 2e 35 33 36 39 2d 34 2e 35 32 35 33 2c 32 2e 39 39 32 2c 30 2c 35 2e 37 31 32 33 2c 2e 35 35 36 34 2c 38 2e 31 36 30 32 2c 31 2e 36 36 39 31 5a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 20 78 31 3d 22 33 30 2e 33 31 37 35 22 20 79 31 3d Data Ascii: 3-.0743,.1358-.1362,.1855-.1855,3.5114-3.0166,7.6904-4.5253,12.5369-4.5253,2.992,0,5.7123,.5564,8.1602,1.6691Z" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/> <line x1="30.3175" y1=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50088	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2914	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-04.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1368	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 2961 Connection: close CF-Ray: 85971c0988eb422b-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 76500 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "567c783cb00b7e353776c56f873d3213" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5b0b740c03260f172f837d0dbe65a26a.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: 1STADXX6mOx2809HCyQcGR5imwcGmJ5eQ9QQ3moH1RY0tvZukP47lQ== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: 4i1+5+h5hL5NlAQOs6AuUF5aywCswIYPPzD+DD3FJIYK6yC5D0P0WYLUdsUm0ubjAvTWQ+aW1A8= x-amz-meta-cache-tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861389 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: DCMCNS1VRBS1K4HQ x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: wjXsm4yOyXMAjOEbOXQjkLY1tXFbIlLU X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:34 UTC	503	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 30 68 6c 43 61 52 51 64 25 32 42 65 66 7a 59 45 32 4c 6d 4a 6b 6e 33 4d 70 34 58 65 6f 6a 64 48 4c 77 36 4c 4d 25 32 46 6e 35 62 37 25 32 42 6d 6f 38 4a 71 43 55 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0hlCaRQd%2BefzYE2LmJkn3Mp4XeojdHLw6LM%2Fn5b7%2Bmo8JqCU
2024-02-22 12:07:34 UTC	867	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 36 2e 30 30 34 32 2c 33 38 2e 31 36 35 31 63 2d 32 2e 35 34 30 32 2d 32 2e 35 31 36 31 2d 33 2e 38 31 30 33 2d 35 2e 36 32 34 38 2d 33 2e 38 31 30 33 2d 39 2e 33 32 36 36 2c 30 2d 33 2e 36 30 34 31 2c 31 2e 32 37 30 31 2d 36 2e 37 31 33 34 2c 33 2e 38 31 30 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <path d="M16.0042,38.1651c-2.5402-2.5161-3.8103-5.6248-3.8103-9.3266,0-3.6041,1.2701-6.7134,3.810
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 31 2e 37 37 31 37 2c 36 2e 31 38 32 31 76 2e 36 35 33 35 6d 38 2e 35 32 37 39 2d 33 2e 35 39 32 37 63 2d 2e 33 31 34 37 2d 2e 31 36 39 34 2d 2e 37 31 33 37 2d 2e 32 35 34 35 2d 31 2e 31 39 37 38 2d 2e 32 35 34 35 48 35 2e 39 37 30 35 63 2d 2e 35 38 30 35 2c 30 2d 31 2e 30 31 36 34 2c 2e 30 36 31 2d 31 2e 33 30 36 33 2c 2e 31 38 31 34 2d 2e 37 32 35 38 2c 2e 33 31 34 37 2d 31 2e 30 38 38 37 2c 31 2e 30 34 30 35 2d 31 2e 30 38 38 37 2c 32 2e 31 37 37 33 76 34 2e 36 30 39 31 48 34 31 2e 34 32 34 34 56 35 2e 33 34 37 32 63 30 2d 31 2e 31 33 36 39 2d 2e 33 37 34 39 2d 31 2e 38 33 38 35 2d 31 2e 31 32 34 38 2d 32 2e 31 30 34 33 5a 6d 2d 33 2e 35 35 36 36 2c 32 2e 39 33 39 32 76 2e 36 35 33 35 4d 37 2e 33 34 39 31 2c 33 32 2e 30 39 32 35 48 33 2e 35 37 35 36 56 Data Ascii: 1.7717,6.1821v.6535m8.5279-3.5927c-.3147-.1694-.7137-.2545-1.1978-.2545H5.9705c-.5805,0-1.0164,.061-1.3063,.1814-.7258,.3147-1.0887,1.0405-1.0887,2.1773v4.6091H41.4244V5.3472c0-1.1369-.3749-1.8385-1.1248-2.1043Zm-3.5566,2.9392v.6535M7.3491,32.0925H3.5756V
2024-02-22 12:07:34 UTC	725	IN	Data Raw: 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 39 2e 34 34 39 31 2c 32 36 2e 30 32 37 37 63 2e 30 34 38 32 2c 2e 33 38 37 37 2c 2e 30 37 33 2c 2e 37 33 38 35 2c 2e 30 37 33 2c 31 2e 30 35 32 35 2c 30 2c 32 2e 30 30 37 39 2d 2e 37 30 31 37 2c 33 2e 36 38 39 38 2d 32 2e 31 30 35 2c 35 2e 30 34 34 33 2d 31 2e 33 35 34 34 2c 31 2e 33 33 31 31 2d 33 2e 30 30 30 32 2c 31 2e 39 39 35 39 2d 34 2e 39 33 35 31 2c 31 2e 39 39 35 39 2d 2e 38 37 31 31 2c 30 2d 31 2e 36 36 39 31 2d 2e 31 30 39 32 2d 32 2e 33 39 34 39 2d 2e 33 32 36 37 2d 2e 39 36 38 32 2d 2e 33 33 38 31 2d 31 2e 38 33 39 33 2d 2e 38 39 35 32 2d 32 2e 36 31 33 32 2d 31 2e 36 36 39 31 6c 2e 38 33 34 39 2c 34 2e 31 37 33 32 22 20 66 69 6c 6c 3d Data Ascii: ke-width="1.5"/> <path d="M29.4491,26.0277c.0482,.3877,.073,.7385,.073,1.0525,0,2.0079-.7017,3.6898-2.105,5.0443-1.3544,1.3311-3.0002,1.9959-4.9351,1.9959-.8711,0-1.6691-.1092-2.3949-.3267-.9682-.3381-1.8393-.8952-2.6132-1.6691l.8349,4.1732" fill=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50094	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	855	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:34 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50092	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	970	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:34 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:34 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:34 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50091	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	1005	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:34 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50090	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2914	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-05.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1362	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/svg+xml Content-Length: 2161 Connection: close CF-Ray: 85971c0a4a6703d5-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "2980634c868a2531d8d26a9a34c92e16" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: NdwRnF7kOPPZgWXwDoy9BoKvCG-15pgwD1WV1JdADHfd0JzsVyzHrQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: XPsqQ/lBh0ZmhXWQQtI0p1qPRxsMj5LOTS+MT3bJuwHpY/7GdgcA7YNdarBHIuYT/4W+nvdyHJg= x-amz-meta-cache-tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861353 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: MSAK3Q2NXNB28YT0 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: pQyzbgObXIEPe_EgwTlAdgo5iuJPbxFY X-Cache: RefreshHit from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:34 UTC	515	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 72 36 25 32 42 76 76 6b 66 51 5a 47 32 56 77 66 67 65 66 4a 4d 25 32 46 39 6a 6a 48 66 75 72 31 42 74 4c 39 42 25 32 46 75 42 38 4c 32 33 54 64 6a 25 32 42 71 39 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r6%2BvvkfQZG2VwfgefJM%2F9jjHfur1BtL9B%2FuB8L23Tdj%2Bq9
2024-02-22 12:07:34 UTC	861	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 34 35 32 31 22 20 79 3d 22 34 2e 37 33 39 37 22 20 77 69 64 74 68 3d 22 34 30 2e 30 39 35 38 22 20 68 65 69 67 68 74 3d 22 32 39 2e 36 39 32 34 22 20 72 78 3d 22 34 2e 34 38 34 35 22 20 72 79 3d 22 34 2e 34 38 34 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <rect x="2.4521" y="4.7397" width="40.0958" height="29.6924" rx="4.4845" ry="4.4845" fill="#fff"/
2024-02-22 12:07:34 UTC	1300	IN	Data Raw: 70 61 74 68 20 64 3d 22 4d 34 32 2e 35 34 37 39 2c 31 36 2e 37 30 30 32 76 31 34 2e 39 31 34 36 63 30 2c 31 2e 35 35 35 39 2d 31 2e 32 36 31 33 2c 32 2e 38 31 37 33 2d 32 2e 38 31 37 33 2c 32 2e 38 31 37 33 68 2d 34 2e 37 30 30 36 6d 37 2e 35 31 37 39 2d 31 37 2e 37 33 31 39 76 2d 35 2e 30 35 33 38 6d 30 2c 35 2e 30 35 33 38 48 32 2e 34 35 32 31 6d 34 30 2e 30 39 35 39 2d 35 2e 30 35 33 38 48 31 39 2e 35 30 35 37 63 2d 2e 32 37 36 34 2c 30 2d 2e 35 32 30 31 2d 2e 31 38 31 31 2d 2e 35 39 39 39 2d 2e 34 34 35 38 6c 2d 2e 37 35 36 32 2d 32 2e 35 30 39 35 63 2d 2e 32 33 39 32 2d 2e 37 39 33 39 2d 2e 39 37 30 34 2d 31 2e 33 33 37 33 2d 31 2e 37 39 39 36 2d 31 2e 33 33 37 33 68 2d 37 2e 30 30 34 33 63 2d 2e 38 32 39 32 2c 30 2d 31 2e 35 36 30 34 2c 2e 35 34 33 Data Ascii: path d="M42.5479,16.7002v14.9146c0,1.5559-1.2613,2.8173-2.8173,2.8173h-4.7006m7.5179-17.7319v-5.0538m0,5.0538H2.4521m40.0959-5.0538H19.5057c-.2764,0-.5201-.1811-.5999-.4458l-.7562-2.5095c-.2392-.7939-.9704-1.3373-1.7996-1.3373h-7.0043c-.8292,0-1.5604,.543

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50097	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	782	OUT	GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	546	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 915 Connection: close Cache-Control: public,max-age=1800 Date: Thu, 22 Feb 2024 12:07:34 GMT ETag: "6dc37b6916858add248ddd84eeac2cb2" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fd19835f7197012a8cc880526cfcce2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: u9L0f5i1gow5H3M5nWxjwyg4qyCqG2pOwfr6fVgFToFYcEO-hPKm8Q==
2024-02-22 12:07:34 UTC	915	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 33 2e 39 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 41 76 61 73 74 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 31 33 38 30 36 2c 22 6f 6e 65 53 74 61 72 22 3a 32 32 37 36 2c 22 74 77 6f 53 74 61 72 73 22 3a 35 32 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 36 38 33 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 31 38 30 31 2c 22 66 69 76 65 53 74 61 72 73 22 3a 38 35 31 39 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50095	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	1148	OUT	GET /stats/TrustboxImpression?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:07:34 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 78151a5252ddc63300143dbe81b1f0c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: VkIMKJ6yEmJNnmsTWKmifJs4Cq9D7ChbfQDsJTdD5lu-ybNtZDXbpQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50093	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	1120	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:34 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:34 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:34 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50104	142.250.65.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 76 61 73 74 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 39 32 38 30 30 38 32 36 39 30 38 31 31 37 30 37 36 34 31 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://avast.com","trigger_debug_key":"9280082690811707641"},"type":"trigger-no-matching-source"}]
2024-02-22 12:07:35 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 22 Feb 2024 12:07:34 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50107	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2734	OUT	GET /hs-fs/hubfs/New_Avast_Academy/Computer%20Virus/Academy-Computer-Virus-Hero.jpg?width=1200&name=Academy-Computer-Virus-Hero.jpg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1317	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/jpeg Content-Length: 66711 Connection: close CF-Ray: 85971c0b0e834316-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfWrVxBJpHq2JKG7lWQMCt9Dmn2lqaDEedKymcvPL4DQ:b9b99dcc8c840014865601f182f3f206" Last-Modified: Mon, 22 Nov 2021 09:40:52 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront) cache-tag: F-60252051518,FD-13936192775,P-4650993,FLS-ALL cf-bgj: imgq:85,h2pri cf-resized: internal=ok/m q=0 n=202+0 c=3+78 v=2024.1.3 l=66711 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=1;i=?0,cf-chb=(262;u=3;i=?0 11352;u=5;i=?0 29590;u=6;i=?0) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dAOsHxnLiJpX%2BmH0FhcX7YXGAQ0CyUGdiFjELKJEIg7R7G7nNQuN15EHX1RRitOl7w%2Fa7u4QPAsMJuPQmVA6i3%2B4Msqcn7VbG8%2Fz1T7b%2FskcK6HsMIr%2Fdh2OsAeshBtmdoi7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:34 UTC	52	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c Data Ascii: JFIF
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 01 b9 04 b0 03 01 22 00 02 11 01 03 11 01 ff c4 00 37 00 00 02 02 03 01 01 01 00 00 00 00 00 00 00 00 00 04 05 03 06 01 02 07 00 08 09 01 00 02 02 03 01 01 00 00 00 00 00 00 00 00 00 00 04 05 03 06 01 02 07 00 08 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 e7 74 6b d5 26 b7 db 51 e7 5d ac 5c 66 63 04 34 67 e4 37 4f 63 5d 75 94 66 75 11 1d b6 9e 9b 63 29 1b 60 dd 79 6d ce 88 2b 65 16 0e 4d a8 f3 c0 4d 7b 7b 15 7a d2 25 92 c6 31 a1 d7 7b 15 02 Data Ascii: ) )/'%'/9339GDG]]}) )/'%'/9339GDG]]}"7tk&Q]\fc4g7Oc]ufuc)`ym+eMM{{z%1{
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 86 e6 68 c4 d5 3b e7 bd 14 9a cd b4 52 e9 ef 55 2b 76 6a e5 9b 8a 8b 0c 99 63 48 63 7a 5c fa b3 dc 33 e8 32 be dd 2a 47 9a 6e 3f 35 86 c0 8e d1 c3 f3 ed f1 b4 36 e7 b5 cb 1d 6b b3 e8 9d e6 91 1d 56 31 85 2d 9d 26 05 9a 4a ff 00 91 59 2c e3 b6 ab f7 7c ed 57 8f 59 ac f5 6b 44 d1 99 cd 21 bf a9 6f ce b7 44 aa 42 52 d8 6c 79 39 0f 56 4a 86 d5 4f 3e ad 6a 42 86 f1 ec 52 a3 e8 99 cc 2b 5e 7a a8 05 be cb ad 55 c9 42 44 43 54 a7 2a 28 25 f3 31 ad 85 9b 49 53 6c 39 d2 d6 60 7e 09 00 13 60 e5 4d 16 90 b7 53 1d 3c af 5a 96 dd 6a 2a ef 8b 0a 42 ae c0 a5 5c a3 4a 5a 5b 04 cb 58 c8 60 82 5d 0e eb 3c 0e d6 ca 9b f4 9c d4 a7 c3 56 5f ec ad 94 13 7a 19 05 f4 3e 01 77 38 97 5b 5f 39 a9 2c 45 d4 12 56 fa 1d 10 48 fa 97 d8 ff 00 9b ff 00 4f 59 b9 b7 d3 1b 55 ac 61 e9 37 bd Data Ascii: h;RU+vjcHcz\32Gn?56kV1-&JY,\|WYkD!oDBRly9VJO>jBR+^zUBDCT(%1ISl9`~`MS<Zj*B\JZ[X`]<V_z>w8[_9,EVHOYUa7
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 46 7e 2b ee 82 9d 6e 89 3a a2 18 89 19 f7 2a 20 23 01 cc 56 4b 7f 37 72 aa f3 61 e7 af 10 14 8b 3a fb 56 54 bc dc 29 f6 40 6d 37 00 c4 58 93 a8 02 07 a1 b4 f1 72 37 12 43 53 5d 6c fc fd da ee a2 f9 4c 31 6f ba 90 e7 11 bf 32 92 e7 45 b2 68 e2 ea 22 e8 c8 b2 0b b0 1b 3d e4 86 92 b7 38 92 d3 b5 76 d1 05 84 d6 0c ba 2e 56 f3 bd 3b d8 b1 a7 e1 d9 ea 68 09 82 a9 d8 38 7f 40 8a 4e b7 91 4b ad 9d 8d 33 1f b1 e8 75 37 3b ea 4e b0 47 ed c1 cc 13 c1 a8 f9 db 7f 41 c4 fa ff 00 cc 65 95 57 c4 23 65 c3 eb 14 f4 d7 34 81 f6 05 a0 2e e3 2c 2f 40 dd ea df 41 24 32 30 58 57 a3 b0 9d 5d 2c 7b 03 50 f0 b3 49 bc ac 81 a5 af e5 c2 03 fd b5 a4 50 86 16 d2 c1 44 09 23 1a 18 61 f6 d5 66 6e 6b 26 44 e0 5d 94 43 5d b5 b5 0c 1d a6 59 e1 e5 84 84 7a 67 db 4a 09 0d 15 94 2d 84 d1 85 Data Ascii: F~+n:* #VK7ra:VT)@m7Xr7CS]lL1o2Eh"=8v.V;h8@NK3u7;NGAeW#e4.,/@A$20XW],{PIPD#afnk&D]C]YzgJ-
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 3c fd 6f 4b 37 4f 8f 9d 6d 30 f6 9e 6f 0b b1 2b ed 0b b5 52 ee 0a af 23 51 ef 54 72 91 0c 50 cc d9 d2 36 d5 c6 a1 5b c1 ba d3 ee 0b ad 63 54 2f 89 63 29 73 35 e2 12 9a e5 5b 7b 00 16 8e 75 25 8b 2f f9 42 29 25 1a 51 2d cd 52 58 ab bd 7e 86 d8 bd cb af 16 ce b3 62 5f 6f 5b 4a bd d1 9a 51 b5 14 b0 db f3 d8 b3 8d a4 5f 61 ba d5 ad b5 7e f1 ce d3 bc 47 60 e3 fe db 1e 25 2e b8 db 39 d7 3d 0a bb 75 41 d7 2b 88 af 75 9d 67 06 7c cc 62 34 c0 9c 09 f4 db ae da 39 ad f6 6a 13 6b 04 24 29 5b 63 ae 59 c4 7d cc 43 38 0b 47 0a 9f 3a 49 ed c5 3c 4b 64 27 37 e7 9d 1b 9d 05 66 ce b2 68 d6 87 1c 9a 4b 9d 1f 3b f3 7a cf 70 af d1 7a bf 2e 65 49 8f 7d 76 6d cf bd 16 fa 7b 1d 04 26 6e aa bd fd 2d 59 e5 51 9d 2a da 05 97 66 be e6 cc 2f 36 8b e7 cf 94 2e 85 d7 1d 6b 72 a6 03 d1 Data Ascii: <oK7Om0o+R#QTrP6[cT/c)s5[{u%/B)%Q-RX~b_o[JQ_a~G`%.9=uA+ug\|b49jk$)[cY}C8G:I<Kd'7fhK;zpz.eI}vm{&n-YQ*f/6.kr
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 9e d7 11 c9 a7 b1 ae 36 f6 d1 fb 49 37 c4 fc df e2 5f d0 af 9c 09 69 c5 2d aa 1a 52 3b b7 33 11 a0 b6 8e 11 1e c5 cb e9 17 f5 3a bd b9 27 5b e5 f1 db 96 bb e7 89 3c c2 23 eb 63 f4 ee 77 7f 1a f6 72 77 78 8a e3 49 e9 88 b0 c6 b3 56 8b 11 3b e5 1a 78 78 34 15 df 48 a4 b2 aa f7 64 b5 8b 2d 46 7a 29 13 9e f4 ea fd 7f ab 27 fa bf 57 74 6e 9a ca 51 eb c8 eb d7 df 63 1f 3d f3 6f b1 e9 6d c5 f9 89 85 c3 95 1e 51 95 d6 ec 97 5a 51 5b 32 09 30 fb 04 ad 3e a5 a1 20 1b ed 1a 8f 95 d8 32 51 20 ac 2d 35 87 75 f9 c7 ea 68 00 e8 a5 88 48 4b ca 28 13 b4 20 dd f5 c8 fe 97 3a 6d a4 99 c7 b3 ec c0 29 c0 c9 ac 31 fb 59 86 c7 b1 8f 6b 32 e3 6b f9 3f 80 70 8e 93 cc e4 9e 56 4a cb 1a 4b 73 1d fb 21 8f 69 5d 32 c2 d8 8a a5 7c 2b 8e fa 41 48 d2 fd 8d 4d a9 74 0a 5e be d3 a2 ed 5b Data Ascii: 6I7_i-R;3:'[<#cwrwxIV;xx4Hd-Fz)'WtnQc=omQZQ[20> 2Q -5uhHK( :m)1Yk2k?pVJKs!i]2\|+AHMt^[
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: de 39 e3 1a 1d 25 8b 78 33 bc 39 cc 47 56 9d 73 ad 99 72 d6 74 ab 24 ac 5b 40 0c 3b 06 f7 7a e6 ba 94 cc 34 f1 6e 0b 71 06 96 26 22 2b 3d 64 06 d1 75 f6 16 ab f3 0d 2d 61 59 c5 86 da b9 3f 47 a8 c9 b6 ad a8 90 6b be b2 07 ac 12 cf b8 d0 b8 3b 65 d6 ed 7c 3f a1 3c 60 ec 46 6d a5 78 67 49 27 5a ba 19 a2 65 46 d0 9f 5a a0 6d 1c 76 85 89 3a 6d 04 a8 8a b0 72 69 04 64 be 26 11 96 35 8f 59 25 79 bd 51 2f 49 b5 47 46 32 65 ac 2b 37 f4 12 ae a8 e7 38 7f c9 67 6a a8 e1 de fd 67 d9 3e 19 eb b3 58 be 97 db 88 d8 8b a9 f4 ff 00 54 cf ca 37 80 d7 f8 8c 92 75 4e 21 cc e5 4f d4 48 a3 dc a8 b1 02 c6 40 25 32 bf 2c 81 63 d1 db 5c 51 6d 08 7a 88 d4 bb 7d 48 fa 5e b2 6b 93 aa ba 7b 6c fb d6 db 1f 36 bd 57 fa f2 e4 ee d6 10 b6 b1 ac 9a 3c e4 d9 f6 d1 e3 37 a6 5c db a6 a0 ec Data Ascii: 9%x39GVsrt$[@;z4nq&"+=du-aY?Gk;e\|?<`FmxgI'ZeFZmv:mrid&5Y%yQ/IGF2e+78gjg>XT7uN!OH@%2,c\Qmz}H^k{l6W<7\
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 46 94 1b 55 6e b1 32 ab 57 04 c4 91 cc 75 55 d5 ea 8f 7a ad 77 19 7d 88 95 5e 26 f2 86 7b c0 1d 12 f3 43 71 ce 20 f6 be 77 cc ac b7 1e 71 d1 eb 7d 9d 71 e1 54 a2 36 c2 ee 9d 71 d4 8a 95 7d b2 67 dc a4 f3 ab 1a 4a ba e7 65 e6 bd 09 47 49 a8 d7 dc 25 71 cc f7 9a 09 e6 5c eb 0b 7c 1d 9b a2 a4 66 b1 37 4a a1 6b bc 76 bf 9e f3 a6 fa e7 4d fa 07 3f bd 83 76 eb 9b d7 db 92 d8 f9 d4 18 ff 00 9c 3a 39 5b 42 57 ba c4 4e 20 75 35 c0 f3 42 48 aa 07 51 43 b5 7c 86 24 6f 2c 9a 91 a8 d8 1f db 69 bc 58 d7 3e ce f9 8e 4d 3d 2e 8a 9a a3 98 6f 97 94 bf de d7 85 49 1f 56 12 5a d4 6a 4e d0 ad 8c 33 96 eb ab 21 84 7d 5d bb d7 5c 1c 2e 93 af 4f 9d 8d a9 86 39 e3 4c a4 eb 2a 9b 60 57 ca d4 7d 4c b6 d5 84 17 1f 1a 50 13 78 43 86 7e 94 3b 50 7a 1b cd 69 bd 8d 59 75 1e 4a 67 41 17 Data Ascii: FUn2WuUzw}^&{Cq wq}qT6q}gJeGI%q\\|f7JkvM?v:9[BWN u5BHQC\|$o,iX>M=.oIVZjN3!}]\.O9L*`W}LPxC~;PziYuJgA
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 57 34 fb a0 2d d6 c8 be 26 a2 1f a3 14 e2 95 0c c9 63 28 73 35 33 5d 4b 8e 07 6a b6 19 8c ab b6 53 63 49 a9 21 4d be f3 28 81 80 06 c0 f5 75 03 a2 ad ce fc 59 67 43 ae 88 42 86 52 4d 11 15 e6 31 93 b0 46 2e 6d 80 6c a8 74 b2 47 3a a7 fd 77 84 f4 12 b4 bf 4a a8 f9 53 65 6b 70 b5 cf c8 13 c1 3a d9 24 db 49 62 68 61 83 4e 0d 9f 21 12 26 f0 af 18 91 d8 d2 a3 d7 6d 25 57 8c 67 19 d7 73 c0 63 0b 2b 1c 98 dd 0f 59 af 2d 72 b5 bf 3d 12 39 a1 2e b5 af bd ed a3 c9 10 17 a1 2d 0c 1c e5 5d 14 38 5c 2d c6 46 c6 d8 21 5c 01 18 11 08 a1 db 59 08 49 ed 2d 29 c5 7a 01 03 13 3a d3 3d 30 c1 da 22 de 39 e5 04 a2 9f 61 45 fe ac 11 42 b5 a1 c4 3c f0 92 82 0f 64 ad c7 c3 49 6c ea 6f e0 4e ea 25 1d 1a 96 a6 c3 5b b0 f1 fc 6b 8f 15 5d 9a 02 2c 50 38 82 c5 4f 99 7d be db 54 d2 e4 Data Ascii: W4-&c(s53]KjScI!M(uYgCBRM1F.mltG:wJSekp:$IbhaN!&m%Wgsc+Y-r=9.-]8\-F!\YI-)z:=0"9aEB<dIloN%[k],P8O}T
2024-02-22 12:07:34 UTC	1369	IN	Data Raw: 6e eb 9d 76 12 26 04 6b 09 5e d6 97 55 bb 52 6d 3c 23 52 46 30 da cf 43 30 52 a9 bf 48 d7 f4 5c 43 7a 05 ab 3b e1 2f 49 e7 72 44 ca cd c5 6c 24 e8 5d 7b ad eb 3c 13 c4 c6 af 4a b9 d3 2d 1c 2e 2b 6d 50 d9 d3 39 76 15 ad 0f 5a f0 c5 42 ba e5 e9 b4 93 1b ab a1 df e9 2f b9 60 98 95 4b 6e 79 7c b0 57 9c 55 fb 79 f5 3b 65 07 7d 65 24 1b 1b be 7e 1a ef a5 39 45 9e b9 47 b7 d6 df d6 7a 02 e8 2a c4 32 a4 be 39 1b a6 a0 16 c1 73 81 ec 73 52 ae f4 e5 c6 d6 57 9e 16 f4 11 b6 f4 b9 12 e5 6b ae 58 e3 ea c2 2b 62 a1 a5 6d 65 8e 9f 63 52 be e5 e8 37 ad f5 50 6d 94 eb af 5b f9 d2 ea 81 c5 64 82 39 f5 21 fd 4a b7 60 9b a0 73 9e a4 9a ce 55 7e d1 51 7a a5 18 53 8e ac 1d ac b5 8b 32 9b b8 aa 2c 3b c3 b6 e2 b1 43 b6 e3 49 16 5b f3 fb 2f 7e f9 c7 b9 ca 7f 41 01 80 50 e8 83 18 Data Ascii: nv&k^URm<#RF0C0RH\Cz;/IrDl$]{<J-.+mP9vZB/`Kny\|WUy;e}e$~9EGz*29ssRWkX+bmecR7Pm[d9!J`sU~QzS2,;CI[/~AP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50108	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2685	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:34 UTC	1331	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Content-Type: image/png Content-Length: 1913 Connection: close CF-Ray: 85971c0b0c63c34a-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 1254371 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "b9ec31f25d243816b9b40fbe06bba666" Last-Modified: Mon, 02 May 2022 10:43:06 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 7bf47dc1c691ee43f7c8db83aa03a3cc.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=2376 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: 9NgIA3yhAOmHDCgRkha4xdQijiHI3rS_B44UgU3-pW69g5gDcPRzWw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: 3HEMefBm0rH1qNajv9riDmGBWfq2kDZ66vf6HeNNCll15vqOKYfFBWfbrZuNp15Q2DbNppvzqq8= x-amz-meta-cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651058867058 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: HH2Y8MM05PP58GJ1 x-amz-server-side-encryption: AES256 x-amz-version-id: Zaz8GjCKoojsfqdaqPIDhQQqklNHofl2 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:34 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 43 79 71 43 39 76 52 50 43 63 6f 61 57 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CyqC9vRPCcoaW
2024-02-22 12:07:34 UTC	865	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 56 00 00 00 2a 08 03 00 00 00 1e 68 5c 7f 00 00 01 ef 50 4c 54 45 00 00 00 00 50 70 00 50 70 00 48 70 00 50 6a 00 4c 6c bf 16 16 00 4d 6d 00 4e 6e 00 4d 6b 00 4c 6e 00 4c 6c 00 4c 6c c0 18 18 00 4d 6d 00 4c 6c 00 4c 6d c1 19 19 c1 18 18 00 4d 6d c1 17 17 00 4d 6d ff ff ff fb f1 f1 ec f6 fd ea e8 ef e9 e8 ef de ec f4 f8 e2 e2 dd ec f4 f7 e2 e2 dd eb f4 df e9 ed e7 da e0 f4 d4 d4 f3 d4 d4 f4 d3 d3 cf e1 eb f3 d3 d3 cf e0 eb cf de e4 e4 cc d2 e4 cc d1 f0 c5 c5 ef c5 c5 c0 d6 e2 bf d3 db bf d3 da bf d2 db bf d2 da e1 bf c4 e1 bf c3 ec b7 b7 eb b7 b7 b1 cc d9 b1 cb d9 af c8 d2 b0 c7 d1 af c7 d2 af c7 d1 de b0 b6 e8 a9 a9 e8 a8 a8 e7 a8 a8 a2 c1 d0 9f bd c9 a0 bc c8 9f bc c8 dc a3 a7 dc a2 a7 e4 9a 9a e4 Data Ascii: PNGIHDRV*h\PLTEPpPpHpPjLlMmNnMkLnLlLlMmLlLmMmMm
2024-02-22 12:07:34 UTC	1048	IN	Data Raw: 64 31 de 6b 3c ea c4 ce b9 1f 16 d6 b1 48 d0 1d d6 6f e0 19 73 f0 75 fc 83 d9 f8 16 5b 91 b4 8a 6c 3d 2b d0 37 9e 1d 25 8b e5 82 fb 58 a7 6a b3 2f 91 38 9b 4d ba 5e 9f 46 4c 36 60 b3 b8 fa 17 3b 51 ab d5 4a 74 54 a2 56 ab e9 65 da 1a 05 38 60 a5 4b d9 20 c0 02 fd 78 d4 62 e9 7a 7d 43 13 a4 e2 dd 3e da 84 19 47 f5 14 59 cd 99 4b 36 b3 25 cb 51 1d 16 78 eb 7d b7 53 5c 34 41 3a 01 a7 03 34 e9 c0 41 d7 2d 3e 69 63 d9 5c ea 00 ba 95 5e 07 b6 8b 9c 63 c5 35 83 31 4b 37 70 06 e0 94 4c 44 87 dd 6b 17 99 cb 0e d2 b9 04 cb 19 74 58 f6 85 11 93 f5 1b fd e3 76 f5 d3 74 67 fa ee dd 7c d3 20 55 37 dd cc d3 fb 2d 2c d5 04 4f 83 b2 42 3e 2f b9 4b 66 17 d7 29 0a b0 f5 8a 7c 76 5c 26 84 44 dd 74 ad 22 73 59 64 b3 83 2e 6b 47 9d b1 af 12 dc 17 89 44 22 a6 40 5b 01 8c a3 c9 Data Ascii: d1k<Hosu[l=+7%Xj/8M^FL6`;QJtTVe8`K xbz}C>GYK6%Qx}S\4A:4A->ic\^c51K7pLDktXvtg\| U7-,OB>/Kf)\|v\&Dt"sYd.kGD"@[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50103	142.251.40.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	1015	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:35 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"9280082690811707641","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:35 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50089	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	1389	OUT	GET /activityi;dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:35 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:35 GMT Expires: Thu, 22 Feb 2024 12:07:35 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:35 UTC	589	IN	Data Raw: 32 63 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4f 4f 41 36 38 37 30 76 6f 51 44 46 51 Data Ascii: 2c7<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=COOA6870voQDFQ
2024-02-22 12:07:35 UTC	129	IN	Data Raw: 39 33 38 2e 31 33 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 63 2d 63 6f 6d 70 75 74 65 72 2d 76 69 72 75 73 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus"/></body></html>
2024-02-22 12:07:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50106	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	702	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A32%20GMT&n=-1&b=What%20Is%20a%20Computer%20Virus%3F%20%7C%20Computer%20Virus%20Definition%20%7C%20Avast&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&enc=UTF-8&yv=1.15.1&tagmgr=gtm HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
2024-02-22 12:07:34 UTC	923	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:34 GMT Expires: Thu, 22 Feb 2024 12:07:34 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:07:34 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50114	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2683	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1362	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/png Content-Length: 3675 Connection: close CF-Ray: 85971c0bbff5434f-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 433947 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "5c90960290145851dc3d17bdf94b91fa" Last-Modified: Thu, 05 May 2022 10:21:41 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 a0be26685e47d6d6220ccd40bc5f0a4e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3877 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: QHQJSYmyq5f6jzZUxNsXADcL91MtFE6d5XOnqaW4o5ojVQviAcz9PQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: tR8AcO4ZMlCMJrVNiINKP2azfOmdGEI8x1kyrtRLlunQCGkag1p9Fofk1whYAFCrJ5ujGfKOXh3hXD1rgHEc8THGQlkhIfggRoxxdzj02vI= x-amz-meta-cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651495281049 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: B7ZKJR5CDGY9J0SQ x-amz-server-side-encryption: AES256 x-amz-version-id: z1wggTVnGRhq57s9cuSgN5DWgYCAohSo X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:35 UTC	550	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 25 32 46 51 4d 34 72 4c 45 31 78 58 39 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FQM4rLE1xX9
2024-02-22 12:07:35 UTC	826	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 70 00 00 00 26 08 06 00 00 00 1c 37 1f a1 00 00 0e 22 49 44 41 54 78 da ed 5b 77 74 54 75 16 66 77 dd e3 f1 ec 9e b3 67 77 cf d1 5d 4d a6 24 99 99 14 7a 42 09 35 f4 50 a4 4a 87 00 a1 09 06 10 10 a4 2a d2 14 b0 a0 34 81 d0 8b 8a 52 04 c5 82 8a eb a2 02 22 b0 b8 22 48 11 e6 cd bc e9 93 4c cd 94 cc 7c 7b 7e f7 25 93 69 c9 cc 84 28 70 36 73 ce fd 63 de 7b bf fb ca f7 6e fb ee 7d 0d 00 34 a8 97 fb 57 1a a8 c5 8a eb 6a b1 e2 97 bb 22 22 f9 0e b5 28 7d de 5d 3b ff 3d 26 bc 58 f1 8b 46 ac 28 0c 07 29 f3 e1 87 ff 9c 2a 16 b7 91 27 49 5b 46 00 a8 4c 96 7b 95 22 39 ee 86 a8 c4 f2 8f 38 91 62 d5 dd 3a ff bd 28 9c 58 ae b3 24 65 fd ad 12 a0 87 1e 7a e8 0f 69 22 c9 6b 69 92 94 29 32 b1 74 91 4c 22 19 5b 2d 80 da Data Ascii: PNGIHDRp&7"IDATx[wtTufwgw]M$zB5PJ4R""HL\|{~%i(p6sc{n}4Wj""(}];=&XF()'I[FL{"98b:(X$ezi"ki)2tL"[-
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: a5 c4 8b dd a3 cf 68 44 b9 d1 10 38 de b2 71 13 94 92 8a 07 2d cd 80 f7 da b5 2a 3d 25 25 b4 c6 ef 72 c3 3c 6f 61 05 08 32 d8 f6 ee 0b 24 80 cc 2b f9 d9 31 16 0b 65 e7 5c 4e 2e e0 f7 a1 74 ed 1b d1 5d 69 b2 fc f4 7d 09 a0 cf e9 00 9f db 1e 5c 56 b3 80 b0 eb 08 06 50 db 6f 20 6d 57 35 6b 05 cb ba 8d f0 db ed 14 9b f9 bc ee 11 00 32 bd 01 5d 8d 72 e0 fe f1 47 ba 07 75 bb bc aa ed a9 99 d0 17 14 c2 5f 5e 0e bf cb 05 c3 d4 69 e0 1a e7 80 cb 68 0a fd b8 89 f0 72 4a 5a 63 7a e6 d9 10 00 d9 76 ae 49 0b ca cc f5 93 9e 84 df 6a 85 e7 fa 35 70 0d 9b 43 9d db 11 7e bf 0f 5e 8e 83 ba 75 7b 70 8a c6 d0 8d 2c 80 79 c5 8b 74 2f ba e1 05 40 b9 17 7c bb 4e d1 eb 42 91 dc a7 91 a4 75 bc ff 00 74 38 a0 6a d4 3c 6a cc a9 04 90 ef da 23 64 9f 79 f9 0a e1 fc 3b 77 45 02 18 ac Data Ascii: hD8q-*=%%r<oa2$+1e\N.t]i}\VPo mW5k2]rGu_^ihrJZczvIj5pC~^u{p,yt/@\|NBut8j<j#dy;wE
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 58 b7 0b c6 a9 55 5d 0c d3 e2 25 42 9d b6 72 55 48 66 ca c8 72 56 22 30 e0 cb ce 9e 85 e7 f6 ad 8a 3c e1 3a 54 cd 5a 12 21 ee b9 7a 95 8e 61 dc a7 fb ea 15 12 d7 0f 3f 40 d3 b3 5f 5d 59 df ca 5a 31 31 d5 01 e8 3c 79 32 12 c0 1d 3b 05 00 2f 5c 88 04 70 d4 d8 98 00 3a 4e 9c a0 63 6d fb f6 0b d9 1a 73 41 62 39 f8 ae f9 15 2c be 3c 31 00 25 0a 7a c8 42 81 be 86 ba 04 a4 53 22 a7 0c 96 75 0f 58 89 a0 ae e8 08 84 03 c8 66 79 18 68 ac ec 30 ce 9a 4b f5 2f 5b cf bc 04 f3 08 e6 c5 4b 84 e3 2a 00 2c e7 d5 50 a6 37 12 ce 11 10 59 5d 24 2f 7a d5 63 e9 7f af 3b 00 d9 9a f0 46 6f c5 1b 6e 3f 7c 44 e8 a9 85 14 52 3e 68 ba f7 ae 11 40 ed c0 21 c4 f8 b3 3a 2d 78 7e 26 3a 23 13 04 20 7b 40 15 12 0e a0 7e f4 58 81 e3 3c 7b 36 aa ae 92 57 5e 13 18 9c 57 d6 46 05 d0 bc 74 b9 Data Ascii: XU]%BrUHfrV"0<:TZ!za?@_]YZ11<y2;/\p:NcmsAb9,<1%zBS"uXfyh0K/[K*,P7Y]$/zc;Fon?\|DR>h@!:-x~&:# {@~X<{6W^WFt
2024-02-22 12:07:35 UTC	111	IN	Data Raw: 54 f7 a8 db 77 85 6e e8 68 e8 c7 4d 82 ae ff 60 18 26 4c a1 b8 61 18 3f 99 26 b3 4c f3 17 d1 8c a4 61 72 11 f8 8e dd 60 7e ee 05 f0 1d ba 40 3b 78 04 ed 63 c3 3d 2c cd d6 0d 1c 4a 34 19 9b a2 ae 07 30 d6 07 9e 8a d5 71 7f 23 5f ff 89 f5 3d f7 59 d9 6d 6d 14 ca ac 3a f9 1f 76 dd 85 08 ce 85 b6 98 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: TwnhM`&La?&Lar`~@;xc=,J40q#_=Ymm:vIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	50113	35.190.80.1	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	480	OUT	POST /report/v3?s=YaQnl%2B06%2BOl83yPKeo%2Bq9MTAQ8k2FWeSz6Pqtpo6ymZa1CwY8XNRtfOP37KuT9lyXN0e4IsEgvGbPiXxRxzgcGCTDm4g6%2F0EOG0Cs3U6b0YMDtWHwey3wzjAE%2FZ6jdFWKTtl HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 513 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:34 UTC	513	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 38 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 61 64 65 6d 79 2e 61 76 61 73 74 2e 63 6f 6d 2f 68 75 62 66 73 2f 41 76 61 73 74 2f 41 63 61 64 65 6d 79 2f 61 73 73 65 74 73 2f 63 73 73 2f 73 75 62 73 65 74 5f 65 6e 2e 63 73 73 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 39 39 2e 36 30 2e 31 30 33 2e 32 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 Data Ascii: [{"age":0,"body":{"elapsed_time":780,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://academy.avast.com/hubfs/Avast/Academy/assets/css/subset_en.css","sampling_fraction":0.01,"server_ip":"199.60.103.28","status_code":200,"typ
2024-02-22 12:07:35 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 22 Feb 2024 12:07:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	50098	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2659	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/arrow-blue.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 272 Connection: close CF-Ray: 85971c0bbb6141ba-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 506411 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "5ad7a6aa7f2d255641479f2f3fd8a213" Last-Modified: Thu, 19 Oct 2023 13:56:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c38cfac20df9757e670e782ca61768aa.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: Ifh_1mEX-zWBRDmvap90RQP2QIgwbeA0sdTMDEBC_UFBcCAuRHKFHg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: QdQp8cO4rM7B9NfBvAJOO53ssNWQ+dVOqv6as1gAG0G2bGCxTRfwUOGCTdn7v0B/AEvjWzljFBM= x-amz-meta-cache-tag: F-51393081133,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1627032969357 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: E6Q00W832ZACK04Z x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: .JIH2m.PHBDiJgMI8RpBMziLU6THb4If X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:35 UTC	546	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 6b 30 4a 46 30 6d 66 79 6c 47 73 61 71 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k0JF0mfylGsaq
2024-02-22 12:07:35 UTC	272	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 30 22 20 68 65 69 67 68 74 3d 22 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 20 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 39 20 31 4c 35 2e 34 37 30 34 33 20 34 2e 34 34 31 33 34 43 35 2e 31 35 34 30 31 20 34 2e 37 34 39 38 35 20 34 2e 36 34 37 33 37 20 34 2e 37 34 33 33 35 20 34 2e 33 33 38 39 36 20 34 2e 34 32 36 38 33 4c 31 20 31 22 20 73 74 72 6f 6b 65 3d 22 23 30 30 37 30 46 36 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 Data Ascii: <svg width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9 1L5.47043 4.44134C5.15401 4.74985 4.64737 4.74335 4.33896 4.42683L1 1" stroke="#0070F6" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	50110	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:34 UTC	2663	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/quote-redesign.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 872 Connection: close CF-Ray: 85971c0c19a30f97-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 505039 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "d3c6807718e415c9fe487ef1ed95df48" Last-Modified: Thu, 19 Oct 2023 13:57:01 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 86a640712a72b4264f1681744fa48612.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: wG2IymylWqftdJUpz-1tHixBidEFVOBphMcTHiCrd-CH9Z5hQKAr-w== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: wjBYPphqu8Jv0RerGvrgGwNbhbwb+arvoDsJpNER/5Oe0clvgPApSs42gBSxtHcEhSsucdp2Eqc= x-amz-meta-cache-tag: F-51727009665,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1627479923876 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: VA45CR8YE0QNPQSS x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: N2IDK.MskiCf_wd0zn9bRegV.QAmqmk9 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:35 UTC	546	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 63 65 76 6c 6a 31 64 52 41 43 4c 74 34 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cevlj1dRACLt4
2024-02-22 12:07:35 UTC	859	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 31 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 31 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 33 20 31 31 2e 37 32 36 43 31 33 20 36 2e 38 30 33 35 31 20 31 36 2e 35 36 38 32 20 31 2e 36 36 33 37 36 20 32 32 2e 32 33 33 32 20 30 2e 31 37 37 30 34 34 43 32 32 2e 36 37 39 34 20 30 2e 30 35 39 39 35 35 39 20 32 33 2e 31 33 36 34 20 30 2e 32 39 35 36 34 36 20 32 33 2e 33 33 30 31 20 30 2e 37 31 34 32 35 32 4c 32 33 2e 35 33 32 31 20 31 2e 31 35 30 37 43 32 33 2e 37 37 36 32 20 31 2e 36 37 37 39 37 20 32 33 2e 35 31 36 32 20 32 2e 33 Data Ascii: <svg width="24" height="18" viewBox="0 0 24 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M13 11.726C13 6.80351 16.5682 1.66376 22.2332 0.177044C22.6794 0.0599559 23.1364 0.295646 23.3301 0.714252L23.5321 1.1507C23.7762 1.67797 23.5162 2.3
2024-02-22 12:07:35 UTC	13	IN	Data Raw: 22 2f 3e 0d 0a 3c 2f 73 76 67 3e 0d 0a Data Ascii: "/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	50109	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2730	OUT	GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/Academy-Computer-Virus.png?width=1320&name=Academy-Computer-Virus.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1283	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/png Content-Length: 34146 Connection: close CF-Ray: 85971c0c1fc143c5-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfrXTrp2Hh_JPkVSTBE3YqndKGSrQPC1ZFp0iTiQtODQ:a5c410ce574f68df077d03d147f26444" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront) cache-tag: F-83104191249,FD-83103412024,P-4650993,FLS-ALL cf-bgj: imgq:0,h2pri cf-resized: internal=ok/h q=0 n=8+0 c=1+0 v=2024.1.3 l=34146 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=4;i=?0,cf-chb=(45;u=5;i=?0) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CM91hKvBqXQMrzzYL9mOP3ev0S43HeiR54L%2Fnaz8loIbtPm%2FL%2BYs6rT4CSHSr%2BJeV88tpBU67%2FHqKSkRT%2BGsZ6B3S6jowNj4nBwXPjCrwzCE6TeD5rN%2FN5gWIBNfzdcfhJGU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 28 00 00 02 59 08 06 00 00 00 aa 48 db 62 00 00 80 00 49 44 41 54 78 5e ec dd 7d f8 5d 65 7d e7 fb f9 ef f4 61 fa 6c 99 ce 39 a7 8a 4a 0a 6a 20 24 31 a2 28 29 32 a0 4d 15 47 6a b4 d8 27 c4 94 53 2f c4 52 8d da 5a 07 45 d3 8a 55 a6 53 23 8e 5a b9 38 35 55 a7 55 b1 07 3b 8a d3 cb d3 98 38 e5 1c 94 53 d3 c1 29 6d ea 4f 7e d0 94 14 73 25 c4 34 69 14 b0 fb f0 d9 f9 ad fd fb ae ef bd f6 d3 bd ef b5 ee b5 f6 7e 7f af eb 75 41 7e fb 69 ad fd 4b ee 75 ef cf be 1f fe 55 ef db 27 2e 04 00 00 00 90 d9 43 f7 5d de 7b f0 af 7f 0d 00 00 60 d1 fc ab c7 3a 43 3d 00 00 00 00 99 1d da df eb 2d ed 06 00 00 58 38 04 94 00 00 00 40 1b 1c b8 2b e8 ac 03 00 00 2c 02 02 4a 00 00 00 a0 0d ee dd 1b 74 d6 01 00 00 16 01 01 25 Data Ascii: PNGIHDR(YHbIDATx^}]e}al9Jj $1()2MGj'S/RZEUS#Z85UU;8S)mO~s%4i~uA~iKuU'.C]{`:C=-X8@+,Jt%
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 0f 04 9d 6e 00 00 00 0c 47 40 09 00 00 00 a4 74 68 7f d0 e9 06 00 00 c0 70 04 94 00 00 00 40 4a 0f ec 0b 3a dd 00 00 00 18 8e 80 12 00 00 00 48 69 f9 8e a0 d3 0d 00 00 80 e1 08 28 01 00 00 80 54 4e 1e 0b 3a dc 00 00 00 18 8d 80 12 00 00 00 48 e5 d8 c1 a0 c3 0d 00 00 80 d1 08 28 01 00 00 80 54 d8 20 07 00 00 60 6a 04 94 00 00 00 40 2a 07 ef 0e 3a dc 00 00 00 18 8d 80 12 00 00 00 48 e5 fe 3b 83 0e 37 00 00 00 46 23 a0 04 00 00 00 52 a9 e8 70 03 00 00 60 34 02 4a 00 00 00 20 05 36 c8 01 00 00 88 42 40 09 00 18 eb a1 43 ff d8 db f1 ee df eb ad 79 e6 c5 bd ff e5 c7 9f 36 b0 e9 79 2f ee ed fa d8 1f 07 f7 07 80 85 74 e4 be a0 b3 0d 00 00 80 f1 08 28 01 00 63 6d bd f2 ea 52 30 e9 29 bc f4 8f 01 80 85 f3 e0 3d 41 67 1b 00 00 00 e3 11 50 02 00 46 ba ed bf 7e 36 08 Data Ascii: nG@thp@J:Hi(TN:H(T `j@*:H;7F#Rp`4J 6B@Cy6y/t(cmR0)=AgPF~6
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: bb 16 e5 ce 0f dc 1c 3c 76 1c 3d 77 f1 78 ad 45 19 04 87 4d d3 d4 ef 09 d6 a8 d4 b9 12 52 02 c8 ea de bd 41 e7 1a 00 00 00 d3 23 a0 04 80 96 1b 15 4e 8a 0d ea 34 fd d9 3f 7e 12 f6 b9 1f da da c0 66 39 93 d0 ce df 63 a6 7d eb 7d 20 a4 04 90 c5 89 23 41 c7 1a 00 00 00 71 08 28 01 a0 c5 c6 85 93 b2 bc f4 b5 72 c0 18 11 d0 69 fd ca e2 f1 fb 2e cd b0 0e e5 30 1a 4d f9 77 fb 82 e3 b5 08 29 01 64 71 f4 40 d0 b1 06 00 00 40 1c 02 4a 00 68 29 85 6c 36 38 ac 0a 27 0b f6 7e da f8 c6 df 3e 8e 7d 8d 20 24 6c 83 cf 7f 32 38 66 ab 2a a4 f4 f7 01 80 a4 d8 20 07 00 00 20 19 02 4a 00 68 21 85 93 0a d9 26 09 27 65 fb ab 7f 75 70 3f 6d 20 e3 6f 1f c5 ee e4 dd 8a 35 28 87 b9 e9 cd c1 b1 5b db af db 51 7a bf fc fb a0 91 a6 7b f6 ee ed 6f 2c a4 db 34 1d 5e f4 ff fa 99 6e f7 cf Data Ascii: <v=wxEMRA#N4?~f9c}} #Aq(ri.0Mw)dq@@Jh)l68'~>} $l28f* Jh!&'eup?m o5([Qz{o,4^n
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 9f 4f 9b e3 54 04 71 18 ee a1 ad 1b 7a 3b ce 5f d7 5b 73 c6 da e0 77 26 0a 24 35 9d 7b 79 e9 6b fd f7 58 ed 4e 71 db d0 1d d4 27 e0 77 03 4f 4d bb 8b eb ef 8b e8 38 f5 f7 a5 38 07 00 0d 3b 76 30 e8 48 23 af e5 bf f8 64 6f d7 fb 6e e8 ed b8 ee 0d bd 8b 5f f8 e2 be 35 4f bf 20 68 4b 01 60 91 6d ba f0 79 fd f6 71 eb e5 2f ef b7 97 7b 6e fd fd de 43 7f f5 d9 a0 4d 05 72 23 a0 44 a3 f4 e1 da 86 33 40 17 7d ec d6 db 7a 7f b7 f4 f5 68 f6 b9 be f0 17 ff 6f 70 fb 83 9f b8 25 08 e0 30 b9 e5 cb 36 f4 47 55 2a b0 bc f1 a5 97 56 fe be de fd be 0f 0d 7e 07 cf 7e e1 cf 06 b7 4f e2 b5 d7 fd 56 f0 77 a3 29 fa 42 47 23 41 fd 7a 9b 00 6a c4 06 39 ad a0 0f d5 fa 80 4d 10 09 00 b3 51 60 79 db 87 df 13 b4 b3 40 2e 04 94 68 84 82 49 8d 04 f2 8d 22 d0 35 5b 7e ee aa de e7 f6 fc Data Ascii: OTqz;_[sw&$5{ykXNq'wOM88;v0H#don_5O hK`myq/{nCMr#D3@}zhop%06GU*V~~OVw)BG#Azj9MQ`y@.hI"5[~
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: ae da 7e de 39 8d ed 78 3d 4a 57 47 50 2e 52 40 59 9a 3e ff b1 3f 0e da 6a 00 53 62 83 9c 46 69 b4 4e d1 86 b1 39 0e 00 e4 51 b4 c3 c2 6e de 68 0a 01 25 92 d9 f1 ee df 1b 34 62 31 1b 67 00 f3 6e 5c 40 f9 c1 df fa ad 7e 18 69 3b 04 de 69 a7 37 13 e8 8d 62 8f 47 bb fd f9 f3 98 c4 59 cf fe a9 c1 73 34 b1 06 e5 22 05 94 a5 f0 f7 b1 76 d9 b7 d5 00 a6 74 ef de a0 03 8d fa 6c ba f0 79 73 d7 2e 03 40 d7 d8 be ba 96 de f0 6d 35 50 07 02 4a 24 73 f1 4b 7e 71 d0 88 f1 8d 37 10 1a 16 50 6a ed 43 4d 63 2b 6e 9b 84 76 d2 7e 68 6b fd bb 5f 57 e9 e2 2e de c3 02 ca 1f 7d ca ea ba b9 cf 7a c1 cf 46 07 ae 6d 62 03 4a 6d 5c e6 db 6a 00 53 38 71 24 e8 3c a3 5e f6 fa 30 0f 6b 03 03 40 17 95 66 e4 b0 51 0e 1a 42 40 89 64 6c 40 c9 37 de 40 c8 07 94 0a c3 6c 98 64 69 37 66 dd 5f Data Ascii: ~9x=JWGP.R@Y>?jSbFiN9Qnh%4b1gn\@~i;i7bGYs4"vtlys.@m5PJ$sK~q7PjCMc+nv~hk_W.}zFmbJm\jS8q$<^0k@fQB@dl@7@ldi7f_
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: fd 8b 45 40 89 1c 08 28 91 0c 01 25 45 85 65 d7 8a 54 e0 35 eb 08 3c 3b b5 5b b6 9f 77 4e 18 c8 61 d5 af bf dc bf 85 fd fa 9e d3 cf 2e bd 8f e3 a4 da dc 68 54 11 50 02 2d 72 e4 be a0 d3 8c 66 d8 b6 d7 b7 6f b1 08 28 29 8a 5a 94 f2 ed 5f 2c 02 4a e4 40 40 89 64 08 28 29 aa ba ec 74 6c 85 94 da 38 47 c1 e5 c7 3f 7d 7b ef 33 9f ff 42 b0 fb 5e 15 4d 49 d6 a8 be 52 68 76 d6 da de 43 5b 19 3d 39 d2 67 3f ea 7f 1d c1 0e e8 a3 e8 77 a7 91 af 75 87 93 2a 02 4a a0 45 1e bc 27 e8 34 a3 19 b6 0d f6 ed 5b 2c 02 4a 8a a2 16 a5 7c fb 17 8b 80 12 39 10 50 22 19 02 4a 8a aa 2e bb de 61 2a 84 93 13 fa c6 3f f8 5f 47 69 14 aa 46 46 fa 30 b8 a0 20 b3 c9 22 a0 04 5a e4 c0 5d 41 a7 19 cd b0 d7 3a df be c5 22 a0 a4 28 6a 51 ca b7 7f b1 08 28 91 03 01 25 92 21 a0 a4 a8 e1 a5 51 Data Ascii: E@(%EeT5<;[wNa.hTP-rfo()Z_,J@@d()tl8G?}{3B^MIRhvC[=9g?wuJE'4[,J\|9P"J.a?_GiFF0 "Z]A:"(jQ(%!Q
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: a8 45 29 df fe c5 22 a0 44 0e 04 94 48 86 80 92 a2 d2 96 0f db 2a 37 cd 51 b5 24 a4 bc 78 ed d9 83 63 1d ba 7e a6 29 dd 5e 9a ce 7e d6 da e0 39 03 37 be 6e 68 38 59 15 ea 6a ed c9 e2 cf 43 47 a2 b6 a4 08 28 81 cc 96 76 a3 05 6c 3b ee db b7 58 04 94 14 45 2d 4a f9 f6 2f 16 01 25 72 20 a0 44 32 04 94 14 95 be b4 06 a5 fd b0 a6 11 89 95 f5 e5 dd 59 37 ce d1 4e dd f6 38 27 dd 31 db 6f 66 a3 f5 2b fd 73 0f 0c 59 73 52 f5 9f 3e 70 4b e9 79 f4 be a9 34 5a d3 fe bc cd 45 40 09 64 74 fc 50 d0 49 46 1e b6 cd f6 ed 5b 2c 02 4a 8a a2 16 a5 7c fb 17 8b 80 12 39 10 50 22 19 02 4a 8a 4a 5f 0a d8 26 0e 29 b5 bb f7 35 2f 0c 83 bd 06 68 c7 ee 41 28 f6 d2 2b fc 91 8d 2c 3b 52 74 fb 79 e7 04 cf dd f7 d9 8f fa 87 0d ea 97 5e f3 c6 d2 fb f3 bf ad 7b 4e ef 8b 77 de d5 bf 4d d3 Data Ascii: E)"DH*7Q$xc~)^~97nh8YjCG(vl;XE-J/%r D2Y7N8'1of+sYsR>pKy4ZE@dtPIF[,J\|9P"JJ_&)5/hA(+,;Rty^{NwM
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 01 25 72 20 a0 44 32 04 94 14 d5 5c 69 8a b6 fd 10 37 8c 1f 89 a8 d1 96 7a ac 0f 31 47 29 82 4b 51 c8 a9 00 d3 d2 3a 93 c5 ed 55 bb 89 17 86 4d d7 b6 c7 32 e9 9a 95 f3 58 04 94 40 06 4b bb d1 32 f6 ba e1 db b7 58 04 94 14 45 2d 4a f9 f6 2f 16 01 25 72 20 a0 44 32 04 94 14 d5 6c 55 ed 76 6d f9 70 d2 57 11 56 2a 74 b4 23 32 eb a2 d7 50 48 59 8c f6 d4 7f fd 39 f8 e9 ea 8b 54 04 94 40 c3 8e 1f 0a 3a c6 c8 cf 5e 13 7c fb 16 8b 80 92 a2 a8 45 29 df fe c5 22 a0 44 0e 04 94 48 86 80 92 a2 9a 2f 05 8c 7e d7 ee d8 dd ba f5 18 85 9a db df 7a 43 ff 39 67 0d 2d f5 1c cf fa e9 97 06 3f 1f 46 af bb c8 45 40 09 34 ec c8 7d 41 c7 18 f9 d9 eb 82 6f df 62 11 50 52 14 b5 28 e5 db bf 58 04 94 c8 81 80 12 c9 10 50 52 54 de aa 6b f4 a1 82 4b 8d 7c 14 05 98 7e 8a b7 42 d2 e2 f6 Data Ascii: %r D2\i7z1G)KQ:UM2X@K2XE-J/%r D2lUvmpWV*t#2PHY9T@:^\|E)"DH/~zC9g-?FE@4}AobPR(XPRTkK\|~B
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: a8 2e 14 01 25 50 b3 43 fb 83 8e 30 da 87 80 92 a2 3a 54 1a 90 a0 59 62 19 3e ef cc 05 8d 32 d5 68 d3 84 a3 2a 7d fb 17 8b 80 12 39 10 50 22 19 02 4a 57 5a 6f 32 c3 c5 5a e1 a4 ed dc 17 4e 7b ca 33 9a 0f 29 45 df a6 52 14 35 b6 08 28 81 9a b1 41 4e 27 10 50 52 54 07 4a 9f 73 e6 79 b3 9b 1c b4 4c 56 82 19 68 be fd 8b 45 40 89 1c 08 28 91 0c 01 a5 29 85 72 fe a2 d3 10 8d 9a f4 e1 64 61 db 35 bf 16 dc bf 11 84 94 14 35 b6 08 28 81 9a 2d df 11 74 84 d1 3e 04 94 14 d5 e2 52 30 c9 34 ee 7a e9 fd d5 fb 1c 59 be fd 8b 45 40 89 1c 08 28 91 0c 01 e5 4a 65 0c 27 fd e8 c9 db 3e f5 89 fe f4 6e fb 33 ff 98 c6 10 52 52 d4 c8 22 a0 04 6a 74 f2 58 d0 09 46 3b 11 50 52 54 0b 4b eb 25 b2 e9 4d b3 22 83 4a df fe c5 22 a0 44 0e 04 94 48 86 80 b2 97 35 9c 14 1b 46 6e bd e2 aa Data Ascii: .%PC0:TYb>2h*}9P"JWZo2ZN{3)ER5(AN'PRTJsyLVhE@()rda55(-t>R04zYE@(Je'>n3RR"jtXF;PRTK%M"J"DH5Fn
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 83 a8 c7 b0 31 10 55 51 04 94 40 0d 8e dc 17 74 7e d1 6e b6 9f e1 db b7 58 04 94 d4 c2 96 06 00 f8 fe 36 e6 9a 6f ff 62 11 50 22 07 02 4a 24 b3 10 01 65 0d a3 27 b5 4b b7 0f fd 9e bc e9 c2 c1 9f 6f fb d4 27 82 c7 14 ec 54 ef ad eb ce 0e 83 c6 59 69 ad ca 11 af 29 49 a7 7b b7 75 14 a5 82 69 ad 3b 7a f2 68 da cd 91 b4 41 90 ce 59 21 67 97 c2 59 aa 96 22 a0 04 6a 70 68 7f d0 f9 45 bb d9 3e 86 6f df 62 11 50 52 0b 57 ea bb b2 4b f7 42 f2 ed 5f 2c 02 4a e4 40 40 89 64 e6 3e a0 ac 61 f4 a4 5f 73 b2 18 91 68 43 cb 51 01 a0 c2 cb 41 10 b1 b6 86 80 52 b4 46 a5 1b 4d 59 6b 48 d9 96 a0 4e a3 1c 15 48 37 d9 b9 d3 da 40 0a 41 15 86 52 0b 57 04 94 40 0d d8 20 a7 73 6c ff c2 b7 6f b1 08 28 a9 85 2a d6 9b 5c 68 be fd 8b 45 40 89 1c 08 28 91 cc dc 07 94 89 d7 6f 19 16 4e Data Ascii: 1UQ@t~nX6obP"J$e'Ko'TYi)I{ui;zhAY!gY"jphE>obPRWKB_,J@@d>a_shCQARFMYkHNH7@ARW@ slo(*\hE@(oN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	50112	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2980	OUT	GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/A1-Acanning-for-viruses.png?width=2207&name=A1-Acanning-for-viruses.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-computer-virus Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1241	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/webp Content-Length: 68766 Connection: close CF-Ray: 85971c0c1ae90ca0-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfbRIr1sc9C4X7wpAgOYKsqkbY9U1_VZXCdNALlOaZDQ:5808a1eaf5342d26a21e53e4eaf1663e" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 6583236304db9b508d67c62740f04654.cloudfront.net (CloudFront) cache-tag: F-83100902450,FD-83103412024,P-4650993,FLS-ALL cf-bgj: imgq:100,h2pri cf-resized: internal=ok/h q=0 n=13+94 c=0+0 v=2024.1.3 l=68766 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=08ffmY%2BGjC3YiEGAMcs8HIWaj9HyZmlgxsqbxUPF2w2RGoAWL9rmTuBrXRS6%2F9nDk%2FFVVEvlAiwgRde2sOMEDbfBVONn4bJMWaxSaoQBhEuuyWzDcPmjyL7MYCTfndGy%2Ftqa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:35 UTC	128	IN	Data Raw: 52 49 46 46 96 0c 01 00 57 45 42 50 56 50 38 4c 89 0c 01 00 2f 9e 88 7e 11 cd 40 72 db 48 92 04 3b a2 7a 16 fd ff c5 19 99 d5 99 51 b3 1c 23 fa 3f 01 7a c8 e8 97 29 39 fa 59 b2 c1 6c b0 c1 7b fc 51 68 2f 20 d8 e3 13 ca 98 e5 3e 53 16 08 03 76 81 8d c0 c8 8c 32 80 2b 6e 6c 4d 4d a3 d4 fa 41 7b df c5 00 02 31 0e 08 09 10 c7 c8 62 34 e0 59 69 83 e0 8e df 35 05 9d b9 01 30 06 4c 69 4c Data Ascii: RIFFWEBPVP8L/~@rH;zQ#?z)9Yl{Qh/ >Sv2+nlMMA{1b4Yi50LiL
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 7d d4 d9 ff 34 11 93 cc 46 b1 94 6d 62 45 7a 0a 77 b1 ed 05 75 61 40 c8 a6 91 cb b0 8d bb 45 08 34 b6 d2 62 17 dd 70 9b fc 5c fa 8a 2e ca 5c 88 e8 94 93 e8 24 a5 f4 29 d1 ad 04 6d 3d 66 f7 13 b1 6c 30 b7 4d 29 33 8f 77 f4 fd 83 39 8c a5 74 b3 04 41 34 ab e1 11 36 3f 04 d7 90 d7 ab d7 35 a4 da 5f 97 1e 72 03 3b b2 6d d3 56 3f db f6 0b e0 e5 1f cf 8d e2 d9 5b e7 9c 75 2e 3e 1d 37 b6 ad 36 c7 76 98 0b c0 fe 2b 49 09 51 56 f4 4c 4f 57 4f e6 55 16 8e 13 49 72 a4 e2 c8 d7 f9 6f 60 32 d4 69 ad f5 d1 7f 06 6e 1b 29 4a 8e 71 b1 8f 40 66 8a 9a 8c 64 41 31 ef c3 7e 27 93 f8 97 33 00 58 23 bd 5c 2e 64 0a d2 32 08 03 c8 54 98 73 d8 e8 6b 7f 88 dc 5a 29 38 95 52 30 15 d3 5c d5 94 f9 d9 e4 f0 91 cf 43 3e ff 71 9a e4 45 e4 0c be f1 b6 d8 78 db 69 e3 94 82 68 3b c2 21 72 Data Ascii: }4FmbEzwua@E4bp\.\$)m=fl0M)3w9tA46?5_r;mV?[u.>76v+IQVLOWOUIro`2in)Jq@fdA1~'3X#\.d2TskZ)8R0\C>qExih;!r
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 30 54 f6 ff c9 ab c3 03 6d db 7a da da b6 d6 3b 91 40 60 c5 d1 da 3f 0a 86 69 53 8d 59 a5 e8 d9 b6 7f 95 64 bb 59 ab ba ba 7b 9a 7b ba 67 66 33 e3 61 16 33 c3 97 d2 57 d0 c7 d0 07 60 66 38 cc e7 6c de 67 36 ef d9 7b 7a 78 ba bb aa d6 12 4b 5d 33 7b d5 fa 9f a9 eb d2 2b 66 66 66 29 66 66 86 4e 97 78 89 a5 16 33 fc 95 b1 94 31 7e 05 86 16 33 b6 78 a5 3f b1 54 99 18 4a 68 66 5b 2c ed d4 cc b8 22 5f d7 32 7b a7 93 2e b3 97 21 15 99 99 99 db ec 36 33 ed b4 cd 4c 62 69 a5 93 9a 99 99 9d 32 94 e1 40 64 18 5f 8a da cc cc 2e 33 33 33 b3 30 75 28 a6 b4 c3 bf 19 22 b6 a8 42 33 b3 33 26 61 6c 2e 33 a4 63 2e 33 33 bb 0d 11 33 33 1f fc 0a a6 32 44 cc a2 49 8f 43 66 08 99 d9 e9 32 db 91 2f 91 a9 cd 2e 53 e0 3b 92 24 4b 92 6d db 12 51 f3 a8 1a 58 0c 0c c6 04 64 02 31 21 Data Ascii: 0Tmz;@`?iSYdY{{gf3a3W`f8lg6{zxK]3{+fff)ffNx31~3x?TJhf[,"_2{.!63Lbi2@d_.3330u("B33&al.3c.33332DICf2/.S;$KmQXd1!
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 98 cb 99 14 25 95 56 f6 56 53 62 ae 73 d0 93 33 56 72 2d 67 ab 9e 5c 05 43 74 fd 25 f5 ca 77 ba 85 01 92 ea 37 02 33 4c 92 6c ca d4 6e 9c 6f eb a6 55 53 41 10 b3 06 b6 ab fc 95 38 17 9a b9 8a 6f 2a 4c 17 bc 50 15 9c e0 d1 a4 e5 0f e1 32 05 c1 4a b7 f3 19 70 f9 0d f6 ac 66 38 37 57 21 2d 43 a5 ee 68 31 21 cc 26 98 41 0d d5 73 ae 52 c9 45 34 e4 ab b8 54 85 0c c1 68 61 56 56 69 76 ab fe 54 72 37 2d 00 a7 31 5b 7d b8 59 ae a8 58 30 ba c1 6b 45 11 c0 f1 2a 0d 59 61 7d 44 60 65 a4 37 90 e2 d9 94 88 4a c6 72 f5 70 ae d3 8b 47 c8 74 56 ec e6 45 3f 8f a0 13 9f c5 41 30 dc f7 07 4e d6 89 9d 2c ad 20 88 7a 3f 66 0d 92 f5 b0 21 57 12 00 6d d3 8f 3d 7c be 4c 88 f5 97 bb d0 a3 83 1b 7e 40 2f c7 e9 25 eb 37 5c 00 fa 30 f3 31 b7 e5 c8 55 4a b9 e0 61 18 c9 fa bf 7c 27 5f Data Ascii: %VVSbs3Vr-g\Ct%w73LlnoUSA8oLP2Jpf87W!-Ch1!&AsRE4ThaVVivTr7-1[}YX0kEYa}D`e7JrpGtVE?A0N, z?f!Wm=\|L~@/%7\01UJa\|'_
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 12 06 11 33 fc 3f 97 47 77 c6 3b b3 d9 30 a7 cf 84 a5 27 45 90 90 56 39 e4 ce 63 a2 e3 b8 2c 7a bb e1 f6 14 e3 8f 1f 74 84 11 a9 22 f4 f3 ad 67 5c 63 83 c6 2a 18 40 9e e2 d3 31 dc b3 33 fe 4c 93 9f 21 93 0a 2b ec cb 09 92 c3 1a 85 a8 68 8a b3 e7 f7 46 9e 8f d2 eb 6f 6b f4 14 b5 74 f4 ac 65 48 97 95 11 67 7d 2e f7 ee 90 17 67 d3 3c 63 26 3a 65 32 63 13 67 9d 64 58 d2 38 42 72 80 57 df d5 7a c2 38 6d f6 a8 e6 f4 06 aa 7d 87 6b 5a 04 68 e8 28 2e da b6 a9 11 df 9f 66 78 30 47 ae c2 b6 69 92 ae 0a 23 dc b2 1c c6 67 9c 2c 3c 99 7b e2 8a 73 75 1c 99 91 23 63 6b 8a fd e6 11 46 8f 4a 2d 40 53 df 22 83 c3 19 b5 01 da 09 55 ec bf 02 7b d6 92 28 65 4f 5a e4 40 b4 14 4d f1 88 74 84 d5 c8 16 50 68 15 e7 27 a9 0f 40 7d cb e8 ea 58 3c 28 f5 1e 07 6c 67 d3 60 0e 1c 4c 83 Data Ascii: 3?Gw;0'EV9c,zt"g\c*@13L!+hFokteHg}.g<c&:e2cgdX8BrWz8m}kZh(.fx0Gi#g,<{su#ckFJ-@S"U{(eOZ@MtPh'@}X<(lg`L
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: e9 c5 83 fd c3 87 14 c1 ec 45 73 e3 1f 52 f3 30 bb 18 75 72 eb 82 c5 f5 3c fc 8b ef db 73 d0 7b 6c c6 e0 f1 97 69 37 bf c1 e3 83 3e b2 82 10 e0 44 e5 23 3f 28 8f 31 e4 04 93 01 81 9a b9 21 15 04 b6 8a 5d 42 10 b8 fe 40 ce f2 82 2d 51 06 c7 48 86 c9 19 60 a8 de 37 34 ed 84 01 de c0 93 76 49 5e 3c e9 5a 63 02 8b 77 bb 41 94 04 f1 a1 36 31 fb c6 8f 04 cd 0f 0b 24 10 fe 70 77 3e c4 4a ab 92 41 04 9e 72 57 51 65 02 9b c5 2d 0c 89 61 08 b3 54 49 2a 98 77 59 12 06 70 8e a9 86 0c ce f0 78 a6 24 d2 63 3e 41 e9 01 8b bd 7d 37 50 04 38 81 ea 85 f1 29 1e ef 7e 27 00 29 95 20 6a 66 cd bb fe 13 1e cd 48 04 59 46 9e eb 15 f2 16 38 fe 90 0e 09 bd fb 27 31 90 c0 73 c6 a5 06 82 67 06 78 7c 2b ac 30 40 f0 0f c1 95 99 23 26 0c 71 60 94 b0 00 75 6f 31 34 1b 6a 6a ab 98 71 e9 Data Ascii: EsR0ur<s{li7>D#?(1!]B@-QH`74vI^<ZcwA61$pw>JArWQe-aTI*wYpx$c>A}7P8)~') jfHYF8'1sgx\|+0@#&q`uo14jjq
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 68 87 1b 35 3b 46 6c 96 e9 77 a2 ae 8f ac 12 64 19 fc 8e 67 1d 40 bd 83 5d b6 c5 e3 08 c6 f0 6b 8f fa c2 fd bd 25 83 22 00 03 f4 ee f1 49 26 7d c7 e9 6f 16 ff 2a c1 8a cb 21 87 bb bb 61 c7 c7 a7 79 3f 91 83 7f 04 80 ae 23 bd d4 84 2c 0e f7 ab 1b 56 fc fd 10 09 f6 f0 e9 93 ca 21 60 10 12 0c 87 78 d7 11 a9 3d e4 29 b0 39 be 4b a4 29 d6 a9 c0 ed b6 6d 51 b2 28 57 a7 48 98 c2 49 c9 f6 fc 00 bc df 0a ed 13 65 bb 45 d1 3e f2 3f 54 30 8f 0e 78 f7 28 fb 10 00 af 26 31 24 c4 01 3f 01 fc 33 80 da 13 c3 35 7b 8e 10 87 f5 a8 79 dd fa 9c 24 85 45 70 43 22 7c aa db 56 20 b0 04 12 0d a2 b2 4b 1a 8a 60 dd 49 4f 68 34 c1 2a 8e 54 06 f0 f1 39 c1 da 6b f6 10 e0 46 de 6d 61 ca 0e 51 00 85 c7 3a 6b 6e e4 be 0a 57 c3 d4 3d 0f 20 b1 40 10 c9 5b bd f5 16 b7 58 a3 cc 8d 97 0c d0 Data Ascii: h5;Flwdg@]k%"I&}o!ay?#,V!`x=)9K)mQ(WHIeE>?T0x(&1$?35{y$EpC"\|V K`IOh4T9kFmaQ:knW= @[X
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 00 00 92 58 75 e7 fc 70 a6 eb c6 38 96 74 4b 89 53 6c 28 63 30 fd a6 a4 4e 05 a2 ae 5f 7a 97 72 7d a0 fc 3b a3 81 8a 83 f3 cf a3 5a 0c c4 47 3f 05 20 3d 45 8c cf a7 e5 8a ce c1 96 c7 2d 3a 74 f0 af ea c0 66 7a c0 82 00 03 8f 39 00 72 45 94 ac 33 cf f2 45 b9 33 c1 b1 8d 49 31 28 86 26 78 6a 1b 0b b0 b5 df 6b 5f 64 6f 26 ac 39 01 f3 c7 53 97 ab 01 83 6c c7 4b 39 f7 be 04 07 cc 05 7b 66 e4 95 84 46 9a 2e 49 2e a6 17 73 c9 3f 2f c5 35 a9 7c be 74 05 e2 53 de 17 cf 74 d8 aa 65 47 44 c4 3c 1b 28 99 5e e4 1d e9 a7 1a 18 1e 2a 21 5b 93 17 7c ab 40 fb f8 07 18 4b 60 95 14 20 24 00 8b 2b ca 3c c6 08 c0 92 2b db 69 63 6e 84 13 a0 f0 a6 92 ce d7 20 c9 ee 04 e0 98 37 47 2d c9 63 f5 e7 44 00 fd 88 a8 42 ff d0 40 98 9a fb 2a 21 89 ed ab 6f ef 91 dd 2d eb dc fa ba 3d 37 Data Ascii: Xup8tKSl(c0N_zr};ZG? =E-:tfz9rE3E3I1(&xjk_do&9SlK9{fF.I.s?/5\|tSteGD<(^![\|@K` $+<+icn 7G-cDB@!o-=7
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 64 72 58 32 f8 c9 1f 7b 5c d1 e4 ee b9 51 da 5f 91 e0 ee e9 f8 29 6d 6f b2 f8 0a 12 69 3e 43 dc 3d 91 06 01 00 f4 da d7 2c 7b 5f 51 da bf d5 48 27 71 f7 9c 2e d3 fd c9 51 d8 9c d4 67 ef 83 e9 8b 74 1f cd df bf 0c a6 74 9f 90 bb e7 a8 b0 39 19 4c 5f 29 91 e6 d3 e2 ee 99 0e 54 9a cf 63 72 f7 bc 8b 17 d8 9b 7c ae 1f 0d 01 5b 93 9e 0e 6d 6f 92 26 94 bd c9 c3 ff 2a 3b 32 ad 87 c7 bb a2 a4 f1 58 66 5c 51 de 8f 45 3f 6c 6a 07 d5 e4 64 0f 9c 4c 7f 39 84 71 25 53 8e f6 d4 bf db 3e 5d 51 d2 7c 5e c3 f2 12 0f fd a0 57 f6 10 bb a1 97 ee e1 37 fd c3 d7 40 25 12 7a 5c 51 94 95 f1 6b 9c bd 75 8b 3e 69 37 f8 0a b8 13 74 03 32 2a 18 84 19 99 2b 8a 65 df 94 18 77 86 ee 47 07 6c 94 60 98 8e b9 a2 bc 1f d7 30 c3 9d a2 1b 88 fc bd 4f cc 7d ac 1f 11 58 15 57 f4 83 fa 65 b8 73 Data Ascii: drX2{\Q_)moi>C=,{_QH'q.Qgtt9L_)Tcr\|[mo&;2Xf\QE?ljdL9q%S>]Q\|^W7@%z\Qku>i7t2+ewGl`0O}XWes
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: d1 a5 d1 05 93 c8 49 3c 24 ac dc 9c 3c 5f 39 0d 2f ab 3a 5a 28 50 96 25 66 ef 19 e8 a8 30 27 b2 a6 d2 b2 ca 1b 8f e6 0a 40 ef b9 ba d2 a3 15 3a 36 37 2a 3b d7 61 02 08 32 df 7c 1e 00 88 36 df 48 12 c2 b5 10 4f 91 5f 17 14 46 98 cd 57 e2 2f be 40 81 77 41 65 4d 4d 56 db 1d e5 ce d9 39 ef 8b ff 61 9b ba 82 4a d9 a5 fd b4 23 f7 ed 25 ca a2 cb 83 1b c1 cb 30 d3 0a 68 49 bb b5 3c 2b 79 eb d0 b5 4d ed 26 5d 3a dd cb 66 45 12 7a b4 e1 1c 53 2e 15 79 b0 0e 23 47 7a 7e 89 bc 4b cc b7 bd 24 db ea b3 cd 4a f3 9d 1f 70 65 35 3c 95 30 15 32 4a 1e 35 a6 89 91 c9 b4 a8 b2 47 51 a7 a2 46 f9 bf 6b ca 6c c0 db 7c f3 ed 0c 32 3a d7 7c 33 b8 9d b6 a4 1f a7 a9 fb 45 f5 b4 9c 27 63 ef fc c0 1c 0a a0 75 b9 ce 6d f8 be f5 72 b0 eb 5c 47 71 92 65 ba b1 36 7d 5e b2 e2 0a ba fa b1 Data Ascii: I<$<_9/:Z(P%f0'@:67*;a2\|6HO_FW/@wAeMMV9aJ#%0hI<+yM&]:fEzS.y#Gz~K$Jpe5<02J5GQFkl\|2:\|3E'cumr\Gqe6}^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	50096	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	1142	OUT	GET /stats/TrustboxView?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:07:34 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f91b1dd39ce8309d7fc575add365607e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: YV5Ff5pnLPi7wbiuYLHSoYbHqWgFUUe6GBQ-lXv0zYyrJNdbLZKNTA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	50111	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2412	OUT	GET /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: text/plain Content-Length: 18 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:35 UTC	18	IN	Data Raw: 4e 6f 20 55 52 4c 20 6d 61 74 63 68 20 66 6f 75 6e 64 Data Ascii: No URL match found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	50116	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	606	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	50115	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	756	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	50117	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	643	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653116&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:35 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:35 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	50120	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	433	OUT	GET /trustbox-data/5419b6ffb0d04a076446a9af?businessUnitId=46d31466000064000500a775&locale=en HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	553	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 915 Connection: close Cache-Control: public,max-age=1800 Date: Thu, 22 Feb 2024 12:07:34 GMT ETag: "6dc37b6916858add248ddd84eeac2cb2" Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Hit from cloudfront Via: 1.1 27c608e7692c0c2238fa431356d5d6e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: jQ9MPorH5hEWGKLop3nh6YXFhkDm3M58dBq-n-wtbpztmlnCjEeDKg== Age: 1
2024-02-22 12:07:35 UTC	915	IN	Data Raw: 7b 22 62 75 73 69 6e 65 73 73 55 6e 69 74 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 73 74 53 63 6f 72 65 22 3a 33 2e 39 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 41 76 61 73 74 22 2c 22 6e 75 6d 62 65 72 4f 66 52 65 76 69 65 77 73 22 3a 7b 22 74 6f 74 61 6c 22 3a 31 33 38 30 36 2c 22 6f 6e 65 53 74 61 72 22 3a 32 32 37 36 2c 22 74 77 6f 53 74 61 72 73 22 3a 35 32 37 2c 22 74 68 72 65 65 53 74 61 72 73 22 3a 36 38 33 2c 22 66 6f 75 72 53 74 61 72 73 22 3a 31 38 30 31 2c 22 66 69 76 65 53 74 61 72 73 22 3a 38 35 31 39 7d 2c 22 77 65 62 73 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 22 7d 2c 22 62 75 73 69 6e 65 73 73 45 6e 74 69 74 79 22 3a 7b 22 73 74 61 72 73 22 3a 34 2e 30 2c 22 74 72 75 Data Ascii: {"businessUnit":{"stars":4.0,"trustScore":3.9,"displayName":"Avast","numberOfReviews":{"total":13806,"oneStar":2276,"twoStars":527,"threeStars":683,"fourStars":1801,"fiveStars":8519},"websiteUrl":"https://www.avast.com"},"businessEntity":{"stars":4.0,"tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	50119	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	793	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus&rl=&if=false&ts=1708603653120&cd[content_ids]=%5B%27AVAST-ONE-IOS%27%2C%27AVAST-ONE-ANDROID%27%2C%27AVAST-ONE-FREE-WIN%27%2C%27AVAST-ONE-FREE-MAC%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603652701&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:35 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:35 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:35 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	50118	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2666	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-01.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1356	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 1453 Connection: close CF-Ray: 85971c0e3a9a8ce2-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "66a0fa5dc355b1af8a02c5b6b15440dc" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5503b1530c5d4fe35fc0727878485b7c.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: t4xEp9fLrf4ccXDY0aRuMi02Suw167QbKZU2467_CKufVizWv5BW2g== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: M3/Ax/Ew0DLurT5GhRF22nxnQeshyxctoLzTZ83QnFetCbcZRoCeHB/GYy4H89Eyf1hN7vfO48U= x-amz-meta-cache-tag: F-83103137412,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861391 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: DCM9FWDT27NV6SN6 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: 5YQ7OrSxz85bB4IDokC5EUKfcTHPr_v0 X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:35 UTC	501	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 58 47 72 36 30 54 70 58 34 4f 43 47 76 25 32 42 42 33 67 5a 4e 72 50 38 68 4c 66 67 77 70 37 66 55 4e 6a 45 45 59 71 6f 67 45 42 32 31 43 5a 58 6e 65 4a 57 66 4e Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XGr60TpX4OCGv%2BB3gZNrP8hLfgwp7fUNjEEYqogEB21CZXneJWfN
2024-02-22 12:07:35 UTC	881	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 2e 32 30 33 32 2c 31 30 2e 32 39 32 34 56 32 38 2e 32 36 30 33 63 30 2c 31 2e 30 34 38 38 2c 2e 35 35 31 35 2c 31 2e 35 37 33 35 2c 31 2e 36 35 36 2c 31 2e 35 37 33 35 68 32 39 2e 38 39 30 37 63 31 2e 30 34 37 39 2c 30 2c 31 2e 35 37 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <g> <path d="M2.2032,10.2924V28.2603c0,1.0488,.5515,1.5735,1.656,1.5735h29.8907c1.0479,0,1.57
2024-02-22 12:07:35 UTC	572	IN	Data Raw: 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 35 2e 31 33 37 2c 31 33 2e 31 37 37 35 56 33 31 2e 31 34 35 34 63 30 2c 31 2e 30 34 38 38 2c 2e 35 35 31 35 2c 31 2e 35 37 33 35 2c 31 2e 36 35 36 2c 31 2e 35 37 33 35 48 33 31 2e 35 35 30 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 31 34 33 33 34 37 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 33 33 2e 37 31 37 37 20 33 37 2e 37 38 38 31 Data Ascii: ke-width="1.5"/> <path d="M5.137,13.1775V31.1454c0,1.0488,.5515,1.5735,1.656,1.5735H31.5507" fill="none" fill-rule="evenodd" stroke="#143347" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/> </g> <polygon points="33.7177 37.7881

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	50121	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2666	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-02.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1353	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 1372 Connection: close CF-Ray: 85971c0e3ee80f70-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 75154 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cd19091c7015abbb49bb204d76711eca" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 6e810acc9d798bdf126180508d1b511e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: TodX-5cBB6-Ehaiq0qWhVT9aA7tW0Wc2mJZ0klLT_w1nwf5xdBze1A== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: STj9ixgP7FqPojBtf7ilkApQS2tXBNvi1E46t2R9Ggfj7ibnYdczdUGId8NFj0PFrzWuLllimaQMDBM3T47JmY3Kxz23HVXy x-amz-meta-cache-tag: F-83103371371,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861350 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: WSVAR59F4N02K2WD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: IGnjSCnaTTw77NGWknAJ9o6fDiPIthh5 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:35 UTC	548	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 39 6a 25 32 42 66 69 50 50 69 50 36 43 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9j%2BfiPPiP6C
2024-02-22 12:07:35 UTC	837	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 4d 39 2e 38 32 39 36 2c 31 36 2e 37 37 30 32 6c 36 2e 32 31 37 33 2c 32 33 2e 32 30 34 63 2e 33 33 37 2c 31 2e 31 31 30 39 2c 31 2e 30 37 30 38 2c 31 2e 35 33 37 34 2c 32 2e 32 30 31 35 2c 31 2e 32 37 39 34 6c 31 39 2e 39 39 2d 35 2e 33 35 34 38 63 31 2e 30 37 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <path d="M9.8296,16.7702l6.2173,23.204c.337,1.1109,1.0708,1.5374,2.2015,1.2794l19.99-5.3548c1.071
2024-02-22 12:07:35 UTC	535	IN	Data Raw: 20 3c 70 61 74 68 20 64 3d 22 4d 31 34 2e 38 34 34 34 2c 32 34 2e 30 37 39 36 6c 35 2e 38 32 38 32 2c 33 2e 33 33 37 37 63 2e 36 33 31 36 2c 2e 33 36 31 37 2c 31 2e 34 33 36 37 2c 2e 31 34 37 33 2c 31 2e 38 30 34 39 2d 2e 34 38 30 36 6c 33 2e 34 30 39 33 2d 35 2e 38 31 34 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 20 78 31 3d 22 31 37 2e 39 39 35 32 22 20 79 31 3d 22 31 33 2e 37 35 30 34 22 20 78 32 3d 22 32 31 2e 36 38 39 34 22 20 79 32 3d 22 32 37 2e 35 34 33 39 22 20 Data Ascii: <path d="M14.8444,24.0796l5.8282,3.3377c.6316,.3617,1.4367,.1473,1.8049-.4806l3.4093-5.8146" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/> <line x1="17.9952" y1="13.7504" x2="21.6894" y2="27.5439"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	50122	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2666	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-03.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1364	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 1597 Connection: close CF-Ray: 85971c0e4b3c7c9a-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 1 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "e5b6246059cbaefd13d4aaa720cf8530" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 3ce8b408dfcacf1e62d9fe4b346a6a62.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: k41OFaVrjtIUsg__mrgeQKinku0bT98MzpR-MfDnu4BaGNu6PFyd3g== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: KmklS9rWS5/ZPhz/5hYuDNSn5iZfo64nLDPFciWvGRR56SVN2hUdOd47vkUSw+HDx/gVcuJGtOs= x-amz-meta-cache-tag: F-83103412059,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861352 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: YTZR7A42QERMHSSK x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: .b6budyzH4HWoRHYogMm8XKP5a8WYDYG X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:35 UTC	507	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 54 4a 4f 46 36 66 53 63 73 50 37 64 35 6f 6d 71 32 4c 73 73 70 50 57 42 6b 56 6b 70 58 46 4a 49 6e 70 56 41 49 25 32 46 56 62 52 77 59 33 25 32 42 64 32 56 73 44 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TJOF6fScsP7d5omq2LsspPWBkVkpXFJInpVAI%2FVbRwY3%2Bd2VsD
2024-02-22 12:07:35 UTC	867	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 65 6c 6c 69 70 73 65 20 63 78 3d 22 32 33 2e 36 33 30 36 22 20 63 79 3d 22 32 33 2e 35 33 33 32 22 20 72 78 3d 22 31 37 2e 39 38 39 35 22 20 72 79 3d 22 31 36 2e 34 38 38 35 22 20 66 69 6c 6c 3d 22 23 66 66 64 64 62 66 22 2f 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <ellipse cx="23.6306" cy="23.5332" rx="17.9895" ry="16.4885" fill="#ffddbf"/> <g> <path d="
2024-02-22 12:07:35 UTC	730	IN	Data Raw: 30 32 2d 31 31 2e 36 34 37 2c 2e 30 37 34 33 2d 2e 30 37 34 33 2c 2e 31 33 35 38 2d 2e 31 33 36 32 2c 2e 31 38 35 35 2d 2e 31 38 35 35 2c 33 2e 35 31 31 34 2d 33 2e 30 31 36 36 2c 37 2e 36 39 30 34 2d 34 2e 35 32 35 33 2c 31 32 2e 35 33 36 39 2d 34 2e 35 32 35 33 2c 32 2e 39 39 32 2c 30 2c 35 2e 37 31 32 33 2c 2e 35 35 36 34 2c 38 2e 31 36 30 32 2c 31 2e 36 36 39 31 5a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 20 78 31 Data Ascii: 02-11.647,.0743-.0743,.1358-.1362,.1855-.1855,3.5114-3.0166,7.6904-4.5253,12.5369-4.5253,2.992,0,5.7123,.5564,8.1602,1.6691Z" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"/> <line x1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	50123	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2666	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-04.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1356	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 2961 Connection: close CF-Ray: 85971c0e594343a5-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "567c783cb00b7e353776c56f873d3213" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5b0b740c03260f172f837d0dbe65a26a.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: 1STADXX6mOx2809HCyQcGR5imwcGmJ5eQ9QQ3moH1RY0tvZukP47lQ== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: 4i1+5+h5hL5NlAQOs6AuUF5aywCswIYPPzD+DD3FJIYK6yC5D0P0WYLUdsUm0ubjAvTWQ+aW1A8= x-amz-meta-cache-tag: F-83103137411,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861389 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: DCMCNS1VRBS1K4HQ x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: wjXsm4yOyXMAjOEbOXQjkLY1tXFbIlLU X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:35 UTC	507	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 41 77 64 62 75 73 69 71 79 61 55 53 73 34 25 32 46 63 38 57 43 54 41 57 65 73 25 32 42 25 32 46 6b 67 62 30 4e 34 51 69 72 48 4b 68 61 48 46 77 61 78 39 7a 30 59 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AwdbusiqyaUSs4%2Fc8WCTAWes%2B%2Fkgb0N4QirHKhaHFwax9z0Y
2024-02-22 12:07:35 UTC	875	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 36 2e 30 30 34 32 2c 33 38 2e 31 36 35 31 63 2d 32 2e 35 34 30 32 2d 32 2e 35 31 36 31 2d 33 2e 38 31 30 33 2d 35 2e 36 32 34 38 2d 33 2e 38 31 30 33 2d 39 2e 33 32 36 36 2c 30 2d 33 2e 36 30 34 31 2c 31 2e 32 37 30 31 2d 36 2e 37 31 33 34 2c 33 2e 38 31 30 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <path d="M16.0042,38.1651c-2.5402-2.5161-3.8103-5.6248-3.8103-9.3266,0-3.6041,1.2701-6.7134,3.810
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 2e 31 38 32 31 76 2e 36 35 33 35 6d 38 2e 35 32 37 39 2d 33 2e 35 39 32 37 63 2d 2e 33 31 34 37 2d 2e 31 36 39 34 2d 2e 37 31 33 37 2d 2e 32 35 34 35 2d 31 2e 31 39 37 38 2d 2e 32 35 34 35 48 35 2e 39 37 30 35 63 2d 2e 35 38 30 35 2c 30 2d 31 2e 30 31 36 34 2c 2e 30 36 31 2d 31 2e 33 30 36 33 2c 2e 31 38 31 34 2d 2e 37 32 35 38 2c 2e 33 31 34 37 2d 31 2e 30 38 38 37 2c 31 2e 30 34 30 35 2d 31 2e 30 38 38 37 2c 32 2e 31 37 37 33 76 34 2e 36 30 39 31 48 34 31 2e 34 32 34 34 56 35 2e 33 34 37 32 63 30 2d 31 2e 31 33 36 39 2d 2e 33 37 34 39 2d 31 2e 38 33 38 35 2d 31 2e 31 32 34 38 2d 32 2e 31 30 34 33 5a 6d 2d 33 2e 35 35 36 36 2c 32 2e 39 33 39 32 76 2e 36 35 33 35 4d 37 2e 33 34 39 31 2c 33 32 2e 30 39 32 35 48 33 2e 35 37 35 36 56 39 2e 39 35 36 33 6d 33 Data Ascii: .1821v.6535m8.5279-3.5927c-.3147-.1694-.7137-.2545-1.1978-.2545H5.9705c-.5805,0-1.0164,.061-1.3063,.1814-.7258,.3147-1.0887,1.0405-1.0887,2.1773v4.6091H41.4244V5.3472c0-1.1369-.3749-1.8385-1.1248-2.1043Zm-3.5566,2.9392v.6535M7.3491,32.0925H3.5756V9.9563m3
2024-02-22 12:07:35 UTC	717	IN	Data Raw: 3d 22 31 2e 35 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 39 2e 34 34 39 31 2c 32 36 2e 30 32 37 37 63 2e 30 34 38 32 2c 2e 33 38 37 37 2c 2e 30 37 33 2c 2e 37 33 38 35 2c 2e 30 37 33 2c 31 2e 30 35 32 35 2c 30 2c 32 2e 30 30 37 39 2d 2e 37 30 31 37 2c 33 2e 36 38 39 38 2d 32 2e 31 30 35 2c 35 2e 30 34 34 33 2d 31 2e 33 35 34 34 2c 31 2e 33 33 31 31 2d 33 2e 30 30 30 32 2c 31 2e 39 39 35 39 2d 34 2e 39 33 35 31 2c 31 2e 39 39 35 39 2d 2e 38 37 31 31 2c 30 2d 31 2e 36 36 39 31 2d 2e 31 30 39 32 2d 32 2e 33 39 34 39 2d 2e 33 32 36 37 2d 2e 39 36 38 32 2d 2e 33 33 38 31 2d 31 2e 38 33 39 33 2d 2e 38 39 35 32 2d 32 2e 36 31 33 32 2d 31 2e 36 36 39 31 6c 2e 38 33 34 39 2c 34 2e 31 37 33 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 Data Ascii: ="1.5"/> <path d="M29.4491,26.0277c.0482,.3877,.073,.7385,.073,1.0525,0,2.0079-.7017,3.6898-2.105,5.0443-1.3544,1.3311-3.0002,1.9959-4.9351,1.9959-.8711,0-1.6691-.1092-2.3949-.3267-.9682-.3381-1.8393-.8952-2.6132-1.6691l.8349,4.1732" fill="none" f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	50124	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2666	OUT	GET /hubfs/what_is_a_computer_virus_academy_refresh/icon-05.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1334	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/svg+xml Content-Length: 2161 Connection: close CF-Ray: 85971c0eadd715d7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 164192 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "2980634c868a2531d8d26a9a34c92e16" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL X-Amz-Cf-Id: NdwRnF7kOPPZgWXwDoy9BoKvCG-15pgwD1WV1JdADHfd0JzsVyzHrQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: XPsqQ/lBh0ZmhXWQQtI0p1qPRxsMj5LOTS+MT3bJuwHpY/7GdgcA7YNdarBHIuYT/4W+nvdyHJg= x-amz-meta-cache-tag: F-83103435641,FD-83103412024,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1661509861353 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: MSAK3Q2NXNB28YT0 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: pQyzbgObXIEPe_EgwTlAdgo5iuJPbxFY X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:35 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 6f 42 52 6b 66 79 66 37 49 50 54 54 59 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oBRkfyf7IPTTY
2024-02-22 12:07:35 UTC	862	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 33 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 35 22 20 68 65 69 67 68 74 3d 22 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 3e 0a 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 34 35 32 31 22 20 79 3d 22 34 2e 37 33 39 37 22 20 77 69 64 74 68 3d 22 34 30 2e 30 39 35 38 22 20 68 65 69 67 68 74 3d 22 32 39 2e 36 39 32 34 22 20 72 78 3d 22 34 2e 34 38 34 35 22 20 72 79 3d 22 34 2e 34 38 34 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_3" data-name="Layer 3" xmlns="http://www.w3.org/2000/svg" width="45" height="45" viewBox="0 0 45 45"> <rect x="2.4521" y="4.7397" width="40.0958" height="29.6924" rx="4.4845" ry="4.4845" fill="#fff"/
2024-02-22 12:07:35 UTC	1299	IN	Data Raw: 61 74 68 20 64 3d 22 4d 34 32 2e 35 34 37 39 2c 31 36 2e 37 30 30 32 76 31 34 2e 39 31 34 36 63 30 2c 31 2e 35 35 35 39 2d 31 2e 32 36 31 33 2c 32 2e 38 31 37 33 2d 32 2e 38 31 37 33 2c 32 2e 38 31 37 33 68 2d 34 2e 37 30 30 36 6d 37 2e 35 31 37 39 2d 31 37 2e 37 33 31 39 76 2d 35 2e 30 35 33 38 6d 30 2c 35 2e 30 35 33 38 48 32 2e 34 35 32 31 6d 34 30 2e 30 39 35 39 2d 35 2e 30 35 33 38 48 31 39 2e 35 30 35 37 63 2d 2e 32 37 36 34 2c 30 2d 2e 35 32 30 31 2d 2e 31 38 31 31 2d 2e 35 39 39 39 2d 2e 34 34 35 38 6c 2d 2e 37 35 36 32 2d 32 2e 35 30 39 35 63 2d 2e 32 33 39 32 2d 2e 37 39 33 39 2d 2e 39 37 30 34 2d 31 2e 33 33 37 33 2d 31 2e 37 39 39 36 2d 31 2e 33 33 37 33 68 2d 37 2e 30 30 34 33 63 2d 2e 38 32 39 32 2c 30 2d 31 2e 35 36 30 34 2c 2e 35 34 33 34 Data Ascii: ath d="M42.5479,16.7002v14.9146c0,1.5559-1.2613,2.8173-2.8173,2.8173h-4.7006m7.5179-17.7319v-5.0538m0,5.0538H2.4521m40.0959-5.0538H19.5057c-.2764,0-.5201-.1811-.5999-.4458l-.7562-2.5095c-.2392-.7939-.9704-1.3373-1.7996-1.3373h-7.0043c-.8292,0-1.5604,.5434

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	50126	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	2732	OUT	GET /hs-fs/hubfs/what_is_a_computer_virus_academy_refresh/A1-Acanning-for-viruses.png?width=2207&name=A1-Acanning-for-viruses.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=2&tt=bz5&bcn=%2F%2F173bf109.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609
2024-02-22 12:07:35 UTC	1296	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:35 GMT Content-Type: image/png Content-Length: 152040 Connection: close CF-Ray: 85971c0f7c7e0c96-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfbRIr1sc9C4X7wpAgOYKsqkbY0-G5bZp2dStCtR1xDQ:5808a1eaf5342d26a21e53e4eaf1663e" Last-Modified: Fri, 26 Aug 2022 10:31:02 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront) cache-tag: F-83100902450,FD-83103412024,P-4650993,FLS-ALL cf-bgj: imgq:0,h2pri cf-resized: internal=ok/m q=0 n=177+0 c=23+0 v=2024.1.3 l=152040 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=4;i=?0,cf-chb=(37;u=2;i=?0 978;u=5;i) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mObC10Y4OvfKWiGA6A7wsLev0xV%2FV0i5Ny8x8t9zjIn%2F6ka4HAIy5R54xXVoaaW60wQWIN%2FlrOVvAXy49fsu9UIMGtbIKRovyCn1NO%2BMyC6cGip6RKKyoW%2FtCNVVqaxswGQ%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 9f 00 00 05 fb 08 06 00 00 00 9c 85 88 4e 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 74 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 Data Ascii: PNGIHDRNtEXtSoftwareAdobe ImageReadyqe<tiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 1d 00 00 00 00 00 00 00 60 8a 50 f9 04 00 00 00 00 00 00 00 80 86 09 9f 00 00 00 00 00 00 00 00 d0 30 e1 13 00 00 00 00 00 00 00 00 1a 26 7c 02 00 00 00 00 00 00 00 40 c3 84 4f 00 00 00 00 00 00 00 00 68 98 f0 09 00 00 00 00 00 00 00 00 0d 13 3e 01 00 00 00 00 00 00 00 a0 61 c2 27 00 00 00 00 00 00 00 00 34 4c f8 04 00 00 00 00 00 00 00 80 86 75 1b 02 06 c9 19 02 00 00 00 00 00 00 00 5a a4 68 08 a6 07 e1 93 c9 4f 60 04 00 00 00 00 00 00 80 4e d4 ec ef d9 c2 2b 93 84 f0 c9 d4 7d 13 02 00 00 00 00 00 00 c0 64 56 cb ef e6 02 2a 1d 40 f8 a4 f3 df 28 00 00 00 00 00 00 00 40 65 d5 7e 77 17 4c 69 13 e1 93 ce b8 e0 01 00 00 00 00 00 00 80 d6 aa f4 3b bd 40 ca 38 10 3e 69 df 05 0c 00 00 00 00 00 00 00 4c ac e1 bf e7 0b a3 b4 80 f0 c9 f8 5c 9c c6 01 00 00 00 00 00 Data Ascii: `P0&\|@Oh>a'4LuZhO`N+}dV*@(@e~wLi;@8>iL\
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: ec eb 99 88 73 d5 16 d3 2d 7c 32 11 c1 93 76 6e d3 ca e5 ad 1c 77 00 00 00 00 00 00 00 26 a7 56 54 42 69 76 79 23 e1 91 56 4d c3 d3 ee 00 8a f0 49 4d 1d b6 26 7c d2 ea aa 27 f5 06 4f 5a 35 cd 4e b3 cf 9b 3d 9e 18 c7 6d 00 00 00 00 00 00 00 98 bc 8a e3 b8 cd 78 55 39 69 76 7d 3d fd d6 b2 7e da 54 3f 99 4e e1 93 5c 8b d6 35 12 f4 a8 77 fd 78 4e d1 d3 ec ba 18 87 fd 00 00 00 00 00 00 00 98 18 e3 11 90 a8 67 5d 23 81 90 66 ab 9e b4 a2 92 4a ad af 79 5a 54 3f 99 2e e1 93 f1 0a 9e 34 5b ed a4 d5 a1 95 6a af 27 d7 c4 38 9a 9a 07 00 00 00 00 00 00 60 ea 29 b6 78 db 56 4f af d3 4c 08 a5 dd 01 94 56 4e bf 23 7c 32 66 87 cd 87 4f 5a 59 f5 a4 93 82 27 cd 54 42 69 c5 b4 3b b9 71 18 77 00 00 00 00 00 00 00 26 bf 66 82 15 ad 98 ea a6 d8 e0 b6 ad 98 86 a7 15 01 94 29 5f Data Ascii: s-\|2vnw&VTBivy#VMIM&\|'OZ5N=mxU9iv}=~T?N\5wxNg]#fJyZT?.4[j'8`)xVOLVN#\|2fOZY'TBi;qw&f)_
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 5a b3 65 cb 96 ff b9 ff fe fb ef fc c1 0f 7e f0 8b ab ae ba 6a c3 ea d5 ab 7b d3 7e 15 2a a2 0c af 34 32 d6 f3 b1 96 57 5b 56 cb f2 6a 8f a3 ca f2 29 53 f9 64 32 84 4f 5a 3d e5 4e ab a6 db a9 65 d9 98 cb 5f fa d2 97 ce fa ab bf fa ab 93 57 ae 5c f9 fb 33 67 ce 3c b9 f4 66 3c a4 74 4e 66 97 de 90 5d bb cb 0d c5 ce 9d 3b a3 a7 a7 27 7b 93 96 de 70 d9 1b 38 2d 4b 63 99 96 95 3f 08 d2 f2 21 57 df a0 0f 86 72 e0 a4 fc 41 53 de 2f ed 53 fe 40 18 be 7f f9 5c 95 c3 2e 69 bf 72 78 25 7d 70 a5 7d ca ed a5 f5 63 f5 3f 78 fb d1 fa 1f 7c 7d 94 1f 97 3f 9c 46 eb bf fc c1 34 5e fd 8f f5 fa f5 af 7f fd eb 5f ff fa d7 bf fe f5 af 7f fd eb 5f ff fa d7 bf fe f5 af 7f fd eb 5f ff fa d7 bf fe f5 af 7f fd eb bf de fe cb db 8c 57 ff e5 70 49 3d af bf bc 6f b5 fe cb fb 56 eb 3f Data Ascii: Ze~j{~*42W[Vj)Sd2OZ=Ne_W\3g<f<tNf];'{p8-Kc?!WrAS/S@\.irx%}p}c?x\|}?F4^___WpI=oV?
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 10 f5 4c b7 13 63 5c b8 b9 77 bc e3 1d 47 74 77 77 9f b4 7d fb f6 ee 34 d5 ce 7e fb 2e 8e 15 cb 0e 8d 28 a8 74 02 00 00 00 00 00 00 00 d9 8f ec 85 fe 58 b5 72 79 f6 9b fa a3 8f 3e 1a 3b 77 ee cc 75 77 77 1f b6 78 f1 e2 df 5a b5 6a d5 61 f9 7c be bb 30 30 6d cf f0 80 49 3d d5 50 c6 5a 17 15 da 8a 2a db 8d b5 ff 98 2f 7b 32 cb 4f 97 6b b3 8e c7 b5 b4 95 ab e3 22 cb 2e d8 e7 3f ff f9 33 0f 3f fc f0 17 f7 f5 f5 1d 92 d2 59 73 e6 cc 89 27 3d 69 95 4f 0e 00 00 00 00 00 00 00 a8 60 d5 aa 95 b1 cf 9c 39 f1 f8 e3 8f a7 ea 27 dd 5d 5d 5d c7 ef bf ff fe 4f 5f b8 70 e1 9c 42 a1 50 29 60 12 51 c3 ef f7 a3 ac ab b4 ed 68 9a 0d 8b 4c b9 2a 29 93 3d 7c 92 1b c7 f6 6a 49 38 55 da ae 62 3a ea 8f ff f8 8f 97 cf 9c 39 f3 f9 9b 37 6f 9e 59 7a 53 c4 31 c7 1c 15 91 92 58 a6 d9 Data Ascii: Lc\wGtww}4~.(tXry>;wuwwxZja\|00mI=PZ/{2Ok".?3?Ys'=iO`9']]]O_pBP)`QhL)=\|jI8Ub:97oYzS1X
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 91 97 d9 cc 99 59 18 65 de fc 79 31 af bf 10 bb 6e be 31 9e b8 fd d6 98 7f d6 2b 63 de ef 9d 35 ae 27 68 eb dd 97 c6 e6 9f fd 6b ec 3b 67 6b ec bb fc a0 88 7c d7 c8 b7 c3 8c 59 31 23 dd e6 cd 8f 05 fb f6 c7 ce 0d df 88 5f ff e0 86 58 70 cc 9f c4 bc 23 cf 1d d7 e3 5b ff f0 c3 f1 d0 43 eb 4a 63 33 3f 96 2f 5b 16 5d 5d 5d 31 3c 88 35 b3 34 76 e9 36 6f ee dc d8 77 f1 e2 d8 b2 75 6b fc fc 17 bf 88 43 0e 59 1a 4b 0e 3e d8 a7 3a 00 00 30 b1 d6 5c 1f f1 f0 9d 11 bf 4a f7 77 44 ec d8 14 b1 73 e3 c0 ba d9 8b 22 16 2f 8f 58 54 ba 2d 39 2e 62 e5 a9 a5 db 69 c6 0c 00 00 00 98 f4 52 51 86 4d 5b b6 a6 c2 17 33 07 55 3e 49 46 ab 7e 32 da 36 a3 55 3f a9 f4 b8 15 55 4f a6 34 d3 ee 0c 35 da 14 3b a3 05 57 c6 7a bc 67 9f 15 2b 97 47 a1 bf 3f f2 f9 7c d3 07 b9 f9 f3 9f 8b 4d Data Ascii: Yey1n1+c5'hk;gk\|Y1#_Xp#[CJc3?/[]]]1<54v6owukCYK>:0\JwDs"/XT-9.biRQM[3U>IF~26U?UO45;Wzg+G?\|M
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: fb 9f d2 15 52 26 63 f8 24 d7 c6 3e 1a 99 72 27 37 1e c7 d8 73 d7 cf 62 f6 9c 39 cd 57 3d 29 2b 57 17 29 b5 99 da 6e d6 ae c7 6f 89 39 b3 e7 ec 6d bb 15 c7 57 92 da 4c 6d 37 2b 55 27 99 53 7a ad ad a8 7a b2 e7 10 4b 6d a5 36 55 3e 01 00 00 5a 2a 4d 83 93 c2 20 b5 38 e1 75 63 6f 53 4b f5 93 24 85 5d 4c c1 33 69 ad 7d 70 5d dc b1 fa 9e b8 fe a6 1f 67 8f 01 00 00 60 aa 2a 16 0a d9 6f b5 69 ea 9d dd 72 51 7d ca 9d c1 db d5 b2 ac 1e a3 15 ac 98 76 53 f1 74 4f e1 d7 56 ed c2 c9 b5 b1 af 81 37 40 7f 7f b9 ec 4f 43 7a ef 5b 13 dd 33 67 0e 6a b0 89 10 45 da 77 f7 b1 a4 36 53 db cd ea dd 70 77 cc d8 6f e6 88 6e 9a 38 b4 cc 8c 59 a5 e3 fb f5 dd 4d 1f df f6 ed db 63 ee dc b9 2d bf c8 66 74 77 c7 c6 0d 1b 7c c2 03 00 00 ad 71 db 65 b5 4d b5 53 b6 ea f4 da b6 49 b7 5f Data Ascii: R&c$>r'7sb9W=)+W)no9mWLm7+U'SzzKm6U>ZM 8ucoSK$]L3i}p]g`oirQ}vStOV7@OCz[3gjEw6Spwon8YMc-ftw\|qeMSI_
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: c5 cb 62 5e 7f 21 22 2b 1f 54 6c ac cd dc a0 f7 5e a9 ad 8d bb 76 c5 81 a5 b6 9b 35 7b c9 a9 f1 c8 9d ff 1c 0b f6 ed 4f 73 0c ed 39 b6 7a 0e 71 ef a1 e5 06 46 b1 d0 1f 9b b6 f4 c5 41 a5 b6 9b b5 68 e1 a2 78 e0 c1 87 62 df c5 8b b3 f2 4b e9 2f e9 8a 0d 9e 8f 72 80 25 25 e9 b6 6c d9 12 2b 96 2d f3 09 0f 00 00 34 6e cd f5 03 d3 ee 34 6a e7 c6 88 4b 9f 13 71 ee b5 11 4b 8e af be ed 89 af 8f f8 ee df 95 fa bb af b6 76 d3 b1 ad 3c ad ae c3 b9 fe e6 5b 46 2c 7b ed 59 67 c6 86 4d 9b e3 86 9b f6 ae 4b 53 ef 7c ed 9a 6b e3 b5 af 38 73 cf b2 3f 78 f3 9f 95 96 6f dd f3 fc c2 0b ce ab 18 ac 18 ec 03 1f fb 44 a9 dd 5b f7 3c ff 9b 77 9c 1b a7 3d eb 19 7b 9e 5f f6 95 2b b3 a0 cb e0 be 93 14 ce 48 53 d4 bc f5 0d af 2a f5 31 7a c5 cd eb 4b fb 7d f0 63 97 c4 1d ab 7f 3e 64 Data Ascii: b^!"+Tl^v5{Os9zqFAhxbK/r%%l+-4n4jKqKv<[F,{YgMKS\|k8s?xoD[<w={_+HS*1zK}c>d
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: f2 8a 7d 55 0a ba 94 fb 4a 15 51 2a 05 27 8e 3d fa 88 ac fd e5 87 2e 19 b1 2e 05 48 06 bb f8 b3 5f 1c b1 cd a9 27 9f 14 7f 53 7a 0d af 79 f9 4b 86 b4 51 9e c6 a6 1c a4 49 61 9b 74 5b 38 ec 3b 63 7a 5e 5e 97 6e 69 da 9b 0b 2f 38 bf ea 98 de 39 ec 75 a4 31 1a 3c ad 50 3d 5e f2 fc d3 86 1c f3 ff dc f3 8b 51 b7 4d a1 97 5a c6 ed ca 6b ae 1b 12 10 4a ed fe c5 07 3f 32 62 fc d3 d8 5d fa a1 bf cb 2a dd a4 5b 1a c3 21 6f 83 4d 9b e3 8c 57 bf c9 e7 01 00 00 00 63 2a f4 f5 47 7f 7f 7f 3b ba ca 19 ed da 4d b6 f0 c9 a4 4d 12 a5 79 a7 5a 61 de ef 9d 15 0b df f0 47 f1 c0 da b5 a9 fc c6 b0 8a 26 51 39 dd 31 b8 42 4a 69 9f b4 6f 6a 23 b5 d5 6a f3 8e 3c 37 16 3d fd af e2 fe 35 6b f7 56 40 c9 6e b9 91 c7 56 be a5 75 e5 ed 4a fb a4 7d 53 1b a9 ad 56 5b 72 f0 c1 b1 7c d9 61 Data Ascii: }UJQ'=..H_'SzyKQIat[8;cz^^ni/89u1<P=^QMZkJ?2b][!oMWc*G;MMyZaG&Q91BJioj#j<7=5kV@nVuJ}SV[r\|a
2024-02-22 12:07:35 UTC	1369	IN	Data Raw: 66 5b 8f 6f c1 82 f9 d9 ed a0 03 0f 8c 8d 9b 36 c6 96 2d 5b 63 e3 86 0d b1 2b 05 78 d2 f1 cf 9c 19 fb ec b3 4f 2c 5a b8 20 56 2c 5b 16 f3 e7 cf f3 41 0e 00 00 b4 5e 0a 80 8c 55 61 24 ad ff ee df 0d 0d 97 54 f2 fc f7 0e 4c c5 73 f5 9f 0d 84 4f d6 fd 64 20 80 92 a6 e6 19 1e 34 29 57 3f f9 ee 7b ab 1f 5b 8d be 7f f3 ad 43 9e a7 e9 61 2a 85 0e 52 58 23 ad 4b 95 52 ca fe e5 33 97 c7 05 83 a6 c1 49 01 95 c1 53 f8 94 03 09 e5 4a 25 97 7d e5 ca 11 6d 56 ea 2b 85 4d 2e fb af ab e3 7f 56 df 1d d7 df 74 eb 88 c0 4a 35 e5 e9 61 86 4f e1 93 c2 2b 77 bc ef c2 38 bf 74 3b fe e8 23 e3 4f df 78 76 9c 53 61 2a 9a 56 59 b6 74 c9 90 e7 1b 9b 08 66 6c da 52 fb be d5 82 29 d5 0c 3e af c9 95 d7 5c 17 b3 57 3e bd ae 36 ee 7b e8 a1 38 6e e1 91 3e 1b 00 00 00 a8 a8 58 28 44 3e df Data Ascii: f[o6-[c+xO,Z V,[A^Ua$TLsOd 4)W?{[CaRX#KR3ISJ%}mV+M.VtJ5aO+w8t;#OxvSaVYtflR)>\W>6{8n>X(D>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	50125	142.251.40.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:35 UTC	1352	OUT	GET /ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://4711400.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:35 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	50127	142.250.80.66	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:36 UTC	1105	OUT	GET /ddm/fls/z/dc_pre=COOA6870voQDFQWKfwQdNcALDg;src=4711400;type=globa0;cat=avast0;ord=1;num=834445146105;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-computer-virus;u8=;u17=link;ps=1;pcor=146869136;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-computer-virus HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:36 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:36 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:36 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	50137	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	602	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:39 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:39 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c25dc994263-EWR
2024-02-22 12:07:39 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	50138	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	1317	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source;navigation-source, trigger Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:39 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"8782932854740061077","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	50136	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2946	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/infobox_corner.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://academy.avast.com/hubfs/Avast/Academy/assets/css/redesign.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:39 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:39 GMT Content-Type: image/svg+xml Content-Length: 220 Connection: close CF-Ray: 85971c2728831912-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 501279 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "e05c250261453d8437f2c957a7423b1b" Last-Modified: Thu, 19 Oct 2023 13:56:57 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 b5b0850774f11b0c2514532a2d3bdc44.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: U1EAnSs0yyHLShjgTfex4uaGlLCgAyFH8Uwpe8jfX_8Fp2ihgHI9hQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: Tk0anphcgEcRVYJIebaNCrOzZ06N2P74bOhQkUFv/Ucq1DanI8agoZ9hsJ9YSJ/TmiTGrJk7UMg= x-amz-meta-cache-tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1642494856538 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 79V69RSGAPG7CEZM x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: nlB3DP4T8p_xXq7bXhv9f1YlmL9K1Zp4 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:39 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 61 4a 64 58 34 78 48 53 70 6b 69 48 6c Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aJdX4xHSpkiHl
2024-02-22 12:07:39 UTC	220	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 35 32 22 20 68 65 69 67 68 74 3d 22 35 31 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 32 20 35 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 32 20 34 39 2e 35 30 31 56 31 2e 35 30 30 39 38 48 35 30 22 20 73 74 72 6f 6b 65 3d 22 23 46 46 37 38 30 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0d 0a 3c 2f 73 76 67 3e 0d 0a Data Ascii: <svg width="52" height="51" viewBox="0 0 52 51" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2 49.501V1.50098H50" stroke="#FF7800" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	50140	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:39 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:39 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c28a9780f83-EWR
2024-02-22 12:07:39 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	50142	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2964	OUT	GET /hs-fs/hubfs/New_Avast_Academy/What%20is%20Malware/What_Is_Malware-Hero.png?width=1200&name=What_Is_Malware-Hero.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:39 UTC	1238	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:39 GMT Content-Type: image/webp Content-Length: 64968 Connection: close CF-Ray: 85971c299c941a03-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfJw52PqHuz-8-Z2pQjf8HkTRmp_JT3RFRkAkfKe_HDQ:5cd4a4727476ae6ed6932770a63db0a0" Last-Modified: Mon, 16 Sep 2019 13:12:51 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 19573252c5c774150e1e56391f71cc12.cloudfront.net (CloudFront) cache-tag: F-13473038854,FD-12448744162,P-4650993,FLS-ALL cf-bgj: imgq:86,h2pri cf-resized: internal=ok/m q=0 n=180+0 c=11+70 v=2024.1.3 l=64968 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JqfDZLfcV%2F411YnALAGAuE1z6gTW6VS2DsGuc7X3kvh1aypsMG5JaBCcACAhBmJfVUkXNoXsMVcDJVkTeSHAAIDSI44eLafxRD4QN%2FvECeeSHcPR0Imoy0gE18llYIq0FF4q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:39 UTC	131	IN	Data Raw: 52 49 46 46 c0 fd 00 00 57 45 42 50 56 50 38 20 b4 fd 00 00 30 34 02 9d 01 2a b0 04 b9 01 3e 49 22 8e 45 22 a2 21 13 ba 45 0c 28 04 84 a6 ef c3 11 6e da 1c 08 9e 0f f6 f7 a2 1f 4b ff 6f c0 df c9 ef 7e 59 00 f0 c6 ce 03 f8 3e 65 7f e8 d9 25 67 a4 f7 1a 71 9c aa 83 a7 1f ff 3d fe 0f f7 23 c9 46 5b f5 7f e4 ff c1 fe d6 ff 70 f7 ae e6 1e eb 7d 3b f7 9f f2 ff ec bf c3 7c da ff 2f b7 bf 7f ff 89 Data Ascii: RIFFWEBPVP8 04*>I"E"!E(nKo~Y>e%gq=#F[p};\|/
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: e5 21 eb 3f af ff d4 fe ed fe 8f f7 0b e8 67 fa 4f f9 9f e6 3f ce 7c 14 ff 17 fe d7 fe e7 e7 ff ff ff b0 2f ed 1f d9 ff ea ff 76 ff 27 f1 67 ff 37 ee 77 b8 df de 4f 50 3f d3 3f c8 fe e3 ff e0 f8 54 ff 33 ff ab fc 57 fa 9f ff ff f9 3e 84 ff 46 ff 1b ff bf fc 97 fb df ff ff 40 1f d1 7f cf ff fe f6 4f ff 4b ff 7f fd 67 ef ff fd 6f b2 6f e7 bf e4 ff f3 7e 7f ff f5 fb 0f fe 47 fd 8f fe ff e7 ff fc 8f a9 7f fb ff ba 5f f9 7e 52 7f be ff d2 fd cf ff c1 f2 59 fd f7 fe 2f ff ff fb ff f9 3e 00 3f fc 7a 80 7f e7 ff ff d9 9f e8 bf dc 3f c4 ff 6d f5 9f df df de 3f bd fe c2 ff 7d f4 5f f1 ff 9e ff 1b fd c7 fc 9f fa ff f1 1f b7 3f 23 df e8 f7 e5 f5 8f eb 3f ef fa 09 fc d7 f0 cf e9 7f c3 ff 95 ff 87 fd ff f7 6f ef 37 f3 ff f1 ff cc 7e 4b fa 23 fa d7 f1 3f ef ff c9 fe f3 Data Ascii: !?gO?\|/v'g7wOP??T3W>F@OKgoo~G_~RY/>?z?m?}_?#?o7~K#?
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: 8f 99 d5 fb 0e 11 1d 93 bf cc ea fc f0 1e 75 fc 0e 23 c2 db f1 8d fa 23 b2 77 f9 9d 5f c1 7d 6f d1 1d 99 bb b7 08 43 6e 14 6e 4c d8 e0 88 9a 0f f9 ce 29 af 95 73 bf da e2 e7 7f 9a c1 ce ff 6c 36 c6 fd 3a ad 9d fa 23 b2 77 f9 9d 5f 9d fa 23 b2 d0 55 ce ff 55 6d af 92 ce 89 43 48 f0 45 92 e6 fb 1d ee 11 d9 95 b8 bb 53 d3 66 a6 0b eb f3 bf 4e ab 67 6c 00 4f 3c df 02 de 45 bb f4 47 92 c3 88 ea fc ef d1 1d 93 bf cd 21 5f 6e ff 33 ab f3 aa 8f 5b 8d 3f 24 ed bd 42 21 80 07 f3 8c 3c 26 ef 53 0f 5a 8e 59 5c f0 f8 b5 aa b7 3c 55 70 24 29 5b ff 97 95 bb 54 da a4 91 31 85 f4 56 35 d7 74 6d f1 53 31 7c ce 6a 7d 9a 86 6d a5 00 17 34 6a d7 f3 39 1b bd 25 86 91 49 e5 bc 0c ca 88 29 22 28 cc 2c 52 00 04 ce d3 ae e6 bb 14 8e 15 d9 0d 89 fa 03 a0 58 91 d1 5d 46 40 58 34 9c Data Ascii: u##w_}oCnnL)sl6:#w_#UUmCHESfNglO<EG!_n3[?$B!<&SZY\<Up$)[T1V5tmS1\|j}m4j9%I)"(,RX]F@X4
2024-02-22 12:07:39 UTC	290	IN	Data Raw: 21 d6 96 6e 48 60 cf c1 80 7c f2 19 17 7d dd 74 f1 76 bd 9a 06 98 b8 8c 6e 9b 5b 56 44 c6 b2 c9 fb 4a ce 11 21 7e 2c 83 40 0f 4e 8d 15 bf 93 bd cb aa cb d8 97 e2 ad f4 bd 80 ce 7a 15 79 de e3 51 0d ae b6 8e 95 08 60 b8 6a d1 9d 2a 2a 13 b3 df f2 56 3b d0 ca f5 8b 61 9a 97 d6 00 e6 09 ca 11 54 7c 89 47 2f 4c 0e b2 f1 2b ad 7c d6 20 f1 53 90 96 b3 63 c9 90 f1 79 2e 31 50 39 39 8d 6b 6a 56 81 c6 b5 b5 83 cb 5a 43 b5 30 44 bf e3 be 76 60 ea da e9 94 98 f5 77 ed 3a cb 62 48 d5 60 71 33 39 5c 73 a9 dc 39 e1 21 87 f7 e6 2e 1f 25 a4 3c c9 78 62 f0 dd 7e 77 e8 8e c9 df e6 cc ea b6 3e a9 c2 70 3a ef 1d f5 5b 1c 07 9d 7e 7c 78 ee e3 df 41 81 e5 53 9c 44 d4 44 80 71 ea 0b a6 5c ec 77 b8 fd 07 45 49 13 53 83 eb 53 5e b6 27 44 cc 63 82 26 60 36 67 2a e7 85 ce 1d fe 6c Data Ascii: !nH`\|}tvn[VDJ!~,@NzyQ`j*V;aT\|G/L+\| Scy.1P99kjVZC0Dv`w:bH`q39\s9!.%<xb~w>p:[~\|xASDDq\wEISS^'Dc&`6gl
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: 8b 1f 69 f7 59 c2 3d 53 84 79 00 5e e1 1d 63 ca 2a 7c 32 1f c4 cc a2 02 fc bf 5f 5f a7 bf 26 2c 8f b9 ba 33 55 6e 04 e5 83 30 a5 80 b1 28 36 8a f6 2b a6 4a 94 f8 f8 e0 6e 55 ad 17 64 77 38 f5 e5 29 bc 07 3e 91 0f ae 61 72 8e ac b4 4e 41 b0 d1 8f d9 95 80 b1 b2 03 32 dc bd 97 b6 73 2f 97 3e 1a 35 8e 8d 74 13 77 17 2d 8a c2 5b 72 b7 a1 d3 98 1b 66 39 b9 ea 5b 75 dc f2 32 54 7d 51 a4 5d 1e 7f b2 8a f5 2e 58 4f e2 65 06 af df 6f 4b e8 65 f7 0d 66 2a e4 7f f3 1f 90 18 96 d4 12 99 f1 af 2e 69 7e 8b 1a 40 02 e5 0e df 6d 76 9d ce 36 49 c9 b0 94 0a ab fb ef fe 70 71 3e 2c 55 59 21 07 74 0d ab 62 3e 91 b5 30 1e 4f e2 07 18 40 98 4e 86 ca b5 2a 49 a7 17 b2 69 bf 2a c4 d7 e3 77 80 36 60 1e ce da 16 e3 3a 76 5d 47 9b cf d7 a1 af 9e fb 34 ad c1 cf cc e8 75 5b a5 60 16 Data Ascii: iY=Sy^c\|2__&,3Un0(6+JnUdw8)>arNA2s/>5tw-[rf9[u2T}Q].XOeoKef.i~@mv6Ipq>,UY!tb>0O@NIiw6`:v]G4u[`
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: ef f3 3b b7 54 a3 a0 2e 66 1e 48 57 f8 80 00 fd 1b 91 0e 75 86 62 4e 4a 6e 04 4f 60 cc 46 4c fd a8 0b 62 50 f3 1e f2 75 76 c7 b3 d0 90 0c 0e 50 99 09 6d 9a 04 dd e9 bf f9 11 7b 64 5f 0e e7 6a 14 af a2 0f 47 3e 6a 00 1d d5 e1 50 62 61 f8 56 4b 3b 92 9e 11 e9 be 77 af 0d 15 33 4c f9 76 11 d2 b8 b9 0f 66 59 86 6b 67 0b 77 e6 f7 e6 5a 87 68 49 8f 29 96 0d 9a a4 ff f1 2e e6 7a 91 a3 51 e5 5b 45 6c ca 6f cb dc 17 0d f2 20 f3 c3 d2 5c 49 b9 d2 6e 63 d2 51 c8 9a cf 39 3a 2d 60 7f a7 05 fc bc 5d d2 b5 45 2c 02 25 ad f1 85 b1 12 d4 1a 2f a5 f2 ef 61 d3 b2 18 9a 71 c7 08 44 b4 92 55 7e 1c 07 5d b9 a1 21 0d 35 e0 ef 91 60 06 eb ea 00 10 7e df 30 a0 59 bb fd 78 47 f5 ea b5 38 ae fa 62 34 fd fe 79 b9 4b 43 89 43 a9 d6 d0 76 4f 23 71 1a 7e 11 f9 02 21 df d1 de d9 da cb Data Ascii: ;T.fHWubNJnO`FLbPuvPm{d_jG>jPbaVK;w3LvfYkgwZhI).zQ[Elo \IncQ9:-`]E,%/aqDU~]!5`~0YxG8b4yKCCvO#q~!
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: cf b2 d9 98 9f ed 3b 2a f2 1a 25 93 5f e2 f7 08 cb e6 61 60 71 42 cf 78 eb 46 27 18 00 26 35 6b a8 ba d4 ab 88 9b ef 1c db e9 44 51 75 16 56 60 15 90 31 89 81 18 f4 26 f4 e3 c5 09 e5 7e 65 5a 56 27 f8 ee 9f a5 64 72 91 20 7f 52 0f f7 3d 4b a6 68 86 9e ca a0 09 95 da ba 69 29 2f 8b 46 34 36 7f 00 09 c1 9a bd f2 6a ff 0d 8f 87 36 11 4c 83 01 3b cd bb ba f9 1d 69 0f b6 03 ee d7 72 4f b6 f9 d4 3c b8 7f 14 04 78 40 61 08 a3 c2 2f cf b2 d2 04 28 26 a7 c0 ef 94 d5 b3 78 f4 7e d6 81 c9 bf e4 57 fe 5b 83 29 72 df 2c dc 71 73 29 91 3b 7e 7c b1 34 85 17 82 05 f0 72 1b 65 ca f0 a1 d9 e4 2f 46 93 72 33 ee fd 80 36 0e 65 97 3b 35 d2 df e6 91 13 2e 76 43 60 ec 11 bf 5a 96 49 ce bd e0 6f 8f 58 09 87 cc 28 23 07 b9 2e a8 0a 4a c6 66 f4 19 9d fa 4f 19 99 bf a2 46 e8 ad 33 Data Ascii: ;*%_a`qBxF'&5kDQuV`1&~eZV'dr R=Khi)/F46j6L;irO<x@a/(&x~W[)r,qs);~\|4re/Fr36e;5.vC`ZIoX(#.JfOF3
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: 59 e1 67 f3 46 d7 e0 e0 95 74 b7 af 45 51 72 09 6a 65 83 d1 88 64 2b e8 56 05 da 22 99 2d 4d 80 cb 4e 14 b2 7d 99 c1 84 e2 2a 81 0a 4c f4 aa 65 cf b9 07 76 0d 57 01 5d 2e 96 6e 83 89 72 bd 6b 32 81 08 97 47 d0 c3 8f 27 38 08 8d 1c f1 75 41 ef 35 7f 74 ed 3d a8 2d 8f b4 c9 97 7f 99 f0 8c e2 0e 97 2e 78 a2 37 90 4b 91 86 c5 49 63 94 20 29 85 e6 94 9e e3 9b c9 14 28 83 5c 88 ac b1 06 49 cb c5 b8 06 f8 2c aa 00 6e 89 d0 2c 9d cd 26 aa 17 70 81 1c 7f a2 31 d2 ad 6e aa 2d d0 a5 a8 88 43 ec 67 69 f9 02 e5 35 00 46 b2 0b 3e 1c da fc 64 c3 4a e3 85 59 82 19 32 ee cc 77 91 0e 4e 63 9e ca c6 c9 55 55 d4 31 e3 35 7f 88 01 b3 3a 5d 26 f1 48 0b 92 07 97 3d da 19 52 4b 72 69 d9 22 28 81 41 8f 7c 97 6e ba 9d cb ba 69 1f db 6e 21 98 73 7b 58 b4 61 45 fc a0 80 ad 28 8b 6a Data Ascii: YgFtEQrjed+V"-MN}*LevW].nrk2G'8uA5t=-.x7KIc )(\I,n,&p1n-Cgi5F>dJY2wNcUU15:]&H=RKri"(A\|nin!s{XaE(j
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: 91 2a b4 30 e1 13 e1 13 0c 5d e6 57 45 7d 08 9c ac 7a 70 25 6a cb 43 76 9b e4 d1 80 01 ca 72 01 bf a8 17 3b 18 11 bc c1 f6 38 c3 d7 4c f2 1b 22 99 06 33 e9 1a 92 d6 2c ae 21 60 1d b3 13 5f c1 21 b4 85 f2 1c d3 41 79 f6 cb e8 42 bd 58 c2 66 82 68 88 b6 26 b8 55 4e 5f 48 ca 53 03 8b 67 77 69 65 6a f5 ec 12 8e 93 17 25 f8 45 f5 c9 6a 1b 19 07 55 5d c0 8f 81 3d a6 6e e4 8e da ab de 94 74 ad 39 e0 eb 9d 99 93 51 41 52 ff 23 68 42 bc c0 74 5c 17 6d 86 5e c2 d6 5b b1 d0 78 29 79 18 6c 27 2f 67 5e ba 24 a8 97 35 17 66 84 29 0d 8e 84 6b 95 c6 fb d0 ee 46 e9 16 77 fb 6f 3a f3 d0 a8 ee 80 ad a0 95 d3 83 dd 56 d2 81 80 58 91 35 f2 a3 0f 3d 99 e5 ad cc 3c b7 46 77 11 d6 5d c7 c2 17 0f 46 da ba a7 96 ef 51 57 e5 22 6c eb f9 89 b2 d9 f3 1b 34 d3 57 81 2b 06 50 2f a7 ef Data Ascii: *0]WE}zp%jCvr;8L"3,!`_!AyBXfh&UN_HSgwiej%EjU]=nt9QAR#hBt\m^[x)yl'/g^$5f)kFwo:VX5=<Fw]FQW"l4W+P/
2024-02-22 12:07:39 UTC	1369	IN	Data Raw: 6d f3 ce 31 57 f1 f5 d0 bc dd ee 62 77 d8 67 9d f3 b7 7c 00 58 91 81 92 26 24 c4 ca 8a 8c 89 b9 ad 3f cd ca f1 4e 4d ea f4 61 88 f3 02 b5 b9 df 6a 01 15 d9 7e dd b1 7f a1 30 8d 10 b5 33 5d f1 45 7e d8 5e 57 08 48 b2 da cc 54 40 e3 f1 d1 d1 fa a0 d9 40 0c 9f ac 20 95 6d 85 6d 4c f4 f2 60 c5 14 7a ac d2 60 87 06 b4 c8 0b 1a 6a 39 1c 0b 14 b6 62 ec ad 20 88 bf f6 71 f8 44 76 77 d9 9c 8a 96 00 7a 6d da 17 74 4d 2f 90 92 24 0c 75 7a 44 1f 65 83 97 b1 c1 c7 2a 3f ee 8a 14 d3 fe b3 62 84 9b 42 51 a2 79 1f df a7 19 be ca 5a 79 13 27 1d 1e 3c 16 aa 43 46 1a 65 86 60 b8 08 1e 2c 4b c9 53 3b db be d9 07 df f7 d3 65 6a c7 eb 2d 9f a9 25 33 5f 0b ae c7 16 12 c0 4c 32 f2 e0 5c a8 2f c3 7a a2 d6 59 d1 1a 4c 2e a4 0c 63 39 eb 05 86 55 08 88 54 21 07 ba b9 14 d7 84 e0 67 Data Ascii: m1Wbwg\|X&$?NMaj~03]E~^WHT@@ mmL`z`j9b qDvwzmtM/$uzDe*?bBQyZy'<CFe`,KS;ej-%3_L2\/zYL.c9UT!g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	50143	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	3025	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/PC-editors-choice-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F" If-None-Match: "5c90960290145851dc3d17bdf94b91fa" If-Modified-Since: Thu, 05 May 2022 10:21:41 GMT
2024-02-22 12:07:39 UTC	1353	IN	HTTP/1.1 304 Not Modified Date: Thu, 22 Feb 2024 12:07:39 GMT Connection: close CF-Ray: 85971c2998d941e9-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 313082 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="PC-editors-choice-icon.webp" ETag: "5c90960290145851dc3d17bdf94b91fa" Last-Modified: Thu, 05 May 2022 10:21:41 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 cd691f5232ad8151e816e4693db0dfac.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3877 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: QIfpz7oCMISlPd5HYIeQMixTX-TD1suifkkzmdFeIdHcSpWFd7gO9g== X-Amz-Cf-Pop: JFK52-P1 x-amz-id-2: pvulnfW0hOVXqQpoMgtpvNl+SIlSyHTOfHTyGu+VlwVZfc81pFW8MNkV2B2d5GMbdDzM5xrZ01g= x-amz-meta-cache-tag: F-72443436447,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651495281049 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: TDFJC85E4H9RWQ3Z x-amz-server-side-encryption: AES256 x-amz-version-id: z1wggTVnGRhq57s9cuSgN5DWgYCAohSo X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:39 UTC	546	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 56 4e 57 43 6d 67 25 32 46 31 61 49 35 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VNWCmg%2F1aI5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	50144	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2786	OUT	GET /hubfs/New_Avast_Academy/awards_icons_academy_new/AV-Test-Top-product-icon.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F" If-None-Match: "b9ec31f25d243816b9b40fbe06bba666" If-Modified-Since: Mon, 02 May 2022 10:43:06 GMT
2024-02-22 12:07:39 UTC	1347	IN	HTTP/1.1 304 Not Modified Date: Thu, 22 Feb 2024 12:07:39 GMT Connection: close CF-Ray: 85971c29b85f42d3-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "b9ec31f25d243816b9b40fbe06bba666" Last-Modified: Mon, 02 May 2022 10:43:06 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 7bf47dc1c691ee43f7c8db83aa03a3cc.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=2376 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL X-Amz-Cf-Id: 9NgIA3yhAOmHDCgRkha4xdQijiHI3rS_B44UgU3-pW69g5gDcPRzWw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: 3HEMefBm0rH1qNajv9riDmGBWfq2kDZ66vf6HeNNCll15vqOKYfFBWfbrZuNp15Q2DbNppvzqq8= x-amz-meta-cache-tag: F-72061125011,FD-72060929107,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1651058867058 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: HH2Y8MM05PP58GJ1 x-amz-server-side-encryption: AES256 x-amz-version-id: Zaz8GjCKoojsfqdaqPIDhQQqklNHofl2 X-Cache: RefreshHit from cloudfront X-HS-Alternate-Content-Type: text/plain X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3
2024-02-22 12:07:39 UTC	459	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 6a 45 57 38 70 32 56 44 4c 30 34 47 63 5a 25 32 42 5a 35 33 34 54 39 77 5a 41 65 36 61 4f 44 34 50 68 5a 6e 78 31 75 5a 41 31 74 6d 48 59 38 30 30 68 34 65 4d 49 4e 25 32 46 64 55 53 50 67 25 32 42 69 78 39 34 25 32 46 6a 38 66 45 39 47 4a 6b 78 37 63 34 70 35 36 51 66 65 44 42 57 32 6b 45 58 30 6d 4b 33 Data Ascii: X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jEW8p2VDL04GcZ%2BZ534T9wZAe6aOD4PhZnx1uZA1tmHY800h4eMIN%2FdUSPg%2Bix94%2Fj8fE9GJkx7c4p56QfeDBW2kEX0mK3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	50145	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2663	OUT	GET /hubfs/Avast/Academy/assets/i/helpers/infobox_corner.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:39 UTC	1333	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:39 GMT Content-Type: image/svg+xml Content-Length: 220 Connection: close CF-Ray: 85971c29decac461-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 501279 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "e05c250261453d8437f2c957a7423b1b" Last-Modified: Thu, 19 Oct 2023 13:56:57 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 b5b0850774f11b0c2514532a2d3bdc44.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL X-Amz-Cf-Id: U1EAnSs0yyHLShjgTfex4uaGlLCgAyFH8Uwpe8jfX_8Fp2ihgHI9hQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: Tk0anphcgEcRVYJIebaNCrOzZ06N2P74bOhQkUFv/Ucq1DanI8agoZ9hsJ9YSJ/TmiTGrJk7UMg= x-amz-meta-cache-tag: F-64133824855,FD-21313625078,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1642494856538 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 79V69RSGAPG7CEZM x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: nlB3DP4T8p_xXq7bXhv9f1YlmL9K1Zp4 X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:39 UTC	544	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 25 32 42 41 67 6b 79 76 5a 55 70 64 52 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BAgkyvZUpdR
2024-02-22 12:07:39 UTC	220	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 35 32 22 20 68 65 69 67 68 74 3d 22 35 31 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 32 20 35 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 32 20 34 39 2e 35 30 31 56 31 2e 35 30 30 39 38 48 35 30 22 20 73 74 72 6f 6b 65 3d 22 23 46 46 37 38 30 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0d 0a 3c 2f 73 76 67 3e 0d 0a Data Ascii: <svg width="52" height="51" viewBox="0 0 52 51" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2 49.501V1.50098H50" stroke="#FF7800" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	50149	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-01.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:40 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2562 Connection: close CF-Ray: 85971c2ac9734233-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 157699 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "18715d69ddd4017fca484c62932ee2d8" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 7edae070a6a25cc68c970c1111701a20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: VglvHeE_-CS2YMFLbzQ1z-yCdnJwHIv9eXt6Uk79HWF4B3ThmsJGbA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: PI6TnIKUndz/ha+HEkdoF8jCxkDTAjg7AfLGJbWIg1XXu2zbMJNtCv8ysM9ZoEvPffDmUpd0kVA= x-amz-meta-cache-tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721672 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 7CCM85GX6YGNAVV0 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: tTZjzQF1zWdr2YbqNlz_wz97NrjjxdhB X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	499	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 75 36 38 53 43 37 69 6e 46 36 47 42 47 66 49 67 4c 64 4b 6d 6d 73 33 49 36 4f 79 31 51 51 73 32 44 6b 25 32 46 69 25 32 46 67 51 52 71 6a 75 76 31 57 62 31 56 76 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u68SC7inF6GBGfIgLdKmms3I6Oy1QQs2Dk%2Fi%2FgQRqjuv1Wb1Vv
2024-02-22 12:07:40 UTC	870	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 6d 37 2e 33 39 30 35 2c 38 2e 38 33 37 35 68 31 36 2e 38 31 32 31 63 31 2e 34 31 32 32 2c 30 2c 32 2e 35 35 38 36 2c 31 2e 31 34 36 35 2c 32 2e 35 35 38 36 2c 32 2e 35 35 38 36 76 31 31 2e 38 32 37 38 48 34 2e 38 33 31 39 76 2d 31 31 2e 38 32 37 38 63 30 2d 31 2e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <path d="m7.3905,8.8375h16.8121c1.4122,0,2.5586,1.1465,2.5586,2.5586v11.8278H4.8319v-11.8278c0-1.
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 34 2e 33 33 38 32 2c 31 35 2e 36 36 34 31 63 2e 34 32 37 38 2e 32 34 37 35 2c 31 2e 30 30 34 36 2e 33 35 31 33 2c 31 2e 34 35 38 34 2e 33 35 31 33 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 20 78 31 3d 22 31 35 2e 37 39 36 36 22 20 79 Data Ascii: ke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m14.3382,15.6641c.4278.2475,1.0046.3513,1.4584.3513" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <line x1="15.7966" y
2024-02-22 12:07:40 UTC	323	IN	Data Raw: 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 39 2e 31 36 38 37 2c 32 36 2e 37 33 36 33 48 32 2e 38 33 31 33 63 2d 2e 39 33 39 39 2d 2e 30 39 35 37 2d 31 2e 33 33 30 36 2d 31 2e 32 31 31 37 2d 31 2e 33 35 30 31 2d 32 2e 30 32 32 37 76 2d 2e 30 35 39 35 68 32 39 2e 30 33 37 38 63 2d 2e 30 31 39 36 2e 38 31 34 34 2d 2e 34 32 38 38 2c 31 2e 39 33 32 2d 31 2e 33 35 30 31 2c 32 2e 30 38 32 32 5a 22 20 66 69 6c 6c 3d 22 23 65 66 66 31 66 32 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 Data Ascii: " stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> </g> </g> <path d="m29.1687,26.7363H2.8313c-.9399-.0957-1.3306-1.2117-1.3501-2.0227v-.0595h29.0378c-.0196.8144-.4288,1.932-1.3501,2.0822Z" fill="#eff1f2" stroke="#071d2b" stroke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	50150	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:40 UTC	1334	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2050 Connection: close CF-Ray: 85971c2adcad43af-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 243399 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "928ca01f2ee63c298cad657cdb7575dc" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 42cdf90926c91454b0e8865bb13f3962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: tbnvwx41ZO3R0Q4ugY4TFwGXl6tvuGMsDuvHnnnHgwiYJlqN3jJrJA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: qI5otDfjTsqB2GcocnpM1Cc3x4F8ILF5gM9SkbpRhM5tRnIFVaEzgUR3fV86GjqIp2Z6bJeGBAo= x-amz-meta-cache-tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721771 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 0MBYNSFT632KGF7M x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: YgQ11h.xoKDO5RlxlF2GcatWO0jMIsjM X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:40 UTC	552	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 30 4e 44 53 36 37 55 43 25 32 42 33 25 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0NDS67UC%2B3%
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 37 2e 32 34 38 35 2c 32 31 2e 38 34 39 36 76 31 2e 35 34 34 38 63 30 2c 32 2e 33 33 30 32 2c 31 2e 33 36 31 37 2c 34 2e 30 31 36 35 2c 33 2e 38 38 38 33 2c 34 2e 30 31 36 35 2c 33 2e 34 38 35 34 2c 30 2c 33 2e 38 33 35 38 2d 32 2e 32 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <path d="m17.2485,21.8496v1.5448c0,2.3302,1.3617,4.0165,3.8883,4.0165,3.4854,0,3.8358-2.2
2024-02-22 12:07:40 UTC	681	IN	Data Raw: 33 34 5a 6d 36 2e 31 36 36 37 2d 31 30 2e 39 31 36 37 63 2e 37 32 30 39 2e 31 33 37 2c 31 2e 34 31 30 39 2e 32 37 39 38 2c 32 2e 30 35 39 38 2e 34 36 33 35 2c 32 2e 36 30 39 32 2e 37 33 38 34 2c 33 2e 39 31 33 35 2c 31 2e 36 31 33 38 2c 33 2e 39 31 33 35 2c 32 2e 36 32 36 32 2c 30 2c 31 2e 30 32 39 39 2d 31 2e 33 30 34 33 2c 31 2e 39 31 34 2d 33 2e 39 31 33 35 2c 32 2e 36 35 31 39 2d 35 2e 39 31 31 36 2c 31 2e 36 33 34 35 2d 31 33 2e 30 33 38 32 2c 31 2e 36 33 34 39 2d 31 38 2e 39 34 39 38 2c 30 2d 32 2e 36 30 39 32 2d 2e 37 33 37 39 2d 33 2e 39 31 33 35 2d 31 2e 36 32 32 2d 33 2e 39 31 33 35 2d 32 2e 36 35 31 39 2c 30 2d 31 2e 30 31 32 34 2c 31 2e 33 30 34 33 2d 31 2e 38 38 37 38 2c 33 2e 39 31 33 35 2d 32 2e 36 32 36 32 2e 36 35 37 38 2d 2e 31 38 36 31 Data Ascii: 34Zm6.1667-10.9167c.7209.137,1.4109.2798,2.0598.4635,2.6092.7384,3.9135,1.6138,3.9135,2.6262,0,1.0299-1.3043,1.914-3.9135,2.6519-5.9116,1.6345-13.0382,1.6349-18.9498,0-2.6092-.7379-3.9135-1.622-3.9135-2.6519,0-1.0124,1.3043-1.8878,3.9135-2.6262.6578-.1861

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	50146	142.251.40.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	1002	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:40 UTC	2211	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"8782932854740061077","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	50152	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-05.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:40 UTC	1362	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 4118 Connection: close CF-Ray: 85971c2b382772a7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "2d20353cf7ab34148cea8990568f1752" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 42cdf90926c91454b0e8865bb13f3962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: FosDrCzUHsd-WP2bwLLQ8Kugj-4UboQAB87D_KdzB2mcK_Bt4DETHw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: rVC5RBmlsojalvSkHVUG1Q9R0504WWWW9LIkkTx0h2L8/lRgeMOSGvobpGoMbO6vbup0CsUUdDM= x-amz-meta-cache-tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721653 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: GP18HFAKWBPNDT5C x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: BlnosN6G9_ve2k2nqb1pRcJ9xO1JXyDt X-Cache: RefreshHit from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	499	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 71 71 4e 49 36 35 36 4d 41 61 4e 68 4a 74 39 75 79 6a 69 44 6e 38 59 6c 47 53 73 6e 66 42 73 32 69 57 66 33 70 38 5a 48 45 4a 6b 36 44 56 72 53 64 53 75 39 42 38 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qqNI656MAaNhJt9uyjiDn8YlGSsnfBs2iWf3p8ZHEJk6DVrSdSu9B8
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 37 34 35 33 22 20 79 3d 22 39 2e 31 34 31 31 22 20 77 69 64 74 68 3d 22 32 36 2e 35 30 39 34 22 20 68 65 69 67 68 74 3d 22 31 36 2e 38 38 32 38 22 20 72 78 3d 22 33 2e 38 33 37 39 22 20 72 79 3d 22 33 2e 38 33 37 39 22 20 66 69 6c 6c Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <rect x="2.7453" y="9.1411" width="26.5094" height="16.8828" rx="3.8379" ry="3.8379" fill
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 34 2d 31 2e 39 39 34 73 31 2e 39 39 34 2e 38 39 32 38 2c 31 2e 39 39 34 2c 31 2e 39 39 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 31 65 32 32 32 61 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 30 2e 35 30 33 35 2c 31 37 2e 38 31 36 38 63 30 2c 31 2e 31 30 31 33 2e 38 39 32 38 2c 31 2e 39 39 34 2c 31 2e 39 39 34 2c 31 2e 39 39 34 68 32 2e 37 34 37 34 63 2e 38 31 30 36 2c 30 2c 31 2e 34 36 37 36 2e 36 35 37 31 2c 31 2e 34 36 37 36 2c 31 2e 34 36 37 36 73 2d 2e 36 35 37 31 2c 31 2e 34 36 37 36 2d 31 2e 34 36 37 36 2c 31 2e Data Ascii: 4-1.994s1.994.8928,1.994,1.994" fill="none" stroke="#1e222a" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m20.5035,17.8168c0,1.1013.8928,1.994,1.994,1.994h2.7474c.8106,0,1.4676.6571,1.4676,1.4676s-.6571,1.4676-1.4676,1.
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 36 35 35 34 6c 2d 2e 33 37 32 38 2d 2e 34 38 36 34 63 2d 2e 33 34 31 33 2d 2e 34 34 35 32 2d 2e 35 32 36 32 2d 2e 39 39 30 35 2d 2e 35 32 36 32 2d 31 2e 35 35 31 34 76 2d 2e 36 37 39 32 22 20 66 69 6c 6c 3d 22 23 65 34 36 22 20 73 74 72 6f 6b 65 3d 22 23 31 65 32 32 32 61 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 32 2e 34 30 34 32 2c 32 30 2e 39 37 31 37 6c 2d 2e 35 39 33 36 2d 2e 31 35 32 34 63 2d 2e 35 34 33 33 2d 2e 31 33 39 35 2d 31 2e 30 32 35 35 2d 2e 34 35 34 32 2d 31 2e 33 37 31 39 2d 2e 38 39 35 34 6c 2d 2e 34 31 39 34 2d 2e 35 33 34 33 Data Ascii: 6554l-.3728-.4864c-.3413-.4452-.5262-.9905-.5262-1.5514v-.6792" fill="#e46" stroke="#1e222a" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m12.4042,20.9717l-.5936-.1524c-.5433-.1395-1.0255-.4542-1.3719-.8954l-.4194-.5343
2024-02-22 12:07:40 UTC	11	IN	Data Raw: 3c 2f 67 3e 0a 3c 2f 73 76 67 3e Data Ascii: </g></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	50147	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	635	OUT	POST /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive Content-Length: 1451 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.avast.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:39 UTC	1451	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 38 31 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 30 38 36 30 33 36 35 38 35 33 35 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 69 64 22 3a 32 34 30 2c 22 76 65 72 73 69 6f 6e 5f 67 75 69 22 3a 22 32 30 32 33 2e 30 31 2e 31 33 22 2c 22 76 65 72 73 69 6f 6e 5f 61 70 70 22 3a 22 31 2e 30 2e 30 22 2c 22 65 64 69 74 69 6f 6e 22 3a 32 2c 22 69 70 6d 5f 70 72 6f 64 75 63 74 22 3a 6e 75 6c 6c 7d 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 7b 22 6f 73 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 73 65 63 63 68 75 61 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 Data Ascii: {"record":[{"event":{"type":81,"subtype":1,"time":1708603658535},"product":{"id":240,"version_gui":"2023.01.13","version_app":"1.0.0","edition":2,"ipm_product":null},"platform":{"os":0},"browser":{"secchua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
2024-02-22 12:07:40 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: application/json Content-Length: 19 Access-Control-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:40 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	50151	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-06.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603652.0.0.0; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"
2024-02-22 12:07:40 UTC	1334	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2024 Connection: close CF-Ray: 85971c2b4c7e4398-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 236355 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "51730e5547db617f6f3517e9d2e11458" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: I_v5KXoaSy_vxdsRWNY4dvyWBFVmvXd73nk2DPoNYphKokyOJg7WqA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: gTljSZYF9M6GMxiTntaCkQsyqasuZHBd7kbVrvmfl0u9nKJp359Y0VPtM79e2f9kuLSu/l6BTTo= x-amz-meta-cache-tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721709 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 30CH3MMG1T8309QB x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: rebY07NTfU0aOxqPuGkgYHGI7Mka2WIJ X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:40 UTC	546	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 48 6b 6d 4c 34 33 45 6a 6a 25 32 46 59 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HkmL43Ejj%2FY
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 36 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 33 35 31 36 22 20 79 3d 22 37 2e 35 33 32 34 22 20 77 69 64 74 68 3d 22 32 37 2e 32 39 36 37 22 20 68 65 69 67 68 74 3d 22 31 37 2e 33 38 34 32 22 20 72 78 3d 22 32 2e 30 33 39 38 22 20 72 79 3d 22 32 2e 30 33 39 38 22 20 66 69 6c 6c Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_6" data-name="Layer 6" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <rect x="2.3516" y="7.5324" width="27.2967" height="17.3842" rx="2.0398" ry="2.0398" fill
2024-02-22 12:07:40 UTC	655	IN	Data Raw: 2c 32 2e 37 30 38 36 6d 2d 32 2e 32 32 30 31 2c 30 68 32 2e 32 32 30 31 6d 2d 32 2e 32 32 30 31 2c 30 6c 2d 2e 34 31 31 35 2c 31 2e 30 30 39 36 6d 32 2e 36 33 31 35 2d 31 2e 30 30 39 36 6c 2e 33 38 38 36 2c 31 2e 30 30 39 36 6d 31 2e 36 33 32 2d 33 2e 36 32 36 33 76 33 2e 35 31 31 35 68 2e 37 37 37 36 63 2e 39 33 31 32 2c 30 2c 31 2e 36 37 30 34 2d 2e 38 34 36 35 2c 31 2e 36 37 30 34 2d 31 2e 37 36 37 2c 30 2d 2e 38 37 38 35 2d 2e 36 33 31 31 2d 31 2e 37 34 34 35 2d 31 2e 35 31 30 33 2d 31 2e 37 34 34 35 68 2d 2e 39 33 37 37 5a 6d 2d 39 2e 31 33 38 35 2d 2e 35 37 31 36 76 34 2e 39 35 30 34 63 30 2c 2e 34 38 38 35 2e 31 39 34 33 2e 39 35 36 39 2e 35 34 2c 31 2e 33 30 31 39 6c 33 2e 34 39 38 2c 33 2e 34 39 31 63 2e 33 34 34 39 2e 33 34 34 32 2e 38 31 32 32 Data Ascii: ,2.7086m-2.2201,0h2.2201m-2.2201,0l-.4115,1.0096m2.6315-1.0096l.3886,1.0096m1.632-3.6263v3.5115h.7776c.9312,0,1.6704-.8465,1.6704-1.767,0-.8785-.6311-1.7445-1.5103-1.7445h-.9377Zm-9.1385-.5716v4.9504c0,.4885.1943.9569.54,1.3019l3.498,3.491c.3449.3442.8122

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.4	50148	142.251.40.166	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:39 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 136 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:39 UTC	136	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 76 61 73 74 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 38 37 38 32 39 33 32 38 35 34 37 34 30 30 36 31 30 37 37 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://avast.com","trigger_debug_key":"8782932854740061077"},"type":"trigger-no-matching-source"}]
2024-02-22 12:07:40 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 22 Feb 2024 12:07:40 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.4	50155	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1141	OUT	GET /stats/TrustboxImpression?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-malware&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:07:39 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e6fc68fd040718147cda2e3ef6f63636.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: SJIiJValiF3bnu5Omw_Ts-mPGYQ7aqWS3Z2nMpRz9ICoZ5TsOB_6Fg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.4	50154	13.225.214.12	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1135	OUT	GET /stats/TrustboxView?locale=en&theme=white&styleWidth=160&stars=1%2C2%2C3%2C4%2C5&noReviews=hide&scrollToList=true&url=https%3A%2F%2Fwww.avast.com%2Fc-malware&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&language=en-US&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Host: widget.trustpilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?templateId=5419b6ffb0d04a076446a9af&businessunitId=46d31466000064000500a775 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Thu, 22 Feb 2024 12:07:39 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 78151a5252ddc63300143dbe81b1f0c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR50-C1 X-Amz-Cf-Id: 1plgrXTFU-YWn1hZAPu_bEzERkosQYLLoaoLzo4MZgChG0xWuzhdQA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.4	50157	142.250.65.194	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1346	OUT	GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:40 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:40 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-22 12:07:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.4	50158	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:40 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2167 Connection: close CF-Ray: 85971c2cb8a44240-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 157699 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "7c914298239cf721327de260c143da58" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: jhWiQEeQ422_B0FgmAc59ZuNfr80bL03mzyCDu-jLPWKLC__FGppcQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: fYTtMKc556U8ItUYFqnuL/WzwRfWUHn7Wy9+MeIUSEgiIwgODMEWomqcqLZFO4jCLjAemHrHmT4= x-amz-meta-cache-tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721623 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 7CCG84119BCRBR0S x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Nm6pUoWOXZXqi4yYCSLqrc4_OBhD1YWj X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	507	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 59 6c 75 34 39 6e 74 67 79 68 32 51 64 54 79 55 33 51 57 79 73 7a 75 6b 48 73 6e 67 79 71 65 52 41 66 43 4e 38 57 74 4c 59 31 61 30 43 79 4b 50 65 25 32 46 33 59 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ylu49ntgyh2QdTyU3QWyszukHsngyqeRAfCN8WtLY1a0CyKPe%2F3Y
2024-02-22 12:07:40 UTC	862	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 39 2e 38 38 34 31 22 20 63 79 3d 22 32 36 2e 33 38 38 38 22 20 72 3d 22 31 2e 33 39 38 38 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 31 37 2e 34 33 37 38 22 20 63 79 3d 22 32 36 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <circle cx="9.8841" cy="26.3888" r="1.3988" fill="#fff"/> <circle cx="17.4378" cy="26
2024-02-22 12:07:40 UTC	1305	IN	Data Raw: 37 39 38 2e 32 35 39 37 2e 32 37 30 31 2e 35 36 34 36 2e 32 37 30 31 2e 39 31 35 34 2c 30 2c 2e 38 34 36 36 2d 2e 36 39 33 31 2c 31 2e 35 35 37 34 2d 31 2e 35 34 33 35 2c 31 2e 35 35 37 34 2d 2e 38 33 35 31 2c 30 2d 31 2e 35 34 33 35 2d 2e 37 32 36 33 2d 31 2e 35 34 33 35 2d 31 2e 35 35 37 34 2c 30 2d 2e 33 35 30 38 2e 30 39 36 35 2d 2e 36 35 35 37 2e 32 38 39 34 2d 2e 39 31 35 34 6d 2d 35 2e 30 32 36 2c 30 63 2e 31 38 36 34 2e 32 36 30 35 2e 32 37 39 37 2e 35 36 35 34 2e 32 37 39 37 2e 39 31 35 34 2c 30 2c 2e 38 34 36 36 2d 2e 36 39 32 39 2c 31 2e 35 35 37 34 2d 31 2e 35 34 33 34 2c 31 2e 35 35 37 34 2d 2e 38 33 35 32 2c 30 2d 31 2e 35 34 33 35 2d 2e 37 32 36 33 2d 31 2e 35 34 33 35 2d 31 2e 35 35 37 34 2c 30 2d 2e 33 35 2e 30 39 36 35 2d 2e 36 35 34 39 Data Ascii: 798.2597.2701.5646.2701.9154,0,.8466-.6931,1.5574-1.5435,1.5574-.8351,0-1.5435-.7263-1.5435-1.5574,0-.3508.0965-.6557.2894-.9154m-5.026,0c.1864.2605.2797.5654.2797.9154,0,.8466-.6929,1.5574-1.5434,1.5574-.8352,0-1.5435-.7263-1.5435-1.5574,0-.35.0965-.6549

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.4	50162	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	841	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.4	50156	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1335	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:40 UTC	1206	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://4711400.fls.doubleclick.net/activityi;dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.4	50163	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2916	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-02.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; _ga=GA1.1.704409195.1708603609; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false
2024-02-22 12:07:40 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 1996 Connection: close CF-Ray: 85971c2d2af1c335-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 327637 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "9cb7c6dbeadcbeb59c505fd42d45d12a" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 079cd4553da15b2329bffae6abe6157e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: mawrosHyJIuAeS1BqugNKoMhRpdbKnwmmcNoWRjxUoFabrto5LtxRw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: k3YueYuxCuOCUp3wMEEbBioCJCcnBtcN4K9tv/qh+y0IMLWDj15DONJuiHVO0kbgsxhe//azkaY= x-amz-meta-cache-tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721737 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: N47KCRP2VJT5DMWK x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: WrM3Asm8FGgkIXZp6IPRVGiFIuxXItT6 X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	507	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 68 6c 31 55 53 30 57 54 46 4b 67 78 38 33 4b 7a 59 70 4d 37 7a 44 50 7a 43 59 39 72 55 25 32 42 31 62 68 54 37 59 78 68 38 58 5a 4d 46 57 68 31 63 64 6b 43 36 59 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hl1US0WTFKgx83KzYpM7zDPzCY9rU%2B1bhT7Yxh8XZMFWh1cdkC6Y
2024-02-22 12:07:40 UTC	862	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 38 2e 32 38 35 35 2c 32 35 2e 32 33 36 38 48 33 2e 37 31 34 35 63 2d 2e 38 32 39 36 2c 30 2d 31 2e 35 30 32 32 2d 31 2e 30 35 35 35 2d 31 2e 35 30 32 32 2d 32 2e 33 35 37 35 68 30 73 31 30 2e 30 38 33 2c 30 2c 31 30 2e 30 38 33 2c 30 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <path d="m28.2855,25.2368H3.7145c-.8296,0-1.5022-1.0555-1.5022-2.3575h0s10.083,0,10.083,0
2024-02-22 12:07:40 UTC	1134	IN	Data Raw: 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 6f 6c 79 6c 69 6e 65 20 70 6f 69 6e 74 73 3d 22 31 37 2e 33 34 31 38 20 31 32 2e 33 38 38 31 20 31 38 2e 36 38 33 37 20 31 33 2e 37 33 20 32 30 2e 30 32 35 35 20 31 32 2e 33 38 38 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 Data Ascii: 071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> </g> <g> <polyline points="17.3418 12.3881 18.6837 13.73 20.0255 12.3881" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.4	50160	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	951	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:40 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:40 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:40 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.4	50165	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2986	OUT	GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware-EN.png?width=1684&height=1200&name=Types-of-Malware-EN.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1242	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/webp Content-Length: 38496 Connection: close CF-Ray: 85971c2d8e8172ab-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfiesepIcdZnIjYhf6WVye8_9jmAtmUVFXQeO9Cc2jDQ:1806d19e710b9b4f989d80c2f8554643" Last-Modified: Thu, 19 Jan 2023 22:44:41 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront) cache-tag: F-99217761792,FD-99217965202,P-4650993,FLS-ALL cf-bgj: imgq:100,h2pri cf-resized: internal=ok/m q=0 n=258+0 c=6+83 v=2023.9.8 l=38496 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bSAgM95GUY6Pa5MH9hp%2FcXWgAfUa9%2B1QcNSJH1u%2FenrvUHMdwKDBqFkMxpHIy1fgixDjuRZtFm0rb6gZxTSHljTNKZWZM4rEZ8ROPFOosNXJVAt75vM5Wi7UZ%2BURvXkvwWib"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:40 UTC	127	IN	Data Raw: 52 49 46 46 58 96 00 00 57 45 42 50 56 50 38 4c 4b 96 00 00 2f 93 c6 2b 11 3f 05 21 92 24 c5 d6 2c ef 63 06 2f cf c2 f7 2f 04 8f 7a ba 3f 98 70 15 49 b6 ab 34 f9 8f 7b 15 00 5a 90 8c 13 94 bc 9c 6f 70 18 49 b6 12 ed fb b8 c3 79 24 9e 7f 44 87 f3 f6 3d 83 6c 23 55 ed 60 8e ea 60 1e ed ab 30 d5 e9 89 48 09 89 11 23 46 1c 91 90 71 44 00 11 91 12 22 45 64 1c 19 51 44 83 d8 60 f2 6d Data Ascii: RIFFXWEBPVP8LK/+?!$,c//z?pI4{ZopIy$D=l#U``0H#FqD"EdQD`m
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: f2 6d 32 98 7c 9b 0c 46 ff 37 98 7c 1b 0d 66 68 9d 77 80 d6 a1 83 26 d3 14 9a 42 97 ab 72 5d 6e ef e4 ee a1 29 34 b9 86 8a 52 14 31 99 04 92 44 14 41 22 ad 29 4f 84 43 79 31 e1 71 c0 a1 30 07 9e 88 c5 d8 fd b0 ec 0a b3 80 05 b7 18 2c 7c 0d 60 25 8e 6b 00 1b 5f 05 6c b0 80 db f8 2e ac 82 9d 84 d7 0d 36 60 31 74 f0 5d d0 61 32 e2 14 8b 62 48 4a 15 8c 23 72 3b 31 e2 48 68 0a 88 94 c0 08 52 b0 d1 1a 5b 0e 25 46 19 c4 b8 83 6f b0 ec 07 71 2a 20 ce 2a e8 64 94 60 ba 2e bc 83 f6 12 39 42 0e 22 45 c8 41 e4 08 29 8a 22 51 a4 56 2a 17 37 6b 95 d6 26 3e db c5 f3 73 66 72 db 20 a2 d4 3a 46 b6 a1 f4 7c 9f 54 95 1a cd 36 94 72 73 13 ce 41 2d b5 70 0e ea 93 c2 09 6a ed 84 13 84 f8 ef bb 71 ef 7f f0 6c 70 99 30 9b 65 0c 90 e8 f5 7d e6 ed f7 3b ef 00 ad 93 8e 84 46 92 24 Data Ascii: m2\|F7\|fhw&Br]n)4R1DA")OCy1q0,\|`%k_l.6`1t]a2bHJ#r;1HhR[%Foq* d`.9B"EA)"QV7k&>sfr :F\|T6rsA-pjqlp0e};F$
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 12 4b 47 69 40 70 a9 97 9c 1a 01 d7 a8 30 cc 5f fd 36 c0 22 3d 8e 8c 4e 5c 06 72 3f 47 60 93 5d 92 a5 59 a2 d3 50 05 ca 06 a1 a5 b6 0f 3c 99 31 30 d1 80 44 4b d9 22 84 8b 44 9b 55 0d 4d c0 02 d0 52 a3 e5 c5 62 a4 33 88 41 c9 78 3a 2b 45 2a c7 51 42 d7 5a e9 14 88 8a 4a 78 65 5a d0 fa 36 1e 24 b3 74 a4 06 c4 9f 3d 09 b8 46 95 61 5e 0c b2 48 60 18 d2 22 d5 38 49 80 c9 18 31 52 f6 63 51 ed c9 da d0 89 2c 55 d2 50 09 b9 26 80 27 87 00 81 d7 cd b7 90 f4 9c db 57 80 6a b3 aa a1 09 66 2c 33 9a c3 13 b9 28 15 a3 7c d1 08 55 48 5d 5a cf c9 8c 5e 1c 88 a8 b9 8c 7e 44 8b 08 39 19 0f 92 58 3a 4a 03 c2 7f 4c 05 5c a3 d2 30 cb 20 89 d6 30 69 08 56 15 ed 99 98 ea a5 8c 44 00 cc f4 2d 56 d6 94 5d 68 a3 40 ac 03 7b 04 e8 64 05 25 b5 29 17 af 9a 49 cf 5c 34 1a aa cd aa 86 Data Ascii: KGi@p0_6"=N\r?G`]YP<10DK"DUMRb3Ax:+E*QBZJxeZ6$t=Fa^H`"8I1RcQ,UP&'Wjf,3(\|UH]Z^~D9X:JL\0 0iVD-V]h@{d%)I\4
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 31 d3 66 f9 eb 36 05 47 98 b9 0d 3c 68 c4 1a 53 0d 36 82 dd da 25 1a 23 5d 01 2e 33 c5 81 9e 11 76 ac 17 46 32 52 78 f3 7e 9b ec 1c 85 01 45 60 5d 23 36 4c fa ba 4d 3c 01 5e df 96 37 cc a4 14 d1 2d 04 7a 16 09 79 a7 e7 b9 08 a2 66 99 72 50 93 c4 34 07 13 9b ba 44 1a 46 14 0e 69 4b 99 36 4b 5f df 36 3a 42 98 e9 df 67 a8 4c b8 cd e5 c3 ba 42 3a 21 c2 1e d8 d4 b2 62 33 74 71 60 42 3d 82 18 a4 eb 8a b2 35 ee df d6 ce 29 31 20 e8 2e ac 6b c4 86 c9 5e df 36 4b 62 18 65 83 6f d4 e0 d9 bc 73 8a 65 a2 a4 86 1b 3b 55 29 fd f4 9f c8 2c 88 9c d4 a7 21 32 3d 6a 74 82 4e 59 61 d8 36 4b 0e 4d 76 68 66 74 f4 d3 67 71 96 b7 4d 1c f5 81 0f 94 98 76 2d 41 e5 57 0d d4 50 e9 93 04 58 b9 a5 95 a3 32 a0 e6 40 50 d7 88 0f 93 13 76 9a 50 4a 69 c8 dc 3e 17 34 64 60 0a bc c5 b6 dc Data Ascii: 1f6G<hS6%#].3vF2Rx~E`]#6LM<^7-zyfrP4DFiK6K_6:BgLB:!b3tq`B=5)1 .k^6Kbeose;U),!2=jtNYa6KMvhftgqMv-AWPX2@PvPJi>4d`
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3d 66 cd d9 62 a0 0d bc 75 f3 78 d2 b1 3d 7f e9 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f eb 3f 3f f8 cf 97 f8 f2 ea 54 7f a9 69 ae df 24 c3 6a d3 5c 78 fd fa b3 63 39 64 fd da 47 d5 4d c3 92 3b 55 33 ff fa 18 0d 5f af 5d 6e 0c 4c ca d5 f9 47 c7 5f 68 d7 2e 1b bc 3c 9c 3c 74 8c 85 d3 97 1a 23 26 77 da e6 58 0a a7 2f f5 8c 2b 56 93 d0 5e 9a 84 24 92 00 d7 97 75 fb ec 98 09 af 2e 90 7c b8 ea 52 7b fa 54 01 96 2c be 9e bf 74 fd 0e a4 35 4f fc f1 11 4e 57 ee 57 a6 aa 36 7d 05 b9 e8 35 df 56 fc 8c d5 e6 58 08 d9 d9 c6 ed b9 cb 6b 60 ef ec cc 25 f6 a1 ea fc b1 0f 7c f3 b9 db b5 a8 53 32 86 67 eb c0 ea f9 63 1d f8 e6 f5 fe 31 8e 68 98 19 f5 fc 21 30 5f 7d 9b 9c 39 ef 0f 72 36 cb 76 5d 8a f9 d7 74 e3 a6 56 81 cb Data Ascii: =fbux=??????????????????Ti$j\xc9dGM;U3_]nLG_h.<<t#&wX/+V^$u.\|R{T,t5ONWW6}5VXk`%\|S2gc1h!0_}9r6v]tV
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 73 51 ae 29 75 b3 6e c2 bc 96 17 72 d7 ba ab 52 5b 81 ad 43 7c 8d b0 eb a9 65 2d dd 4e 4f 76 57 e4 04 71 a6 9f ee 42 a2 38 02 a0 75 5d f1 da 55 6b af 3e 53 37 c7 3d ef 02 7c 2c 56 00 04 24 7c 1c 9a 91 e7 67 1f 23 5b 0b 15 c5 49 28 35 db 3a 57 ad a9 82 6c 10 af 5b 3a 8a bc 06 cb e4 9d d1 8b c3 db 3e 32 2e 89 c2 a9 d2 91 03 55 a5 ad 82 56 70 de fe b9 ee 76 09 4a fa 2f dc 68 56 42 70 46 eb 3b 50 3c 3f d4 89 c5 c7 0f ee df bb e3 20 75 fd b0 fc 3e 11 30 fe 8f 99 6d 72 5d 73 69 61 e5 90 5e a3 4c 5b e4 ce af 80 c0 df 53 17 62 bc bd c2 4b 31 ea 1e dd 33 64 b9 ff f8 24 3c d3 2e b4 cc 75 2b 47 cd b8 be 1f db 1a 37 ba f2 81 4b da 42 2f ce 91 d1 f1 37 f7 ef b0 e5 c1 22 b6 24 d8 77 a0 cc e3 79 1b 87 93 26 42 81 bf 10 af 78 e0 19 d2 fa 68 0a 5a dc eb 22 60 8a ad 22 76 Data Ascii: sQ)unrR[C\|e-NOvWqB8u]Uk>S7=\|,V$\|g#[I(5:Wl[:>2.UVpvJ/hVBpF;P<? u>0mr]sia^L[SbK13d$<.u+G7KB/7"$wy&BxhZ"`"v
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: bf c9 3e 3b 3a 8e 49 26 67 86 ef 4d 21 4a 6f 35 8b ec 5a 6c ef b3 f8 9e 9f 1b f8 14 9f b5 74 2f d6 6f d8 24 24 df ce df 70 42 2e 47 fc f1 d9 c7 46 d4 4f 8d ce 2d c8 5c 61 12 9d 1b 3f 5e 1b 27 b9 e9 58 7a 04 ff 2d 82 e1 4d 03 5c a8 ea 00 26 3b c6 2f 42 e2 34 b5 2a 27 63 c3 96 1d bb 24 e5 fb 6f 7f d5 f1 d8 0d d4 f7 a2 39 87 48 9f ea 42 85 cb 80 52 9b d2 42 99 45 a7 09 16 74 71 ac f7 38 00 9e b9 eb 76 a1 8b f3 82 bb 7c c3 3f 30 e1 f7 58 53 c5 0b 4e c5 c6 1d bb e4 e5 7b df 70 39 ce 32 07 cd 7b 77 ca 29 b4 94 3b f5 13 35 63 ce c7 0a c5 9f 14 3c 32 b4 67 c6 4f 16 f8 73 be 61 05 be 20 b5 a6 57 05 7f f0 80 1d 0a 7c 8f 6f 18 e5 50 ac df b6 4b 0d f9 ce 1b ce c6 9c b0 21 33 fb 72 6a 56 cc 84 ba 6c 18 1d 55 62 12 96 a3 b6 ff 8d 85 ff b4 ad aa 96 0c 91 e7 a5 55 f3 91 Data Ascii: >;:I&gM!Jo5Zlt/o$$pB.GFO-\a?^'Xz-M\&;/B4*'c$o9HBRBEtq8v\|?0XSN{p92{w);5c<2gOsa W\|oPK!3rjVlUbU
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3f db d9 a5 ea a1 0e 80 64 c8 55 81 b3 4d c8 b2 ed 6f 7d 64 b8 89 f9 8c d5 5c a9 68 fb 5b 3f b2 f4 31 21 1b d6 26 aa b1 f2 1c 61 dc d7 ee c3 e3 10 9e ea 64 0f 78 1f 44 0b 61 4e 67 77 9d ad aa aa 11 a1 4e e8 e8 64 3a b9 f5 f2 98 d8 b3 d1 d3 5b 06 28 f3 71 c4 53 01 8f af 5d 2f 06 ed 15 6e a7 f8 3d e6 c3 c7 c6 d6 ca 2f d1 76 8a ff 98 ad 82 bb 67 c9 3c a7 ca 1a f8 b5 eb a0 98 53 5c 3b ab f0 7f 01 33 f3 34 d2 61 f5 9c 42 a3 3c 2f b0 42 4d 35 a1 b8 28 aa d9 b5 f4 ec 65 72 c8 2b e7 59 1a ff 68 fe 9a 45 68 d7 b5 f2 38 62 a9 60 79 8f 31 0b c2 b7 62 76 fc 36 e7 46 00 8f 3d 70 e8 71 56 51 ff f6 3d be a9 ae 25 63 59 95 54 8e 43 10 32 f0 df 75 67 6d f6 4b 49 f2 d4 4c a8 05 e8 5b 81 92 d1 cf 5c 1f cd 2d a5 ee 7b ee 12 45 d0 c4 fd 9c eb 03 d6 62 de 0d 76 7c ea da f1 50 Data Ascii: ?dUMo}d\h[?1!&adxDaNgwNd:[(qS]/n=/vg<S\;34aB</BM5(er+YhEh8b`y1bv6F=pqVQ=%cYTC2ugmKIL[\-{Ebv\|P
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 97 99 06 76 be 44 df 78 cd fb 8c fe 0e f2 4b 82 e0 08 bc a5 99 66 c4 ff fc d9 6f 40 de 19 ff 59 cf f0 b2 9e d4 0a ca 1f 1a 54 8f bd 61 67 3c 12 e0 46 93 cf 63 40 87 7b eb eb 81 6d 74 2f 38 02 1b f9 5a 73 b5 69 dc e0 ab 32 56 f6 13 82 13 7f f2 e1 17 b0 fe 45 ba e6 ba 44 b5 16 88 df bc 69 67 84 55 e0 80 5d 8e e0 d4 6d 2d 3e b7 0e a7 81 4d 34 ef 0a 6c 62 6b dd d5 d6 f1 82 af 62 a3 b8 7c 4c 7a b0 9d 3e 7c 5a 2b 29 29 fe f0 77 2d 8d 67 da 4d bc bf 4c 15 df ab f3 f9 de 38 5e b1 f9 00 ca 4a 3a 03 5c ad bd da 36 56 70 46 cb af f4 cb 3a d2 5e aa d0 90 91 b8 fd 35 22 91 a5 11 6e 02 37 33 1e f2 39 48 f9 c9 29 92 eb da 77 91 e0 30 38 6a dd d4 6f dd 86 44 93 2f d9 0a 20 46 bb 73 1d aa f9 17 8a 04 79 b2 a5 71 06 c8 f6 2c 1c c5 24 8d b0 ff b1 16 be 4c ec e7 c5 e6 5d 68 Data Ascii: vDxKfo@YTag<Fc@{mt/8Zsi2VEDigU]m->M4lbkb\|Lz>\|Z+))w-gML8^J:\6VpF:^5"n739H)w08joD/ Fsyq,$L]h
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 7a b4 97 c8 ed 32 d9 0e 32 ac 7d d7 31 7a 1a 61 ba e0 4d 56 10 d5 94 fa 8b 78 dd e2 57 07 e5 17 7a fd d5 af d4 85 0d a8 ad 2e d4 b8 47 7a e6 33 f5 b9 e1 7a 8d ac 82 62 49 56 ee 52 92 84 9c e9 86 de f2 b2 c6 8a 56 73 bd 7f 2a 70 cf b8 a7 ff 40 e7 02 37 f7 6b ea c7 fe ce 75 49 d7 62 e5 9f fd 32 a5 41 88 7c 1e 31 3c 39 17 25 67 ba a7 de 42 9b 65 61 46 61 3e 3e 8d 5a c3 4b e9 5d 14 d5 ce ef 37 e4 ee c3 80 64 4c 24 4d d7 3e fc 38 56 56 6a db 07 31 00 53 7e 04 dd 93 73 53 18 d3 79 20 7d 95 9b 94 2f c6 9f ba 53 4d ae 0e ca 6f 55 8b 0a d2 ca e2 17 0e f8 8f ee 02 84 ec c9 b9 7a 73 38 d3 51 03 81 cf bc a2 ec d7 e6 7e 80 18 75 58 e4 47 c0 ff ff cf 79 ea ea a2 a4 aa cd 14 53 98 f3 ca 89 4d e4 f2 c8 59 9e dc d0 a9 88 57 a4 e9 3c ad 3c f2 d6 0a 21 4b d2 9e c3 ea 25 f3 Data Ascii: z22}1zaMVxWz.Gz3zbIVRVs*p@7kuIb2A\|1<9%gBeaFa>>ZK]7dL$M>8VVj1S~sSy }/SMoUzs8Q~uXGySMYW<<!K%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.4	50166	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2979	OUT	GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware.png?width=1321&height=601&name=Types-of-Malware.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1239	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/webp Content-Length: 18080 Connection: close CF-Ray: 85971c2dba4e0c94-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfiFFjKT2D-rDwUCviiwFS9aCSNUNeq5hqXjYz1HwADQ:8462fb18718e5c0119542930b54c24ed" Last-Modified: Thu, 19 Jan 2023 23:23:16 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 b33e91c066f49dc7c18162b9a344e266.cloudfront.net (CloudFront) cache-tag: F-99219737485,FD-99217965202,P-4650993,FLS-ALL cf-bgj: imgq:100,h2pri cf-resized: internal=ok/m q=0 n=173+147 c=0+0 v=2024.1.3 l=18080 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tVeN0NppzhoSJh28y0u79BJCnPJgnyglXEIYbUy6%2Ban7fOejYvjrjDb1zXh3KN80HpOHJE7OZF7bfIKXoBr2HyxChlGXKfMaxWOEdj%2ByVBZD223fwqwl9Fzx3ALkg2WVG9iK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:40 UTC	130	IN	Data Raw: 52 49 46 46 98 46 00 00 57 45 42 50 56 50 38 4c 8c 46 00 00 2f 28 05 96 10 ea 51 dc b6 8d 13 ef bf 75 7a bd fb 46 84 c2 b6 6d 9b ec 9d b4 67 d0 73 11 1a 65 41 0f a8 05 7d aa c9 d5 93 d8 2b b3 3b d6 fc 41 45 b8 0b 1c 2e fe 6c e0 d6 bf 0c fe a4 b2 80 4f 40 83 03 fa 1b 92 1e f7 ff 9e 39 b6 9c 95 c8 bb 33 57 de 8e f7 de 7b ef bd 77 91 bc f7 de fb c8 7b ef bd 8d bc f7 de 6b fc 8c bc 77 f5 3e Data Ascii: RIFFFWEBPVP8LF/(QuzFmgseA}+;AE.lO@93W{w{kw>
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: ef 63 df e7 79 2d 86 ff 05 08 e0 7e 2a e0 02 b8 8a 01 23 c5 13 49 38 71 c7 0d a8 c0 e0 9a 94 5b 98 b0 6f d8 50 56 a8 80 40 01 05 74 ac 05 10 a0 00 46 04 b8 08 6e e1 ba 0e 7a 05 25 c3 a0 92 0e 6f 4e a0 92 4a 19 50 a9 97 b8 84 93 29 e2 1e 5a 78 a3 2e cc 0e 28 80 09 05 30 93 3b 3b d1 a0 f6 20 d7 40 c9 f0 80 15 2a eb a0 b9 8a 8e 99 dc 3b d3 00 57 d2 59 01 95 56 76 36 30 71 65 67 33 e3 18 74 cc 7c fc 10 d0 12 3a 67 c0 a0 22 a2 a3 ce b4 02 a1 42 dd 25 54 5c 78 81 17 38 4b e8 84 01 01 02 dc 41 25 e3 67 1a 68 f4 06 3a ad 05 74 52 2b 80 c3 5a db f2 64 64 d3 9f fe 61 73 77 77 e7 2d b2 ba eb c7 04 13 71 77 77 fe 30 ba bb bb f3 35 e9 84 b5 c8 e4 9b 3b 2b c9 03 59 00 00 53 ca 07 ad 6d db f6 e6 ba d9 b6 6d db b6 6d bb 26 1b ef 96 dd 29 83 6c 23 a9 1d ca a1 1c c2 23 bd Data Ascii: cy-~#I8q[oPV@tFnz%oNJP)Zx.(0;; @;WYVv60qeg3t\|:g"B%T\x8KA%gh:tR+Zddasww-qww05;+YSmmm&)l##
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: cf 6d 95 64 2d c9 a2 df 24 5f ea 67 4a b4 95 25 ab 94 8a a8 94 2a 9a f8 8e 0a da 5e ec 15 93 e6 b9 63 bf 52 29 22 d2 4a a7 d3 03 c5 6e a5 ca 74 8c dd 74 5a a7 d2 9e 6e 15 13 74 47 58 29 b6 9a 74 a1 a7 e9 4c b1 52 75 44 58 07 c8 c6 ec 15 17 4c 71 e3 4a 31 93 a6 d4 30 2a 26 7c 41 3f c7 40 33 ce 28 c9 4c a9 ea 78 70 a4 db da 5e 6d 7c d3 ec 3e 63 f5 4c d3 dd 14 f7 56 b3 6b 95 e3 7c 24 39 90 72 36 38 0f 70 cd 66 b1 07 00 26 46 22 53 36 9a 57 9a 68 c5 b9 4a b2 eb 3b 1b f4 db 2c 62 26 46 75 20 19 e7 27 4d 3e 5e 69 6a a0 1c e7 2f 99 94 63 c1 31 7b c6 9a 59 35 05 20 6f 69 25 58 bd fb 6e 32 2e 48 d2 15 87 82 d3 44 35 f7 49 b0 23 92 ed 25 aa ba af 9b 62 53 00 0a fa 26 72 fa 6e c2 66 aa 4e 08 17 00 ec 89 31 3d 52 5c e7 28 9a e5 8a b3 8b a6 e0 84 48 5a 13 86 10 81 01 Data Ascii: md-$_gJ%^cR)"JnttZntGX)tLRuDXLqJ10&\|A?@3(Lxp^m\|>cLVk\|$9r68pf&F"S6WhJ;,b&Fu 'M>^ij/c1{Y5 oi%Xn2.HD5I#%bS&rnfN1=R\(HZ
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 61 6e 0e 00 6e ae a9 f2 e9 bd a8 8c 94 d3 46 0e 8c 52 8e 29 90 99 05 cf 0b f3 a6 0a 8a 51 7d f4 7f 82 48 74 a4 46 d2 4a fc d5 38 65 78 e0 79 cf 79 24 61 08 d5 ff 5d 0c ca e1 29 9b 10 91 f3 ee 2b 93 e3 07 2d e5 4c 39 02 fe 17 70 df cd 65 3d 11 92 71 0a 20 a3 ed 0f c1 38 0a 6d d2 61 ac 68 66 42 7d 4a e4 19 b7 82 c5 0c 42 b2 19 1f b1 e4 89 e1 fa 51 c3 57 9a 29 ac 40 97 b8 0b cd 9c 9d 50 1e 45 b7 82 3d c4 98 ad 8f 56 ca c4 ff 5a e4 e4 d6 6b a6 01 90 a7 f8 09 11 e3 b2 c2 9a a6 42 b2 28 ec 47 3e 2b e0 7f 05 a0 d5 4a 17 b4 e3 a2 35 aa c3 bb b0 8a 23 8c e0 71 7b 1e 75 32 87 c4 6b a2 36 de 2c 5a 61 13 62 0f 38 59 72 ac de 7e 21 a4 36 c7 3c 25 c8 66 65 8e b1 72 c9 8c 6a ac 29 8d e6 59 42 18 ee ab 0d 25 c6 08 72 e3 a8 08 23 75 d5 ae 33 bc 75 ae 1d b2 98 f3 16 8d c0 Data Ascii: annFR)Q}HtFJ8exyy$a])+-L9pe=q 8mahfB}JBQW)@PE=VZkB(G>+J5#q{u2k6,Zab8Yr~!6<%ferj)YB%r#u3u
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 00 c4 08 3f 00 99 84 b2 fc 80 1b 1c 68 b2 b8 f3 b2 cb 68 af c8 31 96 76 b2 a0 49 16 e3 38 35 2f f0 3f 85 23 f5 5c 43 57 55 de 1b 48 12 0e 1e e3 8d 60 93 46 17 a9 4b a4 f6 bc 2c d4 6a ae a3 fb b3 98 ab 7f ed 38 2e 2e eb 0f 6b 5b 14 79 80 d7 92 5b 9c 57 85 7c cb ba 24 7f 45 27 df ac 2e c6 79 03 cb d1 fa 9a c1 fb 97 4b d2 c1 63 08 41 d9 db 8f be 3d af 4c 31 30 93 65 14 cd 3f 7e fe 3c a4 59 7c 40 e9 57 67 48 9a 8f 8d 39 92 79 61 98 b0 9c 7d ce d1 84 81 1d 53 0e de c2 19 b8 a6 42 b2 2f d2 18 4f 6b d4 b8 4e 7d a6 0a 1c 64 9f 78 a8 fb da ac e8 49 14 4c 5a 5e ca 59 e1 bb 77 17 30 90 43 a5 49 c0 f5 59 c5 b1 b3 5b ce 5f 79 17 c8 51 b1 cf ce c2 3e e5 b1 ee e8 3f 1e 17 c6 d7 30 64 eb 37 53 b9 bd f1 80 40 00 3a 79 87 64 6f 3f 63 6f 88 81 6e bb 63 c7 a9 69 e0 06 e1 38 Data Ascii: ?hh1vI85/?#\CWUH`FK,j8..k[y[W\|$E'.yKcA=L10e?~<Y\|@WgH9ya}SB/OkN}dxILZ^Yw0CIY[_yQ>?0d7S@:ydo?conci8
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 31 c2 c0 d4 b9 50 24 05 30 5b 6a 86 2a 49 7b 82 4b 19 03 7f ec 72 87 0e 00 0c ae ca a3 ab df 0f 11 79 17 e6 67 c2 01 a1 9d e7 76 4f 73 b8 60 00 e4 ab df ce 2d 6a c7 ed 71 e1 f5 db 59 09 ad 84 6c 02 1c 13 e1 96 66 eb 15 f5 6c f1 08 b6 44 c5 c5 ea dd d8 63 cc 78 e8 65 dc 94 26 1c 0f 32 ae aa 1f 9b 12 52 10 5f 63 b2 73 54 33 c7 8d 50 63 b2 21 6b f1 ec 9b 01 4e 0b e9 7b 23 6c 36 cb e2 7a 0a e0 82 a8 64 43 6e b3 38 de 46 8c c3 41 4b c4 37 0e d7 a2 ac d2 1d 9a 43 1c 85 23 67 1d 1c 6f 8d 5c c7 73 f7 8a be 0e 8e 06 ab 91 b3 e9 37 36 87 80 22 f6 77 19 6d 2f e3 cd fd db 4c 3d 5c 7d 0b 97 3d c6 16 b1 2f f8 6f b0 0e 3e 04 78 2d b2 70 36 68 55 f6 0e 68 6d 4e 33 a2 91 b6 56 b7 e3 e7 46 ae 9c 41 aa 75 7b 6e de 20 b5 ba ed 84 d6 42 38 92 e2 e1 b6 f6 3c e6 db fb ab 00 83 Data Ascii: 1P$0[j*I{KrygvOs`-jqYlflDcxe&2R_csT3Pc!kN{#l6zdCn8FAK7C#go\s76"wm/L=\}=/o>x-p6hUhmN3VFAu{n B8<
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: c1 00 17 bb 99 12 d8 f3 06 33 84 a5 ad 56 d3 c5 2b 72 10 72 f9 f3 49 07 ec 8c 0c 7d ce 69 e7 d0 6d 8b 03 d3 90 d2 29 05 0e 1a 55 0f a0 3c e8 65 08 60 c8 68 96 50 b7 e4 d9 6d 39 08 1e 40 ab a2 89 65 c6 55 ff b2 dd 41 1e af a8 b5 e1 27 f0 3a 03 c5 0a 22 45 f2 90 1a 2b a7 02 a7 05 23 18 a0 f1 3c d9 45 85 34 00 ba 58 6b 30 b9 08 b0 5b df e6 83 51 9e a9 bf 81 04 49 da 2b e6 98 a8 9b 61 9f a7 76 b3 1a 38 6b 84 ca 43 4c 9a a8 94 a8 61 6d fd 2b 10 82 46 7d 5b 0a 42 d5 4b 4e 4e e3 5d 46 ef 65 4d 2d b4 6a 14 83 40 c1 d8 d3 ae b2 57 06 2d 9c ab 1b 94 fa 65 2e 18 c6 68 e9 d1 08 8d 41 aa 2b c8 de 2d 1a cd 4a e0 5c c1 dc a4 35 7c 09 5a 18 9f a2 67 77 57 30 f5 79 a3 c0 27 5e 93 54 28 66 a7 29 bd 53 2b 5b cf 23 6b 46 b9 18 04 4e 1d 22 c7 3f 3d 6c d7 a9 d9 07 58 22 b2 b4 Data Ascii: 3V+rrI}im)U<e`hPm9@eUA':"E+#<E4Xk0[QI+av8kCLam+F}[BKNN]FeM-j@W-e.hA+-J\5\|ZgwW0y'^T(f)S+[#kFN"?=lX"
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: f7 54 0b 47 ad 16 85 61 5d d5 16 37 fa bf 45 51 96 55 63 c9 85 fe 8d 2c 00 36 b9 28 61 a5 46 64 cd 8b f1 79 8a cd 53 97 e0 d9 a1 24 9c 6f c6 c4 d9 ed 21 48 52 f6 8d c5 7b 01 c0 4d 6d e0 2a 14 d7 f2 b3 34 fe b1 72 61 5d e1 df d3 e0 40 e3 1b e6 71 d9 fb 41 7a 3f aa 18 86 63 18 9b 1d dd f8 8f 30 6a cb cb 5f bb 21 b4 fb f9 77 84 7e 11 6a 7b 51 4c b6 94 0d a9 3d 6f 7d 0a 60 5b ac 80 9f c8 77 89 48 cb 58 9a 9b d8 b6 c2 b3 5f a8 11 f3 20 04 2f 5c b1 ab e3 19 6d 24 d4 79 c3 d8 ad 65 bb 75 03 c8 85 35 56 7e 93 39 3e a8 2d c2 fd 72 45 2e 6d 27 ec cc a2 18 d8 cf de c6 e6 d7 f5 2d df 77 2c 09 76 04 b5 15 9e 9b 4e ae a3 ed 7b 4b 8e 66 ff 9b cb 09 fa 23 76 03 08 85 c8 33 24 b2 3a 3f e6 0e 12 44 c2 c1 25 79 8c e4 94 88 e3 da a5 da ed c1 6e c9 0b b1 b7 f7 64 68 f6 bf db Data Ascii: TGa]7EQUc,6(aFdyS$o!HR{Mm*4ra]@qAz?c0j_!w~j{QL=o}`[wHX_ /\m$yeu5V~9>-rE.m'-w,vN{Kf#v3$:?D%yndh
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: a5 9f ca 26 39 67 15 61 4d 0f af af b3 92 5a 8b 2a 06 7b db ae 34 ab d6 09 25 19 43 59 47 0b 05 15 12 99 43 4c 36 fb 75 b1 07 36 62 f5 66 a7 75 17 c9 29 0c f6 8d d1 47 5d f0 bb 48 59 26 d4 64 0c 64 ad 25 1f f4 f9 e6 87 f4 b5 7b 87 44 7f 2f 6c 29 02 90 7a c3 08 77 df ab ad d2 ef be bf 67 15 d0 72 17 e0 56 a7 cb 35 7d ce ca d8 b2 1e b3 47 61 11 91 d1 5c 14 ac ab 01 1c 09 c6 2a a1 28 63 18 6b 92 1c 4a 0f 03 85 86 13 5f 41 9f 02 f4 f2 ad ca b2 dd a1 e2 11 d0 c9 4f 9e 1b 45 f4 d7 41 27 8f e8 0e 0f 27 9f f9 c8 63 0f 89 e6 c3 7f e7 cd 1d 59 e5 f7 aa be 34 35 91 3e d8 03 f3 47 38 6d ba 1d 4d d6 6c 8d 6e 5b 46 72 a4 d9 88 78 0a ec 8c e6 82 18 2b 24 33 51 c6 1b 8b 84 aa 8c 41 ac 39 92 cd 01 d8 c0 1d ac c7 1a 59 fd d7 9c 1e 62 e2 6b 67 c7 22 f1 20 19 92 a4 1e 14 4b Data Ascii: &9gaMZ{4%CYGCL6u6bfu)G]HY&dd%{D/l)zwgrV5}Ga\(ckJ_AOEA''cY45>G8mMln[Frx+$3QA9Ybkg" K
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 51 73 47 81 9b c5 06 e8 a3 c6 2f 4d cd 52 c9 b1 65 66 77 5d f2 23 fb 86 94 06 a3 8b 52 24 31 fd 71 9a 70 e3 3d c9 52 e5 88 66 22 e2 eb e0 fc 75 9f b5 d3 53 98 3b a9 d2 80 ee f4 df 4e 63 ab 47 b8 08 43 77 d0 2f 78 38 64 21 d4 df 72 3a a1 c2 1d 55 3d 50 ea fc d2 ec 18 f9 27 d7 2b 0c 0b be 2a 75 fe a9 ed 89 18 b4 fd 2e ae cb e0 ef a6 49 e9 6c 74 19 af ea 4b b8 4d 4c 1a bf d2 d5 95 a4 cb 76 63 45 42 77 6a f4 2a 9c e8 d7 3c c4 86 3e 58 e0 11 19 f4 37 0d 92 e4 68 a5 17 54 94 4a 8e 45 51 08 7b 3c 01 b9 fe af 20 06 71 54 82 73 18 0d c1 e4 aa 99 24 19 cf 55 d3 98 89 f9 52 ad 14 5b 68 89 60 ed 2d a9 93 75 12 e7 e9 3e 11 39 01 fe cc 90 12 72 30 ab 1a 15 dd fd 60 a6 8f 12 03 bc 88 96 b7 31 80 21 f3 e3 a6 be 48 27 72 90 6b 5c 92 66 87 d7 08 30 aa e2 26 66 4a 0a f3 c6 Data Ascii: QsG/MRefw]#R$1qp=Rf"uS;NcGCw/x8d!r:U=P'+u.IltKMLvcEBwj<>X7hTJEQ{< qTs$UR[h`-u>9r0`1!H'rk\f0&fJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.4	50168	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2723	OUT	GET /hs-fs/hubfs/New_Avast_Academy/What%20is%20Malware/What_Is_Malware-Hero.png?width=1200&name=What_Is_Malware-Hero.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1317	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/jpeg Content-Length: 84377 Connection: close CF-Ray: 85971c2db8385e80-EWR CF-Cache-Status: MISS Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfJw52PqHuz-8-Z2pQjf8HkTRm2lqaDEedKymcvPL4DQ:5cd4a4727476ae6ed6932770a63db0a0" Last-Modified: Mon, 16 Sep 2019 13:12:51 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 54a56da0fe0bae919389c7d572d4720e.cloudfront.net (CloudFront) cache-tag: F-13473038854,FD-12448744162,P-4650993,FLS-ALL cf-bgj: imgq:85,h2pri cf-resized: internal=ok/m q=0 n=299+0 c=13+110 v=2024.1.3 l=84377 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=1;i=?0,cf-chb=(260;u=3;i=?0 9010;u=5;i=?0 55446;u=6;i=?0) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9M0Gb59Fhk7zq%2FwDO0sOp%2BzLDGzLV96Db%2F%2FjBGMKNNC7qn48c3KNQgPfV4Ye1ITdilkEblDDAuu0uI85XJklZaCwoDbiux%2B3nl0ja3xeWQtINpoF53UX0Vz1gktyRwe3wWc3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:40 UTC	52	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c Data Ascii: JFIF
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 01 b9 04 b0 03 01 22 00 02 11 01 03 21 01 ff c4 00 35 00 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 01 08 05 06 07 04 03 02 01 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 01 04 03 05 06 02 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 da b0 d9 7c 5e 0e 1e bd 57 89 8c fd f1 9b c2 67 0d 6d cb aa b6 b2 a7 63 e6 b6 fa 38 c9 d0 00 5c 1c 67 bb d3 5b 85 53 cf cf d3 e7 67 b8 f6 03 78 b3 75 8e cd 79 d1 68 b8 57 23 ec 3c 7f ce cf a6 82 Data Ascii: ) )/'%'/9339GDG]]}) )/'%'/9339GDG]]}"!5\|^Wgmc8\g[SgxuyhW#<
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: f3 d4 ab 5d 55 f0 64 ee 7e 51 e8 f8 4c 7a 5d 7a 4f 69 72 b8 cd 5f 81 dc 5a b3 e2 3a bc 03 e9 ef f3 63 c6 66 dc 72 dd de c6 83 57 5d f9 f6 4b 19 83 a8 be 3e 83 f1 61 6b ed 85 cb 1c e7 5a a4 97 4a 97 63 d4 f6 7e 77 e9 19 df 9b 25 5b 7b 0e 57 3d d8 e9 ed d5 ad 3e 34 dd 5f 3e 7e be 9e 2f c7 ce da 71 ab 0b 97 59 ce 72 da f7 bd 68 be 36 7d 20 40 d8 30 1b 41 52 df 57 5b 03 5e f2 f2 1b 9e 4a 98 c5 d0 9b 9e 99 93 f6 d6 5d 4a 83 6b 79 33 98 d9 f0 27 a7 cd 8f a4 f6 ea da 3d 9c f7 5b 93 ce 53 2b 0f 5b e3 df 5e 89 46 44 24 2d 77 db e9 e3 c7 c0 d5 aa 91 31 ef e8 e4 fe 52 8b bb c9 f3 9b 2b 83 c9 4e 99 3c 64 76 56 19 7c 77 72 78 d2 6e 38 aa d6 c3 e2 6d 7f 96 ac ca 59 4c 59 97 6f 61 bc 68 e2 ad 8d db 6a 2b 16 b7 c5 9f c0 57 f9 45 8c d6 12 59 f6 36 23 f7 f8 22 2c e6 46 aa Data Ascii: ]Ud~QLz]zOir_Z:cfrW]K>akZJc~w%[{W=>4_>~/qYrh6} @0ARW[^J]Jky3'=[S+[^FD$-w1R+N<dvV\|wrxn8mYLYoahj+WEY6#",F
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: f2 5d 0e 05 34 af f2 90 d9 a2 40 3e 87 9f 9f a3 aa f5 e5 0d 7d 47 fc 76 ee 23 16 f6 c8 25 29 89 1f 4e dd cc fb f7 2b b3 ed 3e 1f 5f df e3 93 f7 1f bf 2e 43 c1 11 ef 48 e3 b6 a2 b9 75 de 38 cc 08 ea 75 40 41 3b d7 6d 51 a3 56 16 87 2c f2 a8 ee a7 cd d6 f6 1e 40 f6 02 22 76 5e c2 c1 ac af 2b 27 5b a3 d6 e3 f1 24 c8 40 93 20 62 c7 2c 77 da 35 7e 2b 63 f5 f8 9d dc ca 01 30 12 f6 75 67 8d 5f 1c 9b 5d 57 23 16 e3 c8 89 9c 92 00 cb 6d d1 82 9f 3a 9b 41 ae c5 68 e0 2e fd c4 e3 26 cb 18 97 bc c8 3f 64 7e 5d 43 6e f3 af ab c0 62 c9 eb f1 1e b8 63 3f 81 f5 b0 b4 82 44 c4 83 60 ea be 6b 6b b8 53 a9 72 d6 6d a2 13 e8 89 01 99 eb 1e 6b eb b7 2e 85 c3 fb 6e 3d 26 2a 6d 86 cf 60 73 74 db 20 19 eb 59 ca 3a 8b 4d cf 60 6b 8c e1 f1 ee 37 59 dd eb 94 3d 2a 5e ba d7 d7 3e 7e Data Ascii: ]4@>}Gv#%)N+>_.CHu8u@A;mQV,@"v^+'[$@ b,w5~+c0ug_]W#m:Ah.&?d~]Cnbc?D`kkSrmk.n=&m`st Y:M`k7Y=^>~
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 64 2e bd 2b ba de e8 f3 5c 5b 80 58 1a fd e2 cf 55 00 96 77 05 d1 e8 cf 43 95 e7 d6 43 0b c9 6f e8 f0 be b9 83 d1 f6 b4 b6 7d 93 85 66 33 3e b1 53 d2 b7 ae b5 8d d6 fb dc f1 1d 6f a9 f2 de 9b 9c e7 ba 8d a1 ab 16 a7 73 ce eb e8 cf 83 61 d7 aa ef f6 41 26 cd 6b aa d5 aa b5 47 91 e1 fc 5b a8 72 fa 5b fd e8 7a 26 db d4 8b 79 61 c4 2a 15 bc a8 78 2c 75 e4 09 94 4c 09 89 98 5a 8c c6 27 31 6b 95 ad 4f ff 00 1f bf c5 4e c7 d0 4a 40 2c 35 79 b1 59 63 9e eb b4 7a ee 52 2f 1a ae c3 e4 87 8c cf a5 d9 a4 b7 6a cf 8e 23 89 71 0e e9 c2 f0 6c 3a a0 f2 95 95 ad 56 6e cb 96 de a9 9d a9 aa 98 35 1d cd ae d5 76 4c 15 8e 3f 35 6d 4c 55 ec 24 08 ee 7d 7f 8f f5 1b fc ce 96 af 6b 99 2c 6e af b3 ba 19 4d 8a dc d4 6b 75 63 51 cd 71 7e 19 d9 f8 c5 3b fd 6c 4c 4e 43 bf f4 ee 65 d2 Data Ascii: d.+\[XUwCCo}f3>SosaA&kG[r[z&ya*x,uLZ'1kONJ@,5yYczR/j#ql:Vn5vL?5mLU$}k,nMkucQq~;lLNCe
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 61 04 a0 84 c4 c2 53 00 4c 04 a2 40 48 10 00 00 12 04 4c 04 80 00 00 04 c0 00 00 89 00 00 00 00 00 00 00 09 00 00 02 02 00 00 00 02 40 80 48 04 84 24 10 04 80 11 24 00 89 12 04 00 80 48 00 20 04 82 00 48 82 65 04 25 01 28 90 00 82 61 30 12 82 52 84 00 02 62 42 00 98 01 20 80 00 24 08 00 00 00 00 80 00 48 10 48 24 11 20 01 00 01 20 42 41 00 00 48 00 94 00 10 4c a2 50 00 00 00 00 00 48 20 00 00 00 00 89 00 00 00 00 00 00 00 02 40 80 00 00 08 26 50 22 62 40 02 26 04 c0 4c a0 24 84 44 a0 48 09 40 12 10 94 26 24 98 42 62 24 12 00 00 00 08 26 22 41 20 00 00 80 44 80 80 00 98 04 81 00 4c 01 21 30 08 24 12 08 90 40 00 4c c0 40 13 30 00 00 44 c0 4a 40 80 00 00 00 04 c0 04 48 00 00 00 10 04 80 80 48 08 02 40 01 00 48 00 00 00 11 20 00 00 24 00 84 26 12 22 40 89 81 Data Ascii: aSL@HL@H$$H He%(a0RbB $HH$ BAHLPH @&P"b@&L$DH@&$Bb$&"A DL!0$@L@0DJ@HH@H $&"@
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: bb af c0 f5 e8 03 f5 11 22 cb 74 0e 7f d1 33 f3 da 5a 77 88 cc e1 a9 f5 7b 01 fb c8 f1 73 74 8e a7 c9 2c f1 96 2b 87 e6 62 bf 5b 29 89 22 d2 ec 7a bf 40 b1 cf e8 e9 17 e3 e9 f2 ab dd 7b fd 44 4f a4 74 bb 25 5b ac ae 6a dc 4d 76 e4 fd 63 93 d7 eb 36 61 ea 62 cd 6d 78 bf d5 be 5f 59 54 7e 3f af cd 3e eb d2 62 64 ef 1d 7b 8b 77 bb fc ee 9a 97 f7 3e 3d de e8 75 7a 4d b6 98 db 5a 8f 97 59 de 42 18 bd 27 bd f0 4e df 96 39 fe b9 54 2d f5 58 68 7a cd 32 7f 2c 5b 34 ed 3a ae d8 68 ae 1d 7d b0 b5 f3 3e b7 27 11 82 bf 56 9b 0d 5e ad 0d 87 19 bd d2 7b 7f 4f 7c 7b eb 7f 03 1f b4 f7 7e 0f dc b3 39 9e e5 49 2f 45 28 f3 43 a7 c2 fe ff 00 0c 77 a2 77 bd 0f 7f f2 a7 67 78 6f 75 e1 37 38 de 87 8b 26 2a ef 8e ff 00 c0 6d 1e 67 2d b7 53 cb 7d 4d 7d 53 ec 7f 02 b6 44 f6 8e 2d Data Ascii: "t3Zw{st,+b[)"z@{DOt%[jMvc6abmx_YT~?>bd{w>=uzMZYB'N9T-Xhz2,[4:h}>'V^{O\|{~9I/E(Cwwgxou78&*mg-S}M}SD-
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 71 f1 f9 4d 7a c7 cd ed d5 47 ee 2b f7 b3 70 32 f5 57 ed e3 94 cf df f4 7e 33 89 f7 e3 6d fb fc 0d 84 bb e7 03 cb 43 51 6f 3c 35 af e1 1a ff 00 56 c3 17 5a 3e 12 8b 69 82 ad ff 00 09 f4 c2 f8 be bf 26 ff 00 2f 5a ed 75 27 2b 3a fd 35 bd c2 56 5f 34 67 c1 70 30 55 97 ca b1 5e e3 53 cf 46 b1 36 76 9f 1d b3 53 fa 7a b9 46 ef 62 6a c7 cb ce b3 05 c2 c4 d5 9f 82 c6 0b 89 8d aa 7f 26 6c 1d 1b 8c e4 b1 ad dd d9 ea bc a6 61 af ba 5f 9a 85 e9 f5 4e a5 cd e7 55 f7 04 b1 3b ff 00 3a 98 f1 b1 ba fd fe 12 8b c3 8e a9 0c bc f6 1b a9 82 a9 bf 1f 36 6b dd 5c 25 4a f9 33 e0 b0 55 97 27 8d f3 73 77 1b 86 9f 25 5b 83 99 a5 be ef 5a dc 17 33 5a ab 1e 63 3e ff 00 cc a6 3c 5e bc 12 6c d6 92 9b 7a bd 55 a1 71 b3 f4 8f ed 34 6c d9 0e 5f cb 7c fe 7c 6d 42 2e 3f 76 c2 a6 7b fd c6 Data Ascii: qMzG+p2W~3mCQo<5VZ>i&/Zu'+:5V_4gp0U^SF6vSzFbj&la_NU;:6k\%J3U'sw%[Z3Zc><^lzUq4l_\|\|mB.?v{
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 90 f6 69 d1 10 5d 41 e4 fb 57 08 53 ce 47 14 4b 5b cd 8a 08 dc 07 70 d5 18 00 d5 1b 8f 06 ad 8e f0 ea 11 35 19 99 3f 7f 91 50 14 ec 1b ff 00 10 00 51 ab de 57 49 bb 15 07 95 37 c7 ff 00 e4 a8 7e d5 97 03 89 bd f1 30 9b da 45 75 0c 73 9f eb ef 0b fb cb 30 50 5e 65 a5 00 cd fc 30 f9 8f f1 a4 7a bb 2a ff 00 d5 f2 c3 9c 7c cd 1e 8f 63 94 78 f9 d0 ec 1a c5 5d 03 03 7d 20 1e b4 3e 18 7f 8f 9b be e8 ec 79 34 4a 37 9d d9 7f 74 c0 38 aa e5 b0 0e ca 3b e2 62 f3 3c ef eb 52 7b fd de f8 98 0c 37 9e 0f d9 f2 ef 58 4d 6e 3f 8d 64 0e 10 d7 c1 53 d8 07 e3 b6 37 eb f9 4c 68 28 2d 72 cf 23 7f 1d cd f4 24 59 0e 58 ac c0 27 0a df 86 23 21 bb 1b 43 aa 0a bb 11 17 1b 1b f0 8e 21 82 1b 2f 89 82 a8 3e 18 8c 07 b5 1f ab bf 3c 37 53 ad e2 8b d5 22 e7 af bd 65 33 08 c7 6f 8c 79 04 Data Ascii: i]AWSGK[p5?PQWI7~0Eus0P^e0z*\|cx]} >y4J7t8;b<R{7XMn?dS7Lh(-r#$YX'#!C!/><7S"e3oy
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: f0 1f b5 08 a3 ed 2c a2 3d 90 77 1e 44 b4 ab 52 b6 24 67 62 8f 33 1d 21 16 e2 35 5d 36 40 ee 9c e3 4a bb f8 d9 54 ee d1 63 25 f3 58 d1 89 f9 bc 60 ca b0 b8 c7 9a 32 60 e5 51 fe 80 44 35 54 ba 3a af ba 87 b8 36 71 0e 5b 4b 0e f4 9d a1 82 b0 76 5b e9 a1 6e 53 13 af e6 15 d9 23 01 15 a3 4e b2 24 12 96 66 01 1a 5b 13 21 99 1b 2b 0e c8 36 26 61 36 16 26 7d 92 f3 2e d5 c5 48 7e fa 6c ed c3 25 20 b2 4a 6e 51 42 75 9f ae 69 f6 01 1a fe c6 c1 9a b2 39 14 5d 45 ca 49 39 97 90 da 94 f9 9b 05 d7 99 8f 09 72 cd 47 8c 69 a6 63 05 f9 25 a3 3d a8 cc 46 8b 80 94 8c 12 e6 65 db 2d 27 aa e9 d2 4e c0 cd ec 49 97 17 90 e2 c8 ae e2 42 47 df c7 76 e3 2f 10 79 42 9e 14 d1 d9 70 8c 7d 9e d5 9b ab 98 c4 23 67 18 3f 98 33 48 51 88 f6 10 1d e2 4e 55 94 24 36 44 be 89 1f 88 88 8e d8 Data Ascii: ,=wDR$gb3!5]6@JTc%X`2`QD5T:6q[Kv[nS#N$f[!+6&a6&}.H~l% JnQBui9]EI9rGic%=Fe-'NIBGv/yBp}#g?3HQNU$6D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.4	50159	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	898	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	50170	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-04.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1334	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2050 Connection: close CF-Ray: 85971c2dfcd10f89-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 327637 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "928ca01f2ee63c298cad657cdb7575dc" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 42cdf90926c91454b0e8865bb13f3962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: tbnvwx41ZO3R0Q4ugY4TFwGXl6tvuGMsDuvHnnnHgwiYJlqN3jJrJA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: qI5otDfjTsqB2GcocnpM1Cc3x4F8ILF5gM9SkbpRhM5tRnIFVaEzgUR3fV86GjqIp2Z6bJeGBAo= x-amz-meta-cache-tag: F-99219808897,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721771 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 0MBYNSFT632KGF7M x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: YgQ11h.xoKDO5RlxlF2GcatWO0jMIsjM X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:40 UTC	540	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 46 44 69 77 4b 25 32 46 63 32 4f 72 35 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FDiwK%2Fc2Or5
2024-02-22 12:07:40 UTC	864	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 37 2e 32 34 38 35 2c 32 31 2e 38 34 39 36 76 31 2e 35 34 34 38 63 30 2c 32 2e 33 33 30 32 2c 31 2e 33 36 31 37 2c 34 2e 30 31 36 35 2c 33 2e 38 38 38 33 2c 34 2e 30 31 36 35 2c 33 2e 34 38 35 34 2c 30 2c 33 2e 38 33 35 38 2d 32 2e 32 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <path d="m17.2485,21.8496v1.5448c0,2.3302,1.3617,4.0165,3.8883,4.0165,3.4854,0,3.8358-2.2
2024-02-22 12:07:40 UTC	1186	IN	Data Raw: 31 2e 36 31 33 38 2d 33 2e 39 31 33 35 2c 32 2e 36 32 36 32 2c 30 2c 31 2e 30 32 39 39 2c 31 2e 33 30 34 33 2c 31 2e 39 31 34 2c 33 2e 39 31 33 35 2c 32 2e 36 35 31 39 2c 35 2e 39 31 31 35 2c 31 2e 36 33 34 39 2c 31 33 2e 30 33 38 32 2c 31 2e 36 33 34 35 2c 31 38 2e 39 34 39 38 2c 30 2c 32 2e 36 30 39 31 2d 2e 37 33 37 39 2c 33 2e 39 31 33 34 2d 31 2e 36 32 32 31 2c 33 2e 39 31 33 34 2d 32 2e 36 35 31 39 2c 30 2d 31 2e 30 31 32 34 2d 31 2e 33 30 34 33 2d 31 2e 38 38 37 37 2d 33 2e 39 31 33 34 2d 32 2e 36 32 36 32 5a 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 34 2e 37 32 35 38 2c 32 31 2e 36 39 31 76 31 2e 35 34 34 38 63 30 2c 32 2e 33 36 31 37 2d 31 2e 33 34 30 34 2c 34 2e 30 31 36 35 2d 33 Data Ascii: 1.6138-3.9135,2.6262,0,1.0299,1.3043,1.914,3.9135,2.6519,5.9115,1.6349,13.0382,1.6345,18.9498,0,2.6091-.7379,3.9134-1.6221,3.9134-2.6519,0-1.0124-1.3043-1.8877-3.9134-2.6262Z" fill="#fff"/> </g> <path d="m14.7258,21.691v1.5448c0,2.3617-1.3404,4.0165-3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.4	50167	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-01.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2562 Connection: close CF-Ray: 85971c2ddaf5c46d-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 317484 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "18715d69ddd4017fca484c62932ee2d8" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 7edae070a6a25cc68c970c1111701a20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: VglvHeE_-CS2YMFLbzQ1z-yCdnJwHIv9eXt6Uk79HWF4B3ThmsJGbA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: PI6TnIKUndz/ha+HEkdoF8jCxkDTAjg7AfLGJbWIg1XXu2zbMJNtCv8ysM9ZoEvPffDmUpd0kVA= x-amz-meta-cache-tag: F-99219679769,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721672 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 7CCM85GX6YGNAVV0 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: tTZjzQF1zWdr2YbqNlz_wz97NrjjxdhB X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	509	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 31 77 57 72 52 46 6c 58 62 61 65 43 32 43 73 32 30 52 47 61 25 32 46 59 58 65 78 59 50 4f 4d 73 59 45 43 4e 70 4f 52 76 62 32 56 34 65 48 67 79 79 58 25 32 46 6d Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1wWrRFlXbaeC2Cs20RGa%2FYXexYPOMsYECNpORvb2V4eHgyyX%2Fm
2024-02-22 12:07:40 UTC	860	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 6d 37 2e 33 39 30 35 2c 38 2e 38 33 37 35 68 31 36 2e 38 31 32 31 63 31 2e 34 31 32 32 2c 30 2c 32 2e 35 35 38 36 2c 31 2e 31 34 36 35 2c 32 2e 35 35 38 36 2c 32 2e 35 35 38 36 76 31 31 2e 38 32 37 38 48 34 2e 38 33 31 39 76 2d 31 31 2e 38 32 37 38 63 30 2d 31 2e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <path d="m7.3905,8.8375h16.8121c1.4122,0,2.5586,1.1465,2.5586,2.5586v11.8278H4.8319v-11.8278c0-1.
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 34 2e 33 33 38 32 2c 31 35 2e 36 36 34 31 63 2e 34 32 37 38 2e 32 34 37 35 2c 31 2e 30 30 34 36 2e 33 35 31 33 2c 31 2e 34 35 38 34 2e 33 35 31 33 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 20 78 31 3d 22 Data Ascii: 1d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m14.3382,15.6641c.4278.2475,1.0046.3513,1.4584.3513" fill="none" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <line x1="
2024-02-22 12:07:40 UTC	333	IN	Data Raw: 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 39 2e 31 36 38 37 2c 32 36 2e 37 33 36 33 48 32 2e 38 33 31 33 63 2d 2e 39 33 39 39 2d 2e 30 39 35 37 2d 31 2e 33 33 30 36 2d 31 2e 32 31 31 37 2d 31 2e 33 35 30 31 2d 32 2e 30 32 32 37 76 2d 2e 30 35 39 35 68 32 39 2e 30 33 37 38 63 2d 2e 30 31 39 36 2e 38 31 34 34 2d 2e 34 32 38 38 2c 31 2e 39 33 32 2d 31 2e 33 35 30 31 2c 32 2e 30 38 32 32 5a 22 20 66 69 6c 6c 3d 22 23 65 66 66 31 66 32 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 Data Ascii: e="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> </g> </g> <path d="m29.1687,26.7363H2.8313c-.9399-.0957-1.3306-1.2117-1.3501-2.0227v-.0595h29.0378c-.0196.8144-.4288,1.932-1.3501,2.0822Z" fill="#eff1f2" stroke="#071d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.4	50161	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1008	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source=navigation-source Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:40 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:40 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:40 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.4	50169	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-05.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1329	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 4118 Connection: close CF-Ray: 85971c2dee658c1e-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 0 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "2d20353cf7ab34148cea8990568f1752" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 42cdf90926c91454b0e8865bb13f3962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: FosDrCzUHsd-WP2bwLLQ8Kugj-4UboQAB87D_KdzB2mcK_Bt4DETHw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: rVC5RBmlsojalvSkHVUG1Q9R0504WWWW9LIkkTx0h2L8/lRgeMOSGvobpGoMbO6vbup0CsUUdDM= x-amz-meta-cache-tag: F-99218592519,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721653 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: GP18HFAKWBPNDT5C x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: BlnosN6G9_ve2k2nqb1pRcJ9xO1JXyDt X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:40 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 75 46 58 32 36 74 51 53 72 58 41 68 76 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uFX26tQSrXAhv
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 37 34 35 33 22 20 79 3d 22 39 2e 31 34 31 31 22 20 77 69 64 74 68 3d 22 32 36 2e 35 30 39 34 22 20 68 65 69 67 68 74 3d 22 31 36 2e 38 38 32 38 22 20 72 78 3d 22 33 2e 38 33 37 39 22 20 72 79 3d 22 33 2e 38 33 37 39 22 20 66 69 6c 6c Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <rect x="2.7453" y="9.1411" width="26.5094" height="16.8828" rx="3.8379" ry="3.8379" fill
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 34 2d 31 2e 39 39 34 73 31 2e 39 39 34 2e 38 39 32 38 2c 31 2e 39 39 34 2c 31 2e 39 39 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 31 65 32 32 32 61 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 30 2e 35 30 33 35 2c 31 37 2e 38 31 36 38 63 30 2c 31 2e 31 30 31 33 2e 38 39 32 38 2c 31 2e 39 39 34 2c 31 2e 39 39 34 2c 31 2e 39 39 34 68 32 2e 37 34 37 34 63 2e 38 31 30 36 2c 30 2c 31 2e 34 36 37 36 2e 36 35 37 31 2c 31 2e 34 36 37 36 2c 31 2e 34 36 37 36 73 2d 2e 36 35 37 31 2c 31 2e 34 36 37 36 2d 31 2e 34 36 37 36 2c 31 2e Data Ascii: 4-1.994s1.994.8928,1.994,1.994" fill="none" stroke="#1e222a" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m20.5035,17.8168c0,1.1013.8928,1.994,1.994,1.994h2.7474c.8106,0,1.4676.6571,1.4676,1.4676s-.6571,1.4676-1.4676,1.
2024-02-22 12:07:40 UTC	1369	IN	Data Raw: 36 35 35 34 6c 2d 2e 33 37 32 38 2d 2e 34 38 36 34 63 2d 2e 33 34 31 33 2d 2e 34 34 35 32 2d 2e 35 32 36 32 2d 2e 39 39 30 35 2d 2e 35 32 36 32 2d 31 2e 35 35 31 34 76 2d 2e 36 37 39 32 22 20 66 69 6c 6c 3d 22 23 65 34 36 22 20 73 74 72 6f 6b 65 3d 22 23 31 65 32 32 32 61 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 31 32 2e 34 30 34 32 2c 32 30 2e 39 37 31 37 6c 2d 2e 35 39 33 36 2d 2e 31 35 32 34 63 2d 2e 35 34 33 33 2d 2e 31 33 39 35 2d 31 2e 30 32 35 35 2d 2e 34 35 34 32 2d 31 2e 33 37 31 39 2d 2e 38 39 35 34 6c 2d 2e 34 31 39 34 2d 2e 35 33 34 33 Data Ascii: 6554l-.3728-.4864c-.3413-.4452-.5262-.9905-.5262-1.5514v-.6792" fill="#e46" stroke="#1e222a" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> <path d="m12.4042,20.9717l-.5936-.1524c-.5433-.1395-1.0255-.4542-1.3719-.8954l-.4194-.5343
2024-02-22 12:07:40 UTC	11	IN	Data Raw: 3c 2f 67 3e 0a 3c 2f 73 76 67 3e Data Ascii: </g></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.4	50171	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-06.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1334	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2024 Connection: close CF-Ray: 85971c2e1dd915c3-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 327637 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "51730e5547db617f6f3517e9d2e11458" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: I_v5KXoaSy_vxdsRWNY4dvyWBFVmvXd73nk2DPoNYphKokyOJg7WqA== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: gTljSZYF9M6GMxiTntaCkQsyqasuZHBd7kbVrvmfl0u9nKJp359Y0VPtM79e2f9kuLSu/l6BTTo= x-amz-meta-cache-tag: F-99220627505,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721709 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 30CH3MMG1T8309QB x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: rebY07NTfU0aOxqPuGkgYHGI7Mka2WIJ X-Cache: RefreshHit from cloudfront
2024-02-22 12:07:40 UTC	542	IN	Data Raw: 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 79 32 72 76 44 61 64 54 72 4c 65 33 56 Data Ascii: X-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y2rvDadTrLe3V
2024-02-22 12:07:40 UTC	862	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 36 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 72 65 63 74 20 78 3d 22 32 2e 33 35 31 36 22 20 79 3d 22 37 2e 35 33 32 34 22 20 77 69 64 74 68 3d 22 32 37 2e 32 39 36 37 22 20 68 65 69 67 68 74 3d 22 31 37 2e 33 38 34 32 22 20 72 78 3d 22 32 2e 30 33 39 38 22 20 72 79 3d 22 32 2e 30 33 39 38 22 20 66 69 6c 6c Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_6" data-name="Layer 6" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <rect x="2.3516" y="7.5324" width="27.2967" height="17.3842" rx="2.0398" ry="2.0398" fill
2024-02-22 12:07:40 UTC	1162	IN	Data Raw: 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 38 2e 38 34 37 36 2c 31 38 2e 33 37 36 76 34 2e 39 35 30 34 63 30 2c 2e 34 38 38 35 2e 31 39 34 33 2e 39 35 36 39 2e 35 34 2c 31 2e 33 30 31 39 6c 33 2e 34 39 38 2c 33 2e 34 39 31 63 2e 33 34 34 39 2e 33 34 34 32 2e 38 31 32 32 2e 35 33 37 35 2c 31 2e 32 39 39 33 2e 35 33 37 35 68 34 2e 39 33 33 39 63 2e 34 38 35 36 2c 30 2c 2e 39 35 31 35 2d 2e 31 39 32 2c 31 2e 32 39 36 31 2d 2e 35 33 34 32 6c 33 2e 35 31 38 32 2d 33 2e 34 39 33 38 63 2e 33 34 37 37 2d 2e 33 34 35 33 2e 35 34 33 33 2d 2e 38 31 35 31 2e 35 34 33 33 2d 31 2e 33 30 35 31 Data Ascii: " stroke-linejoin="round" stroke-width="1.2"/> </g> <g> <path d="m8.8476,18.376v4.9504c0,.4885.1943.9569.54,1.3019l3.498,3.491c.3449.3442.8122.5375,1.2993.5375h4.9339c.4856,0,.9515-.192,1.2961-.5342l3.5182-3.4938c.3477-.3453.5433-.8151.5433-1.3051

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.4	50172	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2412	OUT	GET /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: text/plain Content-Length: 18 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:40 UTC	18	IN	Data Raw: 4e 6f 20 55 52 4c 20 6d 61 74 63 68 20 66 6f 75 6e 64 Data Ascii: No URL match found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.4	50173	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	599	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:40 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.4	50174	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-03.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:40 UTC	1356	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:40 GMT Content-Type: image/svg+xml Content-Length: 2167 Connection: close CF-Ray: 85971c2fab1f7c84-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "7c914298239cf721327de260c143da58" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: jhWiQEeQ422_B0FgmAc59ZuNfr80bL03mzyCDu-jLPWKLC__FGppcQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: fYTtMKc556U8ItUYFqnuL/WzwRfWUHn7Wy9+MeIUSEgiIwgODMEWomqcqLZFO4jCLjAemHrHmT4= x-amz-meta-cache-tag: F-99219736896,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721623 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 7CCG84119BCRBR0S x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: Nm6pUoWOXZXqi4yYCSLqrc4_OBhD1YWj X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:40 UTC	501	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 25 32 46 56 79 72 6b 54 4b 44 39 6f 66 49 77 6c 67 5a 58 33 6b 52 32 6d 53 32 69 4c 4c 30 35 76 75 7a 5a 76 67 4f 4e 57 65 65 6e 53 79 6c 6d 48 73 65 6e 63 78 4e Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FVyrkTKD9ofIwlgZX3kR2mS2iLL05vuzZvgONWeenSylmHsencxN
2024-02-22 12:07:40 UTC	881	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 39 2e 38 38 34 31 22 20 63 79 3d 22 32 36 2e 33 38 38 38 22 20 72 3d 22 31 2e 33 39 38 38 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 31 37 2e 34 33 37 38 22 20 63 79 3d 22 32 36 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <circle cx="9.8841" cy="26.3888" r="1.3988" fill="#fff"/> <circle cx="17.4378" cy="26
2024-02-22 12:07:40 UTC	1286	IN	Data Raw: 32 37 30 31 2e 39 31 35 34 2c 30 2c 2e 38 34 36 36 2d 2e 36 39 33 31 2c 31 2e 35 35 37 34 2d 31 2e 35 34 33 35 2c 31 2e 35 35 37 34 2d 2e 38 33 35 31 2c 30 2d 31 2e 35 34 33 35 2d 2e 37 32 36 33 2d 31 2e 35 34 33 35 2d 31 2e 35 35 37 34 2c 30 2d 2e 33 35 30 38 2e 30 39 36 35 2d 2e 36 35 35 37 2e 32 38 39 34 2d 2e 39 31 35 34 6d 2d 35 2e 30 32 36 2c 30 63 2e 31 38 36 34 2e 32 36 30 35 2e 32 37 39 37 2e 35 36 35 34 2e 32 37 39 37 2e 39 31 35 34 2c 30 2c 2e 38 34 36 36 2d 2e 36 39 32 39 2c 31 2e 35 35 37 34 2d 31 2e 35 34 33 34 2c 31 2e 35 35 37 34 2d 2e 38 33 35 32 2c 30 2d 31 2e 35 34 33 35 2d 2e 37 32 36 33 2d 31 2e 35 34 33 35 2d 31 2e 35 35 37 34 2c 30 2d 2e 33 35 2e 30 39 36 35 2d 2e 36 35 34 39 2e 32 38 39 34 2d 2e 39 31 35 34 6d 31 37 2e 36 33 34 35 Data Ascii: 2701.9154,0,.8466-.6931,1.5574-1.5435,1.5574-.8351,0-1.5435-.7263-1.5435-1.5574,0-.3508.0965-.6557.2894-.9154m-5.026,0c.1864.2605.2797.5654.2797.9154,0,.8466-.6929,1.5574-1.5434,1.5574-.8352,0-1.5435-.7263-1.5435-1.5574,0-.35.0965-.6549.2894-.9154m17.6345

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.4	50176	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	656	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:41 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:41 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.4	50175	142.251.40.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	1369	OUT	GET /activityi;dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.avast.com/c-malware Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:41 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:41 GMT Expires: Thu, 22 Feb 2024 12:07:41 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:41 UTC	589	IN	Data Raw: 32 62 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4c 43 51 2d 64 48 30 76 6f 51 44 46 5a Data Ascii: 2ba<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CLCQ-dH0voQDFZ
2024-02-22 12:07:41 UTC	116	IN	Data Raw: 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 63 2d 6d 61 6c 77 61 72 65 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 2;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware"/></body></html>
2024-02-22 12:07:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.4	50177	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2675	OUT	GET /hubfs/New_Avast_Academy/what_is_malware_academy_refresh/icon-02.svg HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:41 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:41 GMT Content-Type: image/svg+xml Content-Length: 1996 Connection: close CF-Ray: 85971c31a9a00fa0-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 327638 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "9cb7c6dbeadcbeb59c505fd42d45d12a" Last-Modified: Thu, 19 Jan 2023 23:08:42 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 079cd4553da15b2329bffae6abe6157e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL X-Amz-Cf-Id: mawrosHyJIuAeS1BqugNKoMhRpdbKnwmmcNoWRjxUoFabrto5LtxRw== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: k3YueYuxCuOCUp3wMEEbBioCJCcnBtcN4K9tv/qh+y0IMLWDj15DONJuiHVO0kbgsxhe//azkaY= x-amz-meta-cache-tag: F-99219679770,FD-99217965202,P-4650993,FLS-ALL x-amz-meta-created-unix-time-millis: 1674169721737 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: N47KCRP2VJT5DMWK x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: WrM3Asm8FGgkIXZp6IPRVGiFIuxXItT6 X-Cache: Miss from cloudfront X-HS-Alternate-Content-Type: text/plain
2024-02-22 12:07:41 UTC	501	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 61 4b 57 65 6c 46 41 43 64 37 4d 45 47 67 79 52 72 73 47 43 5a 33 6c 65 44 31 4a 63 50 59 36 64 4a 77 39 6d 64 6c 4d 6b 4f 38 42 25 32 46 6b 73 4b 4a 39 6d 74 41 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aKWelFACd7MEGgyRrsGCZ3leD1JcPY6dJw9mdlMkO8B%2FksKJ9mtA
2024-02-22 12:07:41 UTC	868	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 6d 32 38 2e 32 38 35 35 2c 32 35 2e 32 33 36 38 48 33 2e 37 31 34 35 63 2d 2e 38 32 39 36 2c 30 2d 31 2e 35 30 32 32 2d 31 2e 30 35 35 35 2d 31 2e 35 30 32 32 2d 32 2e 33 35 37 35 68 30 73 31 30 2e 30 38 33 2c 30 2c 31 30 2e 30 38 33 2c 30 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"> <g> <path d="m28.2855,25.2368H3.7145c-.8296,0-1.5022-1.0555-1.5022-2.3575h0s10.083,0,10.083,0
2024-02-22 12:07:41 UTC	1128	IN	Data Raw: 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 2e 32 22 2f 3e 0a 20 20 3c 2f 67 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 6f 6c 79 6c 69 6e 65 20 70 6f 69 6e 74 73 3d 22 31 37 2e 33 34 31 38 20 31 32 2e 33 38 38 31 20 31 38 2e 36 38 33 37 20 31 33 2e 37 33 20 32 30 2e 30 32 35 35 20 31 32 2e 33 38 38 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 73 74 72 6f 6b 65 3d 22 23 30 37 31 64 32 62 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d Data Ascii: " stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/> </g> <g> <polyline points="17.3418 12.3881 18.6837 13.73 20.0255 12.3881" fill="none" fill-rule="evenodd" stroke="#071d2b" stroke-linecap="round" stroke-linejoin="round" stroke-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.4	50178	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	636	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658882&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:41 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:41 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:41 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.4	50180	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2745	OUT	GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware-EN.png?width=1684&height=1200&name=Types-of-Malware-EN.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:41 UTC	1278	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:41 GMT Content-Type: image/png Content-Length: 108799 Connection: close CF-Ray: 85971c31ff466a55-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfiesepIcdZnIjYhf6WVye8_9jowqkFIGH3SmCxBz5DQ:1806d19e710b9b4f989d80c2f8554643" Last-Modified: Thu, 19 Jan 2023 22:44:41 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 7edae070a6a25cc68c970c1111701a20.cloudfront.net (CloudFront) cache-tag: F-99217761792,FD-99217965202,P-4650993,FLS-ALL cf-bgj: imgq:0,h2pri cf-resized: internal=ok/m q=0 n=235+0 c=6+0 v=2024.1.3 l=108799 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=4;i=?0,cf-chb=(45;u=5;i) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2XD6xxVD4gxkInpGWvHZdlQ%2Boq6i2%2FrcFcLbqgK1oYkWntbyxwXSZItRpOzkKG9UQsjfx2X25d%2Bb3AQYRLgk5P9zfXKIZNTWpbQ3zOxGPU8np1GO0uGGR%2FuPJNqwYihS4Jj8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 06 94 00 00 04 b0 08 06 00 00 00 f5 fb a9 a4 00 00 80 00 49 44 41 54 78 5e ec dd 5f ec 26 57 9d e7 f7 bd db fb 48 b1 f6 66 57 5c d0 0a 30 36 6d fe 18 b3 48 66 57 56 db 91 a3 71 64 6b 5a 11 1e 65 64 79 7a 1c 65 0d 0a 4c 1a 13 a1 b5 2d 94 8e 64 46 a0 d5 d0 30 62 34 a0 20 37 16 2b 16 6c 6d 27 a4 01 c9 9b 4d 83 66 22 0b 06 ff 56 43 18 61 61 a6 97 78 c7 4c ac c1 13 02 42 7b f5 84 cf d3 94 29 7f cf df fa 77 ea 9c aa f7 c5 4b 98 fe 9d fa 5f 4f 55 3d df cf 73 4e fd bd c3 7f fc f9 01 00 00 a0 59 ff ef 7f 00 00 00 68 c3 ff f7 37 ee b3 0c 00 00 40 1b fe e9 df f3 fc 23 00 00 40 3b 6c a1 06 00 00 a0 56 04 4a 00 00 a0 5d 04 4a 00 00 a0 71 b6 50 03 00 00 50 2b 02 25 00 00 d0 2e 02 25 00 00 d0 38 5b a8 01 00 00 a8 15 Data Ascii: PNGIHDRIDATx^_&WHfW\06mHfWVqdkZedyzeL-dF0b4 7+lm'Mf"VCaaxLB{)wK_OU=sNYh7@#@;lVJ]JqPP+%.%8[
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 88 8e b7 9d de b2 d3 c4 d8 69 fb 14 44 da f6 3e 39 c7 7e ec e7 a4 33 f4 58 f7 4d b9 16 4d 59 6e 8a 3d 4f d0 08 5b a8 01 1a a0 20 49 21 92 bd 0e c5 28 5c fa 37 5f fb 5f 9d 79 f9 28 84 b2 d3 e7 f8 07 bf 71 eb 71 39 ff fc 23 ff e3 e1 cb ff ea 5f 3a f3 ed d3 df ed f4 96 d6 c3 4e 97 92 9a af 82 36 ad 9f fd f7 be 37 fc e3 33 ce 7c 43 74 2c ec f4 96 9d 26 c6 4e db a7 75 b7 ed 7d 7e fb f7 fe 99 33 ad a5 f5 b6 d3 0d 31 f6 1c 11 9d 23 3a 7f 15 86 0e 5d 8f 29 cb 4d 19 73 be 01 c5 11 28 61 87 96 fe 7e 3a e6 3b 62 f7 23 5f d5 06 be fc af ff 97 51 cb df 7a 5d 41 6a 3c 76 9d 29 75 85 a9 cb 4e a1 b6 80 0d 23 50 6a d1 5c 17 3c f5 4e d1 bc c6 5c 74 43 d4 1b c6 2e c7 67 4a 88 90 b3 fd ba a9 db e9 72 d8 f9 f4 e5 de 0c 14 c6 f4 7b 01 0d 35 76 dd 3b 7f fe e7 7f ee f4 86 1a 43 Data Ascii: iD>9~3XMMYn=O[ I!(\7__y(qq9#_:N673\|Ct,&Nu}~31#:])Ms(a~:;b#_Qz]Aj<v)uN#Pj\<N\tC.gJr{5v;C
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 15 48 c6 7e f9 63 a5 1e b0 b4 2c 3b 4d 5f ce 3e 1a b3 6f 52 c7 34 64 ec b1 ce 15 fa dc 2e b9 5c df 79 82 06 d8 42 0d 50 a1 54 50 10 2a 84 e7 14 df 7d 3d 67 72 a6 1b 2b d4 03 25 15 80 4d 09 19 7c ef 1e 4a 05 38 12 ea c1 d5 89 f5 28 b2 52 e1 8d 96 65 a7 e9 f3 6d 83 95 da 87 3e b1 a0 2e 26 b5 cf a7 f2 9d 23 4b 2f 37 f4 39 02 aa 42 a0 84 1d 29 f5 fd 74 c9 ef 88 9d d0 f7 f9 2d d6 15 64 2b c7 2e 54 57 58 7a d9 d4 16 b0 61 04 4a 2d 4a 5d f0 6c 7b d1 45 5d 37 8d 9c 1b 42 ee cd a5 2f a7 87 8e cf d0 21 e9 24 b5 fd 3e b9 cb b1 d3 f5 c5 6e 06 b1 40 26 75 b3 4f 6d 4f 6c b9 a9 71 71 45 21 50 ea e1 45 d4 26 27 9c 5a ea 17 1e b9 c3 de 8d 3d d7 42 fb 31 f5 e0 16 9a 4e 86 76 01 97 d8 03 56 6a df c5 a6 95 b1 fb 26 f7 f3 61 a5 d6 d7 b6 97 39 ae 45 63 96 8b 8d b3 85 1a a0 42 Data Ascii: H~c,;M_>oR4d.\yBPTP*}=gr+%M\|J8(Rem>.&#K/79B)t-d+.TWXzaJ-J]l{E]7B/!$>n@&uOmOlqqE!PE&'Z=B1NvVj&a9EcB
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 7d 25 16 54 89 ef 33 11 7b c8 d2 36 c4 1e 40 7d bf d8 89 ad 43 ea 81 2c f5 f9 5a e2 73 28 39 c7 3a 66 ec b5 68 ea 72 b1 41 b6 50 03 54 28 d6 bb a4 4f ed 14 1c 4c ed b1 34 47 d1 3e 15 ac d8 f6 7d b1 f0 43 34 ef 58 60 15 1b aa ce 4a f5 88 f2 0d 29 18 0b 70 b4 ee b1 40 cc d7 1b 28 b6 0e a9 b0 27 d5 cb aa 1b ce 2e d5 ce 17 74 c5 4c 3d 47 62 a1 9c f8 f6 fb 1c cb 05 9a 47 a0 84 8d 4b 7d ef 5c e2 fb e9 dc df 11 63 df cf c5 57 5f 48 4d e3 fb 7e 5b 53 5d 41 52 c7 a4 c6 63 37 b6 ae 30 c7 b2 81 9d 22 50 6a d1 94 0b 5e ce 0b eb 62 05 7d 2b f6 ab 04 db 4b 26 16 f4 f8 6e 84 21 a9 ed 4f f5 54 11 df cd 5f 6c bb 9c 69 72 d6 c9 47 c7 41 37 36 df 2f 5b 52 62 fb 52 62 bd b0 72 c5 86 97 93 d0 af 3c 52 fb 22 d5 26 34 ec 5d 6c 7d ba 63 63 ff dd d7 c6 27 f5 00 e2 db d6 50 b8 25 Data Ascii: }%T3{6@}C,Zs(9:fhrAPT(OL4G>}C4X`J)p@('.tL=GbGK}\cW_HM~[S]ARc70"Pj^b}+K&n!OT_lirGA76/[RbRbr<R"&4]l}cc'P%
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: f4 83 1b fb b7 be 9c 75 eb a8 2b 70 6a b9 39 42 cb b4 ed fa e6 bc 89 8d 79 80 1a 72 7c 42 c3 d8 49 bf 7b 74 a8 9d 7d d0 b2 7f ef 0b ed cb 4e 6a bc e3 6e 59 b1 87 39 3b a6 70 ec 21 51 ba 6d 0c 6d 9f c4 d6 3b f5 79 5a f2 73 28 a9 63 3d 54 ee b5 68 ce e5 ce f9 79 c1 8a 6c a1 06 68 80 86 32 8b 85 09 b9 fa 3d 6f fa e6 2c da f7 a5 02 12 1f 85 44 39 c3 e8 85 b6 25 47 ea 3d 4a 5d 58 14 0b 89 ec fb 8a 62 e1 93 74 c1 5a 6c db 62 db 14 7b 97 93 84 86 15 4c 4d 17 5b 66 df dc e7 88 f6 43 2a 4c 9a 7b b9 04 4a 68 12 81 12 36 2a f5 3d 73 c9 ef a7 a9 ef 88 b6 7d 8e 31 f5 90 16 eb 0a 92 3a 06 6b 1e bb a1 72 eb 0a 73 2f 9b da 02 76 84 40 a9 45 73 5d f0 94 d8 6b 5e a9 2e a0 3e b1 1e 23 a1 ae b0 9d d8 4d 2e d6 2b a7 93 da 7e db 3e 75 83 93 ee 26 67 ff dd d7 66 08 05 4b fa 25 Data Ascii: u+pj9Byr\|BI{t}NjnY9;p!Qmm;yZs(c=Thylh2=o,D9%G=J]XbtZlb{LM[fCL{Jh6=s}1:krs/v@Es]k^.>#M.+~>u&gfK%
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 0b 17 db ae 2f f7 f8 8d 79 48 0b 1d a3 4e aa cb 7b 88 9d 4f a7 86 cf a1 0c 39 d6 73 5e 8b 86 2c 17 3b 61 0b 35 40 e5 54 78 57 8f 98 d0 30 6b 3e f6 5a f7 9a eb 27 81 d2 ab c6 84 3f be fd d7 97 1a 4a 2f c4 ce a7 a3 63 6f db 2e 21 75 7e 0d 39 47 14 b8 a5 7a 6a a5 f6 e3 98 e5 02 9b 44 a0 84 8d a9 e1 fb e9 5c df 11 73 ea 01 be 51 64 ac 9c f9 58 a9 ef c3 73 d7 15 a4 b5 63 37 67 5d 61 e8 b2 01 bc 8a 40 a9 45 43 2f 78 a9 1e 30 92 5b 6c d7 8d d3 4e bb 84 39 7b c0 58 63 7b c4 f8 f6 91 6e 66 ba a9 eb 6f be 97 11 a6 7e 09 d2 cd c3 2e ab 2f 74 e3 cd e9 ee ab f0 2c f6 0b 17 2b 67 08 3e 89 05 55 63 8e cf d0 87 ad 50 37 66 db ae cf 77 fc 7c c6 3c a4 e5 cc db 9e 1b 29 b1 87 a0 1a 3e 87 32 f4 58 cf 75 2d 1a ba 5c ec 80 2d d4 00 15 51 21 5e 81 84 8a e8 2a b8 db 9e 29 b1 5e Data Ascii: /yHN{O9s^,;a5@TxW0k>Z'?J/co.!u~9GzjD\sQdXsc7g]a@EC/x0[lN9{Xc{nfo~./t,+g>UcP7fw\|<)>2Xu-\-Q!^*)^
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: f1 b0 d3 c6 a4 f6 69 27 b4 2d a9 e9 43 c1 4f 4a 2a 40 0b 05 55 a9 f5 b1 ed fb 14 c4 d9 f6 d6 d8 fd 30 45 68 99 40 55 08 94 b0 11 a9 ef 65 25 bf 9f a6 d6 65 2c 85 37 b1 1f b5 c6 d4 5a 57 c8 99 47 4d c7 ce b6 ef 9b 52 57 c8 59 f6 14 b1 e5 02 8d 23 50 6a 51 ea 82 67 db 5b 39 c1 83 1d 17 36 55 e8 f7 75 5b cd 65 e7 65 d9 75 99 ba fd 56 ce 0d 48 52 37 83 9c f7 21 e5 d2 43 cb 98 7d 9a 3b fc 5e 2e 6d cf d0 07 89 29 c7 27 d5 d3 2a d5 0d dc b6 ef 4b 1d 3f 2b e7 57 3f 43 82 36 c9 ed 85 15 fa 75 52 4d 9f 43 99 72 ac 65 cc b5 28 67 b9 53 0c 3d 4f 50 09 5b a8 01 2a 95 f3 3e a4 5c ea 2d 13 1a ca 4c 52 45 7b db be 04 bb 0e 7d 73 07 01 39 bd 89 62 81 9c 8f 42 41 3b 0f 9f 50 af a7 54 af 9e d8 f1 4c b1 f3 b2 d4 3b ca 4e 33 f5 1c 49 f5 8c 1a bb dc 29 e6 3e 8f 80 45 10 28 61 Data Ascii: i'-COJ@U0Eh@Ue%e,7ZWGMRWY#PjQg[96Uu[eeuVHR7!C};^.m)'K?+W?C6uRMCre(gS=OP[*>\-LRE{}s9bBA;PTL;N3I)>E(a
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 00 d0 2e 02 25 00 00 d0 38 5b a8 01 00 00 a8 15 81 12 00 00 68 17 81 12 00 00 68 9c 2d d4 00 00 00 d4 8a 40 09 00 00 b4 8b 40 09 00 00 34 ce 16 6a 00 00 00 6a 45 a0 04 00 00 da 45 a0 04 00 00 1a 67 0b 35 00 00 00 b5 22 50 02 00 00 ed 22 50 02 00 00 8d b3 85 1a 00 00 80 5a 11 28 01 00 80 76 11 28 01 00 80 c6 d9 42 0d 00 00 40 ad 08 94 00 00 40 bb 08 94 00 00 40 e3 6c a1 06 00 00 a0 56 04 4a 00 00 a0 5d 04 4a 00 00 a0 71 b6 50 03 00 00 50 2b 02 25 00 00 d0 2e 02 25 00 00 d0 38 5b a8 01 00 00 a8 15 81 12 00 00 68 17 81 12 00 00 68 9c 2d d4 00 00 00 d4 8a 40 09 00 00 b4 8b 40 09 00 00 34 ce 16 6a 00 00 00 6a 45 a0 04 00 00 da 45 a0 04 00 00 1a 67 0b 35 00 00 00 b5 22 50 02 00 00 ed 22 50 02 00 00 8d b3 85 1a 00 00 80 5a 11 28 01 00 80 76 11 28 01 00 80 c6 d9 Data Ascii: .%8[hh-@@4jjEEg5"P"PZ(v(B@@@lVJ]JqPP+%.%8[hh-@@4jjEEg5"P"PZ(v(
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: a1 f0 e8 ad 04 54 80 40 09 95 7b e5 e5 1f f3 ae 24 a0 00 7d ce 78 6d 01 1a 44 a0 84 b2 72 de 99 a4 42 b8 de 05 73 e1 63 7f 08 c0 50 b7 68 7d 3e 72 1e f0 79 e1 23 76 c3 16 6a 00 2c 4e bd 8c 72 7a c6 28 e4 50 d8 61 a7 5f 8c 42 9d 2e 38 ea 05 46 31 e7 de f6 66 67 bd 43 d4 d6 4e ff 1a 5d e0 a4 d0 4a 41 d3 0f 9f 73 d7 71 41 b9 c3 0e d2 5b 09 58 11 81 12 2a a7 ef 9d f6 be d1 51 bd 46 7f 57 0f 26 05 4f 76 5a 00 bf a6 cf 89 7a 21 c5 6a a1 1a c5 c9 4e 07 54 8e 40 09 e5 a4 7a 27 e9 22 4a 32 0f e4 53 60 14 7b 30 a1 97 12 76 c3 16 6a 00 2c 4a 3d 5c 72 42 0b 85 1b 8b 87 16 5d 80 a4 de 42 1f 3c eb 06 3c 09 43 c2 a4 4e 32 54 b2 14 32 3d fe d0 e1 f0 f4 a7 8b 04 4c 0a fb 14 18 d9 f5 b6 14 f6 f1 1e 2b 60 05 04 4a a8 5c e8 3b 26 85 6f 60 bc d0 eb 3f f4 63 61 db 16 a8 1c 81 Data Ascii: T@{$}xmDrBscPh}>ry#vj,Nrz(Pa_B.8F1fgCN]JAsqA[X*QFW&OvZz!jNT@z'"J2S`{0vj,J=\rB]B<<CN2T2=L+`J\;&o`?ca
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: f1 85 38 43 cf 6b df 39 3b e6 98 fa d6 85 ba 0d 1a 43 a0 84 32 28 76 63 6d be 9b f6 d8 f0 66 ce 79 5d fc e3 cf 3a f3 52 d7 7f db 2e 85 cf 18 76 cd 16 6a 00 64 2b 12 26 3d fd e9 2a 7a 25 59 b1 5e 4a 29 ea c1 64 e7 b7 ba c7 1f 9a dc 5b e9 ea 33 57 8e c7 dc 6e 6f 87 50 09 98 01 81 12 2a 66 af fb 32 b4 f0 9e 62 7b 8b ec c9 98 1e 2d 7b 67 f7 a1 0c 3d 27 7d a1 d4 d0 5a 89 af 0e 34 74 1e 73 ce 07 58 11 81 12 ca a0 d8 8d b5 f9 1e 58 c7 be 1c d3 f7 d2 d0 31 bf 4c 99 73 5e 7c c6 b0 6b b6 50 03 20 db a2 61 52 85 bd 92 2c 0d 6b 67 b7 3b 45 d3 d8 f9 54 43 c1 dd c4 de 4a 3a e6 84 4a c0 82 08 94 50 31 7b cd 97 a1 c5 fb 14 7d 0f b7 cb 10 7d 37 d6 f7 da 2d f0 85 06 32 66 b8 b6 bd b3 fb 70 cc 39 49 a0 04 cc 8a 40 09 65 e8 86 6a 2f 98 5c 34 51 ca 9c e7 df 9c f3 12 3b 9f b1 Data Ascii: 8Ck9;C2(vcmfy]:R.vjd+&=z%Y^J)d[3WnoPf2b{-{g='}Z4tsXX1Ls^\|kP aR,kg;ETCJ:JP1{}}7-2fp9I@ej/\4Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.4	50182	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	693	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fc-malware&rl=&if=false&ts=1708603658885&cd[content_ids]=%5B%27%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603658743&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:41 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:41 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:41 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.4	50181	199.60.103.28	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:40 UTC	2738	OUT	GET /hs-fs/hubfs/New_Avast_Academy/what_is_malware_academy_refresh/Types-of-Malware.png?width=1321&height=601&name=Types-of-Malware.png HTTP/1.1 Host: academy.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; s_nr=1708603614517-New; s_gpv=avast.com%3Aus%3Ahomepage%3Aindex-t1; s_gpv_custom=avast.com%3Ahomepage%3Aindex-t1; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; __cfruid=abd91d5abe0b2432fa70b2bdba8c5c52d41bc445-1708603652; __cf_bm=CaYhkcJEnLHTntMw1jxh_PHjc64gDKJzi27DT0zw94o-1708603652-1.0-Ad7M6KznNC01VUgf5njvc33x+9GMjaP6kaBdKTnaZUdKmILp/6EvtNvU5d5YtliUcgAilB9VpBIwiPCiF3ozfrU=; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=3&tt=fhi&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603658.0.0.0; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A38+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609
2024-02-22 12:07:41 UTC	1288	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:41 GMT Content-Type: image/png Content-Length: 46448 Connection: close CF-Ray: 85971c3208c48c77-EWR CF-Cache-Status: MISS Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfiFFjKT2D-rDwUCviiwFS9aCSb4APj0H1d7qLCJx2DQ:8462fb18718e5c0119542930b54c24ed" Last-Modified: Thu, 19 Jan 2023 23:23:16 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 b33e91c066f49dc7c18162b9a344e266.cloudfront.net (CloudFront) cache-tag: F-99219737485,FD-99217965202,P-4650993,FLS-ALL cf-bgj: imgq:0,h2pri cf-resized: internal=ok/m q=0 n=389+0 c=2+0 v=2024.1.3 l=46448 content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=4;i=?0,cf-chb=(45;u=5;i=?0) x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qBidV0MfOW9Zo9WkrX53GS6vyf7UlqPNsIP%2BHWwVo%2BU5Urlt%2BoiGZQoZ%2BQa%2FN17r1haW7riqag6WMU%2BpzyRPOQNFvbzfxg4rbOn5DSk%2BV3U%2BQYA2iWCL0cXaU9SdDWvTmHOf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 29 00 00 02 59 08 06 00 00 00 45 8a b0 5c 00 00 80 00 49 44 41 54 78 5e ec dd fd b3 65 55 9d e7 f9 fe 6d fe 00 27 88 f9 65 42 7f a8 9c 41 1a a1 0a 48 41 1d 85 a6 12 0c 85 ac 01 2a 8b 82 e9 0a 1c 33 9b a8 9e 01 66 c4 1c 83 86 52 a9 32 a9 4a ec 56 07 d3 a7 d0 72 c2 ce 34 8c 1a 9f aa 26 89 ae 2c 8c a0 bd f2 20 4a 23 98 22 9a 91 61 dc cc 0b 99 3c 4b a6 5a a5 15 15 76 c5 1e 3e 37 dd 37 d7 f9 ae bd cf d9 6b 9f bd f7 5a 7b ed f7 27 e2 65 60 de b3 cf 3d f7 9c 7d cf c3 e7 ae 87 7f 51 fc fc d9 ff f5 55 7f 0a 00 00 00 00 00 00 00 11 5c f2 2f 5e fd 9f 6f bd aa 00 00 00 00 00 00 00 80 08 fe 94 92 12 00 00 00 00 00 00 40 4c 94 94 00 00 00 00 00 00 00 a2 a2 a4 04 00 00 00 00 00 00 10 15 25 25 00 00 00 00 00 00 80 Data Ascii: PNGIHDR)YE\IDATx^eUm'eBAHA*3fR2JVr4&, J#"a<KZv>77kZ{'e`=}QU\/^o@L%%
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 00 00 00 98 8c 26 9b e5 68 03 1b 7b 5c 5f 9a 8c a2 d4 d7 ed 71 00 80 dc 50 52 02 00 00 00 c0 24 68 34 a2 2d 00 ad 21 a7 79 4b 93 51 94 43 6d de 03 00 88 89 92 12 00 00 00 00 26 e1 e8 c3 7e 01 68 0d b9 83 76 93 1d bd 87 2e 4d 01 00 b1 50 52 02 00 00 00 40 f6 9a 8c a2 7c fa 11 ff b8 3e 35 99 7a ae 5d bf ed 71 00 80 1c 51 52 02 00 00 00 40 f6 54 40 da 02 d0 d2 a6 3a f6 b8 be 68 c4 a6 fd fe 16 a3 28 01 60 4a 28 29 01 00 00 00 20 6b 4d 76 f4 d6 a8 46 7b 5c 5f 34 cd 7b d1 66 39 c2 5a 94 00 30 25 94 94 00 00 00 00 90 35 ed d6 6d 0b 40 6b c8 51 94 4d 46 75 6a fd 4c 46 51 02 c0 94 50 52 02 00 00 00 40 b6 9a 6c 4e 33 e4 28 4a ad 31 69 bf 7f 95 97 0f fb c7 02 00 72 46 49 09 00 00 00 00 d9 6a b2 f6 e3 50 a3 28 9b 6c de 23 1a f9 69 8f 05 00 e4 8e 92 12 00 00 00 00 b2 Data Ascii: &h{\_qPR$h4-!yKQCm&~hv.MPR@\|>5z]qQR@T@:h(`J() kMvF{\_4{f9Z0%5m@kQMFujLFQPR@lN3(J1irFIjP(l#i
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: b6 be 7c b8 fb db 59 de 67 fa 1e cb 96 a7 96 ca 54 dd 7e 15 aa fa 1e 43 df cf 00 80 2e 50 52 22 3f ee ae de 1a 91 62 3f 00 02 00 90 2a 8d fe 2f 5f c3 d8 e5 1b 88 ac 2c d5 54 7c cd 2b f8 da d2 75 96 85 60 8e 23 02 75 ff a9 a0 ed ba 90 0c a1 b5 33 cb 91 a0 94 96 00 90 3a 4a 4a e4 67 df de 2f 6c 7c c0 63 57 6f 00 c0 98 b8 bb 7c 6f ba f0 52 ef 35 0e 40 8f ca 52 32 56 a9 a6 d2 52 a3 1e 35 05 da de b6 31 50 d1 aa 32 50 23 25 35 b2 d1 fe 7c 29 50 69 a9 e2 74 ac f7 31 00 e4 8d 92 12 f9 d1 f4 b8 f2 03 de 0d b7 dc e6 7d 00 04 00 20 55 0f 3e fa c4 cc 92 25 f6 35 0e 40 c7 34 8a 51 23 ed 52 2b d5 c6 54 a6 e9 3e 54 31 69 7f 86 d4 e9 3e 56 29 9c e3 28 56 00 18 27 4a 4a e4 c7 2d 29 6f ba fd 43 de 07 40 00 00 52 46 49 09 f4 4c d3 7e 55 00 aa a4 b2 c5 55 8a 34 b2 33 b5 32 Data Ascii: \|YgT~C.PR"?b?*/_,T\|+u`#u3:JJg/l\|cWo\|oR5@R2VR51P2P#%5\|)Pit1} U>%5@4Q#R+T>T1i>V)(V'JJ-)oC@RFIL~UU432
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 88 4d a3 78 9b 8e f8 2d 69 d4 a5 bd 1e 00 80 8b 92 12 f9 a1 a4 24 84 10 92 42 28 29 81 00 2f 1f f6 4b 9d 2a 1a 69 a9 11 97 f6 78 60 28 4d a7 78 5b 8c a4 04 80 45 28 29 91 1f 4a 4a 42 08 21 29 84 92 12 68 48 a5 63 93 51 69 ba cc 89 35 ff 78 60 28 4d 47 fb 5a ac 49 09 00 4d 50 52 22 3f 94 94 84 10 42 52 08 25 25 d0 50 d3 e2 87 91 68 88 a9 e9 79 6a a9 5c 67 77 6f 00 68 82 92 12 f9 a1 a4 24 84 10 92 42 28 29 81 06 54 3c ae ae 2c c6 7a 7e 88 29 b4 a0 d4 c8 c9 e7 0e 16 c5 0b 4f b1 3c 01 00 34 47 49 89 fc 50 52 12 42 08 49 21 94 94 40 03 4d 76 47 d6 3a 94 f6 38 60 28 da 24 c7 9e 93 f3 50 a8 03 40 5b 94 94 c8 0f 25 25 21 84 90 14 42 49 09 2c a0 51 66 ab 2b f3 31 55 16 31 85 14 94 9c ab 00 b0 2c 4a 4a e4 87 92 92 10 42 48 0a a1 a4 04 e6 68 ba 59 8e 8a 4c 7b 2c 30 Data Ascii: Mx-i$B()/K*ix`(Mx[E()JJB!)hHcQi5x`(MGZIMPR"?BR%%Phyj\gwoh$B()T<,z~)O<4GIPRBI!@MvG:8`($P@[%%!BI,Qf+1U1,JJBHhYL{,0
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: ed 53 a9 34 6f dd 3f 32 ed e8 dc 50 c1 5d f7 dc a3 d2 52 5f 4f 71 b4 64 9b 34 29 2c 77 dc fc 9e 62 ed c7 4f 78 af 77 40 d2 9a 6c 9a 43 29 84 a1 68 17 79 7b fe b9 b4 0b bd 3d 06 00 30 34 4a 4a e4 87 92 72 b9 e8 03 f3 bc 0f cb 40 17 54 40 a9 ac 24 a4 cc a2 72 52 7f 34 d1 1f 4f 72 8e 8a d7 b9 f7 01 65 25 c6 64 d1 a6 39 da 65 d9 1e 03 f4 45 25 a4 3d 07 5d 4c f5 06 80 14 50 52 22 3f 94 94 ed a3 29 93 75 1f 8e 37 5f 72 79 b1 e5 ca ab 8a 9d b7 de 54 ec fa c0 fb 80 46 b6 5d 77 fd fa 79 73 c6 99 17 78 e7 d4 7a e9 72 eb 1d f6 34 24 13 4c dd b4 6e 3d 1f e5 34 6a 32 24 75 f7 89 ec bc fd fd c5 c9 e3 4c 93 45 e2 16 ed a4 cc a6 39 18 4a 93 51 bd 2a d5 ed 71 00 80 a1 51 52 22 3f 94 94 ed a2 12 c0 16 94 2a 97 f6 ef fd b8 ff 46 0e 68 61 ed db 5f 5b 2f 2e 6d 61 a9 1d 90 c9 Data Ascii: S4o?2P]R_Oqd4),wbOxw@lC)hy{=04JJr@T@$rR4Ore%d9eE%=]LPR"?)u7_ryTF]wysxzr4$Ln=4j2$uLE9JQqQR"?Fha_[/.ma
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 59 66 88 c2 ae 2e 2a 26 55 92 0e 39 d5 5c 3f df 50 c5 ac 2d 2a b5 eb b7 7d 3d 05 5a a3 a4 44 2a 5e 39 e2 9f 7f 96 3d 06 00 10 0b 25 25 f2 43 49 19 16 4a 4a c4 46 49 39 9e d8 b5 22 fb 2c 28 cb f4 39 f5 39 b5 0c 3d c5 dd 16 95 bb 76 df ed bd a6 02 ad 50 52 22 25 f6 fc b3 ec e5 01 00 b1 50 52 22 3f 94 94 61 a1 a4 44 6c 94 94 e3 88 1d e5 a7 ff 1e 62 1a 74 5f 9b c8 a4 16 fd 5c ee cf 39 d4 08 4e f7 35 60 fd fb ee fd 82 f7 ba 0a 04 5b 54 52 3e 77 d0 3f 06 e8 8b 3d ff 2c 8d b6 b4 c7 00 00 62 a0 a4 44 7e 28 29 c3 42 49 89 d8 28 29 d3 8f 46 f4 69 d4 64 f9 38 0d 55 50 96 71 9f a7 74 3b 72 8c 7b ff ea e7 1d 2a f6 b1 95 83 8f 3e e8 bd b6 02 41 58 07 10 29 79 fa 11 ff 1c 74 e9 7c b5 c7 00 00 62 a0 a4 44 7e 28 29 c3 42 49 89 d8 28 29 d3 8f a6 59 bb 25 d6 50 a3 fc ca d8 Data Ascii: Yf.&U9\?P-}=ZD^9=%%CIJJFI9",(99=vPR"%PR"?aDlbt_\9N5`[TR>w?=,bD~()BI()Fid8UPqt;r{>AX)yt\|bD~()BI()Y%P
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 39 a4 a4 d1 79 2a c6 48 dc e8 39 bd ea f1 51 61 a9 51 b4 6d 53 4e f5 97 5d bb ef f6 5e 87 81 0d 4d 36 29 a1 04 42 2c 4d 46 53 b2 89 0e 00 0c 89 92 12 f9 a1 a4 0c 0b 25 25 21 d3 8c 76 f1 2e 7f f7 f5 3c b0 4c f4 dc 51 35 52 4f 65 16 cf 2b c3 a7 6a dd 49 51 79 dc 74 dd d1 79 99 d9 6c e9 f5 6f f4 5e 87 81 19 1a 8d b6 ba 52 8f cd 73 10 4b 93 d1 94 c2 da a9 00 30 14 4a 4a e4 87 92 32 2c 94 94 84 4c 33 ee da 84 5d 8d 7a ac 5a f3 50 58 af 72 b8 e8 79 bc ea 31 50 69 d9 d5 63 a0 e9 fc ee f7 d8 ff d7 5f f5 5e 8b 81 0d 6c 9e 83 94 1d 7f dc 3f 27 ab b0 db 37 00 0c 81 92 12 f9 a1 a4 0c 0b 25 25 21 d3 8b bb 61 4e e8 c6 29 8b a2 02 ab 6a 14 5f e8 9a 97 a4 5d dc 11 b2 a2 e7 f8 3e 9e db dd c7 78 db bb 6e f4 5e 8b 81 0d 8b 36 cf 61 3a 2d 62 fa d9 b1 c5 a3 7d 85 f5 29 01 60 Data Ascii: 9y*H9QaQmSN]^M6)B,MFS%%!v.<LQ5ROe+jIQytylo^RsK0JJ2,L3]zZPXry1Pic_^l?'7%%!aN)j_]>xn^6a:-b})`
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 94 e9 fc 5c b4 6c 41 1d ed 70 af e3 29 e2 01 a0 0e 25 25 f2 43 49 19 16 4a 4a a0 9a bb 79 4e 0e 25 a5 a6 78 d7 fe ae 1f f8 92 5f ac 4d 80 ca c9 33 5e e7 17 91 4d e8 38 95 95 f6 3a 6b e9 3e ce 38 6c 9e 83 c6 34 aa 6c 75 a5 9e a6 84 db 63 80 94 bc 72 e4 d4 6e f4 f6 dc 0d a1 f3 9c d1 95 00 60 51 52 22 3f 94 94 61 c9 ad a4 3c f9 83 03 eb e5 52 97 d6 be fd 35 ef fb 20 7f 7a ec 37 ce c1 0c 4a 4a b7 60 3b f9 73 33 fd 78 ef 47 fc 52 2d 63 9a d6 bd f9 cc ea 91 93 e5 f4 ee fd 97 fd 76 f1 c0 3b 4e 4d ff d6 ff d7 d4 6f 7b d9 f5 73 e3 d5 7f 6f 34 aa 72 fb c5 45 f1 d2 b3 b3 f7 7b 46 71 5f 4b f6 ed fd 82 f7 da 0c 6c 68 32 65 96 5d be 91 3a 8d 86 5c b4 c6 6a 13 2f 1f f6 af 1b 00 a6 8b 92 12 f9 a1 a4 0c 4b 4e 25 a5 0a ca cd 97 5c ee 95 08 cb 3a e3 cc 0b d8 5d 7c 82 72 2a Data Ascii: \lAp)%%CIJJyN%x_M3^M8:k>8l4lucrn`QR"?a<R5 z7JJ`;s3xGR-cv;NMo{so4rE{Fq_Klh2e]:\j/KN%\:]\|r*
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: d6 8b 6c 42 d7 53 5e af dd a1 db 9d 02 ae d2 d2 1e 5b d2 ce e1 4d 2e b7 4e 23 4e 07 8e 0a 47 77 b4 63 53 95 8f 6b 45 28 29 81 69 ba eb 9e cf ac 8f a2 74 9f 37 b6 ff 9f ff 6e da 45 e5 33 df f5 de 57 cc 60 aa 37 00 54 a1 a4 44 7e 28 29 c3 12 5a 5e 0c 15 4a 4a c4 36 e5 92 72 c7 ad 77 cc 7c d8 0c a1 91 7a b5 d1 74 f0 bd 1f 09 9e 0e ae 02 d1 9d 4a 6d a9 c8 d4 f4 ea 65 36 db d1 f1 e5 f5 d9 82 d1 dd 14 c7 7e cd 95 7a 49 e9 9e 07 21 54 6c aa b8 5e 14 4a 4a 60 ba b4 c4 83 9d fe fd 07 3b 6e 99 66 51 a9 cd 70 56 57 e6 7b e1 29 ff 38 00 00 25 25 f2 43 49 19 96 d0 f2 62 a8 50 52 22 b6 29 97 94 9d 8e a4 ac 8b a6 3b 07 6e b6 a3 12 b2 e9 66 3b f6 d8 45 ec 48 4a f7 6b b9 8c a4 d4 e3 aa 9d de 75 3e 84 68 3a e5 9b 92 12 98 36 4d ff 3e fb e2 2b 66 9e 93 df bf fb 63 de 7b f5 Data Ascii: lBS^[M.N#NGwcSkE()it7nE3W`7TD~()Z^JJ6rw\|ztJme6~zI!Tl^JJ`;nfQpVW{)8%%CIbPR");nf;EHJku>h:6M>+fc{
2024-02-22 12:07:41 UTC	1369	IN	Data Raw: 9b 2f bf aa d8 71 cb ce 62 df be ff 58 ac fd f8 09 ef f1 00 50 8b 92 12 f9 a1 a4 0c 0b 25 25 21 d5 c9 ed 1c dc b6 e3 96 8d 9f 67 cf e7 f7 d9 2f e7 93 bd 1f f1 0b c2 39 34 52 d2 dd f9 7b 11 95 93 1a 55 a9 92 d3 5e 57 ad 8c a7 79 97 71 ef 23 fb ba 0a 00 25 ed f4 ed 3e 5f 8c 76 e4 d9 89 35 bf 90 ac 12 71 14 a5 8a 49 15 65 67 9c 75 a1 f7 5a 86 61 6d be ec 7f 5e 2f 2c b3 58 e2 00 e8 17 25 25 f2 43 49 19 16 4a 4a 42 aa 93 db 39 e8 ae 19 b8 e3 d6 3b ec 97 f3 8a 4a 41 5b 14 2e a0 29 db 9a e6 ad e9 de 1a 61 69 69 d4 64 9b 4d 76 8a db ae 2f 8a 5f 66 3a bd fe 37 71 7f 57 5e 77 c1 25 de eb 2a 00 b8 2e bb f6 dd 1b cf 19 bb 76 df ed bd 97 1f 05 8d 90 5c 5d 99 ef f8 e3 fe 71 03 d8 b7 f7 0b eb a5 58 79 1f d7 39 e7 5f 6d 2d de 7c e5 1f 16 17 bd f3 5a 74 e0 2d 5b af 2b 5e Data Ascii: /qbXP%%!g/94R{U^Wyq#%>_v5qIeguZam^/,X%%CIJJB9;JA[.)aiidMv/_f:7qW^w%*.v\]qXy9_m-\|Zt-[+^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.4	50183	142.251.40.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:41 UTC	1339	OUT	GET /ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://4711400.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:41 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.4	50184	142.250.80.66	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:42 UTC	1092	OUT	GET /ddm/fls/z/dc_pre=CLCQ-dH0voQDFZuLfwQdJS4BxQ;src=4711400;type=globa0;cat=avast0;ord=1;num=8910988644031;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fc-malware;u8=;u17=link;ps=1;pcor=247574157;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fc-malware HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:42 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.4	50191	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:43 UTC	593	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:44 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:44 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c44cee07d1c-EWR
2024-02-22 12:07:44 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.4	50193	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:44 UTC	660	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9975a534a66e6e60fea127a62c73d6c7" If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
2024-02-22 12:07:44 UTC	365	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:07:44 GMT Via: 1.1 varnish Cache-Control: max-age=0,must-revalidate ETag: "9975a534a66e6e60fea127a62c73d6c7" Age: 60 X-Served-By: cache-lga21921-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1708603664.097873,VS0,VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.4	50205	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:44 UTC	660	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9975a534a66e6e60fea127a62c73d6c7" If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
2024-02-22 12:07:44 UTC	365	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:07:44 GMT Via: 1.1 varnish Cache-Control: max-age=0,must-revalidate ETag: "9975a534a66e6e60fea127a62c73d6c7" Age: 61 X-Served-By: cache-lga21967-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1708603665.835226,VS0,VE1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.4	50206	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:44 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:44 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:44 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c49af544216-EWR
2024-02-22 12:07:44 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.4	50227	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:46 UTC	2181	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiRW5kIHVzZXIgbGljZW5zZSBhZ3JlZW1lbnRzIHwgQXZhc3QiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvZXVsYSNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjY0OTA5IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9ldWxhI3BjIiwid2Vic2l0ZUlkIjogODIzMjAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRfaXNTdXJ2ZXlTdWJtaXR0ZWRJblNlc3Npb24iOiAiIiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjJkZWQtMWIxMy02MTYxLTlkZjUtNTc2MC02OWMwLTcyYjctZjFmNiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNzA4NjAzNjY0ODk3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDI3NDksImthbXB5bGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJoaXN0b3J5X2xlbmd0aCI6IDEsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE3MDg2MDM2NjQ5MDksInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlfQpdfQ== HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:46 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:46 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-jx2d X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.4	50237	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:47 UTC	1948	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiRW5kIHVzZXIgbGljZW5zZSBhZ3JlZW1lbnRzIHwgQXZhc3QiLCJwYWdlX3VybCI6ICJodHRwczovL3d3dy5hdmFzdC5jb20vZW4tdXMvZXVsYSNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjY0OTA5IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9ldWxhI3BjIiwid2Vic2l0ZUlkIjogODIzMjAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRfaXNTdXJ2ZXlTdWJtaXR0ZWRJblNlc3Npb24iOiAiIiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjJkZWQtMWIxMy02MTYxLTlkZjUtNTc2MC02OWMwLTcyYjctZjFmNiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNzA4NjAzNjY0ODk3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDI3NDksImthbXB5bGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjUyLjAiLCJoaXN0b3J5X2xlbmd0aCI6IDEsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE3MDg2MDM2NjQ5MDksInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlfQpdfQ== HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:48 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:47 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-wwdz X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.4	50242	104.18.32.137	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:49 UTC	593	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.avast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:50 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:50 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c6a089b0cb5-EWR
2024-02-22 12:07:50 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.4	50246	199.232.37.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:50 UTC	660	OUT	GET /wdceu/82320/onsite/embed.js HTTP/1.1 Host: resources.digital-cloud.medallia.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9975a534a66e6e60fea127a62c73d6c7" If-Modified-Since: Sun, 13 Aug 2023 08:54:50 GMT
2024-02-22 12:07:50 UTC	365	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:07:50 GMT Via: 1.1 varnish Cache-Control: max-age=0,must-revalidate ETag: "9975a534a66e6e60fea127a62c73d6c7" Age: 67 X-Served-By: cache-lga21924-LGA X-Cache: HIT X-Cache-Hits: 2 X-Timer: S1708603671.886164,VS0,VE0 Vary: Accept-Encoding Strict-Transport-Security: max-age=31557600

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.4	50248	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:50 UTC	715	OUT	GET /embed/Yo9K67ixJ10?enablejsapi=1 HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:51 UTC	1637	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 22 Feb 2024 12:07:51 GMT Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="YOUTUBE_NOCOOKIE_DOMAIN" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"YOUTUBE_NOCOOKIE_DOMAIN","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/YOUTUBE_NOCOOKIE_DOMAIN"}]} Origin-Trial: AmDnk0SIEsH4Bi0uvITor+113VdZiHamGsT0EG6UHXgEXROwfKYSeE1NWAqwKRr6CFPJ/xqXmMgs+r58fAMEMQgAAACBeyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUtbm9jb29raWUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 64 61 74 61 2d 63 61 73 74 2d 61 70 69 2d 65 6e 61 62 6c 65 64 3d 22 74 72 75 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 41 55 34 70 6a 58 45 43 76 42 67 47 6a 64 57 31 6c 4c 44 4b 4d 51 22 3e 69 66 20 28 27 75 6e 64 65 66 69 6e 65 64 27 20 3d 3d 20 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 20 7c 7c 20 27 75 6e 64 65 66 69 6e 65 64 27 20 3d 3d 20 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 Data Ascii: 8000<!DOCTYPE html><html lang="en" dir="ltr" data-cast-api-enabled="true"><head><meta name="viewport" content="width=device-width, initial-scale=1"><script nonce="AU4pjXECvBgGjdW1lLDKMQ">if ('undefined' == typeof Symbol \|\| 'undefined' == typeof Symbol.i
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 41 46 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 31 45 30 30 2d 31 45 39 46 2c 55 2b 31 45 46 32 2d 31 45 46 46 2c 55 2b 32 30 32 30 2c 55 2b 32 30 41 30 2d 32 30 41 42 2c 55 2b 32 30 41 44 2d 32 30 43 30 2c 55 2b 32 31 31 33 2c 55 2b 32 43 36 30 2d 32 43 37 46 2c 55 2b 41 37 32 30 2d 41 37 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b Data Ascii: boto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)format('woff2');unicode-range:U+0100-02AF,U+0304,U+0308,U+0329,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 31 42 30 2c 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 33 2d 30 33 30 34 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 68 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 41 Data Ascii: 1B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)format('woff2');unicode-range:U+0100-02A
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 38 38 38 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 39 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 7d 2e 70 6c 61 79 65 72 2d 75 6e 61 76 61 69 6c 61 62 6c 65 20 61 20 7b 63 6f 6c 6f 72 3a 20 23 31 36 37 61 63 36 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 41 55 34 70 6a 58 45 43 76 42 67 47 6a 64 57 31 6c 4c 44 4b 4d 51 22 3e 76 61 72 20 79 74 63 73 69 3d 7b 67 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 3d 28 6e 7c 7c 22 22 29 2b 22 64 61 74 61 5f 22 3b 72 65 74 75 72 6e 20 79 74 63 73 69 5b 6e 5d 7c 7c 28 79 74 63 73 69 5b 6e 5d 3d 7b 74 69 63 6b 3a 7b 7d 2c 69 6e 66 6f 3a 7b 7d 2c 67 65 6c 3a 7b 70 72 65 4c 6f 67 67 65 64 47 Data Ascii: 888; font-size: 19px; font-weight: normal;}.player-unavailable a {color: #167ac6; text-decoration: none;}</style><script nonce="AU4pjXECvBgGjdW1lLDKMQ">var ytcsi={gt:function(n){n=(n\|\|"")+"data_";return ytcsi[n]\|\|(ytcsi[n]={tick:{},info:{},gel:{preLoggedG
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 50 72 65 72 65 6e 64 65 72 29 7b 76 61 72 20 73 74 61 72 74 54 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 79 74 63 73 69 2e 73 65 74 53 74 61 72 74 28 29 3b 64 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 76 4e 61 6d 65 2c 73 74 61 72 74 54 69 63 6b 29 7d 3b 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 76 4e 61 6d 65 2c 73 74 61 72 74 54 69 63 6b 2c 66 61 6c 73 65 29 7d 69 66 28 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 76 4e 61 6d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 79 74 63 73 69 2e 74 69 63 6b 28 22 76 63 22 29 7d 2c 0a 66 61 6c 73 65 29 3b 69 66 28 69 73 47 65 63 6b 6f 28 29 29 7b 76 61 72 20 69 73 48 69 64 64 65 6e 3d 28 64 2e 76 69 73 69 62 69 Data Ascii: Prerender){var startTick=function(){ytcsi.setStart();d.removeEventListener(vName,startTick)};d.addEventListener(vName,startTick,false)}if(d.addEventListener)d.addEventListener(vName,function(){ytcsi.tick("vc")},false);if(isGecko()){var isHidden=(d.visibi
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 65 64 5f 73 74 72 69 6e 67 73 22 3a 74 72 75 65 2c 22 64 69 73 61 62 6c 65 5f 70 61 63 66 5f 6c 6f 67 67 69 6e 67 5f 66 6f 72 5f 6d 65 6d 6f 72 79 5f 6c 69 6d 69 74 65 64 5f 74 76 22 3a 74 72 75 65 2c 22 64 69 73 61 62 6c 65 5f 73 69 6d 70 6c 65 5f 6d 69 78 65 64 5f 64 69 72 65 63 74 69 6f 6e 5f 66 6f 72 6d 61 74 74 65 64 5f 73 74 72 69 6e 67 73 22 3a 74 72 75 65 2c 22 64 69 73 61 62 6c 65 5f 74 68 75 6d 62 6e 61 69 6c 5f 70 72 65 6c 6f 61 64 69 6e 67 22 3a 74 72 75 65 2c 22 65 6d 62 65 64 73 5f 74 72 61 6e 73 70 6f 72 74 5f 75 73 65 5f 73 63 68 65 64 75 6c 65 72 22 3a 74 72 75 65 2c 22 65 6d 62 65 64 73 5f 77 65 62 5f 6e 77 6c 5f 64 69 73 61 62 6c 65 5f 6e 6f 63 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f Data Ascii: ed_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"embeds_web_nwl_disable_nocookie":true,"enable_ab_report_o
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 75 65 2c 22 66 69 6c 6c 5f 73 69 6e 67 6c 65 5f 76 69 64 65 6f 5f 77 69 74 68 5f 6e 6f 74 69 66 79 5f 74 6f 5f 6c 61 73 72 22 3a 74 72 75 65 2c 22 67 63 66 5f 6d 75 73 69 63 5f 69 6e 6e 65 72 74 75 62 65 22 3a 74 72 75 65 2c 22 67 72 61 66 74 5f 67 75 6d 5f 72 65 73 70 6f 6e 73 65 5f 74 6f 5f 6c 6f 67 67 69 6e 67 5f 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 68 35 5f 63 6f 6d 70 61 6e 69 6f 6e 5f 65 6e 61 62 6c 65 5f 61 64 63 70 6e 5f 6d 61 63 72 6f 5f 73 75 62 73 74 69 74 75 74 69 6f 6e 5f 66 6f 72 5f 63 6c 69 63 6b 5f 70 69 6e 67 73 22 3a 74 72 75 65 2c 22 68 35 5f 65 6e 61 62 6c 65 5f 67 65 6e 65 72 69 63 5f 65 72 72 6f 72 5f 6c 6f 67 67 69 6e 67 5f 65 76 65 6e 74 22 3a 74 72 75 65 2c 22 68 35 5f 69 6e 70 6c 61 79 65 72 5f 65 6e 61 62 6c 65 5f 61 64 63 Data Ascii: ue,"fill_single_video_with_notify_to_lasr":true,"gcf_music_innertube":true,"graft_gum_response_to_logging_screen":true,"h5_companion_enable_adcpn_macro_substitution_for_click_pings":true,"h5_enable_generic_error_logging_event":true,"h5_inplayer_enable_adc
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 72 5f 70 75 73 68 5f 68 6f 6d 65 5f 70 61 67 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 73 65 72 76 69 63 65 5f 77 6f 72 6b 65 72 5f 70 75 73 68 5f 77 61 74 63 68 5f 70 61 67 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 73 68 65 6c 6c 5f 6c 6f 61 64 5f 67 63 66 22 3a 74 72 75 65 2c 22 73 68 6f 72 74 65 6e 5f 69 6e 69 74 69 61 6c 5f 67 65 6c 5f 62 61 74 63 68 5f 74 69 6d 65 6f 75 74 22 3a 74 72 75 65 2c 22 73 6b 69 70 5f 69 6e 76 61 6c 69 64 5f 79 74 63 73 69 5f 74 69 63 6b 73 22 3a 74 72 75 65 2c 22 73 6b 69 70 5f 73 65 74 74 69 6e 67 5f 69 6e 66 6f 5f 69 6e 5f 63 73 69 5f 64 61 74 61 5f 6f 62 6a 65 63 74 22 3a 74 72 75 65 2c 22 73 6d 61 72 74 65 72 5f 76 65 5f 64 65 64 75 70 70 69 6e 67 22 3a 74 72 75 65 2c 22 73 74 5f 73 6b 69 70 5f 64 65 62 75 Data Ascii: r_push_home_page_prompt":true,"service_worker_push_watch_page_prompt":true,"shell_load_gcf":true,"shorten_initial_gel_batch_timeout":true,"skip_invalid_ytcsi_ticks":true,"skip_setting_info_in_csi_data_object":true,"smarter_ve_dedupping":true,"st_skip_debu
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 6e 67 5f 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 30 2e 30 31 2c 22 77 65 62 5f 73 79 73 74 65 6d 5f 68 65 61 6c 74 68 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 79 74 69 64 62 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 65 6e 64 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 22 3a 30 2e 30 32 2c 22 79 74 69 64 62 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 65 6e 64 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 5f 73 65 73 73 69 6f 6e 22 3a 30 2e 32 2c 22 79 74 69 64 62 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 65 6e 64 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 5f 74 72 61 6e 73 61 63 74 69 6f 6e 22 3a 30 2e 31 2c 22 61 75 74 6f 70 6c 61 79 5f 70 61 75 73 65 5f 62 79 5f 6c 61 63 74 5f 73 65 63 22 3a 30 2c 22 62 6f 74 67 75 61 Data Ascii: ng_sample_rate":0.01,"web_system_health_fraction":0.01,"ytidb_transaction_ended_event_rate_limit":0.02,"ytidb_transaction_ended_event_rate_limit_session":0.2,"ytidb_transaction_ended_event_rate_limit_transaction":0.1,"autoplay_pause_by_lact_sec":0,"botgua
2024-02-22 12:07:51 UTC	1637	IN	Data Raw: 7d 2c 22 47 41 50 49 5f 48 49 4e 54 5f 50 41 52 41 4d 53 22 3a 22 6d 3b 2f 5f 2f 73 63 73 2f 61 62 63 2d 73 74 61 74 69 63 2f 5f 2f 6a 73 2f 6b 5c 75 30 30 33 64 67 61 70 69 2e 67 61 70 69 2e 65 6e 2e 47 73 62 41 36 38 68 58 73 38 30 2e 4f 2f 64 5c 75 30 30 33 64 31 2f 72 73 5c 75 30 30 33 64 41 48 70 4f 6f 6f 38 39 39 74 2d 48 38 4c 78 62 33 4f 71 7a 4d 44 75 50 6e 36 54 56 5f 69 33 36 61 67 2f 6d 5c 75 30 30 33 64 5f 5f 66 65 61 74 75 72 65 73 5f 5f 22 2c 22 47 41 50 49 5f 48 4f 53 54 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 47 41 50 49 5f 4c 4f 43 41 4c 45 22 3a 22 65 6e 5f 55 53 22 2c 22 47 4c 22 3a 22 55 53 22 2c 22 48 4c 22 3a 22 65 6e 22 2c 22 48 54 4d 4c 5f 4c 41 4e 47 22 3a 22 65 6e 22 2c 22 49 4e 4e Data Ascii: },"GAPI_HINT_PARAMS":"m;/_/scs/abc-static/_/js/k\u003dgapi.gapi.en.GsbA68hXs80.O/d\u003d1/rs\u003dAHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/m\u003d__features__","GAPI_HOST":"https://apis.google.com","GAPI_LOCALE":"en_US","GL":"US","HL":"en","HTML_LANG":"en","INN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.4	50255	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	626	OUT	POST /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive Content-Length: 1387 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.avast.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:51 UTC	1387	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 38 31 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 30 38 36 30 33 36 37 30 30 36 36 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 69 64 22 3a 32 34 30 2c 22 76 65 72 73 69 6f 6e 5f 67 75 69 22 3a 22 32 30 32 33 2e 30 31 2e 31 33 22 2c 22 76 65 72 73 69 6f 6e 5f 61 70 70 22 3a 22 31 2e 30 2e 30 22 2c 22 65 64 69 74 69 6f 6e 22 3a 32 2c 22 69 70 6d 5f 70 72 6f 64 75 63 74 22 3a 6e 75 6c 6c 7d 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 7b 22 6f 73 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 73 65 63 63 68 75 61 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 Data Ascii: {"record":[{"event":{"type":81,"subtype":1,"time":1708603670066},"product":{"id":240,"version_gui":"2023.01.13","version_app":"1.0.0","edition":2,"ipm_product":null},"platform":{"os":0},"browser":{"secchua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
2024-02-22 12:07:51 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:07:51 GMT Content-Type: application/json Content-Length: 19 Access-Control-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:51 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.4	50256	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	610	OUT	GET /s/player/2070f79f/www-player.css HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:51 UTC	625	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/css Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 375389 Date: Thu, 22 Feb 2024 12:07:51 GMT Expires: Fri, 21 Feb 2025 12:07:51 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:51 UTC	627	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7a 2d 69 6e 64 65 78 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 59 6f 75 54 75 62 65 20 4e 6f 74 6f 22 2c 52 6f 62 6f 74 6f 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 65 65 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 3b 2d 77 65 62 6b 69 74 2d Data Ascii: @charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 61 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 6f 75 74 6c 69 6e 65 3a 30 7d 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 34 2c 30 2c 31 2c 31 29 3b 74 72 61 6e 73 69 74 Data Ascii: -video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transit
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 66 69 74 3a 63 6f 76 65 72 7d 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 5b 64 61 74 61 2d 6e 6f 2d 66 75 6c 6c 73 63 72 65 65 6e 3d 74 72 75 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 2d 66 75 6c 6c 73 63 72 65 65 6e 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 3a 3a 2d 77 65 62 6b 69 74 2d 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 2c 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 3a 3a 2d 77 65 62 6b 69 74 2d 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 2d 73 74 61 72 74 2d 70 6c 61 79 62 61 63 6b 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 6e Data Ascii: fit:cover}.html5-main-video[data-no-fullscreen=true]::-webkit-media-controls-fullscreen-button{display:none}.html5-main-video:not([controls])::-webkit-media-controls,.html5-main-video:not([controls])::-webkit-media-controls-start-playback-button{display:n
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 65 6e 74 2e 79 74 70 2d 69 76 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 7b 6c 65 66 74 3a 31 32 70 78 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 79 74 70 2d 62 69 67 2d 6d 6f 64 65 20 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 2e 79 74 70 2d 69 76 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 7b 6c 65 66 74 3a 32 34 70 78 3b 72 69 67 68 74 3a 32 34 70 78 7d 2e 79 74 70 2d 61 75 74 6f 68 69 64 65 20 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 3a 6e 6f 74 28 2e 68 74 6d 6c 35 2d 65 6e 64 73 63 72 65 65 6e 29 2c 2e 79 74 70 2d 61 75 74 6f 68 69 64 65 20 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 3a 6e 6f 74 28 2e 79 74 70 2d 75 70 6e 65 78 74 29 2c 2e 79 74 70 2d 68 69 64 65 2d 69 6e 66 6f 2d 62 61 72 20 2e 79 74 70 2d Data Ascii: ent.ytp-iv-player-content{left:12px;right:12px}.ytp-big-mode .ytp-player-content.ytp-iv-player-content{left:24px;right:24px}.ytp-autohide .ytp-player-content:not(.html5-endscreen),.ytp-autohide .ytp-player-content:not(.ytp-upnext),.ytp-hide-info-bar .ytp-
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 2c 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 79 74 70 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 29 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 6e 6f 74 28 5b 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 5d 29 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 79 74 70 2d 70 72 6f 62 61 62 6c 79 2d 6b 65 79 62 Data Ascii: n::-moz-focus-inner{padding:0;border:0}.html5-video-player .ytp-button[aria-disabled=true],.html5-video-player .ytp-button[disabled]{opacity:.5}.ytp-button:not([aria-disabled=true]):not([disabled]):not([aria-hidden=true]){cursor:pointer}.ytp-probably-keyb
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 7b 68 65 69 67 68 74 3a 34 38 70 78 7d 2e 79 74 70 2d 62 69 67 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 7b 68 65 69 67 68 74 3a 35 34 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 34 70 78 7d 2e 79 74 70 2d 63 68 Data Ascii: mode .ytp-chrome-bottom,.ytp-embed.ytp-embed-mobile .ytp-chrome-bottom .ytp-chrome-controls,.ytp-embed.ytp-embed-mobile.ytp-small-mode .ytp-chrome-bottom .ytp-chrome-controls{height:48px}.ytp-big-mode .ytp-chrome-bottom{height:54px;padding-top:4px}.ytp-ch
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 6c 61 79 65 72 2d 62 75 74 74 6f 6e 2c 2e 79 74 70 2d 65 6d 62 65 64 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 2e 79 74 70 2d 72 65 6d 6f 74 65 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 7b 77 69 64 74 68 3a 34 38 70 78 3b 68 65 69 67 68 74 3a 34 38 70 78 7d 2e 79 74 70 2d 65 6d 62 65 64 Data Ascii: layer-button,.ytp-embed .ytp-chrome-controls .ytp-button.ytp-remote-button{padding:0}.ytp-embed.ytp-embed-mobile .ytp-chrome-controls .ytp-button,.ytp-embed.ytp-embed-mobile.ytp-small-mode .ytp-chrome-controls .ytp-button{width:48px;height:48px}.ytp-embed
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 68 6f 76 65 72 2c 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 74 72 75 65 5d 2c 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 70 72 65 73 73 65 64 3d 74 72 75 65 5d 2c 2e 79 74 70 2d 72 65 70 6c 61 79 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 7d 2e 79 74 70 2d 73 76 67 2d Data Ascii: hover,.ytp-chrome-controls .ytp-button[aria-expanded=true],.ytp-chrome-controls .ytp-button[aria-pressed=true],.ytp-replay-button:hover{opacity:1;-webkit-transition:opacity .1s cubic-bezier(0,0,.2,1);transition:opacity .1s cubic-bezier(0,0,.2,1)}.ytp-svg-
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 70 72 65 73 73 65 64 3d 74 72 75 65 5d 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 32 34 70 78 3b 6c 65 66 74 3a 31 32 70 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6c 65 66 74 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 2c 77 69 64 74 68 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6c 65 66 74 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 2c 77 69 64 74 68 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 7d 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 Data Ascii: p-chrome-controls .ytp-button[aria-pressed=true]:after{width:24px;left:12px;-webkit-transition:left .25s cubic-bezier(0,0,.2,1),width .25s cubic-bezier(0,0,.2,1);transition:left .25s cubic-bezier(0,0,.2,1),width .25s cubic-bezier(0,0,.2,1)}.ytp-small-mode
2024-02-22 12:07:51 UTC	1252	IN	Data Raw: 70 79 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 76 69 73 69 62 6c 65 29 2c 2e 79 74 70 2d 6f 76 65 72 66 6c 6f 77 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 2e 79 74 70 2d 6f 76 65 72 66 6c 6f 77 2d 62 75 74 74 6f 6e 2d 76 69 73 69 62 6c 65 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 79 74 70 2d 65 78 70 2d 62 6f 74 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 66 6c 65 78 62 6f 78 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 7b 68 65 69 67 68 74 3a 34 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 38 70 78 3b 66 6f 6e 74 2d 73 69 Data Ascii: pylink-button-visible),.ytp-overflow-button:not(.ytp-overflow-button-visible){display:none}.ytp-exp-bottom-control-flexbox .ytp-chrome-controls{display:-webkit-box;display:-webkit-flex;display:flex}.ytp-chrome-controls{height:48px;line-height:48px;font-si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.4	50261	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	1316	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger=navigation-source, event-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:51 UTC	2210	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"851494663615780363","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.4	50262	108.138.106.124	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	588	OUT	GET /c/hotjar-470805.js?sv=7 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: W/7aa25d5c5a008bd4a96eb7daf3924659
2024-02-22 12:07:51 UTC	568	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 22 Feb 2024 12:07:51 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff ETag: W/7aa25d5c5a008bd4a96eb7daf3924659 Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: 0Yw8K0AyEE1RSSsoPyWMMB_-UR-Nog1CdDy-f-alrWT6WAPuLywtbQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.4	50263	142.250.65.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	1345	OUT	GET /td/fls/rul/activityi;fledge=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:51 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:51 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-22 12:07:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.4	50264	142.251.40.134	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	1334	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:52 UTC	1214	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Strict-Transport-Security: max-age=21600 Location: https://4711400.fls.doubleclick.net/activityi;dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.4	50267	63.140.38.55	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	1481	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s46211879239902?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A7%3A50%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aabout%3Aabout&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aabout%3Aabout&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=about&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aabout%3Aabout&v59=D%3Dc59&c60=avast.com%3Aus%3Ahomepage%3Aindex-t1&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout&v118=avast.com%3Ahomepage%3Aindex-t1&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:51 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:07:51 GMT expires: Wed, 21 Feb 2024 12:07:51 GMT last-modified: Fri, 23 Feb 2024 12:07:51 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198445472546816-4617500011644115517 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:07:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.4	50268	142.250.80.46	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:51 UTC	619	OUT	GET /iframe_api HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	2087	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 X-Content-Type-Options: nosniff Expires: Thu, 22 Feb 2024 12:07:51 GMT Date: Thu, 22 Feb 2024 12:07:51 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=VYN2Qq7f9hA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=ct0xFB5laIY; Domain=.youtube.com; Expires=Tue, 20-Aug-2024 12:07:51 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgMg%3D%3D; Domain=.youtube.com; Expires=Tue, 20-Aug-2024 12:07:51 GMT; Path=/; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:52 UTC	1000	IN	Data Raw: 33 65 31 0d 0a 76 61 72 20 73 63 72 69 70 74 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 5c 2f 73 5c 2f 70 6c 61 79 65 72 5c 2f 32 30 37 30 66 37 39 66 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 76 66 6c 73 65 74 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 6a 73 27 3b 74 72 79 7b 76 61 72 20 74 74 50 6f 6c 69 63 79 3d 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 79 6f 75 74 75 62 65 2d 77 69 64 67 65 74 2d 61 70 69 22 2c 7b 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 78 29 7b 72 65 74 75 72 6e 20 78 7d 7d 29 3b 73 63 72 69 70 74 55 72 6c 3d 74 74 50 6f 6c 69 63 79 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 Data Ascii: 3e1var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/2070f79f\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptUR
2024-02-22 12:07:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.4	50274	142.251.32.102	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 135 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	135	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 76 61 73 74 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 38 35 31 34 39 34 36 36 33 36 31 35 37 38 30 33 36 33 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://avast.com","trigger_debug_key":"851494663615780363"},"type":"trigger-no-matching-source"}]
2024-02-22 12:07:52 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 22 Feb 2024 12:07:52 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.4	50279	142.250.80.46	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	721	OUT	GET /s/player/2070f79f/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=VYN2Qq7f9hA; VISITOR_INFO1_LIVE=ct0xFB5laIY
2024-02-22 12:07:52 UTC	688	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 220988 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 22 Feb 2024 08:48:00 GMT Expires: Fri, 21 Feb 2025 08:48:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 11992 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:52 UTC	564	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 72 3b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: (function(){'use strict';var r;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 69 73 29 3b 66 75 6e 63 74 69 6f 6e 20 76 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 62 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 76 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 Data Ascii: is);function v(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}v("Symbol",function(a){function b(f){if(t
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 62 6c 65 20 6f 72 20 41 72 72 61 79 4c 69 6b 65 22 29 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 77 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 66 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 0a 76 61 72 20 6a 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3f 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3a 66 Data Ascii: ble or ArrayLike");}function x(a){if(!(a instanceof Array)){a=w(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function fa(a,b){return Object.prototype.hasOwnProperty.call(a,b)}var ja="function"==typeof Object.assign?Object.assign:f
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 68 3d 61 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 2c 62 29 7b 61 2e 69 3d 7b 6c 63 3a 62 2c 77 63 3a 21 30 7d 3b 61 2e 67 3d 61 2e 6f 7c 7c 61 2e 75 7d 0a 71 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 69 3d 7b 72 65 74 75 72 6e 3a 61 7d 3b 74 68 69 73 2e 67 3d 74 68 69 73 2e 75 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 41 28 61 2c 62 2c 63 29 7b 61 2e 67 3d 63 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 62 7d 7d 0a 71 61 2e 70 72 6f 74 6f 74 79 70 65 2e 42 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 61 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 76 61 28 61 2c 62 2c 63 29 7b 61 2e 6f 3d 62 3b 76 6f 69 Data Ascii: rototype.K=function(a){this.h=a};function ua(a,b){a.i={lc:b,wc:!0};a.g=a.o\|\|a.u}qa.prototype.return=function(a){this.i={return:a};this.g=this.u};function A(a,b,c){a.g=c;return{value:b}}qa.prototype.B=function(a){this.g=a};function va(a,b,c){a.o=b;voi
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6e 20 62 7d 3b 0a 74 68 69 73 2e 74 68 72 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 74 61 28 61 2e 67 29 3b 61 2e 67 2e 6c 3f 62 3d 41 61 28 61 2c 61 2e 67 2e 6c 5b 22 74 68 72 6f 77 22 5d 2c 62 2c 61 2e 67 2e 4b 29 3a 28 75 61 28 61 2e 67 2c 62 29 2c 62 3d 42 61 28 61 29 29 3b 72 65 74 75 72 6e 20 62 7d 3b 0a 74 68 69 73 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 7a 61 28 61 2c 62 29 7d 3b 0a 74 68 69 73 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 45 61 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 64 29 7b 72 65 74 75 72 6e 20 61 2e 6e 65 78 74 28 64 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 64 29 7b 72 Data Ascii: n b};this.throw=function(b){ta(a.g);a.g.l?b=Aa(a,a.g.l["throw"],b,a.g.K):(ua(a.g,b),b=Ba(a));return b};this.return=function(b){return za(a,b)};this[Symbol.iterator]=function(){return this}}function Ea(a){function b(d){return a.next(d)}function c(d){r
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 69 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 67 3b 7d 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 67 28 6b 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6b 2e 63 61 6c 6c 28 68 2c 6d 29 29 7d 7d 0a 76 61 72 20 68 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 67 28 74 68 69 73 2e 63 62 29 2c 72 65 6a 65 63 74 3a 67 28 74 68 69 73 2e 6f 29 7d 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 62 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 67 3d 3d 3d 74 68 69 73 29 74 68 69 73 2e 6f 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 20 50 72 6f 6d Data Ascii: =function(g){this.i(function(){throw g;})};b.prototype.l=function(){function g(k){return function(m){l\|\|(l=!0,k.call(h,m))}}var h=this,l=!1;return{resolve:g(this.cb),reject:g(this.o)}};b.prototype.cb=function(g){if(g===this)this.o(new TypeError("A Prom
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6d 45 76 65 6e 74 22 29 2c 67 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 67 29 29 3b 67 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 67 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 69 3b 72 65 74 75 72 6e 20 6c 28 67 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 68 69 73 2e 68 29 7b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 74 68 69 73 2e 68 2e 6c 65 6e 67 74 68 3b 2b 2b 67 29 66 2e 68 28 74 68 69 73 2e 68 5b 67 5d 29 3b 74 68 69 73 2e 68 3d 6e 75 6c 6c 7d 7d 3b 0a 76 61 72 20 66 3d 6e 65 77 20 63 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 66 62 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 74 68 69 Data Ascii: mEvent"),g.initCustomEvent("unhandledrejection",!1,!0,g));g.promise=this;g.reason=this.i;return l(g)};b.prototype.O=function(){if(null!=this.h){for(var g=0;g<this.h.length;++g)f.h(this.h[g]);this.h=null}};var f=new c;b.prototype.fb=function(g){var h=thi
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 7d 29 7d 3b 0a 72 65 74 75 72 6e 20 62 7d 29 3b 0a 76 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 6c 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 77 28 6c 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 6c 29 7b 76 61 72 20 6b 3d 74 79 70 65 6f 66 20 6c 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 6b 26 26 6e 75 6c 6c 21 3d 3d 6c 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d Data Ascii: })};return b});v("WeakMap",function(a){function b(l){this.g=(h+=Math.random()+1).toString();if(l){l=w(l);for(var k;!(k=l.next()).done;)k=k.value,this.set(k[0],k[1])}}function c(){}function d(l){var k=typeof l;return"object"===k&&null!==l\|\|"function"==
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6e 20 63 28 68 2c 6c 29 7b 76 61 72 20 6b 3d 68 5b 31 5d 3b 72 65 74 75 72 6e 20 65 61 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6b 29 7b 66 6f 72 28 3b 6b 2e 68 65 61 64 21 3d 68 5b 31 5d 3b 29 6b 3d 6b 2e 70 72 65 76 69 6f 75 73 3b 66 6f 72 28 3b 6b 2e 6e 65 78 74 21 3d 6b 2e 68 65 61 64 3b 29 72 65 74 75 72 6e 20 6b 3d 6b 2e 6e 65 78 74 2c 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 6c 28 6b 29 7d 3b 6b 3d 6e 75 6c 6c 7d 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 68 2c 6c 29 7b 76 61 72 20 6b 3d 6c 26 26 74 79 70 65 6f 66 20 6c 3b 22 6f 62 6a 65 63 74 22 3d 3d 6b 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 6b 3f 66 2e 68 61 73 28 6c 29 3f 6b 3d 66 2e 67 65 74 28 6c Data Ascii: n c(h,l){var k=h[1];return ea(function(){if(k){for(;k.head!=h[1];)k=k.previous;for(;k.next!=k.head;)return k=k.next,{done:!1,value:l(k)};k=null}return{done:!0,value:void 0}})}function d(h,l){var k=l&&typeof l;"object"==k\|\|"function"==k?f.has(l)?k=f.get(l
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 74 72 79 29 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 6b 2e 65 6e 74 72 79 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 3d 6b 2e 65 6e 74 72 79 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a 65 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 68 3d 64 28 74 68 69 73 2c 68 29 3b 72 65 74 75 72 6e 20 68 2e 65 6e 74 72 79 26 26 68 2e 6c 69 73 74 3f 28 68 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 68 2e 69 6e 64 65 78 2c 31 29 2c 68 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 68 2e 69 64 5d 2c 68 2e 65 6e 74 72 79 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 68 2e 65 6e 74 72 79 2e 6e 65 78 74 2c 68 2e 65 6e 74 Data Ascii: try),this[1].previous.next=k.entry,this[1].previous=k.entry,this.size++);return this};e.prototype.delete=function(h){h=d(this,h);return h.entry&&h.list?(h.list.splice(h.index,1),h.list.length\|\|delete this[0][h.id],h.entry.previous.next=h.entry.next,h.ent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.4	50273	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	909	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A50%20GMT&n=-1&b=Avast%20About%20us%20%7C%20About%20AVAST%20Software&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
2024-02-22 12:07:52 UTC	909	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:09:16 GMT Expires: Thu, 22 Feb 2024 12:09:16 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: image/gif Accept-Ranges: bytes Content-Length: 43 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:09:16 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2024-02-22 12:07:52 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.4	50288	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	841	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.4	50286	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	951	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:52 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:52 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:52 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.4	50277	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	614	OUT	GET /s/player/2070f79f/player_ias.vflset/en_US/embed.js HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	631	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 54672 Date: Thu, 22 Feb 2024 12:07:52 GMT Expires: Fri, 21 Feb 2025 12:07:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:52 UTC	621	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 2f 2a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 0a 20 55 73 65 20 6f 66 20 74 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 67 6f 76 65 72 6e 65 64 20 62 79 20 61 6e 20 4d 49 54 2d 73 74 79 6c 65 20 6c 69 63 65 6e 73 65 20 74 68 61 74 20 63 61 6e 20 62 65 0a 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 4c 49 43 45 4e 53 45 20 66 69 6c 65 20 61 74 20 68 74 74 70 73 3a 2f 2f 61 6e 67 75 6c 61 72 2e 69 6f 2f 6c 69 63 65 6e 73 65 0a 2a 2f 0a 2f 2a Data Ascii: (function(g){var window=this;/* SPDX-License-Identifier: Apache-2.0 // Copyright Google LLC All Rights Reserved. Use of this source code is governed by an MIT-style license that can be found in the LICENSE file at https://angular.io/license//
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 2c 31 2e 36 38 20 63 20 2d 31 2e 34 39 2c 2e 34 20 2d 32 2e 35 39 2c 31 2e 36 20 2d 32 2e 39 39 2c 33 20 2d 30 2e 36 39 2c 32 2e 37 20 2d 30 2e 36 38 2c 38 2e 33 31 20 2d 30 2e 36 38 2c 38 2e 33 31 20 30 2c 30 20 2d 30 2e 30 31 2c 35 2e 36 31 20 2e 36 38 2c 38 2e 33 31 20 2e 33 39 2c 31 2e 35 20 31 2e 35 39 2c 32 2e 36 20 32 2e 39 39 2c 33 20 32 2e 36 39 2c 2e 37 20 31 33 2e 34 30 2c 2e 36 38 20 31 33 2e 34 30 2c 2e 36 38 20 30 2c 30 20 31 30 2e 37 30 2c 2e 30 31 20 31 33 2e 34 30 2c 2d 30 2e 36 38 20 31 2e 35 2c 2d 30 2e 34 20 32 2e 35 39 2c 2d 31 2e 36 20 32 2e 39 39 2c 2d 33 20 2e 36 39 2c 2d 32 2e 37 20 2e 36 38 2c 2d 38 2e 33 31 20 2e 36 38 2c 2d 38 2e 33 31 20 30 2c 30 20 2e 31 31 2c 2d 35 2e 36 31 20 2d 30 2e 36 38 2c 2d 38 2e 33 31 20 2d 30 2e 34 Data Ascii: ,1.68 c -1.49,.4 -2.59,1.6 -2.99,3 -0.69,2.7 -0.68,8.31 -0.68,8.31 0,0 -0.01,5.61 .68,8.31 .39,1.5 1.59,2.6 2.99,3 2.69,.7 13.40,.68 13.40,.68 0,0 10.70,.01 13.40,-0.68 1.5,-0.4 2.59,-1.6 2.99,-3 .69,-2.7 .68,-8.31 .68,-8.31 0,0 .11,-5.61 -0.68,-8.31 -0.4
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 2e 36 32 20 2d 30 2e 33 2c 30 20 2d 30 2e 36 31 2c 2d 30 2e 31 31 20 2d 30 2e 38 31 2c 2d 30 2e 33 31 20 2d 30 2e 32 2c 2d 30 2e 33 20 2d 30 2e 33 30 2c 2d 30 2e 35 39 20 2d 30 2e 34 30 2c 2d 31 2e 30 39 20 2d 30 2e 31 2c 2d 30 2e 35 20 2d 30 2e 30 39 2c 2d 31 2e 32 31 20 2d 30 2e 30 39 2c 2d 32 2e 32 31 20 6c 20 30 2c 2d 30 2e 37 38 20 35 2e 37 31 2c 2d 30 2e 30 39 20 30 2c 2d 32 2e 36 32 20 63 20 30 2c 2d 31 2e 36 20 2d 30 2e 31 30 2c 2d 32 2e 37 38 20 2d 30 2e 34 30 2c 2d 33 2e 36 38 20 2d 30 2e 32 2c 2d 30 2e 38 39 20 2d 30 2e 37 31 2c 2d 31 2e 35 39 20 2d 31 2e 33 31 2c 2d 31 2e 39 39 20 2d 30 2e 37 2c 2d 30 2e 34 20 2d 31 2e 34 38 2c 2d 30 2e 35 39 20 2d 32 2e 36 38 2c 2d 30 2e 35 39 20 7a 20 6d 20 2d 35 30 2e 34 39 2c 2e 30 39 20 63 20 2d 31 2e 30 Data Ascii: .62 -0.3,0 -0.61,-0.11 -0.81,-0.31 -0.2,-0.3 -0.30,-0.59 -0.40,-1.09 -0.1,-0.5 -0.09,-1.21 -0.09,-2.21 l 0,-0.78 5.71,-0.09 0,-2.62 c 0,-1.6 -0.10,-2.78 -0.40,-3.68 -0.2,-0.89 -0.71,-1.59 -1.31,-1.99 -0.7,-0.4 -1.48,-0.59 -2.68,-0.59 z m -50.49,.09 c -1.0
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 20 2e 35 38 2c 2e 31 31 20 2e 37 38 2c 2e 33 31 20 2e 32 2c 2e 33 20 2e 33 30 2c 2e 35 39 20 2e 34 30 2c 31 2e 30 39 20 2e 31 2c 2e 35 20 2e 30 39 2c 31 2e 32 31 20 2e 30 39 2c 32 2e 32 31 20 6c 20 30 2c 31 2e 30 39 20 2d 32 2e 35 2c 30 20 30 2c 2d 31 2e 30 39 20 63 20 30 2c 2d 31 20 2d 30 2e 30 30 2c 2d 31 2e 37 31 20 2e 30 39 2c 2d 32 2e 32 31 20 30 2c 2d 30 2e 34 20 2e 31 31 2c 2d 30 2e 38 20 2e 33 31 2c 2d 31 20 2e 32 2c 2d 30 2e 33 20 2e 35 31 2c 2d 30 2e 34 30 20 2e 38 31 2c 2d 30 2e 34 30 20 7a 20 6d 20 2d 35 30 2e 34 39 2c 2e 31 32 20 63 20 2e 35 2c 30 20 2e 38 2c 2e 31 38 20 31 2c 2e 36 38 20 2e 31 39 2c 2e 35 20 2e 32 38 2c 31 2e 33 30 20 2e 32 38 2c 32 2e 34 30 20 6c 20 30 2c 34 2e 36 38 20 63 20 30 2c 31 2e 31 20 2d 30 2e 30 38 2c 31 2e 39 30 Data Ascii: .58,.11 .78,.31 .2,.3 .30,.59 .40,1.09 .1,.5 .09,1.21 .09,2.21 l 0,1.09 -2.5,0 0,-1.09 c 0,-1 -0.00,-1.71 .09,-2.21 0,-0.4 .11,-0.8 .31,-1 .2,-0.3 .51,-0.40 .81,-0.40 z m -50.49,.12 c .5,0 .8,.18 1,.68 .19,.5 .28,1.30 .28,2.40 l 0,4.68 c 0,1.1 -0.08,1.90
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6e 64 65 78 4f 66 28 22 78 6d 6c 3a 22 2c 30 29 3f 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 58 4d 4c 2f 31 39 39 38 2f 6e 61 6d 65 73 70 61 63 65 22 3a 30 3d 3d 3d 62 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 78 6c 69 6e 6b 3a 22 2c 30 29 3f 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3a 6e 75 6c 6c 3b 64 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 4e 53 28 64 2c 62 2c 63 29 3a 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 62 2c 63 29 7d 7d 2c 44 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 61 3d 61 2e 73 74 79 6c 65 3b 0a 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 63 29 61 2e 63 73 73 54 65 78 74 3d 63 3b 65 6c 73 65 7b 61 2e 63 73 73 54 65 78 74 3d 22 22 3b 66 Data Ascii: ndexOf("xml:",0)?"http://www.w3.org/XML/1998/namespace":0===b.lastIndexOf("xlink:",0)?"http://www.w3.org/1999/xlink":null;d?a.setAttributeNS(d,b,c):a.setAttribute(b,c)}},Dpb=function(a,b,c){a=a.style;if("string"===typeof c)a.cssText=c;else{a.cssText="";f
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 35 3f 41 35 2e 6e 65 78 74 53 69 62 6c 69 6e 67 3a 77 35 2e 66 69 72 73 74 43 68 69 6c 64 7d 2c 4c 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 41 35 3d 78 35 28 29 3b 0a 76 61 72 20 63 3b 61 3a 7b 69 66 28 63 3d 41 35 29 7b 64 6f 7b 76 61 72 20 64 3d 63 2c 65 3d 61 2c 66 3d 62 2c 68 3d 76 35 28 64 2c 66 29 3b 69 66 28 42 35 28 64 2c 65 2c 68 2e 42 2c 66 2c 68 2e 6b 65 79 29 29 62 72 65 61 6b 20 61 7d 77 68 69 6c 65 28 62 26 26 28 63 3d 63 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 29 7d 63 3d 6e 75 6c 6c 7d 63 7c 7c 28 22 23 74 65 78 74 22 3d 3d 3d 61 3f 28 61 3d 43 35 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 22 22 29 2c 4a 70 62 28 61 2c 22 23 74 65 78 74 22 2c 6e 75 6c 6c 29 29 3a 28 63 3d 43 35 2c 64 Data Ascii: ion(){return A5?A5.nextSibling:w5.firstChild},Lpb=function(a,b){A5=x5();var c;a:{if(c=A5){do{var d=c,e=a,f=b,h=v5(d,f);if(B5(d,e,h.B,f,h.key))break a}while(b&&(c=c.nextSibling))}c=null}c\|\|("#text"===a?(a=C5.createTextNode(""),Jpb(a,"#text",null)):(c=C5,d
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 29 3b 47 35 2e 70 75 73 68 28 62 29 3b 47 35 2e 70 75 73 68 28 63 29 3b 47 35 2e 70 75 73 68 28 64 29 7d 2c 51 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 4c 70 62 28 22 23 74 65 78 74 22 2c 6e 75 6c 6c 29 3b 0a 76 61 72 20 62 3d 41 35 3b 76 61 72 20 63 3d 76 35 28 62 29 3b 69 66 28 63 2e 74 65 78 74 21 3d 3d 61 29 7b 63 3d 63 2e 74 65 78 74 3d 61 3b 66 6f 72 28 76 61 72 20 64 3d 31 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 3d 31 29 63 3d 28 30 2c 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 28 63 29 3b 62 2e 64 61 74 61 21 3d 3d 63 26 26 28 62 2e 64 61 74 61 3d 63 29 7d 7d 2c 53 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 52 70 62 2e 70 75 73 68 28 61 29 3b 0a 69 66 28 61 2e 61 74 74 72 69 62 75 74 65 73 29 7b 76 61 72 20 62 3d 61 2e Data Ascii: );G5.push(b);G5.push(c);G5.push(d)},Qpb=function(a){Lpb("#text",null);var b=A5;var c=v5(b);if(c.text!==a){c=c.text=a;for(var d=1;d<arguments.length;d+=1)c=(0,arguments[d])(c);b.data!==c&&(b.data=c)}},Spb=function(a){Rpb.push(a);if(a.attributes){var b=a.
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 63 5d 2c 61 2e 79 72 5b 63 5d 29 3b 63 3d 61 2e 70 6b 2e 6c 65 6e 67 74 68 2d 31 3b 61 2e 70 6b 5b 62 5d 3d 61 2e 70 6b 5b 63 5d 3b 61 2e 77 77 5b 62 5d 3d 61 2e 77 77 5b 63 5d 3b 61 2e 70 6b 2e 6c 65 6e 67 74 68 2d 2d 3b 61 2e 77 77 2e 6c 65 6e 67 74 68 2d 2d 3b 62 3c 61 2e 70 6b 2e 6c 65 6e 67 74 68 26 26 28 63 3d 61 2e 77 77 5b 62 5d 2c 61 3d 61 2e 70 6b 5b 62 5d 2c 4d 35 28 61 29 2c 61 2e 79 72 5b 63 5d 3d 62 29 7d 2c 58 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3b 0a 72 65 74 75 72 6e 20 61 2e 4e 56 7c 7c 30 3c 28 6e 75 6c 6c 21 3d 28 63 3d 6e 75 6c 6c 3d 3d 61 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 70 6b 29 3f 76 6f 69 64 20 30 3a 62 2e 6c 65 6e 67 74 68 29 3f 63 3a 30 29 7d 2c 4d 35 3d 66 75 6e 63 74 69 6f Data Ascii: c],a.yr[c]);c=a.pk.length-1;a.pk[b]=a.pk[c];a.ww[b]=a.ww[c];a.pk.length--;a.ww.length--;b<a.pk.length&&(c=a.ww[b],a=a.pk[b],M5(a),a.yr[c]=b)},Xpb=function(a){var b,c;return a.NV\|\|0<(null!=(c=null==a?void 0:null==(b=a.pk)?void 0:b.length)?c:0)},M5=functio
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 61 29 7b 76 61 72 20 62 3d 7b 7d 3b 0a 28 76 6f 69 64 20 30 3d 3d 3d 61 7c 7c 61 29 26 26 68 71 62 28 62 29 3b 72 65 74 75 72 6e 20 62 7d 2c 68 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 49 35 3b 0a 62 26 26 21 62 2e 69 73 44 69 73 70 6f 73 65 64 26 26 28 62 2e 55 45 7c 7c 28 62 2e 55 45 3d 5b 5d 29 2c 62 2e 55 45 2e 70 75 73 68 28 61 29 29 7d 2c 6a 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 0a 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 55 45 29 7c 7c 62 2e 66 6f 72 45 61 63 68 28 67 71 62 29 3b 61 2e 55 45 26 26 28 61 2e 55 45 3d 5b 5d 29 3b 61 2e 4e 43 26 26 28 4f 35 28 69 71 62 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 63 3d 67 2e 75 28 61 2e 4e 43 29 2c 64 3d 63 2e 6e 65 78 74 28 29 3b 21 64 2e 64 6f 6e Data Ascii: a){var b={};(void 0===a\|\|a)&&hqb(b);return b},hqb=function(a){var b=I5;b&&!b.isDisposed&&(b.UE\|\|(b.UE=[]),b.UE.push(a))},jqb=function(a){var b;null==(b=a.UE)\|\|b.forEach(gqb);a.UE&&(a.UE=[]);a.NC&&(O5(iqb,function(){for(var c=g.u(a.NC),d=c.next();!d.don
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 62 3d 5b 5d 2e 63 6f 6e 63 61 74 28 67 2e 6f 61 28 70 71 62 29 29 3b 0a 70 71 62 3d 5b 5d 3b 62 3d 67 2e 75 28 62 29 3b 66 6f 72 28 76 61 72 20 63 3d 62 2e 6e 65 78 74 28 29 3b 21 63 2e 64 6f 6e 65 3b 63 3d 62 2e 6e 65 78 74 28 29 29 7b 63 3d 63 2e 76 61 6c 75 65 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 63 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 6f 71 62 28 63 5b 64 5d 29 7d 63 61 74 63 68 28 65 29 7b 64 3d 63 3d 76 6f 69 64 20 30 2c 6e 75 6c 6c 3d 3d 28 64 3d 28 63 3d 48 35 29 2e 4d 44 29 7c 7c 64 2e 63 61 6c 6c 28 63 2c 22 75 6e 6b 6e 6f 77 6e 22 2c 65 29 7d 7d 7d 29 7d 29 7d 2c 72 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 67 2e 49 61 2e 61 70 70 6c 79 28 32 2c 61 72 67 75 6d 65 6e 74 73 29 2c 64 3b 0a 62 3d 6e 75 Data Ascii: b=[].concat(g.oa(pqb));pqb=[];b=g.u(b);for(var c=b.next();!c.done;c=b.next()){c=c.value;try{for(var d=0;d<c.length;d++)oqb(c[d])}catch(e){d=c=void 0,null==(d=(c=H5).MD)\|\|d.call(c,"unknown",e)}}})})},rqb=function(a,b){var c=g.Ia.apply(2,arguments),d;b=nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.4	50287	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	908	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.4	50275	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	625	OUT	GET /s/player/2070f79f/www-embed-player.vflset/www-embed-player.js HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 326071 Date: Thu, 22 Feb 2024 12:07:52 GMT Expires: Fri, 21 Feb 2025 12:07:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:52 UTC	620	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 6d 3b 66 75 6e 63 74 69 6f 6e 20 62 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: (function(){'use strict';var m;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 63 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 75 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 79 6d 62 6f 6c 20 69 73 20 6e 6f 74 20 61 20 63 6f Data Ascii: var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}u("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a co
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 74 20 61 6e 20 69 74 65 72 61 62 6c 65 20 6f 72 20 41 72 72 61 79 4c 69 6b 65 22 29 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 76 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 70 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 0a 76 61 72 20 71 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3f 4f 62 6a 65 Data Ascii: t an iterable or ArrayLike");}function oa(a){if(!(a instanceof Array)){a=v(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function pa(a,b){return Object.prototype.hasOwnProperty.call(a,b)}var qa="function"==typeof Object.assign?Obje
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 74 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 77 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 72 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 78 61 29 78 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 63 2c 64 29 7d 65 6c 73 65 20 61 5b 63 5d 3d 62 5b 63 5d 3b 61 2e 41 61 3d 62 2e 70 72 6f 74 Data Ascii: ta;function w(a,b){a.prototype=ra(b.prototype);a.prototype.constructor=a;if(xa)xa(a,b);else for(var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.Aa=b.prot
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 62 6a 65 63 74 22 29 3b 69 66 28 21 65 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 61 2e 68 2e 41 3d 21 31 2c 65 3b 76 61 72 20 66 3d 65 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 67 29 7b 72 65 74 75 72 6e 20 61 2e 68 2e 76 3d 6e 75 6c 6c 2c 41 61 28 61 2e 68 2c 67 29 2c 49 61 28 61 29 7d 61 2e 68 2e 76 3d 6e 75 6c 6c 3b 64 2e 63 61 6c 6c 28 61 2e 68 2c 66 29 3b 72 65 74 75 72 6e 20 49 61 28 61 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 49 61 28 61 29 7b 66 6f 72 28 3b 61 2e 68 2e 68 3b 29 74 72 79 7b 76 61 72 20 62 3d 61 2e 69 28 61 2e 68 29 3b 69 66 28 62 29 72 65 74 75 72 6e 20 61 2e 68 2e 41 3d 21 31 2c 7b 76 61 6c 75 65 3a 62 2e 76 61 6c 75 65 2c 64 6f 6e 65 3a 21 31 7d 7d 63 61 74 63 68 28 63 29 7b 61 2e 68 2e 69 3d 76 6f 69 64 20 30 2c 41 61 28 61 2e 68 2c 63 29 Data Ascii: bject");if(!e.done)return a.h.A=!1,e;var f=e.value}catch(g){return a.h.v=null,Aa(a.h,g),Ia(a)}a.h.v=null;d.call(a.h,f);return Ia(a)}function Ia(a){for(;a.h.h;)try{var b=a.i(a.h);if(b)return a.h.A=!1,{value:b.value,done:!1}}catch(c){a.h.i=void 0,Aa(a.h,c)
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 62 28 67 29 7b 74 68 69 73 2e 68 3d 30 3b 74 68 69 73 2e 6a 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 69 3d 5b 5d 3b 74 68 69 73 2e 41 3d 21 31 3b 76 61 72 20 68 3d 74 68 69 73 2e 6c 28 29 3b 74 72 79 7b 67 28 68 2e 72 65 73 6f 6c 76 65 2c 68 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6b 29 7b 68 2e 72 65 6a 65 63 74 28 6b 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 74 68 69 73 2e 68 3d 6e 75 6c 6c 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 3f 67 3a 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 68 29 7b 68 28 67 29 7d 29 7d 0a 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 6e Data Ascii: function b(g){this.h=0;this.j=void 0;this.i=[];this.A=!1;var h=this.l();try{g(h.resolve,h.reject)}catch(k){h.reject(k)}}function c(){this.h=null}function d(g){return g instanceof b?g:new b(function(h){h(g)})}if(a)return a;c.prototype.i=function(g){if(n
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 30 21 3d 74 68 69 73 2e 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 73 65 74 74 6c 65 28 22 2b 67 2b 22 2c 20 22 2b 68 2b 22 29 3a 20 50 72 6f 6d 69 73 65 20 61 6c 72 65 61 64 79 20 73 65 74 74 6c 65 64 20 69 6e 20 73 74 61 74 65 22 2b 74 68 69 73 2e 68 29 3b 74 68 69 73 2e 68 3d 67 3b 74 68 69 73 2e 6a 3d 68 3b 32 3d 3d 3d 74 68 69 73 2e 68 26 26 74 68 69 73 2e 65 61 28 29 3b 74 68 69 73 2e 50 28 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 74 68 69 73 3b 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 2e 54 28 29 29 7b 76 61 72 20 68 3d 68 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 68 26 26 68 2e 65 72 72 6f 72 28 67 Data Ascii: 0!=this.h)throw Error("Cannot settle("+g+", "+h+"): Promise already settled in state"+this.h);this.h=g;this.j=h;2===this.h&&this.ea();this.P()};b.prototype.ea=function(){var g=this;e(function(){if(g.T()){var h=ha.console;"undefined"!==typeof h&&h.error(g
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 68 28 6c 2e 68 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 6a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 6a 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 3a 20 22 2b 6c 2e 68 29 3b 7d 7d 0a 76 61 72 20 6c 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 69 3f 66 2e 69 28 6b 29 3a 74 68 69 73 2e 69 2e 70 75 73 68 28 6b 29 3b 74 68 69 73 2e 41 3d 21 30 7d 3b 0a 62 2e 72 65 73 6f 6c 76 65 3d 64 3b 62 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 6b 28 67 29 7d 29 7d 3b 0a 62 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 Data Ascii: h(l.h){case 1:g(l.j);break;case 2:h(l.j);break;default:throw Error("Unexpected state: "+l.h);}}var l=this;null==this.i?f.i(k):this.i.push(k);this.A=!0};b.resolve=d;b.reject=function(g){return new b(function(h,k){k(g)})};b.race=function(g){return new b(
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 66 28 22 66 72 65 65 7a 65 22 29 3b 66 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 66 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 64 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 57 65 61 6b 4d 61 70 20 6b 65 79 22 29 3b 65 28 6b 29 3b 69 66 28 21 70 61 28 6b 2c 67 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 57 65 61 6b 4d 61 70 20 6b 65 79 20 66 61 69 6c 3a 20 22 2b 6b 29 3b 6b 5b 67 5d 5b 74 68 69 73 2e 68 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e Data Ascii: omp_hidden_"+Math.random();f("freeze");f("preventExtensions");f("seal");var h=0;b.prototype.set=function(k,l){if(!d(k))throw Error("Invalid WeakMap key");e(k);if(!pa(k,g))throw Error("WeakMap key fail: "+k);k[g][this.h]=l;return this};b.prototype.get=fun
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6b 3d 6e 65 77 20 61 28 76 28 5b 5b 68 2c 22 73 22 5d 5d 29 29 3b 69 66 28 22 73 22 21 3d 6b 2e 67 65 74 28 68 29 7c 7c 31 21 3d 6b 2e 73 69 7a 65 7c 7c 6b 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6b 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6b 7c 7c 32 21 3d 6b 2e 73 69 7a 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6c 3d 6b 2e 65 6e 74 72 69 65 73 28 29 2c 6e 3d 6c 2e 6e 65 78 74 28 29 3b 69 66 28 6e 2e 64 6f 6e 65 7c 7c 6e 2e 76 61 6c 75 65 5b 30 5d 21 3d 68 7c 7c 22 73 22 21 3d 6e 2e 76 61 6c 75 65 5b 31 5d 29 72 65 74 75 72 6e 21 31 3b 6e 3d 6c 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6e 2e 64 6f 6e 65 7c 7c 34 21 3d 6e Data Ascii: l)return!1;try{var h=Object.seal({x:4}),k=new a(v([[h,"s"]]));if("s"!=k.get(h)\|\|1!=k.size\|\|k.get({x:4})\|\|k.set({x:4},"t")!=k\|\|2!=k.size)return!1;var l=k.entries(),n=l.next();if(n.done\|\|n.value[0]!=h\|\|"s"!=n.value[1])return!1;n=l.next();return n.done\|\|4!=n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.4	50289	31.13.71.36	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	1023	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:52 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:52 UTC	1256	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-22 12:07:52 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.4	50276	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	613	OUT	GET /s/player/2070f79f/player_ias.vflset/en_US/base.js HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	633	IN	HTTP/1.1 200 OK Vary: Accept-Encoding, Origin Accept-Ranges: bytes Content-Type: text/javascript Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 2510414 Date: Thu, 22 Feb 2024 12:07:52 GMT Expires: Fri, 21 Feb 2025 12:07:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:52 UTC	619	IN	Data Raw: 76 61 72 20 5f 79 74 5f 70 6c 61 79 65 72 3d 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 28 54 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 34 20 62 79 20 56 69 74 61 6c 79 20 50 75 7a 72 69 6e 0a 0a 20 50 65 72 6d 69 73 73 69 6f 6e 20 69 73 20 68 65 72 Data Ascii: var _yt_player={};(function(g){var window=this;/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0// SPDX-License-Identifier: Apache-2.0// (The MIT License) Copyright (C) 2014 by Vitaly Puzrin Permission is her
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 66 75 72 6e 69 73 68 65 64 20 74 6f 20 64 6f 20 73 6f 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 63 6f 6e 64 69 74 69 6f 6e 73 3a 0a 0a 20 54 68 65 20 61 62 6f 76 65 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 69 73 20 70 65 72 6d 69 73 73 69 6f 6e 20 6e 6f 74 69 63 65 20 73 68 61 6c 6c 20 62 65 20 69 6e 63 6c 75 64 65 64 20 69 6e 0a 20 61 6c 6c 20 63 6f 70 69 65 73 20 6f 72 20 73 75 62 73 74 61 6e 74 69 61 6c 20 70 6f 72 74 69 6f 6e 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2e 0a 0a 20 54 48 45 20 53 4f 46 54 57 41 52 45 20 49 53 20 50 52 4f 56 49 44 45 44 20 22 41 53 20 49 53 22 2c 20 57 49 54 48 4f 55 54 20 57 41 52 52 41 4e 54 59 20 4f 46 20 41 4e 59 20 4b 49 4e 44 2c 20 45 58 Data Ascii: furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EX
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 72 20 61 6e 79 20 70 75 72 70 6f 73 65 2c 0a 20 20 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 2c 20 61 6e 64 20 74 6f 20 61 6c 74 65 72 20 69 74 20 61 6e 64 20 72 65 64 69 73 74 72 69 62 75 74 65 20 69 74 0a 20 20 20 66 72 65 65 6c 79 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 72 65 73 74 72 69 63 74 69 6f 6e 73 3a 0a 20 20 20 31 2e 20 54 68 65 20 6f 72 69 67 69 6e 20 6f 66 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6d 69 73 72 65 70 72 65 73 65 6e 74 65 64 3b 20 79 6f 75 20 6d 75 73 74 20 6e 6f 74 0a 20 20 20 20 20 20 63 6c 61 69 6d 20 74 68 61 74 20 79 6f 75 20 77 72 6f 74 65 20 74 68 65 20 6f 72 69 67 69 6e 61 6c 20 73 Data Ascii: r any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: 1. The origin of this software must not be misrepresented; you must not claim that you wrote the original s
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 69 66 79 2c 20 6d 65 72 67 65 2c 20 70 75 62 6c 69 73 68 2c 20 64 69 73 74 72 69 62 75 74 65 2c 20 73 75 62 6c 69 63 65 6e 73 65 2c 20 61 6e 64 2f 6f 72 20 73 65 6c 6c 0a 20 63 6f 70 69 65 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2c 20 61 6e 64 20 74 6f 20 70 65 72 6d 69 74 20 70 65 72 73 6f 6e 73 20 74 6f 20 77 68 6f 6d 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 69 73 0a 20 66 75 72 6e 69 73 68 65 64 20 74 6f 20 64 6f 20 73 6f 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 63 6f 6e 64 69 74 69 6f 6e 73 3a 0a 0a 20 54 68 65 20 61 62 6f 76 65 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 69 73 20 70 65 72 6d 69 73 73 69 6f 6e 20 6e 6f 74 69 63 65 20 73 68 61 6c 6c 20 62 65 20 69 6e 63 6c Data Ascii: ify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be incl
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 48 65 2c 4b 65 2c 4c 65 2c 4f 62 61 2c 50 62 61 2c 51 62 61 2c 52 62 61 2c 54 65 2c 55 65 2c 61 66 2c 55 62 61 2c 0a 57 62 61 2c 56 62 61 2c 6a 66 2c 6c 66 2c 58 62 61 2c 6b 66 2c 76 66 2c 4f 65 2c 41 66 2c 5a 62 61 2c 46 66 2c 45 66 2c 4e 65 2c 4f 66 2c 24 62 61 2c 50 66 2c 51 66 2c 52 66 2c 61 63 61 2c 63 63 61 2c 65 63 61 2c 65 67 2c 66 67 2c 67 67 2c 69 63 61 2c 6b 63 61 2c 69 67 2c 6c 63 61 2c 68 67 2c 70 63 61 2c 63 67 2c 67 63 61 2c 72 63 61 2c 6f 63 61 2c 6d 63 61 2c 6e 63 61 2c 73 63 61 2c 71 63 61 2c 6a 67 2c 6a 63 61 2c 6d 67 2c 75 63 61 2c 76 63 61 2c 77 63 61 2c 78 63 61 2c 79 63 61 2c 7a 63 61 2c 41 63 61 2c 42 63 61 2c 43 63 61 2c 44 63 61 2c 45 63 61 2c 46 63 61 2c 47 63 61 2c 48 63 61 2c 49 63 61 2c 4a 63 61 2c 4b 63 61 2c 4c 63 61 2c 4d Data Ascii: He,Ke,Le,Oba,Pba,Qba,Rba,Te,Ue,af,Uba,Wba,Vba,jf,lf,Xba,kf,vf,Oe,Af,Zba,Ff,Ef,Ne,Of,$ba,Pf,Qf,Rf,aca,cca,eca,eg,fg,gg,ica,kca,ig,lca,hg,pca,cg,gca,rca,oca,mca,nca,sca,qca,jg,jca,mg,uca,vca,wca,xca,yca,zca,Aca,Bca,Cca,Dca,Eca,Fca,Gca,Hca,Ica,Jca,Kca,Lca,M
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 2c 46 6e 2c 47 6e 2c 48 6e 2c 4e 66 61 2c 4f 66 61 2c 50 66 61 2c 49 6e 2c 52 66 61 2c 4a 6e 2c 53 66 61 2c 54 66 61 2c 57 66 61 2c 56 66 61 2c 55 66 61 2c 5a 66 61 2c 58 66 61 2c 4c 6e 2c 4e 6e 2c 24 66 61 2c 61 67 61 2c 4f 6e 2c 4d 6e 2c 63 67 61 2c 64 67 61 2c 50 6e 2c 52 6e 2c 65 67 61 2c 53 6e 2c 54 6e 2c 55 6e 2c 67 67 61 2c 57 6e 2c 69 67 61 2c 6a 67 61 2c 6b 67 61 2c 6c 67 61 2c 5a 6e 2c 61 6f 2c 6d 67 61 2c 6e 67 61 2c 6f 67 61 2c 63 6f 2c 70 67 61 2c 72 67 61 2c 71 67 61 2c 73 67 61 2c 74 67 61 2c 75 67 61 2c 77 67 61 2c 65 6f 2c 66 6f 2c 67 6f 2c 68 6f 2c 69 6f 2c 6a 6f 2c 6b 6f 2c 6c 6f 2c 78 67 61 2c 6d 6f 2c 6e 6f 2c 6f 6f 2c 70 6f 2c 71 6f 2c 42 67 61 2c 79 67 61 2c 74 6f 2c 41 67 61 2c 75 6f 2c 7a 67 61 2c 73 6f 2c 72 6f 2c 77 6f 2c 44 67 Data Ascii: ,Fn,Gn,Hn,Nfa,Ofa,Pfa,In,Rfa,Jn,Sfa,Tfa,Wfa,Vfa,Ufa,Zfa,Xfa,Ln,Nn,$fa,aga,On,Mn,cga,dga,Pn,Rn,ega,Sn,Tn,Un,gga,Wn,iga,jga,kga,lga,Zn,ao,mga,nga,oga,co,pga,rga,qga,sga,tga,uga,wga,eo,fo,go,ho,io,jo,ko,lo,xga,mo,no,oo,po,qo,Bga,yga,to,Aga,uo,zga,so,ro,wo,Dg
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 61 2c 4e 74 2c 4f 6a 61 2c 50 6a 61 2c 51 6a 61 2c 52 6a 61 2c 4f 74 2c 53 6a 61 2c 50 74 2c 54 6a 61 2c 51 74 2c 52 74 2c 56 6a 61 2c 53 74 2c 57 6a 61 2c 0a 54 74 2c 55 74 2c 58 6a 61 2c 59 6a 61 2c 56 74 2c 58 74 2c 24 6a 61 2c 59 74 2c 5a 6a 61 2c 61 6b 61 2c 62 6b 61 2c 63 6b 61 2c 65 6b 61 2c 5a 74 2c 66 6b 61 2c 62 75 2c 63 75 2c 68 6b 61 2c 69 6b 61 2c 6c 6b 61 2c 6d 6b 61 2c 64 75 2c 65 75 2c 66 75 2c 67 75 2c 68 75 2c 69 75 2c 6a 75 2c 6b 75 2c 6c 75 2c 6d 75 2c 6e 75 2c 6f 75 2c 70 75 2c 71 6b 61 2c 70 6b 61 2c 72 6b 61 2c 74 6b 61 2c 73 6b 61 2c 76 6b 61 2c 6f 6b 61 2c 75 6b 61 2c 6e 6b 61 2c 71 75 2c 72 75 2c 78 6b 61 2c 79 6b 61 2c 7a 6b 61 2c 77 75 2c 78 75 2c 79 75 2c 74 75 2c 42 6b 61 2c 7a 75 2c 77 6b 61 2c 44 6b 61 2c 45 6b 61 2c 43 6b Data Ascii: a,Nt,Oja,Pja,Qja,Rja,Ot,Sja,Pt,Tja,Qt,Rt,Vja,St,Wja,Tt,Ut,Xja,Yja,Vt,Xt,$ja,Yt,Zja,aka,bka,cka,eka,Zt,fka,bu,cu,hka,ika,lka,mka,du,eu,fu,gu,hu,iu,ju,ku,lu,mu,nu,ou,pu,qka,pka,rka,tka,ska,vka,oka,uka,nka,qu,ru,xka,yka,zka,wu,xu,yu,tu,Bka,zu,wka,Dka,Eka,Ck
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 41 2c 46 6d 61 2c 64 41 2c 65 41 2c 66 41 2c 67 41 2c 47 6d 61 2c 68 41 2c 69 41 2c 6a 41 2c 6b 41 2c 6c 41 2c 48 6d 61 2c 6d 41 2c 49 6d 61 2c 6e 41 2c 4a 6d 61 2c 4b 6d 61 2c 6f 41 2c 70 41 2c 4c 6d 61 2c 71 41 2c 72 41 2c 73 41 2c 4d 6d 61 2c 4e 6d 61 2c 4f 6d 61 2c 50 6d 61 2c 74 41 2c 75 41 2c 51 6d 61 2c 76 41 2c 52 6d 61 2c 53 6d 61 2c 54 6d 61 2c 55 6d 61 2c 56 6d 61 2c 77 41 2c 78 41 2c 57 6d 61 2c 58 6d 61 2c 79 41 2c 7a 41 2c 59 6d 61 2c 41 41 2c 5a 6d 61 2c 24 6d 61 2c 42 41 2c 61 6e 61 2c 62 6e 61 2c 63 6e 61 2c 64 6e 61 2c 43 41 2c 44 41 2c 45 41 2c 46 41 2c 65 6e 61 2c 66 6e 61 2c 47 41 2c 67 6e 61 2c 68 6e 61 2c 69 6e 61 2c 6a 6e 61 2c 48 41 2c 6b 6e 61 2c 6c 6e 61 2c 6d 6e 61 2c 6e 6e 61 2c 6f 6e 61 2c 70 6e 61 2c 71 6e 61 2c 72 6e 61 2c Data Ascii: A,Fma,dA,eA,fA,gA,Gma,hA,iA,jA,kA,lA,Hma,mA,Ima,nA,Jma,Kma,oA,pA,Lma,qA,rA,sA,Mma,Nma,Oma,Pma,tA,uA,Qma,vA,Rma,Sma,Tma,Uma,Vma,wA,xA,Wma,Xma,yA,zA,Yma,AA,Zma,$ma,BA,ana,bna,cna,dna,CA,DA,EA,FA,ena,fna,GA,gna,hna,ina,jna,HA,kna,lna,mna,nna,ona,pna,qna,rna,
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 72 61 2c 76 72 61 2c 77 72 61 2c 54 44 2c 78 72 61 2c 56 44 2c 7a 72 61 2c 41 72 61 2c 42 72 61 2c 43 72 61 2c 44 72 61 2c 45 72 61 2c 24 44 2c 48 72 61 2c 4b 72 61 2c 61 45 2c 4c 72 61 2c 0a 4e 72 61 2c 47 72 61 2c 4f 72 61 2c 50 72 61 2c 51 72 61 2c 49 72 61 2c 4a 72 61 2c 57 44 2c 46 72 61 2c 5a 44 2c 4d 72 61 2c 59 44 2c 58 44 2c 52 72 61 2c 53 72 61 2c 54 72 61 2c 55 72 61 2c 56 72 61 2c 57 72 61 2c 62 73 61 2c 58 72 61 2c 64 45 2c 65 45 2c 66 45 2c 65 73 61 2c 67 73 61 2c 66 73 61 2c 63 73 61 2c 68 73 61 2c 6a 73 61 2c 69 45 2c 6c 73 61 2c 6f 73 61 2c 6c 45 2c 6e 73 61 2c 79 73 61 2c 70 73 61 2c 78 73 61 2c 70 45 2c 7a 73 61 2c 43 73 61 2c 71 45 2c 6f 45 2c 41 73 61 2c 42 73 61 2c 44 73 61 2c 73 45 2c 46 73 61 2c 47 73 61 2c 48 73 61 2c 49 73 61 2c Data Ascii: ra,vra,wra,TD,xra,VD,zra,Ara,Bra,Cra,Dra,Era,$D,Hra,Kra,aE,Lra,Nra,Gra,Ora,Pra,Qra,Ira,Jra,WD,Fra,ZD,Mra,YD,XD,Rra,Sra,Tra,Ura,Vra,Wra,bsa,Xra,dE,eE,fE,esa,gsa,fsa,csa,hsa,jsa,iE,lsa,osa,lE,nsa,ysa,psa,xsa,pE,zsa,Csa,qE,oE,Asa,Bsa,Dsa,sE,Fsa,Gsa,Hsa,Isa,
2024-02-22 12:07:52 UTC	1252	IN	Data Raw: 78 61 2c 47 78 61 2c 6f 48 2c 48 78 61 2c 70 48 2c 49 78 61 2c 4c 78 61 2c 4d 78 61 2c 4e 78 61 2c 72 48 2c 50 78 61 2c 51 78 61 2c 74 48 2c 75 48 2c 76 48 2c 53 78 61 2c 77 48 2c 78 48 2c 79 48 2c 54 78 61 2c 7a 48 2c 52 78 61 2c 55 78 61 2c 41 48 2c 57 78 61 2c 56 78 61 2c 42 48 2c 59 78 61 2c 43 48 2c 44 48 2c 46 48 2c 5a 78 61 2c 24 78 61 2c 48 48 2c 49 48 2c 4b 48 2c 57 48 2c 56 48 2c 62 79 61 2c 4a 48 2c 65 79 61 2c 66 79 61 2c 69 79 61 2c 6a 79 61 2c 6b 79 61 2c 6d 79 61 2c 68 79 61 2c 6e 79 61 2c 6f 79 61 2c 70 79 61 2c 58 48 2c 64 79 61 2c 67 79 61 2c 59 48 2c 74 79 61 2c 76 79 61 2c 61 49 2c 77 79 61 2c 62 49 2c 78 79 61 2c 5a 48 2c 79 79 61 2c 63 49 2c 7a 79 61 2c 75 79 61 2c 64 49 2c 42 79 61 2c 65 49 2c 47 79 61 2c 45 79 61 2c 44 79 61 2c 43 Data Ascii: xa,Gxa,oH,Hxa,pH,Ixa,Lxa,Mxa,Nxa,rH,Pxa,Qxa,tH,uH,vH,Sxa,wH,xH,yH,Txa,zH,Rxa,Uxa,AH,Wxa,Vxa,BH,Yxa,CH,DH,FH,Zxa,$xa,HH,IH,KH,WH,VH,bya,JH,eya,fya,iya,jya,kya,mya,hya,nya,oya,pya,XH,dya,gya,YH,tya,vya,aI,wya,bI,xya,ZH,yya,cI,zya,uya,dI,Bya,eI,Gya,Eya,Dya,C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.4	50281	142.251.40.134	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	1368	OUT	GET /activityi;dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1 Host: 4711400.fls.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:52 UTC	663	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:52 GMT Expires: Thu, 22 Feb 2024 12:07:52 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:52 UTC	589	IN	Data Raw: 32 63 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 64 63 5f 70 72 65 3d 43 4a 37 62 75 4e 66 30 76 6f 51 44 46 55 Data Ascii: 2c2<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CJ7buNf0voQDFU
2024-02-22 12:07:52 UTC	124	IN	Data Raw: 38 2e 31 33 32 3b 75 61 6d 62 3d 30 3b 75 61 6d 3d 3b 75 61 70 3d 57 69 6e 64 6f 77 73 3b 75 61 70 76 3d 31 30 2e 30 2e 30 3b 75 61 77 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 65 6e 2d 75 73 25 32 46 61 62 6f 75 74 22 2f 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 8.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout"/></body></html>
2024-02-22 12:07:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.4	50293	142.251.40.230	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	1010	OUT	GET /activity;register_conversion=1;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=1860249415.1708603604;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnYOTstDl3IKKPv_XKCE1ptiXQCA_Ge7GThgqHqaUDk0OQMaVycs4whY5_5ytM
2024-02-22 12:07:52 UTC	2210	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"17965486908181651421"}],"aggregatable_trigger_data":[{"filters":{"14":["9823594"]},"key_piece":"0x20619744950ba078","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x4105ea4ea9febb02","not_filters":{"14":["9823594"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["9823594"]},"key_piece":"0x43c2bd7b1a45d158","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x54adc1416a3e7","not_filters":{"14":["9823594"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"851494663615780363","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"17965486908181651421","filters":{"14":["9823594"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"17965486908181651421","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4711400"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 23-Mar-2024 12:07:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.4	50294	172.64.155.119	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:52 GMT Content-Type: text/javascript Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85971c7a0c3d8c09-EWR
2024-02-22 12:07:52 UTC	80	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"NY","stateName":"New York","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.4	50292	34.117.223.223	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	2400	OUT	GET /v4/receive/json/81 HTTP/1.1 Host: analytics.ff.avast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AKA_A2=A; apex__avastLocale=en-us; test_FULL_trSrc=mmm_ava_esg_000_361_m; _gcl_au=1.1.1860249415.1708603604; __srcCookie=006_a8b\|\|source=email\|medium=email\|campaign=sig-email\|segmentCode=a; __trSrc=006_a8b; pglpid=f8759d7ff4ec777866c403d26d64bd4c; UTM_SOURCE=link; FULL_trSrc=mmm_ava_esg_000_361_m; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; event69=event69; channelStack=s_eVar72~avast.com; s_tbm=true; s_cc=true; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19776%7CMCMID%7C61856946245616109642292518504905261533%7CMCAAMLH-1709208403%7C7%7CMCAAMB-1709208403%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1708610803s%7CNONE%7CMCSYNCSOP%7C411-19783%7CvVersion%7C5.5.0; _hjSession_470805=eyJpZCI6ImQxZWVjYjYxLTA1NGItNGE1OC05NWMxLTVhYjE4ZmRmZDYwNiIsImMiOjE3MDg2MDM2MDcwMzUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMP_TOKEN=%24NOT_FOUND; _gid=GA1.2.1751936064.1708603609; _fbp=fb.1.1708603609723.347273687; apex__avastExperimentalUserID=704409195.1708603609; sourceCodeCookie=999_a8b\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; trafficSourceCodeCookie=999_a8b; _hjSessionUser_470805=eyJpZCI6IjBkZDcyMjAzLTJhMjQtNThmYS05ZmYxLWNkN2FhMzhmZGJiNCIsImNyZWF0ZWQiOjE3MDg2MDM2MDcwMzAsImV4aXN0aW5nIjp0cnVlfQ==; _gat_UA-58120669-2=1; RT="z=1&dm=avast.com&si=fcd029a1-20d9-4eb8-9dbf-d5b51e7e3240&ss=lsx6gvc5&sl=5&tt=k5r&bcn=%2F%2F173bf109.akstat.io%2F"; _ga_WZQ6MQ6RF3=GS1.1.1708603615.1.1.1708603670.0.0.0; s_nr=1708603670374-New; s_gpv=avast.com%3Aus%3Aabout%3Aabout; s_gpv_custom=avast.com%3Aabout%3Aabout; OptanonConsent=isIABGlobal=false&datestamp=Thu+Feb+22+2024+13%3A07%3A50+GMT%2B0100+(Central+European+Standard+Time)&version=6.33.0&hosts=&consentId=3ee9271b-3c91-4963-bc82-c3424a9b9197&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG270%3A1%2CC0004%3A1%2CC0005%3A1&AwaitingReconsent=false; _ga=GA1.2.704409195.1708603609; _uetsid=df717c70d17a11eea87a4f104fe805a7; _uetvid=df71a7b0d17a11ee9b3785fce7b35c4b
2024-02-22 12:07:52 UTC	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 22 Feb 2024 12:07:52 GMT Content-Type: text/plain Content-Length: 18 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:52 UTC	18	IN	Data Raw: 4e 6f 20 55 52 4c 20 6d 61 74 63 68 20 66 6f 75 6e 64 Data Ascii: No URL match found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.4	50295	63.140.38.138	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	1248	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s46211879239902?AQB=1&ndh=1&pf=1&t=22%2F1%2F2024%2013%3A7%3A50%204%20-60&mid=61856946245616109642292518504905261533&aamlh=7&ce=UTF-8&pageName=avast.com%3Aus%3Aabout%3Aabout&g=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&cc=USD&server=norton&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=avast.com%3Aus%3Aabout%3Aabout&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=avast.com&v41=D%3Dc41&c46=html&v47=s_code_norton%202024-02-06&v48=D%3Dc49&c49=about&v49=D%3Dc48&v57=61856946245616109642292518504905261533&c59=avast.com%3Aabout%3Aabout&v59=D%3Dc59&c60=avast.com%3Aus%3Ahomepage%3Aindex-t1&v72=avast.com&c75=D%3Dv57&v96=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout&v118=avast.com%3Ahomepage%3Aindex-t1&v164=avast%3A006_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:52 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 22 Feb 2024 12:07:52 GMT expires: Wed, 21 Feb 2024 12:07:52 GMT last-modified: Fri, 23 Feb 2024 12:07:52 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3669198447647326208-4617894326592670326 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-22 12:07:52 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.4	50301	76.13.32.146	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	676	OUT	GET /sp.pl?a=10000&d=Thu%2C%2022%20Feb%202024%2012%3A07%3A50%20GMT&n=-1&b=Avast%20About%20us%20%7C%20About%20AVAST%20Software&.yp=10156543&f=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1 Host: sp.analytics.yahoo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU
2024-02-22 12:07:53 UTC	923	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:52 GMT Expires: Thu, 22 Feb 2024 12:07:52 GMT Pragma: no-cache Cache-Control: no-cache, private, must-revalidate Content-Type: application/x-javascript Accept-Ranges: bytes Content-Length: 0 Server: ATS Age: 0 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBOA412UCEK397v4VVpjE7zpPN3xEty8FEgEBAQGK2GXhZdxH0iMA_eMAAA&S=AQAAAolQYM-PCv_OrUQ08vW9dqU; Expires=Fri, 21 Feb 2025 18:07:52 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.4	50306	157.240.241.35	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	608	OUT	GET /tr/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:53 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:53 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.4	50305	157.240.241.35	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	645	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=PageView&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670928&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:53 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:53 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:53 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.4	50304	157.240.241.35	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:52 UTC	675	OUT	GET /tr/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:53 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 22 Feb 2024 12:07:53 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.4	50309	157.240.241.35	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:53 UTC	712	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=334783782127169&ev=ViewContent&dl=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout%23pc&rl=&if=false&ts=1708603670930&cd[content_ids]=%5B%27FAV-ONLINE%27%5D&cd[content_type]=product&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4125&fbp=fb.1.1708603609723.347273687&ler=empty&cdl=API_unavailable&it=1708603670875&coo=false&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:53 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-22 12:07:53 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-22 12:07:53 UTC	1289	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.4	50308	142.251.40.226	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:53 UTC	1347	OUT	GET /ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://4711400.fls.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:53 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.4	50311	142.250.80.66	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:53 UTC	1100	OUT	GET /ddm/fls/z/dc_pre=CJ7buNf0voQDFU-LfwQdMjAFyw;src=4711400;type=globa0;cat=avast0;ord=1;num=2733115133607;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fen-us%2Fabout;u8=;u17=link;ps=1;pcor=136643132;pscdl=noapi;gtm=45He42h0v71039428za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fen-us%2Fabout HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:54 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:53 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.4	50280	142.251.40.214	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:54 UTC	801	OUT	GET /vi/Yo9K67ixJ10/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB_gmAAtAFigIMCAAQARhyIEsoRjAP&rs=AOn4CLCJxsQZZEuXR5yZ_WuQyU6IJ0kWWQ HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube-nocookie.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:54 UTC	654	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Timing-Allow-Origin: * Content-Length: 1880 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 22 Feb 2024 12:07:54 GMT Expires: Thu, 22 Feb 2024 14:07:54 GMT Cache-Control: public, max-age=7200 ETag: "1631533074" Content-Type: image/jpeg Vary: Origin Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:54 UTC	598	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 08 06 06 10 11 11 13 0f 10 11 13 10 13 12 15 11 0f 12 13 12 0f 10 12 10 15 16 12 12 16 15 11 10 11 13 17 18 22 1b 15 1d 20 17 11 10 1d 2b 1d 20 24 25 28 28 28 17 1b 30 3d 2c 26 30 2e 27 34 30 01 09 09 09 0d 0c 0d 16 0d 0e 0e 27 21 1b 1d 32 32 32 27 27 32 30 32 27 32 28 32 32 27 26 26 32 26 26 32 26 32 32 26 26 28 26 32 26 26 26 2a 32 26 26 26 26 26 26 26 26 26 26 32 32 26 26 26 26 26 ff c0 00 11 08 00 5a 00 78 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 00 03 04 05 06 07 02 01 08 ff c4 00 42 10 00 01 03 01 05 03 06 0a 08 05 05 00 00 00 00 00 01 00 02 11 03 04 05 12 21 31 41 51 d3 07 22 54 61 71 81 13 17 18 32 91 93 94 a1 b1 c1 14 23 Data Ascii: JFIF" + $%(((0=,&0.'40'!222''202'2(22'&&2&&2&22&&(&2&&&*2&&&&&&&&&&22&&&&&Zx"B!1AQ"Taq2#
2024-02-22 12:07:54 UTC	1252	IN	Data Raw: 99 4a 5a de 7b f4 89 e6 b7 f1 1f 92 85 ba ae 73 58 f8 47 c8 6c c9 d8 5e 76 c7 ea bb b9 ae 32 f8 a9 54 43 75 0d d0 bb b7 70 56 a0 00 c8 08 03 21 10 80 a7 45 ad c9 ad 02 34 c8 04 a4 a4 e4 ee f7 85 d4 a0 ea 57 92 9a d4 b5 b5 a6 0c ed ce 32 cb 50 37 c2 8d bd 6f 6a 94 de 29 d3 66 32 40 76 d2 73 27 28 1b f0 9c d5 c7 1f 6e 23 39 65 a8 9d 94 4a 63 65 b7 63 a6 d7 96 96 97 64 5b a4 1c e4 67 1b 92 ec ab b2 08 3a 8d b9 7e fe 4a 6b 5c 35 29 79 44 ae 31 21 07 16 8a 21 e2 14 55 6b 23 9a 24 e9 bd 4c 48 5c d4 60 70 82 82 05 c7 23 d8 50 9c da ac 58 41 33 fa e8 50 82 8f 67 3f 00 ac b7 2d d4 d2 05 5a b1 06 30 b7 e0 5d fa 2a b5 07 69 d9 f2 56 6b 1d e0 c0 c6 37 3c 9a d1 e6 98 d1 05 a3 c2 8d e1 7b e1 86 f0 a1 d8 f0 5a 0f 6f c2 7e 4b 87 55 00 eb d4 82 6f c3 37 78 f4 a4 eb 5b 29 Data Ascii: JZ{sXGl^v2TCupV!E4W2P7oj)f2@vs'(n#9eJcecd[g:~Jk\5)yD1!!Uk#$LH\`p#PXA3Pg?-Z0]*iVk7<{Zo~KUo7x[)
2024-02-22 12:07:54 UTC	30	IN	Data Raw: 86 84 1f 30 a1 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 41 ff d9 Data Ascii: 0@!@!@!@!@!@!@!A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.4	50313	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:55 UTC	615	OUT	GET /s/player/2070f79f/player_ias.vflset/en_US/remote.js HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:55 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 120235 Date: Thu, 22 Feb 2024 12:07:55 GMT Expires: Fri, 21 Feb 2025 12:07:55 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Feb 2024 05:03:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:55 UTC	620	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 61 38 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 2e 48 6f 28 61 2c 22 7a 78 22 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 31 34 37 34 38 33 36 34 38 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 2b 4d 61 74 68 2e 61 62 73 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 31 34 37 34 38 33 36 34 38 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 5e 67 2e 6e 62 28 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 62 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 63 29 7c 7c 28 63 3d 5b 53 74 72 69 6e 67 28 63 29 5d 29 3b 0a Data Ascii: (function(g){var window=this;'use strict';var a8=function(a){g.Ho(a,"zx",Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())^g.nb()).toString(36));return a},b8=function(a,b,c){Array.isArray(c)\|\|(c=[String(c)]);
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 62 2e 63 61 6c 6c 28 63 2c 64 2e 76 61 6c 75 65 2c 76 6f 69 64 20 30 2c 61 29 7d 7d 2c 5a 79 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 5b 5d 3b 0a 59 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 74 72 79 7b 76 61 72 20 65 3d 67 2e 43 76 2e 70 72 6f 74 6f 74 79 70 65 2e 42 2e 63 61 6c 6c 28 74 68 69 73 2c 64 2c 21 30 29 7d 63 61 74 63 68 28 66 29 7b 69 66 28 22 53 74 6f 72 61 67 65 3a 20 49 6e 76 61 6c 69 64 20 76 61 6c 75 65 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 22 3d 3d 66 29 72 65 74 75 72 6e 3b 74 68 72 6f 77 20 66 3b 7d 76 6f 69 64 20 30 3d 3d 3d 65 3f 63 2e 70 75 73 68 28 64 29 3a 67 2e 79 6c 61 28 65 29 26 26 63 2e 70 75 73 68 28 64 29 7d 2c 61 29 3b 0a 72 65 74 75 72 6e 20 63 7d 2c 24 79 62 3d 66 75 6e 63 74 Data Ascii: b.call(c,d.value,void 0,a)}},Zyb=function(a,b){var c=[];Yyb(b,function(d){try{var e=g.Cv.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e?c.push(d):g.yla(e)&&c.push(d)},a);return c},$yb=funct
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 65 6f 66 20 61 2e 6d 6d 29 72 65 74 75 72 6e 20 61 2e 6d 6d 28 29 3b 0a 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 4d 61 70 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 4d 61 70 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 53 65 74 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 65 74 29 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 61 2e 76 61 6c 75 65 73 28 29 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 61 2e 73 70 6c 69 74 28 22 22 29 3b 69 66 28 67 2e 62 62 28 61 29 29 7b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2c 63 3d 61 2e 6c 65 6e 67 74 68 2c 64 3d 30 3b 64 3c 63 3b 64 2b 2b 29 62 2e 70 75 73 68 28 61 5b 64 5d 29 3b 72 65 74 75 72 6e 20 62 Data Ascii: eof a.mm)return a.mm();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(g.bb(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 73 65 64 22 2c 7b 50 63 3a 33 2c 4f 63 3a 22 63 68 61 6e 6e 65 6c 5f 74 79 70 65 22 7d 29 7d 2c 6d 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 6a 2e 56 69 28 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 79 6f 75 74 75 62 65 2f 6c 69 76 69 6e 67 5f 72 6f 6f 6d 2f 6d 64 78 2f 63 68 61 6e 6e 65 6c 2f 63 6c 6f 73 65 64 22 2c 62 29 7d 2c 6e 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6a 3d 64 38 28 29 3b 0a 74 68 69 73 2e 6a 2e 4b 68 28 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 79 6f 75 74 75 62 65 2f 6c 69 76 69 6e 67 5f 72 6f 6f 6d 2f 6d 64 78 2f 63 68 61 6e 6e 65 6c 2f 6d 65 73 73 61 67 65 5f 72 65 63 65 69 76 65 64 22 2c 7b 50 63 3a 33 2c 4f 63 3a 22 63 68 61 6e 6e 65 6c 5f 74 79 70 65 22 7d 29 7d 2c 6f 7a 62 3d 66 Data Ascii: sed",{Pc:3,Oc:"channel_type"})},mzb=function(a,b){a.j.Vi("/client_streamz/youtube/living_room/mdx/channel/closed",b)},nzb=function(){this.j=d8();this.j.Kh("/client_streamz/youtube/living_room/mdx/channel/message_received",{Pc:3,Oc:"channel_type"})},ozb=f
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 65 3f 61 2e 63 6c 69 65 6e 74 4e 61 6d 65 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3a 22 55 4e 4b 4e 4f 57 4e 5f 49 4e 54 45 52 46 41 43 45 22 2c 74 68 69 73 2e 61 70 70 3d 61 2e 61 70 70 2c 74 68 69 73 2e 74 79 70 65 3d 0a 61 2e 74 79 70 65 7c 7c 22 52 45 4d 4f 54 45 5f 43 4f 4e 54 52 4f 4c 22 2c 74 68 69 73 2e 75 73 65 72 6e 61 6d 65 3d 61 2e 75 73 65 72 7c 7c 22 22 2c 74 68 69 73 2e 61 76 61 74 61 72 3d 61 2e 75 73 65 72 41 76 61 74 61 72 55 72 69 7c 7c 22 22 2c 74 68 69 73 2e 6f 62 66 75 73 63 61 74 65 64 47 61 69 61 49 64 3d 61 2e 6f 62 66 75 73 63 61 74 65 64 47 61 69 61 49 64 7c 7c 22 22 2c 74 68 69 73 2e 74 68 65 6d 65 3d 61 2e 74 68 65 6d 65 7c 7c 22 75 22 2c 74 7a 62 28 74 68 69 73 2c 61 2e 63 61 70 61 62 69 6c 69 74 69 65 73 7c 7c 22 22 29 2c Data Ascii: e?a.clientName.toUpperCase():"UNKNOWN_INTERFACE",this.app=a.app,this.type=a.type\|\|"REMOTE_CONTROL",this.username=a.user\|\|"",this.avatar=a.userAvatarUri\|\|"",this.obfuscatedGaiaId=a.obfuscatedGaiaId\|\|"",this.theme=a.theme\|\|"u",tzb(this,a.capabilities\|\|""),
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 73 2e 6e 61 6d 65 3d 61 2e 6e 61 6d 65 7c 7c 22 22 3b 74 68 69 73 2e 69 64 3d 61 2e 69 64 7c 7c 61 2e 73 63 72 65 65 6e 49 64 7c 7c 22 22 3b 74 68 69 73 2e 74 6f 6b 65 6e 3d 61 2e 74 6f 6b 65 6e 7c 7c 61 2e 6c 6f 75 6e 67 65 54 6f 6b 65 6e 7c 7c 22 22 3b 74 68 69 73 2e 75 75 69 64 3d 61 2e 75 75 69 64 7c 7c 61 2e 64 69 61 6c 49 64 7c 7c 22 22 3b 74 68 69 73 2e 69 64 54 79 70 65 3d 61 2e 73 63 72 65 65 6e 49 64 54 79 70 65 7c 7c 22 6e 6f 72 6d 61 6c 22 7d 2c 66 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 21 21 62 26 26 28 61 2e 69 64 3d 3d 62 7c 7c 61 2e 75 75 69 64 3d 3d 62 29 7d 2c 7a 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 61 2e 6e 61 6d 65 2c 0a 73 63 72 65 65 6e 49 64 3a 61 2e 69 64 2c 6c Data Ascii: s.name=a.name\|\|"";this.id=a.id\|\|a.screenId\|\|"";this.token=a.token\|\|a.loungeToken\|\|"";this.uuid=a.uuid\|\|a.dialId\|\|"";this.idType=a.screenIdType\|\|"normal"},f8=function(a,b){return!!b&&(a.id==b\|\|a.uuid==b)},zzb=function(a){return{name:a.name,screenId:a.id,l
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 61 5b 30 5d 3a 61 5b 30 5d 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 62 29 3b 72 65 74 75 72 6e 20 67 2e 7a 72 28 61 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 29 7b 72 65 74 75 72 6e 20 30 3d 3d 65 3f 64 3a 64 2e 73 75 62 73 74 72 69 6e 67 28 63 2e 6c 65 6e 67 74 68 29 7d 29 7d 2c 49 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 2e 53 43 28 22 79 74 2d 72 65 6d 6f 74 65 2d 63 6f 6e 6e 65 63 74 65 64 2d 64 65 76 69 63 65 73 22 2c 61 2c 38 36 34 30 30 29 7d 2c 6a 38 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 4a 7a 62 29 72 65 74 75 72 6e 20 4a 7a 62 3b 0a 76 61 72 20 61 3d 67 2e 54 43 28 22 79 74 2d 72 65 6d 6f 74 65 2d 64 65 76 69 63 65 2d 69 64 22 29 3b 61 7c 7c 28 61 3d 44 7a 62 28 29 2c 67 2e 53 43 28 22 79 74 2d 72 65 6d 6f 74 65 2d 64 65 76 69 63 65 2d Data Ascii: a[0]:a[0].substring(0,b);return g.zr(a,function(d,e){return 0==e?d:d.substring(c.length)})},Izb=function(a){g.SC("yt-remote-connected-devices",a,86400)},j8=function(){if(Jzb)return Jzb;var a=g.TC("yt-remote-device-id");a\|\|(a=Dzb(),g.SC("yt-remote-device-
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 2c 61 72 67 75 6d 65 6e 74 73 29 3b 67 2e 46 45 5b 61 5d 3d 21 31 7d 2c 52 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 64 38 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 6e 38 29 7b 6e 38 3d 6e 65 77 20 67 2e 6e 67 28 6e 65 77 20 52 7a 62 29 3b 0a 76 61 72 20 61 3d 67 2e 47 42 28 22 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 5f 77 65 62 5f 66 6c 75 73 68 5f 63 6f 75 6e 74 22 2c 2d 31 29 3b 2d 31 21 3d 3d 61 26 26 28 6e 38 2e 44 3d 61 29 7d 72 65 74 75 72 6e 20 6e 38 7d 2c 53 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 6d 61 74 63 68 28 2f 43 68 72 6f 6d 65 5c 2f 28 5b 30 2d 39 5d 2b 29 2f 29 3b 0a 72 65 74 75 72 6e 20 61 3f 70 61 72 73 65 49 6e 74 28 61 Data Ascii: ,arguments);g.FE[a]=!1},Rzb=function(){},d8=function(){if(!n8){n8=new g.ng(new Rzb);var a=g.GB("client_streamz_web_flush_count",-1);-1!==a&&(n8.D=a)}return n8},Szb=function(){var a=window.navigator.userAgent.match(/Chrome\/([0-9]+)/);return a?parseInt(a
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 62 28 29 3b 0a 76 61 72 20 61 3d 59 7a 62 28 29 3b 61 2e 70 75 73 68 28 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 65 75 72 65 6b 61 2f 63 6c 61 6e 6b 2f 63 61 73 74 5f 73 65 6e 64 65 72 2e 6a 73 22 29 3b 6f 38 28 61 29 7d 2c 63 41 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 24 7a 62 28 29 3b 0a 76 61 72 20 61 3d 59 7a 62 28 29 3b 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 67 2e 6f 61 28 62 41 62 2e 6d 61 70 28 58 7a 62 29 29 29 3b 61 2e 70 75 73 68 28 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 65 75 72 65 6b 61 2f 63 6c 61 6e 6b 2f 63 61 73 74 5f 73 65 6e 64 65 72 2e 6a 73 22 29 3b 6f 38 28 61 29 7d 2c 70 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 67 2e 49 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 74 68 69 73 2e 4b 3d 6e Data Ascii: b();var a=Yzb();a.push("//www.gstatic.com/eureka/clank/cast_sender.js");o8(a)},cAb=function(){$zb();var a=Yzb();a.push.apply(a,g.oa(bAb.map(Xzb)));a.push("//www.gstatic.com/eureka/clank/cast_sender.js");o8(a)},p8=function(a,b,c){g.I.call(this);this.K=n
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 73 2e 68 63 3d 64 7c 7c 31 3b 74 68 69 73 2e 5a 61 3d 6e 65 77 20 67 2e 75 70 28 74 68 69 73 29 3b 74 68 69 73 2e 75 62 3d 34 35 45 33 3b 61 3d 67 2e 78 53 3f 31 32 35 3a 76 6f 69 64 20 30 3b 74 68 69 73 2e 6b 62 3d 6e 65 77 20 67 2e 6b 67 28 61 29 3b 74 68 69 73 2e 4e 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 43 3d 21 31 3b 74 68 69 73 2e 58 3d 74 68 69 73 2e 67 62 3d 74 68 69 73 2e 5a 3d 74 68 69 73 2e 52 61 3d 74 68 69 73 2e 42 61 3d 74 68 69 73 2e 50 62 3d 74 68 69 73 2e 6d 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 6f 61 3d 5b 5d 3b 74 68 69 73 2e 6a 3d 6e 75 6c 6c 3b 74 68 69 73 2e 4b 3d 30 3b 74 68 69 73 2e 4e 3d 74 68 69 73 2e 49 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 41 62 3d 2d 31 3b 74 68 69 73 2e 4d 61 3d 21 31 3b 74 68 69 73 2e 72 62 3d 30 3b 74 68 69 73 2e Data Ascii: s.hc=d\|\|1;this.Za=new g.up(this);this.ub=45E3;a=g.xS?125:void 0;this.kb=new g.kg(a);this.Na=null;this.C=!1;this.X=this.gb=this.Z=this.Ra=this.Ba=this.Pb=this.ma=null;this.oa=[];this.j=null;this.K=0;this.N=this.Ia=null;this.Ab=-1;this.Ma=!1;this.rb=0;this.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.4	50314	142.251.40.196	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:55 UTC	860	OUT	GET /js/th/ToQOEX5gn9COOYOZ9__C9da2xlIrCzMPflL2asQoGhw.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube-nocookie.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-22 12:07:55 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 51695 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 22 Feb 2024 08:09:09 GMT Expires: Fri, 21 Feb 2025 08:09:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 12 Feb 2024 13:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 14326 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:55 UTC	441	IN	Data Raw: 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 67 4d 79 77 69 63 32 39 31 63 6d 4e 6c 63 79 49 36 57 79 49 69 58 53 77 69 63 32 39 31 63 6d 4e 6c 63 30 4e 76 62 6e 52 6c 62 6e 51 69 4f 6c 73 69 49 43 4a 64 4c 43 4a 75 59 57 31 6c 63 79 49 36 57 79 4a 6a 62 47 39 7a 64 58 4a 6c 52 48 6c 75 59 57 31 70 59 30 4a 31 64 48 52 76 62 69 4a 64 4c 43 4a 74 59 58 42 77 61 57 35 6e 63 79 49 36 49 6b 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 69 66 51 3d 3d 0a 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: //# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==(function(
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 63 72 69 70 74 55 52 4c 3a 4c 7d 29 2c 78 3d 34 36 3b 65 6c 73 65 7b 69 66 28 34 36 3d 3d 78 29 72 65 74 75 72 6e 20 45 3d 37 32 2c 75 3b 69 66 28 78 3d 3d 4a 29 72 65 74 75 72 6e 20 75 3b 37 37 3d 3d 78 3f 78 3d 79 2e 63 6f 6e 73 6f 6c 65 3f 70 3a 34 36 3a 78 3d 3d 70 3f 28 79 2e 63 6f 6e 73 6f 6c 65 5b 47 5d 28 5a 2e 6d 65 73 73 61 67 65 29 2c 78 3d 34 36 29 3a 33 39 3d 3d 78 3f 28 45 3d 37 32 2c 78 3d 37 37 29 3a 34 35 3d 3d 78 3f 28 75 3d 54 2c 49 3d 79 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 78 3d 38 35 29 3a 38 35 3d 3d 78 26 26 28 78 3d 49 26 26 49 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 3f 31 3a 4a 29 7d 7d 63 61 74 63 68 28 53 29 7b 69 66 28 37 32 3d 3d 45 29 74 68 72 6f 77 20 53 3b 45 3d 3d 74 26 26 28 5a 3d 53 2c 78 3d 33 39 29 7d 7d 2c 4c 3d Data Ascii: criptURL:L}),x=46;else{if(46==x)return E=72,u;if(x==J)return u;77==x?x=y.console?p:46:x==p?(y.console[G](Z.message),x=46):39==x?(E=72,x=77):45==x?(u=T,I=y.trustedTypes,x=85):85==x&&(x=I&&I.createPolicy?1:J)}}catch(S){if(72==E)throw S;E==t&&(Z=S,x=39)}},L=
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 29 72 65 74 75 72 6e 20 49 3b 69 66 28 35 31 3d 3d 4c 29 75 3d 79 2c 4c 3d 36 33 3b 65 6c 73 65 20 69 66 28 34 3d 3d 4c 29 75 2b 2b 2c 4c 3d 36 38 3b 65 6c 73 65 20 69 66 28 36 32 3d 3d 4c 29 4c 3d 74 3b 65 6c 73 65 20 69 66 28 31 37 3d 3d 4c 29 4c 3d 31 3e 78 2d 38 3e 3e 35 26 26 31 39 3c 3d 28 78 7c 31 29 3f 31 36 3a 31 39 3b 65 6c 73 65 20 69 66 28 37 39 3d 3d 4c 29 74 56 28 39 36 2c 79 2c 34 38 2c 70 2c 45 2c 5a 2c 4a 2c 64 2c 53 29 2c 4c 3d 32 30 3b 65 6c 73 65 7b 69 66 28 32 39 3d 3d 4c 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 63 6c 61 73 73 20 6e 61 6d 65 20 22 2b 70 29 3b 69 66 28 35 35 3d 3d 4c 29 4c 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 45 29 3f 35 31 3a 34 36 3b 65 6c 73 65 20 69 66 28 32 30 3d 3d 4c 29 4c 3d 32 Data Ascii: )return I;if(51==L)u=y,L=63;else if(4==L)u++,L=68;else if(62==L)L=t;else if(17==L)L=1>x-8>>5&&19<=(x\|1)?16:19;else if(79==L)tV(96,y,48,p,E,Z,J,d,S),L=20;else{if(29==L)throw Error("Invalid class name "+p);if(55==L)L=Array.isArray(E)?51:46;else if(20==L)L=2
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 69 63 65 28 74 2c 74 2c 70 29 2c 4a 3d 33 3b 65 6c 73 65 20 69 66 28 36 37 3d 3d 4a 29 72 65 74 75 72 6e 20 75 7d 2c 5a 6d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 78 2c 70 2c 79 2c 64 2c 53 2c 5a 2c 45 2c 4a 29 7b 66 6f 72 28 45 3d 35 31 3b 39 34 21 3d 45 3b 29 69 66 28 35 3d 3d 45 29 74 68 69 73 2e 6e 2b 2b 2c 45 3d 32 38 3b 65 6c 73 65 20 69 66 28 35 34 3d 3d 45 29 7b 61 3a 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 64 29 4a 3d 22 73 74 72 69 6e 67 22 21 3d 3d 74 79 70 65 6f 66 20 53 7c 7c 53 2e 6c 65 6e 67 74 68 21 3d 79 3f 2d 31 3a 64 2e 69 6e 64 65 78 4f 66 28 53 2c 70 29 3b 65 6c 73 65 7b 66 6f 72 28 5a 3d 70 3b 5a 3c 64 2e 6c 65 6e 67 74 68 3b 5a 2b 2b 29 69 66 28 5a 20 69 6e 20 64 26 26 64 5b 5a 5d 3d 3d 3d 53 29 7b 4a 3d 5a 3b 62 Data Ascii: ice(t,t,p),J=3;else if(67==J)return u},Zm=function(t,x,p,y,d,S,Z,E,J){for(E=51;94!=E;)if(5==E)this.n++,E=28;else if(54==E){a:if("string"===typeof d)J="string"!==typeof S\|\|S.length!=y?-1:d.indexOf(S,p);else{for(Z=p;Z<d.length;Z++)if(Z in d&&d[Z]===S){J=Z;b
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 68 69 73 2e 59 4e 29 2c 49 3d 36 35 29 3a 38 3d 3d 49 3f 49 3d 28 70 5e 31 33 29 3e 3e 34 3f 36 35 3a 35 39 3a 49 3d 3d 74 3f 28 75 3d 78 2c 49 3d 36 38 29 3a 38 39 3d 3d 49 26 26 28 49 3d 75 3c 64 2e 6c 65 6e 67 74 68 3f 32 32 3a 34 39 29 7d 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 78 2c 70 2c 79 2c 64 2c 53 2c 5a 2c 45 2c 4a 2c 75 2c 4c 29 7b 69 66 28 32 3d 3d 28 28 74 5e 32 39 29 26 37 29 29 69 66 28 53 3d 22 61 72 72 61 79 22 3d 3d 3d 47 47 28 22 63 61 6c 6c 22 2c 79 2c 22 6f 62 6a 65 63 74 22 29 3f 79 3a 5b 79 5d 2c 74 68 69 73 2e 75 29 78 28 74 68 69 73 2e 75 29 3b 65 6c 73 65 20 74 72 79 7b 5a 3d 5b 5d 2c 64 3d 21 74 68 69 73 2e 4c 2e 6c 65 6e 67 74 68 2c 46 28 30 2c 32 30 2c 5b 6b 45 2c 5a 2c 53 5d 2c 74 68 69 73 29 2c 46 28 30 2c 31 36 2c 5b Data Ascii: his.YN),I=65):8==I?I=(p^13)>>4?65:59:I==t?(u=x,I=68):89==I&&(I=u<d.length?22:49)}},B=function(t,x,p,y,d,S,Z,E,J,u,L){if(2==((t^29)&7))if(S="array"===GG("call",y,"object")?y:[y],this.u)x(this.u);else try{Z=[],d=!this.L.length,F(0,20,[kE,Z,S],this),F(0,16,[
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 3b 65 6c 73 65 20 69 66 28 36 35 3d 3d 68 29 7b 61 3a 7b 73 77 69 74 63 68 28 5a 29 7b 63 61 73 65 20 31 3a 47 3d 53 3f 22 64 69 73 61 62 6c 65 22 3a 22 65 6e 61 62 6c 65 22 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 64 3a 47 3d 53 3f 22 68 69 67 68 6c 69 67 68 74 22 3a 22 75 6e 68 69 67 68 6c 69 67 68 74 22 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 34 3a 47 3d 53 3f 22 61 63 74 69 76 61 74 65 22 3a 22 64 65 61 63 74 69 76 61 74 65 22 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 78 3a 47 3d 53 3f 22 73 65 6c 65 63 74 22 3a 22 75 6e 73 65 6c 65 63 74 22 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 70 3a 47 3d 53 3f 22 63 68 65 63 6b 22 3a 22 75 6e 63 68 65 63 6b 22 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 74 3a 47 3d 53 3f 22 66 6f 63 75 73 22 3a 22 62 6c 75 72 Data Ascii: ;else if(65==h){a:{switch(Z){case 1:G=S?"disable":"enable";break a;case d:G=S?"highlight":"unhighlight";break a;case 4:G=S?"activate":"deactivate";break a;case x:G=S?"select":"unselect";break a;case p:G=S?"check":"uncheck";break a;case t:G=S?"focus":"blur
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 79 2c 64 29 2c 75 3d 37 39 3b 65 6c 73 65 20 69 66 28 39 34 3d 3d 75 29 75 3d 31 32 3b 65 6c 73 65 20 69 66 28 34 33 3d 3d 75 29 75 3d 33 38 3b 65 6c 73 65 20 69 66 28 34 3d 3d 75 29 75 3d 45 2e 49 67 3d 3d 70 3f 33 33 3a 37 39 3b 65 6c 73 65 20 69 66 28 31 36 3d 3d 75 29 5a 3d 64 2e 73 72 63 2c 75 3d 37 37 3b 65 6c 73 65 20 69 66 28 37 37 3d 3d 75 29 75 3d 5a 26 26 5a 5b 45 51 5d 3f 38 3a 39 32 3b 65 6c 73 65 7b 69 66 28 37 39 3d 3d 75 29 72 65 74 75 72 6e 20 4c 3b 33 33 3d 3d 75 3f 28 45 2e 73 72 63 3d 79 2c 5a 5b 6d 70 5d 3d 79 2c 75 3d 37 39 29 3a 38 3d 3d 75 3f 28 51 28 34 32 2c 79 2c 5a 2e 58 2c 64 29 2c 75 3d 37 39 29 3a 33 38 3d 3d 75 3f 75 3d 28 78 26 35 35 29 3d 3d 78 3f 30 3a 38 32 3a 36 32 3d 3d 75 3f 75 3d 22 6e 75 6d 62 65 72 22 21 3d 3d 74 Data Ascii: y,d),u=79;else if(94==u)u=12;else if(43==u)u=38;else if(4==u)u=E.Ig==p?33:79;else if(16==u)Z=d.src,u=77;else if(77==u)u=Z&&Z[EQ]?8:92;else{if(79==u)return L;33==u?(E.src=y,Z[mp]=y,u=79):8==u?(Q(42,y,Z.X,d),u=79):38==u?u=(x&55)==x?0:82:62==u?u="number"!==t
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 73 2e 6e 2c 74 68 69 73 2e 53 5b 74 68 69 73 2e 53 2e 6c 65 6e 67 74 68 3e 3e 31 5d 5d 29 2c 5a 3d 35 31 3b 65 6c 73 65 20 69 66 28 37 31 3d 3d 5a 29 5a 3d 36 30 3b 65 6c 73 65 20 69 66 28 31 38 3d 3d 5a 29 45 3d 53 2c 5a 3d 35 3b 65 6c 73 65 20 69 66 28 32 37 3d 3d 5a 29 79 3d 77 69 6e 64 6f 77 2e 62 74 6f 61 2c 5a 3d 37 3b 65 6c 73 65 20 69 66 28 37 34 3d 3d 5a 29 5a 3d 28 74 2b 38 5e 33 32 29 3c 74 26 26 28 74 2d 33 5e 32 38 29 3e 3d 74 3f 39 30 3a 38 30 3b 65 6c 73 65 20 69 66 28 38 32 3d 3d 5a 29 5a 3d 64 3c 78 2e 6c 65 6e 67 74 68 3f 39 3a 34 3b 65 6c 73 65 20 69 66 28 38 30 3d 3d 5a 29 72 65 74 75 72 6e 20 45 7d 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 78 2c 70 2c 79 2c 64 2c 53 2c 5a 2c 45 2c 4a 2c 75 2c 4c 29 7b 66 6f 72 28 75 3d 36 30 3b 35 31 Data Ascii: s.n,this.S[this.S.length>>1]]),Z=51;else if(71==Z)Z=60;else if(18==Z)E=S,Z=5;else if(27==Z)y=window.btoa,Z=7;else if(74==Z)Z=(t+8^32)<t&&(t-3^28)>=t?90:80;else if(82==Z)Z=d<x.length?9:4;else if(80==Z)return E},P=function(t,x,p,y,d,S,Z,E,J,u,L){for(u=60;51
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 72 28 68 3d 33 37 3b 32 39 21 3d 68 3b 29 69 66 28 33 37 3d 3d 68 29 68 3d 35 36 3b 65 6c 73 65 20 69 66 28 35 36 3d 3d 68 29 68 3d 28 74 26 31 39 29 3d 3d 74 3f 35 31 3a 32 31 3b 65 6c 73 65 7b 69 66 28 36 34 3d 3d 68 29 72 65 74 75 72 6e 20 47 3b 69 66 28 36 37 3d 3d 68 29 74 68 69 73 5b 74 68 69 73 2b 22 22 5d 3d 74 68 69 73 2c 68 3d 38 31 3b 65 6c 73 65 20 69 66 28 38 31 3d 3d 68 29 68 3d 32 3c 3d 28 74 7c 36 29 3e 3e 34 26 26 33 3e 74 2d 34 3e 3e 35 3f 38 32 3a 36 34 3b 65 6c 73 65 20 69 66 28 38 32 3d 3d 68 29 7b 69 66 28 49 3d 70 2e 58 2e 76 5b 53 74 72 69 6e 67 28 79 29 5d 29 7b 66 6f 72 28 4c 3d 28 49 3d 49 2e 63 6f 6e 63 61 74 28 29 2c 30 29 2c 75 3d 78 3b 4c 3c 49 2e 6c 65 6e 67 74 68 3b 2b 2b 4c 29 28 4a 3d 49 5b 4c 5d 29 26 26 21 4a 2e 4e 70 Data Ascii: r(h=37;29!=h;)if(37==h)h=56;else if(56==h)h=(t&19)==t?51:21;else{if(64==h)return G;if(67==h)this[this+""]=this,h=81;else if(81==h)h=2<=(t\|6)>>4&&3>t-4>>5?82:64;else if(82==h){if(I=p.X.v[String(y)]){for(L=(I=I.concat(),0),u=x;L<I.length;++L)(J=I[L])&&!J.Np
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 49 29 43 28 70 2c 78 2c 74 29 2c 74 5b 62 64 5d 3d 32 37 39 36 2c 49 3d 36 32 3b 65 6c 73 65 20 69 66 28 37 3d 3d 49 29 73 51 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 2c 49 3d 37 34 3b 65 6c 73 65 20 69 66 28 37 35 3d 3d 49 29 49 3d 35 35 3b 65 6c 73 65 20 69 66 28 37 30 3d 3d 49 29 75 3d 53 2e 43 2c 75 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 58 28 38 2c 53 2c 78 2c 32 35 2c 32 35 34 2c 78 29 7d 29 2c 49 3d 34 39 3b 65 6c 73 65 20 69 66 28 34 32 3d 3d 49 29 49 3d 31 3e 28 79 2b 31 26 38 29 26 26 31 3c 3d 28 79 5e 32 36 29 3e 3e 33 3f 38 33 3a 38 34 3b 65 6c 73 65 20 69 66 28 35 35 3d 3d 49 29 49 3d 53 2e 4c 2e 6c 65 6e 67 74 68 3f 39 34 3a 34 39 3b 65 6c 73 65 20 69 66 28 33 36 3d 3d 49 29 74 68 69 73 2e 4f 3d 5a 2c 49 3d 34 32 3b 65 6c 73 65 20 69 66 28 39 Data Ascii: I)C(p,x,t),t[bd]=2796,I=62;else if(7==I)sQ.call(this,t),I=74;else if(75==I)I=55;else if(70==I)u=S.C,u(function(){cX(8,S,x,25,254,x)}),I=49;else if(42==I)I=1>(y+1&8)&&1<=(y^26)>>3?83:84;else if(55==I)I=S.L.length?94:49;else if(36==I)this.O=Z,I=42;else if(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.4	50316	142.251.40.118	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:55 UTC	557	OUT	GET /vi/Yo9K67ixJ10/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB_gmAAtAFigIMCAAQARhyIEsoRjAP&rs=AOn4CLCJxsQZZEuXR5yZ_WuQyU6IJ0kWWQ HTTP/1.1 Host: i.ytimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:55 UTC	654	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Timing-Allow-Origin: * Content-Length: 1880 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 22 Feb 2024 12:07:55 GMT Expires: Thu, 22 Feb 2024 14:07:55 GMT Cache-Control: public, max-age=7200 ETag: "1631533074" Content-Type: image/jpeg Vary: Origin Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:55 UTC	598	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 08 06 06 10 11 11 13 0f 10 11 13 10 13 12 15 11 0f 12 13 12 0f 10 12 10 15 16 12 12 16 15 11 10 11 13 17 18 22 1b 15 1d 20 17 11 10 1d 2b 1d 20 24 25 28 28 28 17 1b 30 3d 2c 26 30 2e 27 34 30 01 09 09 09 0d 0c 0d 16 0d 0e 0e 27 21 1b 1d 32 32 32 27 27 32 30 32 27 32 28 32 32 27 26 26 32 26 26 32 26 32 32 26 26 28 26 32 26 26 26 2a 32 26 26 26 26 26 26 26 26 26 26 32 32 26 26 26 26 26 ff c0 00 11 08 00 5a 00 78 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 00 03 04 05 06 07 02 01 08 ff c4 00 42 10 00 01 03 01 05 03 06 0a 08 05 05 00 00 00 00 00 01 00 02 11 03 04 05 12 21 31 41 51 d3 07 22 54 61 71 81 13 17 18 32 91 93 94 a1 b1 c1 14 23 Data Ascii: JFIF" + $%(((0=,&0.'40'!222''202'2(22'&&2&&2&22&&(&2&&&*2&&&&&&&&&&22&&&&&Zx"B!1AQ"Taq2#
2024-02-22 12:07:55 UTC	1252	IN	Data Raw: 99 4a 5a de 7b f4 89 e6 b7 f1 1f 92 85 ba ae 73 58 f8 47 c8 6c c9 d8 5e 76 c7 ea bb b9 ae 32 f8 a9 54 43 75 0d d0 bb b7 70 56 a0 00 c8 08 03 21 10 80 a7 45 ad c9 ad 02 34 c8 04 a4 a4 e4 ee f7 85 d4 a0 ea 57 92 9a d4 b5 b5 a6 0c ed ce 32 cb 50 37 c2 8d bd 6f 6a 94 de 29 d3 66 32 40 76 d2 73 27 28 1b f0 9c d5 c7 1f 6e 23 39 65 a8 9d 94 4a 63 65 b7 63 a6 d7 96 96 97 64 5b a4 1c e4 67 1b 92 ec ab b2 08 3a 8d b9 7e fe 4a 6b 5c 35 29 79 44 ae 31 21 07 16 8a 21 e2 14 55 6b 23 9a 24 e9 bd 4c 48 5c d4 60 70 82 82 05 c7 23 d8 50 9c da ac 58 41 33 fa e8 50 82 8f 67 3f 00 ac b7 2d d4 d2 05 5a b1 06 30 b7 e0 5d fa 2a b5 07 69 d9 f2 56 6b 1d e0 c0 c6 37 3c 9a d1 e6 98 d1 05 a3 c2 8d e1 7b e1 86 f0 a1 d8 f0 5a 0f 6f c2 7e 4b 87 55 00 eb d4 82 6f c3 37 78 f4 a4 eb 5b 29 Data Ascii: JZ{sXGl^v2TCupV!E4W2P7oj)f2@vs'(n#9eJcecd[g:~Jk\5)yD1!!Uk#$LH\`p#PXA3Pg?-Z0]*iVk7<{Zo~KUo7x[)
2024-02-22 12:07:55 UTC	30	IN	Data Raw: 86 84 1f 30 a1 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 40 21 08 41 ff d9 Data Ascii: 0@!@!@!@!@!@!@!A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.4	50319	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:56 UTC	643	OUT	GET /generate_204?HTGzYg HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:57 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Thu, 22 Feb 2024 12:07:56 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.4	50324	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:57 UTC	1199	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive Content-Length: 6568 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-YouTube-Ad-Signals: dt=1708603672192&flash=0&frm=2&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C0%2C0&vis=1&wgl=true&ca_type=image sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Goog-Request-Time: 1708603676190 Content-Type: application/json X-YouTube-Utc-Offset: 60 X-YouTube-Client-Name: 56 X-YouTube-Client-Version: 1.20240219.00.00 X-YouTube-Time-Zone: Europe/Zurich X-Goog-Visitor-Id: Cgt3cXRNM0VwcUZ1SSiX8tyuBjIKCgJVUxIEGgAgWA%3D%3D sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube-nocookie.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:57 UTC	6568	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 63 6c 69 65 6e 74 4e 61 6d 65 22 3a 35 36 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 32 30 32 34 30 32 31 39 2e 30 30 2e 30 30 22 2c 22 63 6f 6e 66 69 67 49 6e 66 6f 22 3a 7b 22 61 70 70 49 6e 73 74 61 6c 6c 44 61 74 61 22 3a 22 43 4a 66 79 33 4b 34 47 45 4b 57 51 73 41 55 51 73 4c 4b 77 42 52 43 33 37 36 38 46 45 4b 61 42 73 41 55 51 76 5a 6d 77 42 52 44 51 6a 62 41 46 45 4e 57 49 73 41 55 51 71 6f 33 5f 45 68 43 51 73 72 41 46 45 4d 79 75 5f 68 49 51 37 72 4f 77 42 52 44 39 74 72 41 46 45 4f 48 79 72 77 55 51 6f 70 4b 77 42 52 44 38 68 62 41 46 45 4b 69 61 73 41 55 51 75 4b 71 77 42 52 43 2d 2d 61 38 46 45 4d Data Ascii: {"context":{"client":{"hl":"en","gl":"US","clientName":56,"clientVersion":"1.20240219.00.00","configInfo":{"appInstallData":"CJfy3K4GEKWQsAUQsLKwBRC3768FEKaBsAUQvZmwBRDQjbAFENWIsAUQqo3_EhCQsrAFEMyu_hIQ7rOwBRD9trAFEOHyrwUQopKwBRD8hbAFEKiasAUQuKqwBRC--a8FEM
2024-02-22 12:07:57 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Thu, 22 Feb 2024 12:07:57 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:07:57 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-02-22 12:07:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.4	50326	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:58 UTC	2185	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgQWJvdXQgdXMgfCBBYm91dCBBVkFTVCBTb2Z0d2FyZSIsInBhZ2VfdXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjc2NzgxIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsIndlYnNpdGVJZCI6IDgyMzIwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICIyZGVkLTFiMTMtNjE2MS05ZGY1LTU3NjAtNjljMC03MmI3LWYxZjYiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTcwODYwMzY3Njc3OSIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyNzM3LCJrYW1weWxlX3ZlcnNpb24iOiAiMi41Mi4wIiwib25zaXRlX3ZlcnNpb24iOiAiMi41Mi4wIiwiaGlzdG9yeV9sZW5ndGgiOiAxLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNzA4NjAzNjc2NzgxLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0= HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.avast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:58 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:58 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-cg9l X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.4	50327	142.250.65.206	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:58 UTC	422	OUT	GET /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:58 UTC	240	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1609 Date: Thu, 22 Feb 2024 12:07:58 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:07:58 UTC	1012	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px aria
2024-02-22 12:07:58 UTC	597	IN	Data Raw: 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 Data Ascii: gle.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-backgrou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.4	50328	35.241.45.82	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:07:58 UTC	1952	OUT	GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJXaW4zMiIsInBhZ2VfdGl0bGUiOiAiQXZhc3QgQWJvdXQgdXMgfCBBYm91dCBBVkFTVCBTb2Z0d2FyZSIsInBhZ2VfdXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNzA4NjAzNjc2NzgxIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxOGRkMGI2MTdiZjM5Ny0wMWQzNWJkM2NlOTA3ZC0yNjAzMWU1MS0xNDAwMDAtMThkZDBiNjE3YzA5MWMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtZXUiLCJhY2NvdW50SWQiOiA4MjMxOCwidXJsIjogImh0dHBzOi8vd3d3LmF2YXN0LmNvbS9lbi11cy9hYm91dCNwYyIsIndlYnNpdGVJZCI6IDgyMzIwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICIyZGVkLTFiMTMtNjE2MS05ZGY1LTU3NjAtNjljMC03MmI3LWYxZjYiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTcwODYwMzY3Njc3OSIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyNzM3LCJrYW1weWxlX3ZlcnNpb24iOiAiMi41Mi4wIiwib25zaXRlX3ZlcnNpb24iOiAiMi41Mi4wIiwiaGlzdG9yeV9sZW5ndGgiOiAxLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNzA4NjAzNjc2NzgxLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0= HTTP/1.1 Host: udc-neb.kampyle.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:07:58 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 22 Feb 2024 12:07:58 GMT Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept Access-Control-Max-Age: 1800 X-ME: prod-instance-gatewayservice-green-4gj8 X-Application-Context: application:9090 Content-Type: image/gif; charset=UTF-8 Content-Length: 0 Server: Jetty(9.2.11.v20150529) Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.4	50333	142.251.40.238	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:00 UTC	1199	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive Content-Length: 1249 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-YouTube-Ad-Signals: dt=1708603672773&flash=0&frm=2&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C0%2C0&vis=1&wgl=true&ca_type=image sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Goog-Request-Time: 1708603679174 Content-Type: application/json X-YouTube-Utc-Offset: 60 X-YouTube-Client-Name: 56 X-YouTube-Client-Version: 1.20240219.00.00 X-YouTube-Time-Zone: Europe/Zurich X-Goog-Visitor-Id: Cgt3cXRNM0VwcUZ1SSiX8tyuBjIKCgJVUxIEGgAgWA%3D%3D sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube-nocookie.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube-nocookie.com/embed/Yo9K67ixJ10?enablejsapi=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:08:00 UTC	1249	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 63 6c 69 65 6e 74 4e 61 6d 65 22 3a 35 36 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 32 30 32 34 30 32 31 39 2e 30 30 2e 30 30 22 2c 22 63 6f 6e 66 69 67 49 6e 66 6f 22 3a 7b 22 61 70 70 49 6e 73 74 61 6c 6c 44 61 74 61 22 3a 22 43 4a 66 79 33 4b 34 47 45 4b 57 51 73 41 55 51 73 4c 4b 77 42 52 43 33 37 36 38 46 45 4b 61 42 73 41 55 51 76 5a 6d 77 42 52 44 51 6a 62 41 46 45 4e 57 49 73 41 55 51 71 6f 33 5f 45 68 43 51 73 72 41 46 45 4d 79 75 5f 68 49 51 37 72 4f 77 42 52 44 39 74 72 41 46 45 4f 48 79 72 77 55 51 6f 70 4b 77 42 52 44 38 68 62 41 46 45 4b 69 61 73 41 55 51 75 4b 71 77 42 52 43 2d 2d 61 38 46 45 4d Data Ascii: {"context":{"client":{"hl":"en","gl":"US","clientName":56,"clientVersion":"1.20240219.00.00","configInfo":{"appInstallData":"CJfy3K4GEKWQsAUQsLKwBRC3768FEKaBsAUQvZmwBRDQjbAFENWIsAUQqo3_EhCQsrAFEMyu_hIQ7rOwBRD9trAFEOHyrwUQopKwBRD8hbAFEKiasAUQuKqwBRC--a8FEM
2024-02-22 12:08:00 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Thu, 22 Feb 2024 12:08:00 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-22 12:08:00 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-02-22 12:08:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.4	50334	142.250.65.206	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:00 UTC	422	OUT	GET /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube-nocookie.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-22 12:08:01 UTC	240	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1609 Date: Thu, 22 Feb 2024 12:08:01 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:08:01 UTC	1012	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px aria
2024-02-22 12:08:01 UTC	597	IN	Data Raw: 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 Data Ascii: gle.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-backgrou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.4	50337	34.117.223.223	443	2848	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:04 UTC	175	OUT	POST /v4/receive/json/70 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Avast SimpleHttp/3.0 Content-Length: 602 Host: analytics.avcdn.net
2024-02-22 12:08:04 UTC	602	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 30 38 36 31 30 38 33 30 36 36 33 2c 22 74 79 70 65 22 3a 37 30 7d 2c 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 67 75 69 64 22 3a 22 65 36 31 64 31 66 63 31 2d 34 39 61 31 2d 34 62 36 36 2d 61 64 30 66 2d 33 66 63 32 62 38 34 37 64 61 30 65 22 2c 22 68 77 69 64 22 3a 22 33 46 35 43 37 43 44 34 34 44 31 46 36 41 43 37 36 39 39 33 34 43 41 44 41 32 36 37 42 34 44 46 43 37 37 37 37 30 35 44 37 32 46 35 38 35 32 33 46 46 38 42 33 39 30 45 35 43 43 39 30 33 35 42 22 7d 2c 22 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 22 3a 7b 22 61 69 69 64 22 3a 22 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 22 7d 2c 22 69 6e 73 74 75 70 22 3a Data Ascii: {"record":[{"event":{"subtype":1,"time":1708610830663,"type":70},"identity":{"guid":"e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e","hwid":"3F5C7CD44D1F6AC769934CADA267B4DFC777705D72F58523FF8B390E5CC9035B"},"installation":{"aiid":"mmm_ava_esg_000_361_m"},"instup":
2024-02-22 12:08:04 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:08:04 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:08:04 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.4	50336	34.117.223.223	443	2848	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:04 UTC	217	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats Content-MD5: FKwp8DVvw+oGNTetJ9p1zQ== User-Agent: Avast SimpleHttp/3.0 Content-Length: 391 Host: v7event.stats.avast.com
2024-02-22 12:08:04 UTC	391	OUT	Data Raw: 53 66 78 43 72 65 61 74 65 64 3d 31 37 30 38 36 30 33 36 37 38 0a 53 66 78 4e 61 6d 65 3d 61 76 61 73 74 5f 66 72 65 65 5f 61 6e 74 69 76 69 72 75 73 5f 73 65 74 75 70 5f 6f 6e 6c 69 6e 65 5f 78 36 34 2e 65 78 65 0a 53 66 78 53 69 7a 65 3d 31 30 37 30 30 35 32 38 0a 53 66 78 56 65 72 73 69 6f 6e 3d 32 34 2e 31 2e 38 38 32 31 2e 30 0a 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 0a 65 64 69 74 69 6f 6e 3d 31 0a 65 76 65 6e 74 3d 73 74 75 62 0a 67 75 69 64 3d 65 36 31 64 31 66 63 31 2d 34 39 61 31 2d 34 62 36 36 2d 61 64 30 66 2d 33 66 63 32 62 38 34 37 64 61 30 65 0a 6d 69 64 65 78 3d 33 66 35 63 37 63 64 34 34 64 31 66 36 61 63 37 36 39 39 33 34 63 61 64 61 32 36 37 62 34 64 66 63 37 37 37 37 30 35 64 37 32 66 35 38 Data Ascii: SfxCreated=1708603678SfxName=avast_free_antivirus_setup_online_x64.exeSfxSize=10700528SfxVersion=24.1.8821.0cookie=mmm_ava_esg_000_361_medition=1event=stubguid=e61d1fc1-49a1-4b66-ad0f-3fc2b847da0emidex=3f5c7cd44d1f6ac769934cada267b4dfc777705d72f58
2024-02-22 12:08:04 UTC	172	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 22 Feb 2024 12:08:04 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.4	50338	34.117.223.223	443	2848	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:05 UTC	217	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats Content-MD5: FKwp8DVvw+oGNTetJ9p1zQ== User-Agent: Avast SimpleHttp/3.0 Content-Length: 391 Host: v7event.stats.avast.com
2024-02-22 12:08:05 UTC	391	OUT	Data Raw: 53 66 78 43 72 65 61 74 65 64 3d 31 37 30 38 36 30 33 36 37 38 0a 53 66 78 4e 61 6d 65 3d 61 76 61 73 74 5f 66 72 65 65 5f 61 6e 74 69 76 69 72 75 73 5f 73 65 74 75 70 5f 6f 6e 6c 69 6e 65 5f 78 36 34 2e 65 78 65 0a 53 66 78 53 69 7a 65 3d 31 30 37 30 30 35 32 38 0a 53 66 78 56 65 72 73 69 6f 6e 3d 32 34 2e 31 2e 38 38 32 31 2e 30 0a 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 0a 65 64 69 74 69 6f 6e 3d 31 0a 65 76 65 6e 74 3d 73 74 75 62 0a 67 75 69 64 3d 65 36 31 64 31 66 63 31 2d 34 39 61 31 2d 34 62 36 36 2d 61 64 30 66 2d 33 66 63 32 62 38 34 37 64 61 30 65 0a 6d 69 64 65 78 3d 33 66 35 63 37 63 64 34 34 64 31 66 36 61 63 37 36 39 39 33 34 63 61 64 61 32 36 37 62 34 64 66 63 37 37 37 37 30 35 64 37 32 66 35 38 Data Ascii: SfxCreated=1708603678SfxName=avast_free_antivirus_setup_online_x64.exeSfxSize=10700528SfxVersion=24.1.8821.0cookie=mmm_ava_esg_000_361_medition=1event=stubguid=e61d1fc1-49a1-4b66-ad0f-3fc2b847da0emidex=3f5c7cd44d1f6ac769934cada267b4dfc777705d72f58
2024-02-22 12:08:05 UTC	172	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 22 Feb 2024 12:08:05 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.4	50339	34.117.223.223	443	2848	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:06 UTC	217	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats Content-MD5: FKwp8DVvw+oGNTetJ9p1zQ== User-Agent: Avast SimpleHttp/3.0 Content-Length: 391 Host: v7event.stats.avast.com
2024-02-22 12:08:06 UTC	391	OUT	Data Raw: 53 66 78 43 72 65 61 74 65 64 3d 31 37 30 38 36 30 33 36 37 38 0a 53 66 78 4e 61 6d 65 3d 61 76 61 73 74 5f 66 72 65 65 5f 61 6e 74 69 76 69 72 75 73 5f 73 65 74 75 70 5f 6f 6e 6c 69 6e 65 5f 78 36 34 2e 65 78 65 0a 53 66 78 53 69 7a 65 3d 31 30 37 30 30 35 32 38 0a 53 66 78 56 65 72 73 69 6f 6e 3d 32 34 2e 31 2e 38 38 32 31 2e 30 0a 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 61 76 61 5f 65 73 67 5f 30 30 30 5f 33 36 31 5f 6d 0a 65 64 69 74 69 6f 6e 3d 31 0a 65 76 65 6e 74 3d 73 74 75 62 0a 67 75 69 64 3d 65 36 31 64 31 66 63 31 2d 34 39 61 31 2d 34 62 36 36 2d 61 64 30 66 2d 33 66 63 32 62 38 34 37 64 61 30 65 0a 6d 69 64 65 78 3d 33 66 35 63 37 63 64 34 34 64 31 66 36 61 63 37 36 39 39 33 34 63 61 64 61 32 36 37 62 34 64 66 63 37 37 37 37 30 35 64 37 32 66 35 38 Data Ascii: SfxCreated=1708603678SfxName=avast_free_antivirus_setup_online_x64.exeSfxSize=10700528SfxVersion=24.1.8821.0cookie=mmm_ava_esg_000_361_medition=1event=stubguid=e61d1fc1-49a1-4b66-ad0f-3fc2b847da0emidex=3f5c7cd44d1f6ac769934cada267b4dfc777705d72f58
2024-02-22 12:08:06 UTC	172	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 22 Feb 2024 12:08:06 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.4	50340	34.160.176.28	443	1436	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:06 UTC	171	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Host: shepherd.ff.avast.com User-Agent: Avast Antivirus Content-Length: 271
2024-02-22 12:08:06 UTC	271	OUT	Data Raw: 64 61 74 61 3d 43 41 41 51 25 32 46 25 32 46 25 32 46 25 32 46 25 32 46 77 38 59 25 32 46 25 32 46 25 32 46 25 32 46 25 32 46 77 38 67 25 32 46 25 32 46 25 32 46 25 32 46 25 32 46 77 38 71 46 57 31 74 62 56 39 68 64 6d 46 66 5a 58 4e 6e 58 7a 41 77 4d 46 38 7a 4e 6a 46 66 62 57 49 43 43 67 43 49 41 51 44 4b 41 79 52 6c 4e 6a 46 6b 4d 57 5a 6a 4d 53 30 30 4f 57 45 78 4c 54 52 69 4e 6a 59 74 59 57 51 77 5a 69 30 7a 5a 6d 4d 79 59 6a 67 30 4e 32 52 68 4d 47 58 79 41 77 51 34 4d 54 6b 78 67 67 6c 41 4d 30 59 31 51 7a 64 44 52 44 51 30 52 44 46 47 4e 6b 46 44 4e 7a 59 35 4f 54 4d 30 51 30 46 45 51 54 49 32 4e 30 49 30 52 45 5a 44 4e 7a 63 33 4e 7a 41 31 52 44 63 79 52 6a 55 34 4e 54 49 7a 52 6b 59 34 51 6a 4d 35 4d 45 55 31 51 30 4d 35 4d 44 4d 31 51 74 6f 54 Data Ascii: data=CAAQ%2F%2F%2F%2F%2Fw8Y%2F%2F%2F%2F%2Fw8g%2F%2F%2F%2F%2Fw8qFW1tbV9hdmFfZXNnXzAwMF8zNjFfbWICCgCIAQDKAyRlNjFkMWZjMS00OWExLTRiNjYtYWQwZi0zZmMyYjg0N2RhMGXyAwQ4MTkxgglAM0Y1QzdDRDQ0RDFGNkFDNzY5OTM0Q0FEQTI2N0I0REZDNzc3NzA1RDcyRjU4NTIzRkY4QjM5MEU1Q0M5MDM1QtoT
2024-02-22 12:08:06 UTC	1525	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Feb 2024 12:08:06 GMT Content-Type: text/plain Content-Length: 29411 AB-Tests: 49afa038-20e4-4cff-b058-f7c69b5a850d:A,oa-7466-v0:b,oa-7675:a,oa-7794-fake:b Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread Config-Id: 5 Config-Name: Avast-Windows-AV-Consumer_websocket-testing_ipm_6363_chrome_offer_setup_free_free_production-new-installs_version-18.6-and-higher_production_quic-sni-block-release-stage-2_v2017_hns-pre-scan-enabled-countries_noomnianda1_phone-support-tile_avast-18-r7-and-18-r8_fs-and-idp-integration_cef-settings-off_opening-browser-onboarding_old-smartscan_usa_ipm_6513_open_ui_a_test-akamai_test-pam-no-master-password_v18.5-and-higher_cleanup-premium-installation_release---iavs9x-only_version-19.1-and-older-00efc01802d47c827a25b91051dcba6a647e6b1e1da5eeb7b0ad527e0b44f2b6 Config-Version: 4902 Segments: websocket testing,ipm_6363_chrome_offer_setup_free,free,production new installs,version 18.6 and higher,production,quic sni block release stage 2,v2017,hns pre-scan enabled countries,noomnianda1,phone support tile,avast 18 r7 and 18 r8,fs and idp integration,cef settings off,opening browser onboarding,old smartscan,usa,ipm_6513_open_ui_a,test akamai,test pam no master password,v18.5 and higher,cleanup premium installation,release - iavs9x only,version 19.1 and older TTL: 86400 TTL-Spread: 43200 Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-22 12:08:06 UTC	1252	IN	Data Raw: 5b 52 65 6d 6f 74 65 41 63 63 65 73 73 53 68 69 65 6c 64 2e 53 65 74 74 69 6e 67 5d 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 44 61 79 3d 36 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 48 6f 75 72 3d 34 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 4d 69 6e 75 74 65 3d 33 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 54 65 6e 53 65 63 6f 6e 64 73 3d 31 32 0d 0a 5b 42 72 65 61 63 68 47 75 61 72 64 5d 0d 0a 45 6e 61 62 6c 65 64 3d 30 0d 0a 5b 57 65 62 53 68 69 65 6c 64 2e 57 65 62 53 6f 63 6b 65 74 5d 0d 0a 45 6e 61 62 6c 65 64 3d 31 0d 0a 5b 53 65 74 74 69 6e 67 73 2e 55 73 65 72 49 6e 74 65 72 66 61 63 65 5d 0d 0a Data Ascii: [RemoteAccessShield.Setting]BruteForceMaxAttemptsPerDay=60BruteForceMaxAttemptsPerHour=40BruteForceMaxAttemptsPerMinute=30BruteForceMaxAttemptsPerTenSeconds=12[BreachGuard]Enabled=0[WebShield.WebSocket]Enabled=1[Settings.UserInterface]
2024-02-22 12:08:06 UTC	1252	IN	Data Raw: 63 6c 65 61 6e 65 72 2e 63 6f 6d 2c 70 69 72 69 66 6f 72 6d 2e 63 6f 6d 2c 61 76 61 73 74 2e 63 6f 6d 2c 61 76 67 2e 63 6f 6d 2c 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2c 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2c 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 54 53 6b 69 70 70 65 64 49 6e 6a 45 78 74 3d 2d 0d 0a 41 54 53 6b 69 70 70 65 64 4f 62 73 45 78 74 3d 2d 0d 0a 44 6f 68 45 6e 61 62 6c 65 64 3d 31 0d 0a 44 6f 68 4d 6f 64 65 3d 33 0d 0a 44 6f 68 53 79 73 74 65 6d 45 6e 61 62 6c 65 64 3d 31 0d 0a 50 69 6e 6e 69 6e 67 3d 30 0d 0a 5b 4f 50 4d 5d 0d 0a 64 65 66 5f 62 61 73 65 3d 65 79 4a 44 59 57 31 77 59 57 6c 6e 62 6b 52 6c 5a 6d 6c 75 61 58 52 70 62 32 35 7a 49 6a 70 37 49 6c 5a 6c 63 6e 4e 70 62 32 34 69 4f 69 49 78 49 69 77 69 51 32 46 74 63 47 46 70 5a 32 35 7a 49 Data Ascii: cleaner.com,piriform.com,avast.com,avg.com,facebook.com,booking.com,google.comATSkippedInjExt=-ATSkippedObsExt=-DohEnabled=1DohMode=3DohSystemEnabled=1Pinning=0[OPM]def_base=eyJDYW1wYWlnbkRlZmluaXRpb25zIjp7IlZlcnNpb24iOiIxIiwiQ2FtcGFpZ25zI
2024-02-22 12:08:06 UTC	1252	IN	Data Raw: 55 69 4f 69 4a 77 58 32 56 73 62 53 4a 39 58 58 30 73 49 6e 42 79 61 57 39 79 61 58 52 35 49 6a 6f 78 4d 6a 41 77 66 53 78 37 49 6d 6c 6b 49 6a 6f 69 51 30 78 50 55 30 56 66 54 30 5a 47 52 56 4a 66 52 56 5a 46 54 6c 52 66 56 45 56 54 56 46 39 50 52 6b 5a 66 56 6b 46 53 53 55 46 4f 56 46 39 43 49 69 77 69 63 47 78 68 59 32 56 74 5a 57 35 30 49 6a 6f 69 63 47 39 77 64 58 41 69 4c 43 4a 6c 62 47 56 74 5a 57 35 30 49 6a 6f 7a 4e 7a 59 73 49 6d 39 77 64 47 6c 76 62 6e 4d 69 4f 6e 73 69 62 47 46 31 62 6d 4e 6f 54 33 42 30 61 57 39 75 49 6a 70 37 49 6d 46 31 64 47 39 4a 62 6d 4e 79 5a 57 31 6c 62 6e 52 4e 63 32 64 54 61 47 39 33 62 69 49 36 64 48 4a 31 5a 53 77 69 63 6d 56 77 5a 57 46 30 5a 58 49 69 4f 6e 73 69 64 48 4a 35 51 57 64 68 61 57 35 42 5a 6e 52 6c 63 Data Ascii: UiOiJwX2VsbSJ9XX0sInByaW9yaXR5IjoxMjAwfSx7ImlkIjoiQ0xPU0VfT0ZGRVJfRVZFTlRfVEVTVF9PRkZfVkFSSUFOVF9CIiwicGxhY2VtZW50IjoicG9wdXAiLCJlbGVtZW50IjozNzYsIm9wdGlvbnMiOnsibGF1bmNoT3B0aW9uIjp7ImF1dG9JbmNyZW1lbnRNc2dTaG93biI6dHJ1ZSwicmVwZWF0ZXIiOnsidHJ5QWdhaW5BZnRlc
2024-02-22 12:08:06 UTC	340	IN	Data Raw: 52 66 56 45 56 54 56 46 39 50 52 6b 5a 66 56 6b 46 53 53 55 46 4f 56 46 39 44 49 6e 31 64 66 58 30 73 65 79 4a 70 5a 43 49 36 49 6b 46 57 51 56 4e 55 58 30 39 51 52 55 35 66 56 55 6c 66 54 30 39 66 4d 54 67 32 4d 54 45 69 4c 43 4a 77 62 47 46 6a 5a 57 31 6c 62 6e 51 69 4f 69 4a 69 62 47 46 75 61 31 39 77 62 33 42 31 63 43 49 73 49 6d 4e 76 62 6e 4e 30 63 6d 46 70 62 6e 52 7a 49 6a 70 37 49 6d 46 75 5a 43 49 36 57 33 73 69 5a 33 4a 6c 59 58 52 6c 63 53 49 36 57 33 73 69 64 6d 46 79 61 57 46 69 62 47 55 69 4f 69 4a 70 63 47 30 75 63 46 39 77 63 6d 38 69 66 53 77 77 58 58 30 73 65 79 4a 73 5a 58 4e 7a 5a 58 45 69 4f 6c 74 37 49 6e 5a 68 63 6d 6c 68 59 6d 78 6c 49 6a 6f 69 61 58 42 74 4c 6e 42 66 63 48 4a 76 49 6e 30 73 4d 31 31 39 4c 48 73 69 62 47 56 7a 63 Data Ascii: RfVEVTVF9PRkZfVkFSSUFOVF9DIn1dfX0seyJpZCI6IkFWQVNUX09QRU5fVUlfT09fMTg2MTEiLCJwbGFjZW1lbnQiOiJibGFua19wb3B1cCIsImNvbnN0cmFpbnRzIjp7ImFuZCI6W3siZ3JlYXRlcSI6W3sidmFyaWFibGUiOiJpcG0ucF9wcm8ifSwwXX0seyJsZXNzZXEiOlt7InZhcmlhYmxlIjoiaXBtLnBfcHJvIn0sM119LHsibGVzc
2024-02-22 12:08:07 UTC	1252	IN	Data Raw: 42 66 62 48 4e 30 49 6e 30 73 4d 46 31 39 4c 48 73 69 5a 33 4a 6c 59 58 52 6c 63 53 49 36 57 33 73 69 64 6d 46 79 61 57 46 69 62 47 55 69 4f 69 4a 70 63 47 30 75 63 46 39 32 5a 58 41 69 66 53 77 78 4f 56 31 39 4c 48 73 69 5a 33 4a 6c 59 58 52 6c 63 53 49 36 57 33 73 69 64 6d 46 79 61 57 46 69 62 47 55 69 4f 69 4a 70 63 47 30 75 63 46 39 68 5a 32 55 69 66 53 77 78 4e 46 31 39 4c 48 73 69 5a 33 4a 6c 59 58 52 6c 63 53 49 36 57 33 73 69 64 6d 46 79 61 57 46 69 62 47 55 69 4f 69 4a 79 5a 58 42 6c 59 58 52 66 61 57 35 30 5a 58 4a 32 59 57 77 69 66 53 77 78 4e 44 51 77 58 58 30 73 65 79 4a 73 5a 58 4e 7a 49 6a 70 62 65 79 4a 32 59 58 4a 70 59 57 4a 73 5a 53 49 36 49 6e 4a 6c 63 47 56 68 64 46 39 6a 62 33 56 75 64 43 4a 39 4c 44 46 64 66 53 78 37 49 6d 56 78 64 Data Ascii: BfbHN0In0sMF19LHsiZ3JlYXRlcSI6W3sidmFyaWFibGUiOiJpcG0ucF92ZXAifSwxOV19LHsiZ3JlYXRlcSI6W3sidmFyaWFibGUiOiJpcG0ucF9hZ2UifSwxNF19LHsiZ3JlYXRlcSI6W3sidmFyaWFibGUiOiJyZXBlYXRfaW50ZXJ2YWwifSwxNDQwXX0seyJsZXNzIjpbeyJ2YXJpYWJsZSI6InJlcGVhdF9jb3VudCJ9LDFdfSx7ImVxd
2024-02-22 12:08:07 UTC	1252	IN	Data Raw: 46 69 62 47 55 69 4f 69 4a 79 5a 58 42 6c 59 58 52 66 61 57 35 30 5a 58 4a 32 59 57 77 69 66 53 77 78 4e 44 51 77 58 58 31 64 66 53 77 69 62 33 42 30 61 57 39 75 63 79 49 36 65 79 4a 73 59 58 56 75 59 32 68 50 63 48 52 70 62 32 34 69 4f 6e 73 69 59 58 56 30 62 30 6c 75 59 33 4a 6c 62 57 56 75 64 45 31 7a 5a 31 4e 6f 62 33 64 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 79 5a 58 42 6c 59 58 52 6c 63 69 49 36 65 79 4a 30 61 57 31 6c 56 47 39 4d 61 58 5a 6c 51 57 4e 30 61 58 5a 6c 54 58 4e 6e 49 6a 6f 32 4d 44 41 73 49 6e 52 79 65 55 46 6e 59 57 6c 75 51 57 5a 30 5a 58 49 69 4f 6a 4d 77 4d 48 31 39 66 53 77 69 64 58 4a 73 49 6a 70 37 49 6e 42 68 63 6d 46 74 63 79 49 36 57 33 73 69 64 6d 46 73 64 57 55 69 4f 69 49 78 49 69 77 69 62 6d 46 74 5a 53 49 36 49 6d 46 6a 64 Data Ascii: FibGUiOiJyZXBlYXRfaW50ZXJ2YWwifSwxNDQwXX1dfSwib3B0aW9ucyI6eyJsYXVuY2hPcHRpb24iOnsiYXV0b0luY3JlbWVudE1zZ1Nob3duIjp0cnVlLCJyZXBlYXRlciI6eyJ0aW1lVG9MaXZlQWN0aXZlTXNnIjo2MDAsInRyeUFnYWluQWZ0ZXIiOjMwMH19fSwidXJsIjp7InBhcmFtcyI6W3sidmFsdWUiOiIxIiwibmFtZSI6ImFjd
2024-02-22 12:08:07 UTC	1252	IN	Data Raw: 46 6a 64 47 6c 76 62 69 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 78 66 56 30 73 49 6d 56 32 59 57 78 31 59 58 52 6c 55 47 46 79 59 57 31 7a 49 6a 70 62 65 79 4a 75 59 57 31 6c 49 6a 6f 69 53 56 42 4e 58 31 56 53 54 46 39 51 51 56 4a 42 54 56 4e 66 51 55 78 4d 49 6e 31 64 66 53 77 69 63 48 4a 70 62 33 4a 70 64 48 6b 69 4f 6a 45 78 4d 44 42 39 4c 48 73 69 61 57 51 69 4f 69 4a 4f 51 55 64 66 52 56 68 51 53 56 4a 46 52 46 39 51 51 55 31 66 51 56 5a 42 55 31 51 69 4c 43 4a 77 62 47 46 6a 5a 57 31 6c 62 6e 51 69 4f 69 4a 77 62 33 42 31 63 43 49 73 49 6d 56 73 5a 57 31 6c 62 6e 51 69 4f 6a 49 33 4d 79 77 69 59 32 39 75 63 33 52 79 59 57 6c 75 64 48 4d 69 4f 6e 73 69 59 57 35 6b 49 6a 70 62 65 79 4a 6e 63 6d 56 68 64 47 56 78 49 6a 70 62 65 79 4a 32 59 58 4a 70 59 Data Ascii: FjdGlvbiIsInZhbHVlIjoxfV0sImV2YWx1YXRlUGFyYW1zIjpbeyJuYW1lIjoiSVBNX1VSTF9QQVJBTVNfQUxMIn1dfSwicHJpb3JpdHkiOjExMDB9LHsiaWQiOiJOQUdfRVhQSVJFRF9QQU1fQVZBU1QiLCJwbGFjZW1lbnQiOiJwb3B1cCIsImVsZW1lbnQiOjI3MywiY29uc3RyYWludHMiOnsiYW5kIjpbeyJncmVhdGVxIjpbeyJ2YXJpY
2024-02-22 12:08:07 UTC	1252	IN	Data Raw: 42 66 63 48 4a 76 49 6e 30 73 4d 31 31 39 4c 48 73 69 5a 33 4a 6c 59 58 52 6c 63 53 49 36 57 33 73 69 64 6d 46 79 61 57 46 69 62 47 55 69 4f 69 4a 70 63 47 30 75 63 46 39 77 62 57 78 6c 65 43 4a 39 4c 43 30 32 4d 46 31 39 4c 48 73 69 62 47 56 7a 63 32 56 78 49 6a 70 62 65 79 4a 32 59 58 4a 70 59 57 4a 73 5a 53 49 36 49 6d 6c 77 62 53 35 77 58 33 42 74 62 47 56 34 49 6e 30 73 4c 54 45 31 58 58 30 73 65 79 4a 6e 63 6d 56 68 64 47 56 78 49 6a 70 62 65 79 4a 32 59 58 4a 70 59 57 4a 73 5a 53 49 36 49 6d 6c 77 62 53 35 77 58 33 42 74 62 48 4e 30 49 6e 30 73 4d 56 31 39 4c 48 73 69 62 47 56 7a 63 32 56 78 49 6a 70 62 65 79 4a 32 59 58 4a 70 59 57 4a 73 5a 53 49 36 49 6d 6c 77 62 53 35 77 58 33 42 74 62 48 4e 30 49 6e 30 73 4d 31 31 39 4c 48 73 69 5a 33 4a 6c 59 Data Ascii: BfcHJvIn0sM119LHsiZ3JlYXRlcSI6W3sidmFyaWFibGUiOiJpcG0ucF9wbWxleCJ9LC02MF19LHsibGVzc2VxIjpbeyJ2YXJpYWJsZSI6ImlwbS5wX3BtbGV4In0sLTE1XX0seyJncmVhdGVxIjpbeyJ2YXJpYWJsZSI6ImlwbS5wX3BtbHN0In0sMV19LHsibGVzc2VxIjpbeyJ2YXJpYWJsZSI6ImlwbS5wX3BtbHN0In0sM119LHsiZ3JlY
2024-02-22 12:08:07 UTC	1252	IN	Data Raw: 66 63 62 6e 6d 61 6a 6d 6a 6d 70 6c 66 6c 61 70 61 6f 6a 6a 6e 69 68 63 6a 6b 69 67 63 6b 0d 0a 47 43 57 54 55 3d 63 68 66 64 6e 65 63 69 68 70 68 6d 68 6c 6a 61 61 65 6a 6d 67 6f 69 61 68 6e 69 68 70 6c 67 6e 0d 0a 47 43 57 54 55 33 3d 6c 6b 6d 64 6f 63 70 62 6e 62 6c 63 68 70 70 65 63 69 63 6b 62 69 70 69 68 6c 6b 65 68 64 66 67 0d 0a 49 45 41 4f 53 3d 38 45 35 45 32 36 35 34 2d 41 44 32 44 2d 34 38 62 66 2d 41 43 32 44 2d 44 31 37 46 30 30 38 39 38 44 30 36 0d 0a 49 45 50 41 4d 3d 30 41 34 45 34 37 34 38 2d 35 46 45 43 2d 34 30 39 38 2d 38 38 46 41 2d 30 38 30 46 31 31 46 46 37 42 39 32 0d 0a 49 45 57 54 55 3d 39 35 42 37 37 35 39 43 2d 38 43 37 46 2d 34 42 46 31 2d 42 31 36 33 2d 37 33 36 38 34 41 39 33 33 32 33 33 0d 0a 5b 49 6e 73 74 75 70 2e 44 69 Data Ascii: fcbnmajmjmplflapaojjnihcjkigckGCWTU=chfdnecihphmhljaaejmgoiahnihplgnGCWTU3=lkmdocpbnblchppecickbipihlkehdfgIEAOS=8E5E2654-AD2D-48bf-AC2D-D17F00898D06IEPAM=0A4E4748-5FEC-4098-88FA-080F11FF7B92IEWTU=95B7759C-8C7F-4BF1-B163-73684A933233[Instup.Di

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.4	50341	142.251.40.174	443	2640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-22 12:08:08 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000DBAD2D9667 HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-02-22 12:08:09 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-tinjoTL-Rf6ZOKdv4sfH-g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-EVaLEsYJOOSAAhXVpqU7rw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Thu, 22 Feb 2024 12:08:09 GMT Expires: Thu, 22 Feb 2024 12:08:09 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-22 12:08:09 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 37 30 65 61 35 65 61 35 0a Data Ascii: rlzC1: 1C1ONGR_enUS1098rlzC2: 1C2ONGR_enUS1098rlzC7: 1C7ONGR_enUS1098dcc: set_dcc: C1:1C1ONGR_enUS1098,C2:1C2ONGR_enUS1098,C7:1C7ONGR_enUS1098events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 70ea5ea5

Target ID:	0
Start time:	13:06:34
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:06:37
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:06:39
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:06:59
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:07:55
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5712 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:07:55
Start date:	22/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 --field-trial-handle=1992,i,5843430262848186460,7299264639848076756,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:07:58
Start date:	22/02/2024
Path:	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
Imagebase:	0x300000
File size:	264'088 bytes
MD5 hash:	21B56ABF76225D8337BD397FF6C75B51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:08:00
Start date:	22/02/2024
Path:	C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Temp\asw.5ce619ffd386e95f\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f
Imagebase:	0x7ff751b70000
File size:	10'700'528 bytes
MD5 hash:	3BA1265F701C2D4A6EDEC89270D18B2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:08:04
Start date:	22/02/2024
Path:	C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Temp\asw.00abf38d93c5fa0f\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.00abf38d93c5fa0f /edition:1 /prod:ais /stub_mapping_guid:c3232637-a4b1-4fca-9573-d868610fc601:10700528 /guid:e61d1fc1-49a1-4b66-ad0f-3fc2b847da0e /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /cookie:mmm_ava_esg_000_361_m /ga_clientid:c55d8d7e-cdcb-4909-a3d0-0e8dc9dc3e1e /edat_dir:C:\Windows\Temp\asw.5ce619ffd386e95f
Imagebase:	0x7ff7ac3a0000
File size:	3'889'096 bytes
MD5 hash:	CA4A5F3F1AADF421F89C19505055C7A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 003052F0 Relevance: 231.5, APIs: 95, Strings: 36, Instructions: 2278synchronizationfileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000103), ref: 0030548F

Part of subcall function 00307FE0: GetVersionExW.KERNEL32(?), ref: 00308004

GetCurrentProcess.KERNEL32 ref: 003054D6

Part of subcall function 00307E70: OpenProcessToken.ADVAPI32(T0,00000008,?,0B59B22C,?,00000000), ref: 00307EAC
Part of subcall function 00307E70: GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,003220C0), ref: 00307ED9
Part of subcall function 00307E70: GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00307F15
Part of subcall function 00307E70: IsValidSid.ADVAPI32 ref: 00307F22
Part of subcall function 00307E70: GetSidSubAuthorityCount.ADVAPI32 ref: 00307F31
Part of subcall function 00307E70: GetSidSubAuthority.ADVAPI32(?,?), ref: 00307F3D
Part of subcall function 00307E70: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00307F4F

InterlockedExchange.KERNEL32(?,0000052F), ref: 003054FC
InterlockedExchange.KERNEL32(?,00000000), ref: 0030550A
InterlockedExchange.KERNEL32(?,000000C1), ref: 00305593
InterlockedExchange.KERNEL32(?,00000000), ref: 003055A2
CreateMutexW.KERNELBASE(00000000,00000001,00000000), ref: 003055D9
GetLastError.KERNEL32 ref: 003055E9
InterlockedExchange.KERNEL32(?,00000420), ref: 00305602
CloseHandle.KERNEL32(?), ref: 003075E3
CloseHandle.KERNEL32(?), ref: 003075F4
CloseHandle.KERNEL32(?), ref: 00307605
_wcsrchr.LIBVCRUNTIME ref: 003076A1
_wcsrchr.LIBVCRUNTIME ref: 003076B3
CreateHardLinkW.KERNEL32(?,00000000,00000000), ref: 003076EF
CopyFileW.KERNEL32(00000000,?,00000000), ref: 00307707
ReleaseMutex.KERNEL32(?), ref: 00307718
CloseHandle.KERNEL32(?), ref: 0030771F
___delayLoadHelper2@8.DELAYIMP ref: 00307817

Part of subcall function 00303B70: #17.COMCTL32 ref: 00303B84
Part of subcall function 00303B70: LoadStringW.USER32(00300000,000003E9,?,00000000), ref: 00303BA1
Part of subcall function 00303B70: LoadStringW.USER32(00300000,?,?,00000000), ref: 00303BBA
Part of subcall function 00303B70: MessageBoxExW.USER32(00000000,00000000,00000000,00000010,00000409), ref: 00303BCF

Strings

/smbupd, xrefs: 0030632B
stable, xrefs: 00306C52
https://, xrefs: 0030659F
Password, xrefs: 00305FA8
{versionSwitch}, xrefs: 00306BED
/edat_dir:, xrefs: 0030739E
enable, xrefs: 0030649E
/silent, xrefs: 00305495
User-Agent: avast! Antivirus (instup), xrefs: 00306EF5
, xrefs: 00305AC3, 003070AD
ProxyType, xrefs: 00305E18
Avast One, xrefs: 00305A80, 00305AA3, 00305B01, 00307064, 00307087, 003070DB
avcfg://settings/Common/VersionSwitch, xrefs: 003062A8
installer.exe, xrefs: 00306A15
AuthorizationType, xrefs: 0030626F
servers, xrefs: 003064D3
/cookie:, xrefs: 0030732A
Enabled, xrefs: 00305DE8
count, xrefs: 003064CE
Properties, xrefs: 003062AD
mirror, xrefs: 003064A3, 00306727
/cust_ini, xrefs: 00305C76
/ppi_icd, xrefs: 00305B68
server0, xrefs: 00306511
User, xrefs: 00305F5F
%s\%s, xrefs: 00306DBE
Port, xrefs: 00305E9D
/ga_clientid:, xrefs: 00307363
urlpgm, xrefs: 0030650C
/cookie, xrefs: 00305856
http://, xrefs: 00306554
/sub_edition:, xrefs: 003073E5
X>2, xrefs: 00307211
D, xrefs: 0030742A
ProxySettings, xrefs: 00305DED, 00305E1D, 00305E5B, 00305EA2, 00305F64, 00305FAD, 00306274
allow_fallback, xrefs: 00306722

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExchangeInterlocked$Close$Handle$LoadToken$AuthorityCreateInformationMutexProcessString_wcsrchr$ChangeCopyCountCurrentErrorFileFindHardHelper2@8LastLinkMessageNotificationOpenReleaseValidVersion___delay
String ID: $ /cookie:$ /edat_dir:$ /ga_clientid:$ /sub_edition:$%s\%s$/cookie$/cust_ini$/ppi_icd$/silent$/smbupd$AuthorizationType$Avast One$D$Enabled$Password$Port$Properties$ProxySettings$ProxyType$User$User-Agent: avast! Antivirus (instup)$X>2$allow_fallback$avcfg://settings/Common/VersionSwitch$count$enable$http://$https://$installer.exe$mirror$server0$servers$stable$urlpgm${versionSwitch}
API String ID: 1293912049-1685258233
Opcode ID: 33e1d248c2ba9cc1f5cf89adb6f66a709a384e9ad54b2516c01aa9dcf6129ad2
Instruction ID: a53d50ce90623e485db75d7f0ee276c9d70164e472ec7c53191e529d744616b1
Opcode Fuzzy Hash: 33e1d248c2ba9cc1f5cf89adb6f66a709a384e9ad54b2516c01aa9dcf6129ad2
Instruction Fuzzy Hash: F2238B71E022289BEB26DB64CC65BEEB7B8AF45304F0041D9E509A7182DB74AFC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003027B0 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0030280A
GetLastError.KERNEL32 ref: 00302831
GetLastError.KERNEL32 ref: 0030286C
GetFileSizeEx.KERNEL32(33C033FC,?), ref: 00302944
wsprintfW.USER32 ref: 0030296F
SetLastError.KERNEL32(00000000), ref: 00302B76

Strings

%hs%d-, xrefs: 00302969
Range: bytes=, xrefs: 00302961
AMD64, xrefs: 003027C0

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$FileSizewsprintf
String ID: %hs%d-$AMD64$Range: bytes=
API String ID: 297799064-1968478037
Opcode ID: 42924de6f4638073ec4bf8893fef5f0f49cd8ffdae9dbbceee38cdb6f4349a05
Instruction ID: 365380939d6579d04dcd13829e924798693c69c98255406ef427b3f66ac3e978
Opcode Fuzzy Hash: 42924de6f4638073ec4bf8893fef5f0f49cd8ffdae9dbbceee38cdb6f4349a05
Instruction Fuzzy Hash: FAC14D70A01305AFEB269FA4DC99B6FBBBCAF04740F144519E906EA2D0DB74D946CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0030BB70 Relevance: 41.0, APIs: 13, Strings: 10, Instructions: 777
filelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0B59B22C,00000000,00000000), ref: 0030BBCD
GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemFirmwareTable), ref: 0030BC00
GetProcAddress.KERNEL32(00000000), ref: 0030BC07
GetSystemFirmwareTable.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0030BC26
GetSystemFirmwareTable.KERNELBASE ref: 0030BCB9
GetModuleHandleW.KERNEL32(ntdll.dll,NtOpenSection), ref: 0030BD1B
GetProcAddress.KERNEL32(00000000), ref: 0030BD22
MapViewOfFile.KERNEL32(00000000,00000004,00000000,000F0000,00010000), ref: 0030BD88
UnmapViewOfFile.KERNEL32(00000000), ref: 0030BE31
MapViewOfFile.KERNEL32(00000000,00000004,00000000,?,?), ref: 0030BE5A
UnmapViewOfFile.KERNEL32(00000000), ref: 0030BECA
CloseHandle.KERNEL32(00000000), ref: 0030BF30
UnmapViewOfFile.KERNEL32(00000000), ref: 0030C466

Strings

ntdll.dll, xrefs: 0030BCFA
W, xrefs: 0030BBDF
_DMI, xrefs: 0030BDFA
LK2, xrefs: 0030BD0D
_SM_, xrefs: 0030BDA0
GetSystemFirmwareTable, xrefs: 0030BBF6
kernel32.dll, xrefs: 0030BBFB
NtOpenSection, xrefs: 0030BCF5
@, xrefs: 0030BD51
,, xrefs: 0030BD06

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: FileView$HandleUnmap$AddressFirmwareModuleProcSystemTable$CloseVersion
String ID: ,$@$GetSystemFirmwareTable$LK2$NtOpenSection$W$_DMI$_SM_$kernel32.dll$ntdll.dll
API String ID: 26960555-3539227798
Opcode ID: 2127bfb6b9479fa80678fe1a8d7434d9fb7e6f449bce1cb85d69af917e6368d8
Instruction ID: 64d8b4d18be7e4e81faf335a95d4ed17f914d4282cadbe159b1461d7fae6c317
Opcode Fuzzy Hash: 2127bfb6b9479fa80678fe1a8d7434d9fb7e6f449bce1cb85d69af917e6368d8
Instruction Fuzzy Hash: AA52BF71E112199FDB12CFA8CC65BAEFBB9FF48314F144219E945AB281D734AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00301930 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 243
commemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00000000,?,PNG,?,?,?), ref: 00301956
SizeofResource.KERNEL32(00000000,00000000,?,?,?), ref: 00301964
LoadResource.KERNEL32(00000000,00000000,?,?,?), ref: 0030196F
LockResource.KERNEL32(00000000,?,?,?), ref: 0030197A
GlobalAlloc.KERNELBASE(00000002,?,?,?,?), ref: 0030198B
GlobalLock.KERNEL32(00000000,?,?,?), ref: 00301998
GlobalUnlock.KERNEL32(00000000,?,?,?), ref: 003019B0
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?), ref: 003019BD
GlobalFree.KERNEL32(00000000), ref: 003019CB
CoInitializeEx.OLE32(00000000,00000000,?,?,?), ref: 003019E6
CoCreateInstance.OLE32(00323EF4,00000000,00000001,0032366C,?,?,?,?), ref: 00301A06
GetDC.USER32(00000000), ref: 00301B3B
CreateDIBSection.GDI32(00000000,00000028,00000000,00000000,00000000,00000000), ref: 00301B52
ReleaseDC.USER32(00000000,00000000), ref: 00301B5E
DeleteObject.GDI32(00000000), ref: 00301B98

Strings

PNG, xrefs: 00301947
(, xrefs: 00301B06

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Global$Resource$Create$Lock$AllocDeleteFindFreeInitializeInstanceLoadObjectReleaseSectionSizeofStreamUnlock
String ID: ($PNG
API String ID: 3552602207-4064097209
Opcode ID: 84585a43611fa2bd763f2ef9ae330a70919035ea7f9e2ab3f4a8b44c2b5f3a4c
Instruction ID: 10a65a371010e4ecab1f3c1d9e5314a042f263ceebc910786d5e784eec8f9149
Opcode Fuzzy Hash: 84585a43611fa2bd763f2ef9ae330a70919035ea7f9e2ab3f4a8b44c2b5f3a4c
Instruction Fuzzy Hash: 05917071A02229EFDB12DFA5DC95BAEBBBCFF48700F104159E505A7290DB74AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003041B0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 132
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 003041D4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003041ED
GetVersionExA.KERNEL32(0000009C,?,?,00989680,00000000), ref: 00304217
GetNativeSystemInfo.KERNELBASE(?), ref: 0030422E
wsprintfA.USER32 ref: 003042DC
wsprintfA.USER32 ref: 003042FF
lstrcatA.KERNEL32(?,?), ref: 00304316
lstrlenA.KERNEL32(?), ref: 0030436E

Strings

srv, xrefs: 00304247, 0030429C
82, xrefs: 0030423B
cookie=%lsedition=%ldevent=%smidex=%lsstat_session=%lsstatsSendTime=%I64dos=win,%d,%d,%d,%d,%d,%s%sexe_version=%lsSfxVersion=%ls, xrefs: 003042D6
status=%08lxstatus_microstub=%08lx%08lx, xrefs: 003042F9
x:2, xrefs: 0030425C
microstub, xrefs: 00304261, 003042CF
:2, xrefs: 0030434A
AMD64, xrefs: 0030424F, 0030429D

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: SystemTimewsprintf$FileInfoNativeUnothrow_t@std@@@Version__ehfuncinfo$??2@lstrcatlstrlen
String ID: status=%08lxstatus_microstub=%08lx%08lx$AMD64$cookie=%lsedition=%ldevent=%smidex=%lsstat_session=%lsstatsSendTime=%I64dos=win,%d,%d,%d,%d,%d,%s%sexe_version=%lsSfxVersion=%ls$microstub$srv$x:2$82$:2
API String ID: 2179732243-3000468488
Opcode ID: a3b7a9e9f93c35dbc5644c5e567bbacc172f39920c8d7ea5cd5ea4d47a78abd2
Instruction ID: 54cb1fb0ff28caebdf21a879e320bfd7eace13ac881c47f13872dce6482eca10
Opcode Fuzzy Hash: a3b7a9e9f93c35dbc5644c5e567bbacc172f39920c8d7ea5cd5ea4d47a78abd2
Instruction Fuzzy Hash: 1C518DB1A012289FCF22CF64DC45B9EBBB9EF48305F0081E9EA09A6151DB758A94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 003038C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,01000002,00000000,00000000,00000000,?), ref: 003038E7
GetLastError.KERNEL32 ref: 003038F3
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?), ref: 0030390A
GetLastError.KERNEL32 ref: 00303916
CloseHandle.KERNEL32(00000000), ref: 0030398F
SetLastError.KERNEL32(00000000), ref: 00303997

Strings

%d.%d.%d.%d, xrefs: 0030396C

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$File$CloseCreateHandleMappingView
String ID: %d.%d.%d.%d
API String ID: 1867540158-3491811756
Opcode ID: 365cd76a4bc1bc6f906d512a0738e0e35b5c33dfc33da924d095e71da50368d7
Instruction ID: 4b6e68f9af607bcb26a20dd0bc8e021ce2f3b199dc06b3e21143f2f291df3c0b
Opcode Fuzzy Hash: 365cd76a4bc1bc6f906d512a0738e0e35b5c33dfc33da924d095e71da50368d7
Instruction Fuzzy Hash: F0219171A01214BBD7325BA59C59FBBBB6CEF48B51F10405DF906E6280DBB89A42C770

Uniqueness

Uniqueness Score: -1.00%

Function 0030A100 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 329
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 0030A180
CreateFileW.KERNELBASE(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0030A1A9
GetLastError.KERNEL32 ref: 0030A1B9
CloseHandle.KERNEL32(?), ref: 0030A468

Strings

\\.\Scsi%u:, xrefs: 0030AD66
SCSIDISK, xrefs: 0030AE58
\\.\PhysicalDrive%u, xrefs: 0030A18F, 0030A5B9, 0030A9C5
DV0, xrefs: 0030B101

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastVersion
String ID: DV0$SCSIDISK$\\.\PhysicalDrive%u$\\.\Scsi%u:
API String ID: 1515857667-4293759372
Opcode ID: 813c52fd67e452b45f7fd4be22f8bea286b101f6c222c2c53de78b448279389c
Instruction ID: ab804381e5082a2b8bda577c5ae077b4706a2da8c638efed3be563b683a8b99b
Opcode Fuzzy Hash: 813c52fd67e452b45f7fd4be22f8bea286b101f6c222c2c53de78b448279389c
Instruction Fuzzy Hash: 24C1F374A02718DFDB16DFA4D8A5AADB7B9FF48310F148159E801AB381DB70AD01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00308DC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 88
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00307FE0: GetVersionExW.KERNEL32(?), ref: 00308004

lstrcatA.KERNEL32(?, (Prototype),?,0B59B22C,?), ref: 00308E56
CryptAcquireContextA.ADVAPI32(?,00000000,?,00000018,F0000040,?,0B59B22C,?), ref: 00308E6D
CryptReleaseContext.ADVAPI32(00000000,00000000,?,0B59B22C,?), ref: 00308E85
GetLastError.KERNEL32(Unable to acquire cryptographic provider!,?,0B59B22C,?), ref: 00308EAC

Part of subcall function 00307DA0: ___std_exception_copy.LIBVCRUNTIME ref: 00307DD8

__CxxThrowException@8.LIBVCRUNTIME ref: 00308ECA

Part of subcall function 0031203A: RaiseException.KERNEL32(?,?,00308071,?,?,?,?,?,?,?,?,00308071,?,0032B144,00000000), ref: 0031209A

CryptReleaseContext.ADVAPI32(00000000,00000000,?,0032B144,00000000,?,0B59B22C,?), ref: 00308ED9

Strings

(Prototype), xrefs: 00308E4D
Unable to acquire cryptographic provider!, xrefs: 00308EA7
vider, xrefs: 00308DFE

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ContextCrypt$Release$AcquireErrorExceptionException@8LastRaiseThrowVersion___std_exception_copylstrcat
String ID: (Prototype)$Unable to acquire cryptographic provider!$vider
API String ID: 2041426586-155044149
Opcode ID: 2a4e126b4e7ee91801b6476640314e4680fd224a4a25582a7be0048db25ba4a9
Instruction ID: 33ede245dec1243886d318426dc53ccf5217c297f2ceb0f607719ff50344d971
Opcode Fuzzy Hash: 2a4e126b4e7ee91801b6476640314e4680fd224a4a25582a7be0048db25ba4a9
Instruction Fuzzy Hash: 8E315271E042189BDB22DFA4DC55BDEB7BCFB08700F10861DF945A7291EB746585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00309250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(00000008,00309209,0B59B22C,?,00309209,0000800C,?,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 003092A8
GetLastError.KERNEL32(Unable to generate random number!,?,00309209,0000800C,?,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 00309320

Part of subcall function 00307DA0: ___std_exception_copy.LIBVCRUNTIME ref: 00307DD8

__CxxThrowException@8.LIBVCRUNTIME ref: 00309338

Part of subcall function 0031203A: RaiseException.KERNEL32(?,?,00308071,?,?,?,?,?,?,?,?,00308071,?,0032B144,00000000), ref: 0031209A

Strings

2, xrefs: 003092E7
Unable to generate random number!, xrefs: 0030931B

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CryptErrorExceptionException@8LastRaiseRandomThrow___std_exception_copy
String ID: Unable to generate random number!$2
API String ID: 4207938790-3630876608
Opcode ID: c8eae244ca1f6f9519ba106a583859b0b86a61eb9c7452c146e176d44b6d62a7
Instruction ID: 50bbacbd0d4797e8d2c9cac9646f0cf5b7764b05df76507471a84b4d48449bc0
Opcode Fuzzy Hash: c8eae244ca1f6f9519ba106a583859b0b86a61eb9c7452c146e176d44b6d62a7
Instruction Fuzzy Hash: 5D21AF71A00258EBCB2AEFA4D852FEEB77CFB08710F10472AF511976D1DB346981CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00309450 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00308378,0000800C,0B59B22C,?), ref: 00309470
CryptDestroyHash.ADVAPI32(?,00000000), ref: 00309489
GetLastError.KERNEL32(Unable to create hash context!), ref: 003094A4
__CxxThrowException@8.LIBVCRUNTIME ref: 003094BC

Strings

Unable to create hash context!, xrefs: 0030949F

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CryptHash$CreateDestroyErrorException@8LastThrow
String ID: Unable to create hash context!
API String ID: 1323042765-1944974401
Opcode ID: 269687b6817dd4cf978e5da8562a8c48ecf858c618adacfd3b48a6fe25cd3d46
Instruction ID: 269147b2ab213f439b3d2f0114c4a22c030580a1990b67f3455e22c5a303bd96
Opcode Fuzzy Hash: 269687b6817dd4cf978e5da8562a8c48ecf858c618adacfd3b48a6fe25cd3d46
Instruction Fuzzy Hash: 9F018671501208AFDB25EF64DC16FEE7BBCEF04700F00405DF90297190DA70A955C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00308130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(wintrust.dll,?,?,0032B144,00000000), ref: 00308136
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 00308149
FreeLibrary.KERNELBASE(00000000,?,?,0032B144,00000000), ref: 00308152

Strings

CryptCATAdminAcquireContext2, xrefs: 00308143
wintrust.dll, xrefs: 00308131

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: ee3b4eab2fe49689d09c9d390ca1de3f774910ad68007fb6112b1dbba53529e0
Instruction ID: 410ba924f53de095e579dceadf283d3863cdfbba8711f3dd05e58d560ffe3dc7
Opcode Fuzzy Hash: ee3b4eab2fe49689d09c9d390ca1de3f774910ad68007fb6112b1dbba53529e0
Instruction Fuzzy Hash: ADD05E36600A31B78A232BA8BC0D9CB6B689DC6F6130A025DF50192158CA2888A3A150

Uniqueness

Uniqueness Score: -1.00%

Function 0030B0E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 449encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0030B780: GetProcessHeap.KERNEL32(DV0), ref: 0030B7DC

Part of subcall function 00308DC0: lstrcatA.KERNEL32(?, (Prototype),?,0B59B22C,?), ref: 00308E56
Part of subcall function 00308DC0: CryptAcquireContextA.ADVAPI32(?,00000000,?,00000018,F0000040,?,0B59B22C,?), ref: 00308E6D
Part of subcall function 00308DC0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,0B59B22C,?), ref: 00308E85

Part of subcall function 00309450: CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00308378,0000800C,0B59B22C,?), ref: 00309470
Part of subcall function 00309450: CryptDestroyHash.ADVAPI32(?,00000000), ref: 00309489

Part of subcall function 00308DC0: GetLastError.KERNEL32(Unable to acquire cryptographic provider!,?,0B59B22C,?), ref: 00308EAC
Part of subcall function 00308DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00308ECA
Part of subcall function 00308DC0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,0032B144,00000000,?,0B59B22C,?), ref: 00308ED9

Part of subcall function 00309450: GetLastError.KERNEL32(Unable to create hash context!), ref: 003094A4
Part of subcall function 00309450: __CxxThrowException@8.LIBVCRUNTIME ref: 003094BC

Part of subcall function 0030C500: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0030C5FD
Part of subcall function 0030C500: GetLastError.KERNEL32(?,?,?,?,00322548), ref: 0030C607

Part of subcall function 00309340: CryptGetHashParam.ADVAPI32(?,00000004,0000800C,00308744,00000000,0B59B22C,?,?,?,00000000), ref: 00309395
Part of subcall function 00309340: CryptGetHashParam.ADVAPI32(?,00000002,00000000,0000800C,00000000,0000800C,00000000,?), ref: 003093DC

CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00008003), ref: 0030B5EF
CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00008003), ref: 0030B623

Strings

DV0, xrefs: 0030B101

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Crypt$Hash$ContextDestroyErrorLast$Exception@8ParamReleaseThrow$AcquireCreateDirectoryHeapProcessSystemlstrcat
String ID: DV0
API String ID: 2781682779-1122645616
Opcode ID: 2a6dfce08dbcfcfb4d1fbe9a6643346b7ab1620b76c98d7decf86f3b00cb18ba
Instruction ID: 5c9fbd272811a494dfbcdfaa6a43daf3bbca6b3d5e0278ece0b4e404a1192039
Opcode Fuzzy Hash: 2a6dfce08dbcfcfb4d1fbe9a6643346b7ab1620b76c98d7decf86f3b00cb18ba
Instruction Fuzzy Hash: 3E128F35902268CBDB22DB68CC54BDDF7B5AF45314F1482DAD809A7382DB35AE84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003082F0 Relevance: 1.6, APIs: 1, Instructions: 90encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(00000000,?,?,?,00000000,00000004,?,00308744,0000800C,0B59B22C,?), ref: 003083CB

Part of subcall function 00309020: CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?,0B59B22C,?,?,00308744,?,?,?,?,00322269,000000FF), ref: 00309088
Part of subcall function 00309020: CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00322269,000000FF), ref: 003090A4
Part of subcall function 00309020: CryptHashData.ADVAPI32(?,?,0B59B22C,00000000,?,?,?,?,00322269,000000FF), ref: 003090BB
Part of subcall function 00309020: CryptGetHashParam.ADVAPI32(00000000,00000004,?,?,00000000,?,?,?,?,00322269,000000FF), ref: 003090E4
Part of subcall function 00309020: CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000,?,00000000,?,?,?,?,?,00322269,000000FF), ref: 00309128
Part of subcall function 00309020: CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00322269,000000FF), ref: 0030913E
Part of subcall function 00309020: CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00322269,000000FF), ref: 0030914E

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Crypt$Hash$Destroy$Param$ContextCreateDataRelease
String ID:
API String ID: 2857581251-0
Opcode ID: 5680133155303e0ddf85287ceea4c5c851931feddc168687104d3ba4d78901a2
Instruction ID: 303efb4badfce481772716cc7a8589db654af074f28210828939b0fdfec68397
Opcode Fuzzy Hash: 5680133155303e0ddf85287ceea4c5c851931feddc168687104d3ba4d78901a2
Instruction Fuzzy Hash: 3F312EB5D01209ABDB11DF95C892BEFBBB8FF54714F004159E901B72C1DB74AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003021B0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 241
timelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KillTimer.USER32(?,00000001), ref: 00302233
InterlockedExchange.KERNEL32(04CFEEBC,00000000), ref: 00302244
DefWindowProcW.USER32(?,?,?,?), ref: 00302250
GetWindowRect.USER32(?,?), ref: 0030226E
GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 003022B5
GetProcAddress.KERNEL32(00000000), ref: 003022BC
GetVersionExW.KERNEL32(?), ref: 003022D8
SetTimer.USER32(?,00000001,00000019,?), ref: 0030230B
DefWindowProcW.USER32(?,?,?,?), ref: 00302317
DefWindowProcW.USER32(?,00000010,?,?), ref: 00302401
DefWindowProcW.USER32(?,?,?,?), ref: 0030242E

Part of subcall function 00301FC0: CreateSolidBrush.GDI32(00824049), ref: 00302021
Part of subcall function 00301FC0: CreateSolidBrush.GDI32(00F67000), ref: 00302064
Part of subcall function 00301FC0: BeginPaint.USER32(?,?), ref: 00302074
Part of subcall function 00301FC0: FillRect.USER32(?,?), ref: 003020E3
Part of subcall function 00301FC0: FillRect.USER32(?,?), ref: 0030210D
Part of subcall function 00301FC0: EndPaint.USER32(?,?), ref: 00302118

Strings

DwmSetWindowAttribute, xrefs: 00302374
user32.dll, xrefs: 003022AB
dwmapi.dll, xrefs: 00302363
ShutdownBlockReasonCreate, xrefs: 0030229F

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ProcWindow$Rect$BrushCreateFillPaintSolidTimer$AddressBeginExchangeHandleInterlockedKillModuleVersion
String ID: DwmSetWindowAttribute$ShutdownBlockReasonCreate$dwmapi.dll$user32.dll
API String ID: 190927372-2496381605
Opcode ID: 21f4156b6f4408071a122fc7c55ffd6d85bcf5243d468f717573855b23684f4f
Instruction ID: 8aeaa3c8fcd7c1b577cf82af36ff7283eb762425da3dc4f0cd716a19b2a0fcd1
Opcode Fuzzy Hash: 21f4156b6f4408071a122fc7c55ffd6d85bcf5243d468f717573855b23684f4f
Instruction Fuzzy Hash: 9171F432601208ABDB22DF64EC9EBFE7B7CFB08711F00445EF505A62A1C7798A51DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00307E70 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcessToken.ADVAPI32(T0,00000008,?,0B59B22C,?,00000000), ref: 00307EAC
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,003220C0), ref: 00307ED9
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00307F15
IsValidSid.ADVAPI32 ref: 00307F22
GetSidSubAuthorityCount.ADVAPI32 ref: 00307F31
GetSidSubAuthority.ADVAPI32(?,?), ref: 00307F3D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00307F4F
GetLastError.KERNEL32(Unable to open process token!), ref: 00307F78
__CxxThrowException@8.LIBVCRUNTIME ref: 00307F90
GetLastError.KERNEL32(Unable to retrieve process mandatory label!,?,0032B144,00000000), ref: 00307F9A
__CxxThrowException@8.LIBVCRUNTIME ref: 00307FB2
GetLastError.KERNEL32(Unable to verify mandatory label!,?,0032B144,00000000), ref: 00307FBC
__CxxThrowException@8.LIBVCRUNTIME ref: 00307FD4

Strings

T0, xrefs: 00307E9B, 00307EA4
Unable to retrieve process mandatory label!, xrefs: 00307F95
Unable to open process token!, xrefs: 00307F73
Unable to verify mandatory label!, xrefs: 00307FB7

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorException@8LastThrowToken$AuthorityInformation$ChangeCloseCountFindNotificationOpenProcessValid
String ID: Unable to open process token!$Unable to retrieve process mandatory label!$Unable to verify mandatory label!$T0
API String ID: 3836789619-754050376
Opcode ID: 5dd8a0ea539c39e8fed6c477e970b6c40ba4ad1e6e371029e3feb5aa7adba5a8
Instruction ID: bca641e73feda13e26df15afe2d84bd7d5bc769bc46431bdffc3002cccf1eba2
Opcode Fuzzy Hash: 5dd8a0ea539c39e8fed6c477e970b6c40ba4ad1e6e371029e3feb5aa7adba5a8
Instruction Fuzzy Hash: 22410C71904219AFDB16DBA4DC55FEEB7BCFF08700F104119F502E6190DB74AA55CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00301D90 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 168
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetObjectW.GDI32(00000000,00000018,?), ref: 00301E04
LoadImageW.USER32(00000000,00000064,00000001,00000000,00000000,00000040), ref: 00301E51
LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008000), ref: 00301E6C
CreatePatternBrush.GDI32(00000000), ref: 00301E76
KiUserCallbackDispatcher.NTDLL(00000032), ref: 00301E98
GetSystemMetrics.USER32(00000031), ref: 00301EA2
LoadImageW.USER32(?,00000064,00000001,00000000,00000000,00000000), ref: 00301EB2
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00301EC5
RegisterClassExW.USER32(?), ref: 00301F0F
CreateWindowExW.USER32(00000000,?,00000000,90080000,?,?,?,?,00000000,00000000,?,?), ref: 00301F38
InterlockedExchange.KERNEL32(?,00000000), ref: 00301F40
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00301F5A
DispatchMessageW.USER32(?), ref: 00301F6D

Strings

0, xrefs: 00301E12

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ImageLoad$CallbackCreateDispatcherSystemUser$BrushClassDispatchExchangeInfoInterlockedMessageMetricsObjectParametersPatternRegisterWindow
String ID: 0
API String ID: 2747924374-4108050209
Opcode ID: 925c8cacec41d7caec80901680e9d87c928a8d85708d5c2fcc9db16bcde2d823
Instruction ID: 035f7493b9381eb99d76b6ff99a4bd7366355d9530053cb63076a39bb90dfecc
Opcode Fuzzy Hash: 925c8cacec41d7caec80901680e9d87c928a8d85708d5c2fcc9db16bcde2d823
Instruction Fuzzy Hash: 56516171A41319AFEB228FA4DC59BAEBBB8FB04700F144219F605EB2D0DBB49905CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00301020 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 60
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00301029
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00301034
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00301044
SetDllDirectoryW.KERNEL32(003235D4), ref: 00301068
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00301073
GetProcAddress.KERNEL32(00000000,LdrEnumerateLoadedModules), ref: 00301083
IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003010A4
ExitProcess.KERNEL32 ref: 003010C0
ExitProcess.KERNEL32 ref: 003010E4
ExitProcess.KERNEL32 ref: 003010F0

Strings

LdrEnumerateLoadedModules, xrefs: 0030107D
ntdll.dll, xrefs: 0030106E
kernel32.dll, xrefs: 0030102F
SetDefaultDllDirectories, xrefs: 0030103E

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc$DirectoryFeatureHeapInformationPresentProcessor
String ID: LdrEnumerateLoadedModules$SetDefaultDllDirectories$kernel32.dll$ntdll.dll
API String ID: 1484830609-1451921263
Opcode ID: b2aebdebb7bc7786d27c488e2f657791d90be962a7cdee5fce4a5ca997b28e13
Instruction ID: c6c48f1ac42155c5fe796670e478c959f1cef6371bf5202bf7c3f71b629eca5c
Opcode Fuzzy Hash: b2aebdebb7bc7786d27c488e2f657791d90be962a7cdee5fce4a5ca997b28e13
Instruction Fuzzy Hash: BE116570B82351B7D6333771EC2FB5E391CAB05F41F114024FA4AE91D0DE98DB854AA6

Uniqueness

Uniqueness Score: -1.00%

Function 0030C500 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0030B780: GetProcessHeap.KERNEL32(DV0), ref: 0030B7DC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0030C5FD
GetLastError.KERNEL32(?,?,?,?,00322548), ref: 0030C607
GetVolumePathNameW.KERNELBASE(?,00000010,00000104,?,?,?,?,?,00322548), ref: 0030C67E
GetLastError.KERNEL32(?,?,?,?,?,00322548), ref: 0030C688
GetVolumeNameForVolumeMountPointW.KERNELBASE(00000010,00000010,00000104,?,?,?,?,?,?,?,00322548), ref: 0030C6EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,00322548), ref: 0030C6F6
CreateFileW.KERNELBASE(00000010,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0030C7AB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00322548), ref: 0030C7B8
DeviceIoControl.KERNELBASE(00000000,002D1080,00000000,00000000,?,0000000C,00000000,00000000), ref: 0030C7D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00322548), ref: 0030C7E3
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00322548), ref: 0030C7F7

Strings

H%2, xrefs: 0030C7F1

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$Volume$Name$CloseControlCreateDeviceDirectoryFileHandleHeapMountPathPointProcessSystem
String ID: H%2
API String ID: 204137380-2716632077
Opcode ID: 7704a8412dfb87816dfdf4127dcf33f799cd10e3e4e81066cdab15ebcd7eb975
Instruction ID: 4f8c0e925faaeadc1cea69a7fde7e34396c4427f3cd689c869b71988cf5035c0
Opcode Fuzzy Hash: 7704a8412dfb87816dfdf4127dcf33f799cd10e3e4e81066cdab15ebcd7eb975
Instruction Fuzzy Hash: C7B1B134A112059FDB16DFA8C8A5BADB7A4EF48710F14922DE902EB3D0DB75A901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00303190 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000020,?,?,?), ref: 003031B1
ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU),00000001,?,00000000), ref: 003031DA
wsprintfW.USER32 ref: 00303201
CreateDirectoryW.KERNELBASE(?,?), ref: 0030320F
wsprintfW.USER32 ref: 00303228
CreateDirectoryW.KERNEL32(?,?), ref: 00303236
GetLastError.KERNEL32(?,?,?), ref: 00303240
LocalFree.KERNEL32(?,?,?,?), ref: 00303250
SetLastError.KERNEL32(00000000,?,?,?), ref: 00303257

Part of subcall function 00309250: CryptGenRandom.ADVAPI32(00000008,00309209,0B59B22C,?,00309209,0000800C,?,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 003092A8

Strings

%s\Temp\asw.%08x%08x, xrefs: 003031F1
%c:\asw.%08x%08x, xrefs: 00303222
D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU), xrefs: 003031D5

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Directory$CreateDescriptorErrorLastSecuritywsprintf$ConvertCryptFreeLocalRandomStringWindows
String ID: %c:\asw.%08x%08x$%s\Temp\asw.%08x%08x$D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU)
API String ID: 1345463893-1526440225
Opcode ID: 154a8478e6a02625343536e718e3f736924b85504c838927244543d0c9afb3d7
Instruction ID: 6f6f5d060f037c0262597bab4ee2322197ead321e530cc2267795a3512a99e59
Opcode Fuzzy Hash: 154a8478e6a02625343536e718e3f736924b85504c838927244543d0c9afb3d7
Instruction Fuzzy Hash: 3C216271A01218AFDB22DFE4DD89DAEBBBCEF05B41F054019F905E6140D7349A468B61

Uniqueness

Uniqueness Score: -1.00%

Function 00308410 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSizeEx.KERNEL32(?,00322160,0B59B22C,?,?,?,?,?,00000000,00322160,000000FF,?,003026F7,?,00000000), ref: 00308443
CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000,?,?,00000000,00322160), ref: 0030847C
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,?,00000000,00322160), ref: 003084A2
UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,?,00000000,00322160), ref: 003084CE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00322160), ref: 003084D5
GetLastError.KERNEL32(Unable to determine file size!,?,?,00000000,00322160,000000FF,?,003026F7,?,00000000), ref: 003084FE
__CxxThrowException@8.LIBVCRUNTIME ref: 00308516

Strings

Unable to open file mapping!, xrefs: 00308488, 003084AE
Unable to process files over 1GB!, xrefs: 00308462
Unable to determine file size!, xrefs: 003084F9
`!2, xrefs: 003084BF

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: File$View$CloseCreateErrorException@8HandleLastMappingSizeThrowUnmap
String ID: Unable to determine file size!$Unable to open file mapping!$Unable to process files over 1GB!$`!2
API String ID: 3729524651-1550744505
Opcode ID: 05b5f48cc3d76c34359bad45f6c63870c55de7e49cc0ab6e8485441d9ddfb914
Instruction ID: dc43529621378c189565cbf6caae28c9bcaa92816315b8fed2fddd3e15a792aa
Opcode Fuzzy Hash: 05b5f48cc3d76c34359bad45f6c63870c55de7e49cc0ab6e8485441d9ddfb914
Instruction Fuzzy Hash: 1431E631A41219BBDB239F55DC16FEFBB78EB05B10F108119F901AA2C0DB745645CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00308520 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ASWS, xrefs: 003086E2
ig2A, xrefs: 003086C9
ig2A, xrefs: 003086F2
Unable to read signature!, xrefs: 00308801, 0030881E, 00308845, 00308862
ASWS, xrefs: 00308675
ASWS, xrefs: 003086BD

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID:
String ID: ASWS$ASWS$ASWS$Unable to read signature!$ig2A$ig2A
API String ID: 0-1997839495
Opcode ID: ff14380af8623f0dfbdcc7a307c60a040d43b35f6b7086963f260a206e0163c8
Instruction ID: 0ea191f18a5b49a8524b16b4ba6882ca2800727d71b5368ab7474658f140d82e
Opcode Fuzzy Hash: ff14380af8623f0dfbdcc7a307c60a040d43b35f6b7086963f260a206e0163c8
Instruction Fuzzy Hash: D591F170D022189FDF1ADFA4C9A5BEDB774FF05304F61812AE440AB1C1DB36A984CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00302BA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 319fileCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00300000,?,0000000A,.edat,00000005,?,?,?,?,00000000,?,?,00000000), ref: 003030A3
LoadResource.KERNEL32(00300000,00000000,?,?,00000000,?,?,00000000), ref: 003030B5
SizeofResource.KERNEL32(00300000,00000000,?,?,00000000,?,?,00000000), ref: 003030C3
CreateFileW.KERNELBASE(?,00000004,00000001,00000000,00000002,00000080,00000000,?,?,00000000,?,?,00000000), ref: 003030EE
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000), ref: 0030310B
CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,00000000), ref: 00303112

Strings

.edat, xrefs: 0030303B
EDAT_, xrefs: 00302E54

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Resource$File$CloseCreateFindHandleLoadSizeofWrite
String ID: .edat$EDAT_
API String ID: 2436039785-3242799629
Opcode ID: 64929194d9b1254a9518c73ab3706f4afcf2fa40ec182910e0d697f523d42de3
Instruction ID: 1057564f41aa8fa7727273390a43a64136a2b10bee0b16aabd08692802c28b96
Opcode Fuzzy Hash: 64929194d9b1254a9518c73ab3706f4afcf2fa40ec182910e0d697f523d42de3
Instruction Fuzzy Hash: 5AA1DA72E012059BDB19DFA8CCA5BEEB7B9EF48700F158129E816B73D1D7305A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00304020 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0030404C
wsprintfA.USER32 ref: 0030406C
wsprintfA.USER32 ref: 003040B6
lstrlenA.KERNEL32(?), ref: 0030410D

Strings

&t=screenview&cd=%s, xrefs: 00304046
v=1&tid=%ls&cid=%ls&aiid=%ls&an=Free&cd3=Online%s, xrefs: 003040B0
&t=event&ec=microstub&ea=error&el=%08lx%08lx, xrefs: 00304081
&t=event&ec=microstub&ea=ok&el=%08lx, xrefs: 00304066

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: wsprintf$lstrlen
String ID: &t=event&ec=microstub&ea=error&el=%08lx%08lx$&t=event&ec=microstub&ea=ok&el=%08lx$&t=screenview&cd=%s$v=1&tid=%ls&cid=%ls&aiid=%ls&an=Free&cd3=Online%s
API String ID: 217384638-4207265834
Opcode ID: 731b373a41955767951597dcc45bf808d4ff3e8714d7bcb012d00c6cf10ab067
Instruction ID: 09bc6a1bead796ee7e106757ef99e93f79692e2fc850e6d28b215219ab8c49bf
Opcode Fuzzy Hash: 731b373a41955767951597dcc45bf808d4ff3e8714d7bcb012d00c6cf10ab067
Instruction Fuzzy Hash: 82313EF1900229ABCB22DF64DC05B9AB7BCFF09314F004599E609E7241EB749B94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 003039C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00300000,00000001,00000010), ref: 003039F1
LoadResource.KERNEL32(00300000,00000000), ref: 00303A01
wsprintfW.USER32 ref: 00303A52

Strings

%d.%d.%d.%d, xrefs: 00303A4A
\StringFileInfo\040904b0\Edition, xrefs: 00303A67
\StringFileInfo\040904b0\SubEdition, xrefs: 00303A8F

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Resource$FindLoadwsprintf
String ID: %d.%d.%d.%d$\StringFileInfo\040904b0\Edition$\StringFileInfo\040904b0\SubEdition
API String ID: 1667977947-3794282237
Opcode ID: de5963e60bba297af8f0617940ed6bdb543281f89ff594eaf28db52b20a67e4e
Instruction ID: d2b805961d670a948ec99a624d1d3050594259b31af8aeab866624cea4e235ca
Opcode Fuzzy Hash: de5963e60bba297af8f0617940ed6bdb543281f89ff594eaf28db52b20a67e4e
Instruction Fuzzy Hash: 72319072A01219ABCB16DF95DC51AFFB7ACEF48710F040069F905EA281EB75DE85C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00302480 Relevance: 9.1, APIs: 6, Instructions: 95sleepfileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000), ref: 00302506
SetEndOfFile.KERNELBASE(?), ref: 00302511
GetLastError.KERNEL32 ref: 0030251B
GetLastError.KERNEL32 ref: 00302550
Sleep.KERNEL32(000003E8,00000000), ref: 00302574
SetLastError.KERNEL32(00000000,00000000), ref: 00302585

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$File$PointerSleep
String ID:
API String ID: 3209234422-0
Opcode ID: 088fc7c701464ac991958de3e404e9baf953126c4c777fbf208d9375dde43c5a
Instruction ID: 35984c133d885a20e23cf86b39154a3e9bd6b851c74d35fa65cd722b84c44c13
Opcode Fuzzy Hash: 088fc7c701464ac991958de3e404e9baf953126c4c777fbf208d9375dde43c5a
Instruction Fuzzy Hash: 5E31AD71D012099BCB129FA5EC687AEFBB8FF4A310F114119EC15A3390DB349941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0030B890 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000010,000000FF,00000000,00000000,?,0030B45F), ref: 0030B99D
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000010,00000000,?,0030B45F), ref: 0030B9D6
WideCharToMultiByte.KERNEL32(00000003,00000000,00000010,000000FF,00000000,00000000,00000000,00000000,?,0030B45F), ref: 0030BA89
WideCharToMultiByte.KERNEL32(00000003,00000000,00000010,000000FF,0030B45F,00000000,00000000,00000000,?,0030B45F), ref: 0030BAC7

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 599e392f7c2d88cb94ca005e6167d0f0d1486883ba701383cdcd2b0be03fe515
Instruction ID: 6142a69c36c9b0ed3d93bfbe4a230a407428d88599c7cd7ec5cba3a66f605a27
Opcode Fuzzy Hash: 599e392f7c2d88cb94ca005e6167d0f0d1486883ba701383cdcd2b0be03fe515
Instruction Fuzzy Hash: 7B919D31A02209DFDB12CF68C894BADFBB5EF85714F244159E815AB3D1DB71AE02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003043E0 Relevance: 3.0, APIs: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00004020,?,00000000,?), ref: 0030440A
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00304415

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ChangeCloseCreateFindNotificationThread
String ID:
API String ID: 4060959955-0
Opcode ID: 46f581d681e4be36846ce959c99d2eaec249e80c14a0d6ef19e6646e79abff54
Instruction ID: b7301724074b3ebdc78cc7ab586949fc1bc356be1456c904472c955a6b53d187
Opcode Fuzzy Hash: 46f581d681e4be36846ce959c99d2eaec249e80c14a0d6ef19e6646e79abff54
Instruction Fuzzy Hash: 59F0A770601208BFDB26DFA5DC1AFAD77B8EB08702F40405CFA06A61D0DB746A85C760

Uniqueness

Uniqueness Score: -1.00%

Function 00304440 Relevance: 3.0, APIs: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000041B0,?,00000000,?), ref: 0030446A
CloseHandle.KERNEL32(00000000), ref: 00304475

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: 26823a43a39c7ee486c54a5be0b6d23db30d6663c28369bd0f424ddc61ca1e23
Instruction ID: 4ea02e9c20187d973c82ae481da0e4ba788f26863d55dbd1fecdf0f89fe9e252
Opcode Fuzzy Hash: 26823a43a39c7ee486c54a5be0b6d23db30d6663c28369bd0f424ddc61ca1e23
Instruction Fuzzy Hash: 84F03770601208BFDB26DFA5DC5AFAE7BBCEB08705F50405CF906961D0DB746A86C764

Uniqueness

Uniqueness Score: -1.00%

Function 0031B5D6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0031A272: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00318B5A,00000001,00000364,?,00312AA0,?,?,?,?,?,00307DDD,?), ref: 0031A2B3

_free.LIBCMT ref: 0031B642

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2264b8dc440bd836ca5efdcdcc207cde03cd0b5dfc6e4b607fc2e260d0dd6cb0
Instruction ID: 767b1a5e49924a34936f63ca33cdbc213ffa12390725789bf091b378ee956a14
Opcode Fuzzy Hash: 2264b8dc440bd836ca5efdcdcc207cde03cd0b5dfc6e4b607fc2e260d0dd6cb0
Instruction Fuzzy Hash: C8014973200345AFE7268F6AD88199AFBEDFB99370F25051DE584872C0EB30A945C734

Uniqueness

Uniqueness Score: -1.00%

Function 0031A272 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00318B5A,00000001,00000364,?,00312AA0,?,?,?,?,?,00307DDD,?), ref: 0031A2B3

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9a27afd784b21d8fcc6207b8def59e61b091ffbbf93ee79b879719406f24fa10
Instruction ID: 9f6eb5b7b908ffc108785afb77e69f99343562d71940e6e22730fb5a278b435c
Opcode Fuzzy Hash: 9a27afd784b21d8fcc6207b8def59e61b091ffbbf93ee79b879719406f24fa10
Instruction Fuzzy Hash: D4F0B431216920679B2B5B668C01ADA379DAF4DB61F198921FC04DA594DA33DC8282E2

Uniqueness

Uniqueness Score: -1.00%

Function 003105F8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00310610

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6a421e40884f1b4c9607477b56cdf3d5cf0cc7c41afa1139d5fe3476b774c56e
Instruction ID: e9ccc30ce5bf45fff1a3e07ce49e624464c4c3d8edc34f2a6398cb49617e4867
Opcode Fuzzy Hash: 6a421e40884f1b4c9607477b56cdf3d5cf0cc7c41afa1139d5fe3476b774c56e
Instruction Fuzzy Hash: A0B012997EE0117DB11FD101AE12FFB020CC0E0B11730481AF080C41C0D5C03C801031

Uniqueness

Uniqueness Score: -1.00%

Function 00310634 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 975169b29e5f349a1b14181df82ea0be91be7deb8818439dc8a391d6c9492b16
Instruction ID: 113486d0043f19e1cf9e91b7ee4d42410d1ab0d1a7d2e97302effc6e4085cd93
Opcode Fuzzy Hash: 975169b29e5f349a1b14181df82ea0be91be7deb8818439dc8a391d6c9492b16
Instruction Fuzzy Hash: 9DB0129A76E112BE724F91046C62EBB024CC0C8B10730851AF000C4280D5802CC40231

Uniqueness

Uniqueness Score: -1.00%

Function 0031063E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 468c85ce921a2d7a54510a2f8e6c92c361e065d4e211876d4eacfbd8bbe4dc7d
Instruction ID: f9b56b5f45d6cda02b9e7463c237feb1eb0be4b09834ccf98058f83d29096e25
Opcode Fuzzy Hash: 468c85ce921a2d7a54510a2f8e6c92c361e065d4e211876d4eacfbd8bbe4dc7d
Instruction Fuzzy Hash: 78B0129676D012FD710F91146C22EBB024CC0C8B10730C41AF400C4280D6802C800131

Uniqueness

Uniqueness Score: -1.00%

Function 00310619 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 40fad6c096d24c90a4b8510fcb93ad0c998115e180f0340d811012819d6c8d8a
Instruction ID: 18e53a6bc33b35f9844f9dfa0b22d54f553d512ece2f364f9649cce0df3c26a1
Opcode Fuzzy Hash: 40fad6c096d24c90a4b8510fcb93ad0c998115e180f0340d811012819d6c8d8a
Instruction Fuzzy Hash: 60B0129776D112BDF10F5100BD22EBB020CC0C8B10B30841AF000D4181D5802D800031

Uniqueness

Uniqueness Score: -1.00%

Function 00310670 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d1eccb0bf313407cc3c05aedc746b79f8bf95c8077e7a93cb0ae923630b9726b
Instruction ID: ad0ffc91d5d7eb17c783ced8a714c86e93f043c5c2947e8bcf4c3d7303955825
Opcode Fuzzy Hash: d1eccb0bf313407cc3c05aedc746b79f8bf95c8077e7a93cb0ae923630b9726b
Instruction Fuzzy Hash: F4B0129676E012FD710F91146C22EBB020CC0C8B50730C41AF400C4280D5802C800231

Uniqueness

Uniqueness Score: -1.00%

Function 0031067A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 58e10307bef9f6b9b298df0bc8a9f5b4a1fc04bfa8669715a32821b0daea684b
Instruction ID: 0a5da77b130a034ccdb1859120521c0c553f3cf6d1fe81a0b85e5d74e55e729d
Opcode Fuzzy Hash: 58e10307bef9f6b9b298df0bc8a9f5b4a1fc04bfa8669715a32821b0daea684b
Instruction Fuzzy Hash: D4B0129AB6D112BE725F9104AC62FBB020CC1C8B10730851AF000C4280D5842DC41231

Uniqueness

Uniqueness Score: -1.00%

Function 00310666 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5be7251f92fd0da043cf458e8f6d1507d9532b85d1e4267b478c45f9997e4dfc
Instruction ID: ae602daa60ba7d3789b48995d7f123e4fcb9dc3e3c5cb41486ae1389ce17c124
Opcode Fuzzy Hash: 5be7251f92fd0da043cf458e8f6d1507d9532b85d1e4267b478c45f9997e4dfc
Instruction Fuzzy Hash: B5B012A676D012BD710F91046D22EBB028CC0C8B10B30C41AF000C4680D6802C810131

Uniqueness

Uniqueness Score: -1.00%

Function 00310652 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e70a6207ffa9c50bce732f4d739fd77942285b44cdf5a90d9d6e065aafefc1b6
Instruction ID: c55a98c72a6dea86f178426691310bf17443b3b6584860c375ceda2d3080af35
Opcode Fuzzy Hash: e70a6207ffa9c50bce732f4d739fd77942285b44cdf5a90d9d6e065aafefc1b6
Instruction Fuzzy Hash: 7BB0129676F012BD710F91146D22EBB020CC0C8B90730C41AF000C8680D5807C810131

Uniqueness

Uniqueness Score: -1.00%

Function 0031065C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 250c41efd15c2a9a31a70740c7291199b67e3ff066c0aca3e478fe16d062f77e
Instruction ID: 21806ec2ce858fd9268cc323cd0aefbf8d7be59e331c15faa1adf5c251c8a2d8
Opcode Fuzzy Hash: 250c41efd15c2a9a31a70740c7291199b67e3ff066c0aca3e478fe16d062f77e
Instruction Fuzzy Hash: CEB012A676E212BE724F91146C62EBB020CC0C8B50730855AF000C4280D5802CC40231

Uniqueness

Uniqueness Score: -1.00%

Function 00310648 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a3780c96f36e99bb3e2bd3b00d0520e3638a11f6845912406d02d6f2bd18aa32
Instruction ID: 3cc07c98174cd93d72a33bb7f7691301a97155aa4efdcae5f044fb421e24679e
Opcode Fuzzy Hash: a3780c96f36e99bb3e2bd3b00d0520e3638a11f6845912406d02d6f2bd18aa32
Instruction Fuzzy Hash: DDB0129677F012BDB10F91146D32FBB020CD4C8B50B30841AF040C4280D5802C800131

Uniqueness

Uniqueness Score: -1.00%

Function 00310684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0031062B

Part of subcall function 00307AE6: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00307AF1
Part of subcall function 00307AE6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00307B59
Part of subcall function 00307AE6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,?), ref: 00307B6A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 92f9750ac02a7ae0bec2faef50f268255fafd267c1f68612b504790efa3ed4bc
Instruction ID: 2c161917565b13d2914e1c886447cec685857f298dc4e68fc9b54a567dcf09b6
Opcode Fuzzy Hash: 92f9750ac02a7ae0bec2faef50f268255fafd267c1f68612b504790efa3ed4bc
Instruction Fuzzy Hash: 70B0129A76D012FD711F9104AC23FBB020CC0C8B10730C41AF400C4280D5806C801131

Uniqueness

Uniqueness Score: -1.00%

Function 00303FE0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(00300000,0000000A,00302BA0,?,?,?,?,?), ref: 00303FF2

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 7ec5b2928fb5ca7639e8497fe8d307be15c87f41d1ff0b89af2cf4cbc6286901
Instruction ID: 03b3f6e25e8b32dbd886ec9869df9cb581617c078dc36da951961a9392a9030e
Opcode Fuzzy Hash: 7ec5b2928fb5ca7639e8497fe8d307be15c87f41d1ff0b89af2cf4cbc6286901
Instruction Fuzzy Hash: 46B09231285308BBCA122A91EC2AFC53F1CA705F52F404000F60E640D086A2A12046A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00309020 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 152encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00308DC0: lstrcatA.KERNEL32(?, (Prototype),?,0B59B22C,?), ref: 00308E56
Part of subcall function 00308DC0: CryptAcquireContextA.ADVAPI32(?,00000000,?,00000018,F0000040,?,0B59B22C,?), ref: 00308E6D
Part of subcall function 00308DC0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,0B59B22C,?), ref: 00308E85

CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?,0B59B22C,?,?,00308744,?,?,?,?,00322269,000000FF), ref: 00309088
CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00322269,000000FF), ref: 003090A4
CryptHashData.ADVAPI32(?,?,0B59B22C,00000000,?,?,?,?,00322269,000000FF), ref: 003090BB
CryptGetHashParam.ADVAPI32(00000000,00000004,?,?,00000000,?,?,?,?,00322269,000000FF), ref: 003090E4
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000,?,00000000,?,?,?,?,?,00322269,000000FF), ref: 00309128
CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00322269,000000FF), ref: 0030913E
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00322269,000000FF), ref: 0030914E
GetLastError.KERNEL32(Unable to create hash context!,?,?,?,?,00322269,000000FF), ref: 00309177
__CxxThrowException@8.LIBVCRUNTIME ref: 0030918F
GetLastError.KERNEL32(Unable to update hash context!,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 00309199
__CxxThrowException@8.LIBVCRUNTIME ref: 003091B1
GetLastError.KERNEL32(Unable to determine digest size!,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 003091BB
__CxxThrowException@8.LIBVCRUNTIME ref: 003091D3
GetLastError.KERNEL32(Unable to retrieve digest!,?,0032B144,00000000,?,?,?,?,00322269,000000FF), ref: 003091DD
__CxxThrowException@8.LIBVCRUNTIME ref: 003091F5

Strings

Unable to create hash context!, xrefs: 00309172
Unable to retrieve digest!, xrefs: 003091D8
Unable to determine digest size!, xrefs: 003091B6
Unable to update hash context!, xrefs: 00309194

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Crypt$Hash$ErrorException@8LastThrow$Context$DestroyParamRelease$AcquireCreateDatalstrcat
String ID: Unable to create hash context!$Unable to determine digest size!$Unable to retrieve digest!$Unable to update hash context!
API String ID: 827938544-872507617
Opcode ID: 2b8d5c5655aa0360d5d841f80d06ab4b80accc6fb5fdbff67990cce228199f9b
Instruction ID: 1558a4532828344f3876d57f46ee93e2cf083fdb6bfe4d9159d3e3693e51431e
Opcode Fuzzy Hash: 2b8d5c5655aa0360d5d841f80d06ab4b80accc6fb5fdbff67990cce228199f9b
Instruction Fuzzy Hash: 63513A71A4121AABDB26DFA4DC59FEEBBBCBF08700F104119F511B6290DB74AA44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00309340 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32(?,00000004,0000800C,00308744,00000000,0B59B22C,?,?,?,00000000), ref: 00309395
CryptGetHashParam.ADVAPI32(?,00000002,00000000,0000800C,00000000,0000800C,00000000,?), ref: 003093DC
GetLastError.KERNEL32(Unable to determine digest size!), ref: 0030940A
__CxxThrowException@8.LIBVCRUNTIME ref: 00309422
GetLastError.KERNEL32(Unable to retrieve digest!,?,0032B144,00000000), ref: 0030942C
__CxxThrowException@8.LIBVCRUNTIME ref: 00309444

Strings

Unable to retrieve digest!, xrefs: 00309427
Unable to determine digest size!, xrefs: 00309405

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CryptErrorException@8HashLastParamThrow
String ID: Unable to determine digest size!$Unable to retrieve digest!
API String ID: 2498184597-199986585
Opcode ID: 4ced74349e7d89506bbe9f938f59430d7117ac2a555947eb7a92481e2df502c4
Instruction ID: 0de90db04a15313c317888dd174b6d6fbdbe1d294b8ca0d96ac28a0e8d94f3e4
Opcode Fuzzy Hash: 4ced74349e7d89506bbe9f938f59430d7117ac2a555947eb7a92481e2df502c4
Instruction Fuzzy Hash: B8310B71940219ABDB22DF95DD46FEEBBBCEF08704F10451AF511A6280DB746A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0031CE7E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0031CFC4

Strings

1#INF, xrefs: 0031E1D1
1#SNAN, xrefs: 0031E1C3
1#QNAN, xrefs: 0031E1CA
1#IND, xrefs: 0031E1BC

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 333d0502dc9120356de683f72164d4f877319245d3c0345404786303c2399dc9
Instruction ID: f84e21d3c29db5d43fdf35512322a20594414bd2e4c84f938ffac797125568a4
Opcode Fuzzy Hash: 333d0502dc9120356de683f72164d4f877319245d3c0345404786303c2399dc9
Instruction Fuzzy Hash: FAC23E71E086288FDB2ACE28DD407E9B7B9EB49305F1545EAD84DE7240E775AEC18F40

Uniqueness

Uniqueness Score: -1.00%

Function 003094D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptHashData.ADVAPI32(?,?,?,00000000), ref: 003094E2
GetLastError.KERNEL32(Unable to update hash context!), ref: 003094F7
__CxxThrowException@8.LIBVCRUNTIME ref: 0030950F

Strings

Unable to update hash context!, xrefs: 003094F2

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CryptDataErrorException@8HashLastThrow
String ID: Unable to update hash context!
API String ID: 913647941-2364437153
Opcode ID: 286bdb65c94662337cbb2489afea35a6454b9a72348a0f693f4abc36647fb90d
Instruction ID: f8b8dd969f8d2ff8ca1a554790392854bf730eb2905a4ac5c36201147726fcc3
Opcode Fuzzy Hash: 286bdb65c94662337cbb2489afea35a6454b9a72348a0f693f4abc36647fb90d
Instruction Fuzzy Hash: 91E04F316402197FCB12BFA8DC16FBEBB6CBB04700F008559BA1595091EA71F925CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0030EDE0 Relevance: 5.2, APIs: 4, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?), ref: 0030F034
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 0030F03B
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?), ref: 0030F058
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 0030F05F

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 03b7327013ae3d86137d58003368b6e8da39557ddb1e3919a9259d8e574cde14
Instruction ID: 938b91f092ea3819ba7ad1c8b87d69c7754e1c843a4b7988644f4dcae52bb212
Opcode Fuzzy Hash: 03b7327013ae3d86137d58003368b6e8da39557ddb1e3919a9259d8e574cde14
Instruction Fuzzy Hash: 02716E72D012295BDF22DBE4DC95AEFB3BCAF08314F054529ED10EB241E7759D468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00314476 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0031456E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00314578
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00314585

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d68d65f48dcc5280abe9b0d9bda78c7fb77550a39bbdf3cad904b503cc1dfa29
Instruction ID: 714d2af58c7ffda24e958c04319452542e36f260e001764329aab6e1b7324bf0
Opcode Fuzzy Hash: d68d65f48dcc5280abe9b0d9bda78c7fb77550a39bbdf3cad904b503cc1dfa29
Instruction Fuzzy Hash: A031D3749012289BCB26DF64D8897CCBBB8BF08310F5041EAE91CA7250E7709FC58F44

Uniqueness

Uniqueness Score: -1.00%

Function 00317C5A Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00317C30,00000000,0032BA28,0000000C,00317D87,00000000,00000002,00000000), ref: 00317C7B
TerminateProcess.KERNEL32(00000000,?,00317C30,00000000,0032BA28,0000000C,00317D87,00000000,00000002,00000000), ref: 00317C82
ExitProcess.KERNEL32 ref: 00317C94

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 84ce031520375202e501d7d4002946bcb4845da5e1871bb9577610bd9ff8fade
Instruction ID: e0d86cf9df70ef1064ef3661bfa3d70ecbb40d1c1e9162b79cc0c26d5f28bf90
Opcode Fuzzy Hash: 84ce031520375202e501d7d4002946bcb4845da5e1871bb9577610bd9ff8fade
Instruction Fuzzy Hash: 3BE0B631054248ABCF276F54DD09AC93B7AEB59351F054418F8199A531CB39DE86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0031C9D0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc19ff811716e5acc633d6ea21d52563c799f43d77a3da49040b1faa70805c1c
Instruction ID: 5ecd56a161ffcbb930c35b3f2654a02116c4a488930338d310d897a052f3acda
Opcode Fuzzy Hash: fc19ff811716e5acc633d6ea21d52563c799f43d77a3da49040b1faa70805c1c
Instruction Fuzzy Hash: 13022B71E502199BDF19CFA9D8806EDBBF5EF88314F25926AD819EB340D730AD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0032126C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00321267,?,?,00000008,?,?,00320F07,00000000), ref: 00321499

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d3e37957f1351932273e8260e752afbf1f73ca33e8e1f81b9059492b8c256de1
Instruction ID: f0de479b21d4b8ccc904fb1bde286f1e2b8339406f0c792913b07591dec35660
Opcode Fuzzy Hash: d3e37957f1351932273e8260e752afbf1f73ca33e8e1f81b9059492b8c256de1
Instruction Fuzzy Hash: B9B1A035210618CFD716CF28D58AB657BF0FF55364F268698E99ACF2A1C335E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00308260 Relevance: 1.5, APIs: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?,0B59B22C,?,?,003220F0,000000FF), ref: 00308296

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CryptDestroyHash
String ID:
API String ID: 174375392-0
Opcode ID: 01a8526b9907a9610066acd7a46744fe51cd2c3e6245863aea7038cad3730ee4
Instruction ID: c415097a73beb44037f0578aababca5de044ccef1682b285c3b799c031c07dba
Opcode Fuzzy Hash: 01a8526b9907a9610066acd7a46744fe51cd2c3e6245863aea7038cad3730ee4
Instruction Fuzzy Hash: ECF09A71A05A44ABD712CF58C911B9AB3ECEB08B20F00466AEC55D37C0DF76A900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00322660 Relevance: 1.5, APIs: 1, Instructions: 7encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(04F5A458,00000000), ref: 0032266C

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 1847d25e63db51dec663af96f5c9ac9fe6f8f9ebd120ee0cc152dcb17cc75264
Instruction ID: 0d8bdf437075ecf02078987821b8640baf6f6dc358f58ffa62437ac8d8fd0a1b
Opcode Fuzzy Hash: 1847d25e63db51dec663af96f5c9ac9fe6f8f9ebd120ee0cc152dcb17cc75264
Instruction Fuzzy Hash: 32B0127070020067DE338B32BD0AF03326CA700B00F0480097241D10A0C7B8D901C534

Uniqueness

Uniqueness Score: -1.00%

Function 00308EF0 Relevance: 1.5, APIs: 1, Instructions: 7encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,003083E7,00000000,?,?,?,00000000,00000004,?,00308744,0000800C,0B59B22C,?), ref: 00308EF8

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: cbff5a7ff7856c1dc3f2e2598d2c2dd497ffd49e0e97347d2efe9523d139c09c
Instruction ID: f5a456cf75036e03a9515cf8c6ae1bbff99878b4356b66e1e1f4ca3c665f7213
Opcode Fuzzy Hash: cbff5a7ff7856c1dc3f2e2598d2c2dd497ffd49e0e97347d2efe9523d139c09c
Instruction Fuzzy Hash: 15B0123114020CB7C6211B41EC05F45BF2CD710B50F008021F7050407087726521A5B9

Uniqueness

Uniqueness Score: -1.00%

Function 00311292 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000112A0,00310755), ref: 00311297

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 052bdb7cb5f0e97b527101b177c4546773bb681275232ec177eae9cd7322d649
Instruction ID: 8d2e3ff2a1376db12d0b4f152b2f43982825b29ab636434f36af146e8c5cb34b
Opcode Fuzzy Hash: 052bdb7cb5f0e97b527101b177c4546773bb681275232ec177eae9cd7322d649
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0030D340 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1665300d083a08cc1470b6f8dfe43ebc002d4937c0a8fc66eb418d5d3e65401
Instruction ID: 8ee3e790f6360cca732dbfd0fd1c6923ac8d370aa7dc3f84ed60f7ea3d65fbf8
Opcode Fuzzy Hash: e1665300d083a08cc1470b6f8dfe43ebc002d4937c0a8fc66eb418d5d3e65401
Instruction Fuzzy Hash: 0EA1B371E05215CFCB19CFA8D8A19AEB7F5FF49304B244629E816EB791D730A940CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003166E4 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb111ddf038646c126d887deb7994efd7c929e5557553313286600f863a282e9
Instruction ID: a22d302d9d5d28281dc2d32180d150128268b6f504bfcaea742ae7e718c625e2
Opcode Fuzzy Hash: cb111ddf038646c126d887deb7994efd7c929e5557553313286600f863a282e9
Instruction Fuzzy Hash: 2461557160060897DE3F9AE889A7BFE6399EF8D718F15481EE882CF6C1D611DDC28311

Uniqueness

Uniqueness Score: -1.00%

Function 003012F0 Relevance: 65.2, APIs: 35, Strings: 2, Instructions: 434windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00301362
PostQuitMessage.USER32(00000002), ref: 0030136A
DestroyWindow.USER32(?), ref: 00301386
PostQuitMessage.USER32(00000000), ref: 0030138E
DestroyWindow.USER32 ref: 003013AF
DestroyWindow.USER32 ref: 003013BB
DestroyWindow.USER32 ref: 003013C7
DestroyWindow.USER32 ref: 003013D3
DestroyWindow.USER32 ref: 003013DF
DestroyWindow.USER32 ref: 003013EB
DeleteObject.GDI32 ref: 003013F7
DeleteObject.GDI32 ref: 00301403
DeleteObject.GDI32 ref: 0030140F
DestroyIcon.USER32 ref: 0030141B
SystemParametersInfoW.USER32(00000029,000001F4,000001F4,00000000), ref: 00301460
CreateFontIndirectW.GDI32(?), ref: 0030146A
CreateFontIndirectW.GDI32(?), ref: 00301491
CreateFontIndirectW.GDI32(?), ref: 003014B8
LoadImageW.USER32(00000064,00000001,00000030,00000030,00000000), ref: 00301669
CreateWindowExW.USER32(00000000,STATIC,00000000,50000003,00000010,00000010,00000030,00000030,?,00000000,00000000), ref: 00301695
SendMessageW.USER32(00000000,00000172,00000001), ref: 003016AE
CreateWindowExW.USER32(00000000,STATIC,?,50000000,00000050,?,?,?,?,00000000,00000000), ref: 003016ED
SendMessageW.USER32(00000000,00000030,00000000), ref: 00301703
CreateWindowExW.USER32(00000000,STATIC,?,50000000,?,?,?,?,?,00000000,00000000), ref: 00301746
CreateWindowExW.USER32(00000000,STATIC,?,50000000,00000010,?,?,?,?,00000000,00000000), ref: 00301787
SendMessageW.USER32(00000030,00000000), ref: 003017A2
SendMessageW.USER32(00000030,00000000), ref: 003017B8

Part of subcall function 00303B30: LoadStringW.USER32(00300000,00000000,003235D4,00000000), ref: 00303B55

CreateWindowExW.USER32(00000000,BUTTON,00000000,50010001,00000010,?,?,?,?,00000000,00000000), ref: 00301810
CreateWindowExW.USER32(00000000,BUTTON,00000000,50010000,?,?,?,?,?,00000000,00000000), ref: 00301851
SendMessageW.USER32(00000030,00000000), ref: 0030186C
SendMessageW.USER32(00000030,00000000), ref: 00301882
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00301898
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 003018EB
SetFocus.USER32 ref: 003018F7
DefWindowProcW.USER32(?,?,?,?), ref: 0030190C

Strings

STATIC, xrefs: 0030168E, 003016E6, 0030173F, 00301780
BUTTON, xrefs: 00301809, 0030184A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Window$CreateDestroy$Message$Send$DeleteFontIndirectObject$InfoLoadParametersPostQuitSystem$FocusIconImageProcString
String ID: BUTTON$STATIC
API String ID: 2791220612-3385952364
Opcode ID: 1f8097fe7e417da17409e42b207658c416223ccfcd58872d9c94bcfb9330e8c5
Instruction ID: 825d454a72fb0b5e5bfecb38de5ba0f2c7da65d9b79460510053dd11e9389ee7
Opcode Fuzzy Hash: 1f8097fe7e417da17409e42b207658c416223ccfcd58872d9c94bcfb9330e8c5
Instruction Fuzzy Hash: F102A171A41318AFDB769F64EC4ABA9BB7DFF48300F00459EF609A62A0D7755A81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0031BBA7 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0031BBEB

Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B87B
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B88D
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B89F
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B8B1
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B8C3
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B8D5
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B8E7
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B8F9
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B90B
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B91D
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B92F
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B941
Part of subcall function 0031B85E: _free.LIBCMT ref: 0031B953

_free.LIBCMT ref: 0031BBE0

Part of subcall function 00318DE9: HeapFree.KERNEL32(00000000,00000000,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?), ref: 00318DFF
Part of subcall function 00318DE9: GetLastError.KERNEL32(?,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?,?), ref: 00318E11

_free.LIBCMT ref: 0031BC02
_free.LIBCMT ref: 0031BC17
_free.LIBCMT ref: 0031BC22
_free.LIBCMT ref: 0031BC44
_free.LIBCMT ref: 0031BC57
_free.LIBCMT ref: 0031BC65
_free.LIBCMT ref: 0031BC70
_free.LIBCMT ref: 0031BCA8
_free.LIBCMT ref: 0031BCAF
_free.LIBCMT ref: 0031BCCC
_free.LIBCMT ref: 0031BCE4

Strings

(2, xrefs: 0031BBBD
H2, xrefs: 0031BC93

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: (2$H2
API String ID: 161543041-1509936221
Opcode ID: 032ef4f36186bed7f2d6c1d71e2ae7493e56d649302c8cf61f69ab0bdac5e4ea
Instruction ID: 8d8840adc8ce97004f09fe1023af6b6e97959e04ffa21fee4b7ff2c2f9ea7427
Opcode Fuzzy Hash: 032ef4f36186bed7f2d6c1d71e2ae7493e56d649302c8cf61f69ab0bdac5e4ea
Instruction Fuzzy Hash: CE314F35500301AFEB2AAB79E845BDAB3E8AF18350F154429F448DB191DF71ACD08794

Uniqueness

Uniqueness Score: -1.00%

Function 00301BF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 128windowregistryCOMMON

Download Yara Rule

APIs

#17.COMCTL32(0B59B22C), ref: 00301C33
LoadImageW.USER32(?,00000064,00000001,00000000,00000000,00000040), ref: 00301C6A
LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008000), ref: 00301C85

Part of subcall function 00303B30: LoadStringW.USER32(00300000,00000000,003235D4,00000000), ref: 00303B55

GetSystemMetrics.USER32(00000032), ref: 00301CAE
GetSystemMetrics.USER32(00000031), ref: 00301CB8
LoadImageW.USER32(?,00000064,00000001,00000000,00000000,00000000), ref: 00301CC7
RegisterClassExW.USER32(?), ref: 00301CE3
CreateWindowExW.USER32(00000000,?,00000000,90880000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00301D05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00301D1B
IsDialogMessageW.USER32(00000000,?), ref: 00301D2F
TranslateMessage.USER32(?), ref: 00301D3D
DispatchMessageW.USER32(?), ref: 00301D47

Strings

0, xrefs: 00301C39

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: LoadMessage$Image$MetricsSystem$ClassCreateDialogDispatchRegisterStringTranslateWindow
String ID: 0
API String ID: 2026041735-4108050209
Opcode ID: 15cf8c8aab9518867e7bd68abf25547fddb9887ecb368ece2fcab3b347ff8d2b
Instruction ID: 64d5d2e5aef8341de437a626cc87f9481df48a4efabbab6729334011ee0219c4
Opcode Fuzzy Hash: 15cf8c8aab9518867e7bd68abf25547fddb9887ecb368ece2fcab3b347ff8d2b
Instruction Fuzzy Hash: F6417F71A41308FFEB229FA0DC49BAEBBB8FB04710F104519FA15AB2D0D7B85A05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00305535 Relevance: 16.7, APIs: 11, Instructions: 166synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00308080: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2), ref: 0030809B
Part of subcall function 00308080: GetProcAddress.KERNEL32(00000000), ref: 003080A2

InterlockedExchange.KERNEL32(?,000000C1), ref: 00305593
InterlockedExchange.KERNEL32(?,00000000), ref: 003055A2
CreateMutexW.KERNELBASE(00000000,00000001,00000000), ref: 003055D9
GetLastError.KERNEL32 ref: 003055E9
InterlockedExchange.KERNEL32(?,00000420), ref: 00305602
CloseHandle.KERNEL32(?), ref: 003075E3
CloseHandle.KERNEL32(?), ref: 003075F4
CloseHandle.KERNEL32(?), ref: 00307605
_wcsrchr.LIBVCRUNTIME ref: 003076A1
_wcsrchr.LIBVCRUNTIME ref: 003076B3
CreateHardLinkW.KERNEL32(?,00000000,00000000), ref: 003076EF
CopyFileW.KERNEL32(00000000,?,00000000), ref: 00307707
ReleaseMutex.KERNEL32(?), ref: 00307718
CloseHandle.KERNEL32(?), ref: 0030771F

Part of subcall function 00303B70: #17.COMCTL32 ref: 00303B84
Part of subcall function 00303B70: LoadStringW.USER32(00300000,000003E9,?,00000000), ref: 00303BA1
Part of subcall function 00303B70: LoadStringW.USER32(00300000,?,?,00000000), ref: 00303BBA
Part of subcall function 00303B70: MessageBoxExW.USER32(00000000,00000000,00000000,00000010,00000409), ref: 00303BCF

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Handle$Close$ExchangeInterlocked$CreateLoadMutexString_wcsrchr$AddressCopyErrorFileHardLastLinkMessageModuleProcRelease
String ID:
API String ID: 3636221856-0
Opcode ID: e0077f2fe5fac3d7a3141edb288596312eaad0b20602ed8886759d0c9bba847e
Instruction ID: 4a18c00dae115649a77e36982c91a799e6cc7c2463eac6746d860b0a98b7d954
Opcode Fuzzy Hash: e0077f2fe5fac3d7a3141edb288596312eaad0b20602ed8886759d0c9bba847e
Instruction Fuzzy Hash: 9A516D71E062289BDB22EB60DC65FDE7778AB05700F0000D5E50AE71D1DB74AF858F61

Uniqueness

Uniqueness Score: -1.00%

Function 00301FC0 Relevance: 15.1, APIs: 10, Instructions: 136COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00824049), ref: 00302021
CreateSolidBrush.GDI32(00362620), ref: 00302042
CreateSolidBrush.GDI32(00DBDBDA), ref: 00302054
CreateSolidBrush.GDI32(00F67000), ref: 00302064
BeginPaint.USER32(?,?), ref: 00302074
FillRect.USER32(?,?), ref: 003020E3
FillRect.USER32(?,?), ref: 0030210D
EndPaint.USER32(?,?), ref: 00302118
CreateSolidBrush.GDI32(003F382C), ref: 0030214E
CreateSolidBrush.GDI32(00FF9640), ref: 0030218A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: BrushCreateSolid$FillPaintRect$Begin
String ID:
API String ID: 2220257389-0
Opcode ID: ce32b3dca06bbedac16114afaf3d27b6c02797538d2d5223ea5c40fea7dfcc33
Instruction ID: a899350d2274575508aa2efb1e2119fa0b3f8f95369bed70a539ab739e6a104a
Opcode Fuzzy Hash: ce32b3dca06bbedac16114afaf3d27b6c02797538d2d5223ea5c40fea7dfcc33
Instruction Fuzzy Hash: 6E5172B1A01304DFDB27DF78E89A8AA77B8FF09300F10861AF506D72A1D774A985DB51

Uniqueness

Uniqueness Score: -1.00%

Function 003189B1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003189C5

Part of subcall function 00318DE9: HeapFree.KERNEL32(00000000,00000000,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?), ref: 00318DFF
Part of subcall function 00318DE9: GetLastError.KERNEL32(?,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?,?), ref: 00318E11

_free.LIBCMT ref: 003189D1
_free.LIBCMT ref: 003189DC
_free.LIBCMT ref: 003189E7
_free.LIBCMT ref: 003189F2
_free.LIBCMT ref: 003189FD
_free.LIBCMT ref: 00318A08
_free.LIBCMT ref: 00318A13
_free.LIBCMT ref: 00318A1E
_free.LIBCMT ref: 00318A2C

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 84610eb4ea7a5890ae0ee754dfc184fbd96ad017211e485800415210b4f7a19b
Instruction ID: d8301b696c45facd461c621648f49cf774f269c4090e45d12b077e48f698286c
Opcode Fuzzy Hash: 84610eb4ea7a5890ae0ee754dfc184fbd96ad017211e485800415210b4f7a19b
Instruction Fuzzy Hash: AE117779511208FFCB0AEF95ED42CD93F65EF18350B5141A6F9088F162DA31DAA0DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00308080 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2), ref: 0030809B
GetProcAddress.KERNEL32(00000000), ref: 003080A2
GetCurrentProcess.KERNEL32(?,?), ref: 003080D1

Strings

IsWow64Process2, xrefs: 00308091
Unable to determine native architecture of the system!, xrefs: 00308101
kernel32, xrefs: 00308096

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process2$Unable to determine native architecture of the system!$kernel32
API String ID: 4190356694-2412497375
Opcode ID: bb0c1eefbe7af3299e303ecf2fdadaf6ab61e4fcdf15c184d7d2248981b10861
Instruction ID: f666b67105281ab317faea96fb766dceadf55aee4e69afbf74cd339ec0b6911f
Opcode Fuzzy Hash: bb0c1eefbe7af3299e303ecf2fdadaf6ab61e4fcdf15c184d7d2248981b10861
Instruction Fuzzy Hash: 57116535E01318BBCB16EFF4EC169DE777CEF08710B00419AE905D7190DE789A558B95

Uniqueness

Uniqueness Score: -1.00%

Function 00308F10 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Unable to decode base64 string!), ref: 00308FD7
__CxxThrowException@8.LIBVCRUNTIME ref: 00308FEF
GetLastError.KERNEL32(Unable to decode base64 string!,?,0032B144,00000000), ref: 00308FF9
__CxxThrowException@8.LIBVCRUNTIME ref: 00309011

Strings

_0, xrefs: 00308F40, 00308F58, 00308FAA
_0, xrefs: 00308F31, 00308FB7
Unable to decode base64 string!, xrefs: 00308FD2, 00308FF4

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorException@8LastThrow
String ID: Unable to decode base64 string!$_0$_0
API String ID: 1006195485-896935390
Opcode ID: 7a4c8195baaad955e56e5faa3e6c2bf09a35aad850a1d9b48da687bed4832052
Instruction ID: 22f30bd3e3bc0f8235c6cdc922e9b10e0741563cdd8244003701af915ed04204
Opcode Fuzzy Hash: 7a4c8195baaad955e56e5faa3e6c2bf09a35aad850a1d9b48da687bed4832052
Instruction Fuzzy Hash: 8A314A71A40219ABDB26DF95DC56FEEB7B8FF08B00F104119F501A62C0DBB4A544CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00301100 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00301115
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 0030111F
GetProcessHeap.KERNEL32(00000000,00000100), ref: 00301157
HeapAlloc.KERNEL32(00000000), ref: 0030115E
GetSystemDirectoryW.KERNEL32(00000000,00000060), ref: 0030116D
lstrcpyW.KERNEL32(?,\b86362a5.exe), ref: 00301187

Strings

\b86362a5.exe, xrefs: 0030117E

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$AllocProcess$DirectorySystemlstrcpy
String ID: \b86362a5.exe
API String ID: 2190664303-3123522761
Opcode ID: 8a65ef4bc0f98efc7f4388e23133dab03edca201a70d50c3440102b4f6011c4f
Instruction ID: 4125c74bd3272e56ae259a49bfaac4a88cbafbed48dcc9e9ba8fdc96b75ce4b2
Opcode Fuzzy Hash: 8a65ef4bc0f98efc7f4388e23133dab03edca201a70d50c3440102b4f6011c4f
Instruction Fuzzy Hash: 46110471901312ABD3269FA6DC45A56BBACFF08710F05401EF90587690DB74E850C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00318EAA Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,003190FB,00000001,00000001,8B000053), ref: 00318F04
__alloca_probe_16.LIBCMT ref: 00318F3C
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,003190FB,00000001,00000001,8B000053,0B59B22C,?,?), ref: 00318F8A
__alloca_probe_16.LIBCMT ref: 00319021
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,0B59B22C,8B000053,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00319084
__freea.LIBCMT ref: 00319091

Part of subcall function 00318E23: HeapAlloc.KERNEL32(00000000,?,?,?,00312AA0,?,?,?,?,?,00307DDD,?,?), ref: 00318E55

__freea.LIBCMT ref: 0031909A
__freea.LIBCMT ref: 003190BF

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 415bee098d64bed86b6148a84f28af96618103085814d849ed488d736ef07fa2
Instruction ID: c2084453c11f88a0eb0558bd3d4a8ce1bf22eafd1c5cb174cf40216cae5866b8
Opcode Fuzzy Hash: 415bee098d64bed86b6148a84f28af96618103085814d849ed488d736ef07fa2
Instruction Fuzzy Hash: 8F51D372610216ABEB2A9F74DC51FEB77AAEB4C750F16462AFC09DA140DB34DCC1C660

Uniqueness

Uniqueness Score: -1.00%

Function 0031EEDD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0031F652,00000000,00000000,00000000,00000000,00000000,003167BA), ref: 0031EF1F
__fassign.LIBCMT ref: 0031EF9A
__fassign.LIBCMT ref: 0031EFB5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0031EFDB
WriteFile.KERNEL32(?,00000000,00000000,0031F652,00000000,?,?,?,?,?,?,?,?,?,0031F652,00000000), ref: 0031EFFA
WriteFile.KERNEL32(?,00000000,00000001,0031F652,00000000,?,?,?,?,?,?,?,?,?,0031F652,00000000), ref: 0031F033

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 0182cfb63ea4c66414e7fb857986eb52912f32f98bb9e1cef20cfb910e17f2de
Instruction ID: 4b22de25534af8ccaf2e922e8780522f2a7a2b9eaf88043ef57ad63c390c5966
Opcode Fuzzy Hash: 0182cfb63ea4c66414e7fb857986eb52912f32f98bb9e1cef20cfb910e17f2de
Instruction Fuzzy Hash: 0451E671A002499FDB16CFA8DC55AEEBBF8FF4C300F15416AE951E7291D730A981CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00311D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00311DAB
___except_validate_context_record.LIBVCRUNTIME ref: 00311DB3
_ValidateLocalCookies.LIBCMT ref: 00311E41
__IsNonwritableInCurrentImage.LIBCMT ref: 00311E6C
_ValidateLocalCookies.LIBCMT ref: 00311EC1

Strings

csm, xrefs: 00311E56

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 14b67d8608c88fc0b935ce0a9405f0b2d9768930dd53370995e1f4a40c504a1b
Instruction ID: 5701969305332029968ae154671ee85b955f80afd0688ffb910dbeffbf787e29
Opcode Fuzzy Hash: 14b67d8608c88fc0b935ce0a9405f0b2d9768930dd53370995e1f4a40c504a1b
Instruction Fuzzy Hash: 0441E634A002089BCF1ADFA8C8459EEBBB5BF4C324F158155ED149B391D731DE96CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0030D860 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0030D90A

Part of subcall function 00307DA0: ___std_exception_copy.LIBVCRUNTIME ref: 00307DD8

__CxxThrowException@8.LIBVCRUNTIME ref: 0030D997

Part of subcall function 0031203A: RaiseException.KERNEL32(?,?,00308071,?,?,?,?,?,?,?,?,00308071,?,0032B144,00000000), ref: 0031209A

__CxxThrowException@8.LIBVCRUNTIME ref: 0030D9B2

Strings

0123456789ABCDEF, xrefs: 0030D8F0, 0030D8FE, 0030D905, 0030D91D, 0030D934, 0030D94D
Unable to convert invalid hexadecimal string!, xrefs: 0030D99C
Unable to convert invalid hexadecimal character!, xrefs: 0030D97F

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___from_strstr_to_strchr___std_exception_copy
String ID: 0123456789ABCDEF$Unable to convert invalid hexadecimal character!$Unable to convert invalid hexadecimal string!
API String ID: 2723989866-230084144
Opcode ID: b99d048ed1769cc4982f0b4f8557a49a37185722af3366ec3d2aacb26928c8ef
Instruction ID: 1add17634fd25287ede8bfdb89131e1c6a45e85326aafae253c6dd67c2e4d712
Opcode Fuzzy Hash: b99d048ed1769cc4982f0b4f8557a49a37185722af3366ec3d2aacb26928c8ef
Instruction Fuzzy Hash: 6341C070A01615AFCB16CFA8C561BEEBBF8EF04710F108559E455AB681D774E944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00303280 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00300000,EDAT_ECOO,0000000A), ref: 00303294
LoadResource.KERNEL32(00300000,00000000), ref: 003032AB
SizeofResource.KERNEL32(00300000,00000000), ref: 003032B9

Strings

@, xrefs: 003032C9
EDAT_ECOO, xrefs: 0030328A
, xrefs: 0030331A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Resource$FindLoadSizeof
String ID: $@$EDAT_ECOO
API String ID: 507330600-2393187713
Opcode ID: 51df92b9326925ad3c84b0682b9b3635a373d3e096f28fb5c02de95aab6e1a88
Instruction ID: 8278b2c83467b66fb9a6645d087a386740bb8773083f42af714fecd63a06f7cb
Opcode Fuzzy Hash: 51df92b9326925ad3c84b0682b9b3635a373d3e096f28fb5c02de95aab6e1a88
Instruction Fuzzy Hash: 4D316032A1175297DB368F78C8E566A73A9FF96340B064B6EE44697181EF70B7844340

Uniqueness

Uniqueness Score: -1.00%

Function 0031BA01 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0031B9C5: _free.LIBCMT ref: 0031B9EE

_free.LIBCMT ref: 0031BA4F

Part of subcall function 00318DE9: HeapFree.KERNEL32(00000000,00000000,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?), ref: 00318DFF
Part of subcall function 00318DE9: GetLastError.KERNEL32(?,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?,?), ref: 00318E11

_free.LIBCMT ref: 0031BA5A
_free.LIBCMT ref: 0031BA65
_free.LIBCMT ref: 0031BAB9
_free.LIBCMT ref: 0031BAC4
_free.LIBCMT ref: 0031BACF
_free.LIBCMT ref: 0031BADA

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc5d96b687ae4ce69053fd4d6e2136e2519ea8f0b48376b875dcd5d2fa60128c
Instruction ID: cb47639cbc687f454af18dc8e9abdba7ae3e0fef48210e4803d2a85e5c57a1fd
Opcode Fuzzy Hash: dc5d96b687ae4ce69053fd4d6e2136e2519ea8f0b48376b875dcd5d2fa60128c
Instruction Fuzzy Hash: B2113D75941B08BAD62ABBB0CC47FCBB79CAF0A700F404815B399AE092DB75B5958790

Uniqueness

Uniqueness Score: -1.00%

Function 00312FFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00312FF1,00312215), ref: 00313008
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00313016
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0031302F
SetLastError.KERNEL32(00000000,?,00312FF1,00312215), ref: 00313081

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 73c08ab2f5a157154a09a8f08a12581d674369ccf267867d6637d2abb3dd5e34
Instruction ID: 45ca4674248a514614f39c218cabedb22ff73972cb6c5dd0f2fc889bef2e77bd
Opcode Fuzzy Hash: 73c08ab2f5a157154a09a8f08a12581d674369ccf267867d6637d2abb3dd5e34
Instruction Fuzzy Hash: B401D4332087116EA63F27767D86ADB6A9CEB0D775B21432DF211690F0EF554D835141

Uniqueness

Uniqueness Score: -1.00%

Function 00318AA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00314E11,?,?,?,003152E9,0B59B22C,00000000,?,0030D904,0123456789ABCDEF,0B59B22C,?,?,00000000), ref: 00318AA9
_free.LIBCMT ref: 00318ADC
_free.LIBCMT ref: 00318B04
SetLastError.KERNEL32(00000000,003152E9,0B59B22C,00000000,?,0030D904,0123456789ABCDEF,0B59B22C,?,?,00000000,00308722), ref: 00318B11
SetLastError.KERNEL32(00000000,003152E9,0B59B22C,00000000,?,0030D904,0123456789ABCDEF,0B59B22C,?,?,00000000,00308722), ref: 00318B1D
_abort.LIBCMT ref: 00318B23

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 799294f0ec8bef038db424701dda76c51e4c39ea20a3c4eacabea29baa8a4c1e
Instruction ID: 2a121adc0f8ffa9e5f1cf1b00df9739186864c0617734b664095215562aee16b
Opcode Fuzzy Hash: 799294f0ec8bef038db424701dda76c51e4c39ea20a3c4eacabea29baa8a4c1e
Instruction Fuzzy Hash: F4F02835245A003BC22F73397C0AFEF292D9FCA761F254519F515DA196EF74C8934128

Uniqueness

Uniqueness Score: -1.00%

Function 00303BF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00303BF5

Part of subcall function 0031059D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 003105A9
Part of subcall function 0031059D: __CxxThrowException@8.LIBVCRUNTIME ref: 003105B7

std::_Xinvalid_argument.LIBCPMT ref: 00303C05

Part of subcall function 003105BD: std::invalid_argument::invalid_argument.LIBCONCRT ref: 003105C9
Part of subcall function 003105BD: __CxxThrowException@8.LIBVCRUNTIME ref: 003105D7
Part of subcall function 003105BD: ___delayLoadHelper2@8.DELAYIMP ref: 003105EF

Strings

invalid string_view position, xrefs: 00303C10
string too long, xrefs: 00303BF0
vector<T> too long, xrefs: 00303C00

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::invalid_argument::invalid_argument$Helper2@8Load___delay
String ID: invalid string_view position$string too long$vector<T> too long
API String ID: 1134749845-2832074639
Opcode ID: 717e00dc0c47a85d39d4eb51a1826d1af089d4414099d444e6c566353e685c61
Instruction ID: 38276e8364ba3010ac1115de6ff89bc7320dbc3d6eb6f597abf6b3707cfdcf70
Opcode Fuzzy Hash: 717e00dc0c47a85d39d4eb51a1826d1af089d4414099d444e6c566353e685c61
Instruction Fuzzy Hash: 23F05CB020520C4AD70EF334AC478E9338A9D09334B600729F835CE4E1DBA0DF898517

Uniqueness

Uniqueness Score: -1.00%

Function 00310A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0032EA40,?,?,0030219F,0032E97C), ref: 00310A8A
LeaveCriticalSection.KERNEL32(0032EA40,?,?,0030219F,0032E97C), ref: 00310ABD
SetEvent.KERNEL32(00000000,0030219F,0032E97C), ref: 00310B4B
ResetEvent.KERNEL32 ref: 00310B57

Strings

@2, xrefs: 00310A84

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID: @2
API String ID: 3553466030-1198769762
Opcode ID: b249bc5e8d6e7d3c7f684b07a116cb47d3061d17a2a1e5366a48016d21d3f2aa
Instruction ID: b550096e9641256a891026fa5cfe4108240e4f8c4c43d0e57700ed14e00f1e2c
Opcode Fuzzy Hash: b249bc5e8d6e7d3c7f684b07a116cb47d3061d17a2a1e5366a48016d21d3f2aa
Instruction Fuzzy Hash: E4014F31A00224DBCB2BAF55FC4A99577ACFB0A311B01846DE80297720CB74A953CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00317CDF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00317C90,00000000,?,00317C30,00000000,0032BA28,0000000C,00317D87,00000000,00000002), ref: 00317CFF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00317D12
FreeLibrary.KERNEL32(00000000,?,?,?,00317C90,00000000,?,00317C30,00000000,0032BA28,0000000C,00317D87,00000000,00000002), ref: 00317D35

Strings

mscoree.dll, xrefs: 00317CF8
CorExitProcess, xrefs: 00317D0A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9a3dba2fe7fa43ec50ca0f8454d101146c93a901ffe158d9cdbec00b6080022d
Instruction ID: 1753daf240bf5a5b36d62e4603a9cea09ad2a833e666c985106cb77cb5179799
Opcode Fuzzy Hash: 9a3dba2fe7fa43ec50ca0f8454d101146c93a901ffe158d9cdbec00b6080022d
Instruction Fuzzy Hash: E2F0313060521CBBDB279B90EC09AEDBFB8EF08711F054158F805A6160DB759A81CA90

Uniqueness

Uniqueness Score: -1.00%

Function 003181DB Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0031824D
_free.LIBCMT ref: 0031826D

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 960f0dcede2ef5fd8c6acdf24c39f95fb58a3397382bfb8ee6a312f31a77476e
Instruction ID: 244a3e2636e4370d5a838ddbaaa8c50c63fd59dcb9568479a9b617ab48afd2b2
Opcode Fuzzy Hash: 960f0dcede2ef5fd8c6acdf24c39f95fb58a3397382bfb8ee6a312f31a77476e
Instruction Fuzzy Hash: 6A410436A002049FDB2ADF78C881A9DB7F5EF8D714F164969E515EB281DB30AD82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0031A07D Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0B59B22C,00000000,8B000053,0030D904,00000000,00000000,?,?,?,0B59B22C,00000001,0030D904,8B000053,00000001,?,?), ref: 0031A0CA
__alloca_probe_16.LIBCMT ref: 0031A102
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0031A153
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0031A165
__freea.LIBCMT ref: 0031A16E

Part of subcall function 00318E23: HeapAlloc.KERNEL32(00000000,?,?,?,00312AA0,?,?,?,?,?,00307DDD,?,?), ref: 00318E55

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 1283a00131273ee08e9970720087907a8bde6002c23c7bbdfe7e2cdd0a5f87b9
Instruction ID: 4bb059c22eae64602418d0df8c21a79b4857c25c1ba80c852b23c390c661250c
Opcode Fuzzy Hash: 1283a00131273ee08e9970720087907a8bde6002c23c7bbdfe7e2cdd0a5f87b9
Instruction Fuzzy Hash: BD31EE32A0160AABDF2A9F64DC41DEE7BA5EF08311F054128FC04DB290EB35CD95CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00318B29 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00315183,00318E66,?,?,00312AA0,?,?,?,?,?,00307DDD,?,?), ref: 00318B2E
_free.LIBCMT ref: 00318B63
_free.LIBCMT ref: 00318B8A
SetLastError.KERNEL32(00000000,?,?), ref: 00318B97
SetLastError.KERNEL32(00000000,?,?), ref: 00318BA0

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2cd3672c6a2ec39c31a15b99c102cbbf9991d130fbfd7c02b1afbdb6547fe96e
Instruction ID: c889077185e325b37b718dd4c5221fb424be5ed81dfe7b976fc38a48f97bd656
Opcode Fuzzy Hash: 2cd3672c6a2ec39c31a15b99c102cbbf9991d130fbfd7c02b1afbdb6547fe96e
Instruction Fuzzy Hash: 060149B66487002BD22B2779AC86DDB252DEFCE3717218028F506D6281DF748D834128

Uniqueness

Uniqueness Score: -1.00%

Function 0031B95C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0031B974

Part of subcall function 00318DE9: HeapFree.KERNEL32(00000000,00000000,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?), ref: 00318DFF
Part of subcall function 00318DE9: GetLastError.KERNEL32(?,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?,?), ref: 00318E11

_free.LIBCMT ref: 0031B986
_free.LIBCMT ref: 0031B998
_free.LIBCMT ref: 0031B9AA
_free.LIBCMT ref: 0031B9BC

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 75c48bfabcdc7240542b37df304a6f02bd26b15865ef15205b6738e2cce1a586
Instruction ID: f37a1e6139c34e25652e9816ee91d11155975c6169e9a5e6c40b9aec70565de4
Opcode Fuzzy Hash: 75c48bfabcdc7240542b37df304a6f02bd26b15865ef15205b6738e2cce1a586
Instruction Fuzzy Hash: 89F0F932515304ABC62AEB68F887C9AB3EDEF18710B650809F548DB541CB30FCC28A68

Uniqueness

Uniqueness Score: -1.00%

Function 00318450 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0031846E

Part of subcall function 00318DE9: HeapFree.KERNEL32(00000000,00000000,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?), ref: 00318DFF
Part of subcall function 00318DE9: GetLastError.KERNEL32(?,?,0031B9F3,?,00000000,?,00000000,?,0031BA1A,?,00000007,?,?,0031BD3F,?,?), ref: 00318E11

_free.LIBCMT ref: 00318480
_free.LIBCMT ref: 00318493
_free.LIBCMT ref: 003184A4
_free.LIBCMT ref: 003184B5

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bb0e087a21fed9ca11ccaa90f8fc8de436e3a0b565c062a5b96c73ca49a4ff46
Instruction ID: 50973b68f89d59a6f887be939213251d403dd217f7dc035924bd65a39c31c6f8
Opcode Fuzzy Hash: bb0e087a21fed9ca11ccaa90f8fc8de436e3a0b565c062a5b96c73ca49a4ff46
Instruction Fuzzy Hash: B3F0BD798067209BE6376B19FC425843AA8FB19B20B56412EF4109A2B1CF7115A38BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0031750E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe,00000104), ref: 00317549
_free.LIBCMT ref: 00317614
_free.LIBCMT ref: 0031761E

Strings

C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe, xrefs: 00317540, 00317547, 00317576, 003175AE

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
API String ID: 2506810119-2204422699
Opcode ID: 0878534deffb5a2b38586280d57761c7ef7fc99c3c2d95248cf33863e2db5540
Instruction ID: bf3ec9d33fd5c234c5136a57c632ecd8a73c1fe78f38367767a0dfbf6d264fcd
Opcode Fuzzy Hash: 0878534deffb5a2b38586280d57761c7ef7fc99c3c2d95248cf33863e2db5540
Instruction Fuzzy Hash: 9F318271A09218AFCB2BDF99D8859DEBBFDEF9D310F15406AF40497250D6708E81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00307FE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00308004
GetLastError.KERNEL32(Unable to determine the operating system version!), ref: 0030804E
__CxxThrowException@8.LIBVCRUNTIME ref: 0030806C

Strings

Unable to determine the operating system version!, xrefs: 00308049

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ErrorException@8LastThrowVersion
String ID: Unable to determine the operating system version!
API String ID: 2663129220-661432720
Opcode ID: 4012ae8bc474129ed8f4ad4dff213ff9552c94c9aa70759e23f4b4cdef99788f
Instruction ID: 29e7ea0f66f57b378a4d78f4e8babb34b2931e19340d4fb05d481cb5611dbd29
Opcode Fuzzy Hash: 4012ae8bc474129ed8f4ad4dff213ff9552c94c9aa70759e23f4b4cdef99788f
Instruction Fuzzy Hash: F801267091416C56CB2AAB66DC265FEBBF8EF09301F4001EEF0D5E2181DA389B48DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00310ACA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0032EA40,?,?,?,00302139,0032E974), ref: 00310AD5
LeaveCriticalSection.KERNEL32(0032EA40,?,?,00302139,0032E974), ref: 00310B12

Strings

@2, xrefs: 00310ACF

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @2
API String ID: 3168844106-1198769762
Opcode ID: dac7b2143893f445c4d8892b0a553ffaa144ca4328ff3c2d0634d6d5d863e300
Instruction ID: 6bf87ff91d4624cf12a0bf02fe828835cf0ff2872a78a83e7e6af7e1d37b9c27
Opcode Fuzzy Hash: dac7b2143893f445c4d8892b0a553ffaa144ca4328ff3c2d0634d6d5d863e300
Instruction Fuzzy Hash: 76F0E231600204DFC72EAF04E846EA87BACEB4A731F10062DE966476E0CBB068C2CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003116E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0031176C: GetLastError.KERNEL32 ref: 0031177E

IsDebuggerPresent.KERNEL32(?,?,?,0030100A), ref: 00311713
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0030100A), ref: 00311722

Strings

,N2, xrefs: 00311703
ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0031171D

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ,N2$ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-3567182042
Opcode ID: 3fcc7171571e4564f6b69249e755df6d0cb099d600062b26f586219fddf6174b
Instruction ID: 2fff74ae3afaa7b38f5a71b89cc40b4d24bc4fbfc2990a7701184bbfa5fac627
Opcode Fuzzy Hash: 3fcc7171571e4564f6b69249e755df6d0cb099d600062b26f586219fddf6174b
Instruction Fuzzy Hash: 74E06D746003118BE3769F24E9057C2BAE8BB08744F00881DE491C6781D7B4E4858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 003192FC Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00319387
__alldvrm.LIBCMT ref: 00319588
__alldvrm.LIBCMT ref: 003195AA

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 59875573e72320a7118c1066d22839fbe5f18940918a11b40eb48330f722db00
Instruction ID: f7c262376e55e2a40381d28bb12e398304e4f0c62e34e023879b0bd8fbcbc876
Opcode Fuzzy Hash: 59875573e72320a7118c1066d22839fbe5f18940918a11b40eb48330f722db00
Instruction Fuzzy Hash: 67A16B759003869FDB2BCF18C8A17EEBBE6EF1A350F19416FD4559B282C6348D81C750

Uniqueness

Uniqueness Score: -1.00%

Function 003011E0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00301206
SelectObject.GDI32(00000000,?), ref: 00301214
GetTextExtentPoint32W.GDI32(?,00000000,-00000002,?), ref: 0030128F
ReleaseDC.USER32(?,?), ref: 003012D5

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: ExtentObjectPoint32ReleaseSelectText
String ID:
API String ID: 4006923989-0
Opcode ID: a6fe2f3e9849d34c358af76d5390fa09c77e48b9cc2f9c8c344561d5e9a65af7
Instruction ID: 2c485a0dfef86ca36b6c49e7aa7f5a9fbef3d457e1660c5e72511cf89b12a100
Opcode Fuzzy Hash: a6fe2f3e9849d34c358af76d5390fa09c77e48b9cc2f9c8c344561d5e9a65af7
Instruction Fuzzy Hash: 4D313075A002189BCB61DF64DC45ADAB7FDFF49300F14C1A9E949A7200DE74AE868FD0

Uniqueness

Uniqueness Score: -1.00%

Function 003132B2 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 003132CC

Part of subcall function 00313219: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00313248
Part of subcall function 00313219: ___AdjustPointer.LIBCMT ref: 00313263

_UnwindNestedFrames.LIBCMT ref: 003132E1
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 003132F2
CallCatchBlock.LIBVCRUNTIME ref: 0031331A

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 4dbbf62a230ce864b2bb52b0cfdce793e84e64ee971ad292059bf22fa32e6a78
Instruction ID: 71b609551ba7ca1efad2b425b59ba4ca4f228fd13c5d4802f00e93e6213e31d3
Opcode Fuzzy Hash: 4dbbf62a230ce864b2bb52b0cfdce793e84e64ee971ad292059bf22fa32e6a78
Instruction Fuzzy Hash: F7014C32200108BBDF166E95CC41EEF7B69EF5D754F054504FE586A121C732E9B2DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0031B1D4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0031B17B,?,00000000,00000000,00000000,?,0031B378,00000006,FlsSetValue), ref: 0031B206
GetLastError.KERNEL32(?,0031B17B,?,00000000,00000000,00000000,?,0031B378,00000006,FlsSetValue,00326E08,FlsSetValue,00000000,00000364,?,00318B77), ref: 0031B212
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0031B17B,?,00000000,00000000,00000000,?,0031B378,00000006,FlsSetValue,00326E08,FlsSetValue,00000000), ref: 0031B220

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b838227e75702d59b17cdae4920e8075162456a11199415f93f310c99af24dda
Instruction ID: ded1cb6decb9648053f1a8cbef332422fdc9ea59f2862bab69161bfee02e26ad
Opcode Fuzzy Hash: b838227e75702d59b17cdae4920e8075162456a11199415f93f310c99af24dda
Instruction Fuzzy Hash: CF01FC32701226ABC7374A79EC4499AB79CEF0DBA1B110924F906D7540D734D947C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00303B70 Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00303B84
LoadStringW.USER32(00300000,000003E9,?,00000000), ref: 00303BA1
LoadStringW.USER32(00300000,?,?,00000000), ref: 00303BBA
MessageBoxExW.USER32(00000000,00000000,00000000,00000010,00000409), ref: 00303BCF

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: LoadString$Message
String ID:
API String ID: 2278601591-0
Opcode ID: 410b43591a7f6743ac5748cb27671fad73ff66b97c886207310845b8345cd9f8
Instruction ID: a5a8dededf169619c16c7a6bde7349ca88e463f215ec7ca1bea582cfdf3099dd
Opcode Fuzzy Hash: 410b43591a7f6743ac5748cb27671fad73ff66b97c886207310845b8345cd9f8
Instruction Fuzzy Hash: 8BF0FF75A45308FBDB11AF94DC0ABDDBB7CEF08701F008099FA05A61D0DBB45A458B95

Uniqueness

Uniqueness Score: -1.00%

Function 00308880 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 315COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00308C7A

Part of subcall function 0030FC70: GetProcessHeap.KERNEL32(00000000,?,?,?,?,00000000), ref: 0030FCB3
Part of subcall function 0030FC70: HeapFree.KERNEL32(00000000), ref: 0030FCBA

Part of subcall function 0030ED90: GetProcessHeap.KERNEL32(00000000,8B55CCCC,003082E6,?,00308A31,?,?,?), ref: 0030EDB7
Part of subcall function 0030ED90: HeapFree.KERNEL32(00000000,?,?), ref: 0030EDBE

Part of subcall function 0030FAC0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 0030FC26
Part of subcall function 0030FAC0: HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 0030FC2D
Part of subcall function 0030FAC0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 0030FC4D
Part of subcall function 0030FAC0: HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 0030FC54

Part of subcall function 0030E450: GetProcessHeap.KERNEL32(00000000,00000001), ref: 0030EC60
Part of subcall function 0030E450: HeapFree.KERNEL32(00000000), ref: 0030EC67

Strings

Unable to initialize DSA parameters!, xrefs: 00308C50
Unable to read digest or signature!, xrefs: 00308C47

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$FreeProcess$Exception@8Throw
String ID: Unable to initialize DSA parameters!$Unable to read digest or signature!
API String ID: 786774151-2226104879
Opcode ID: b6eeec89c94d3064b1ac0a6c15924df944ce9b3924ced1187ed8ea1e6978b8dc
Instruction ID: 946f231cdc8356eb00bd39825b0711287ba998c3fd79e76e9eb4949ebabfae7d
Opcode Fuzzy Hash: b6eeec89c94d3064b1ac0a6c15924df944ce9b3924ced1187ed8ea1e6978b8dc
Instruction Fuzzy Hash: 64B1DEB2D0131C9ADF52EBA4DC55BDEB3BCAF08304F444566E549E7141EB70EA88CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00319CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00319CDE
_free.LIBCMT ref: 00319D04

Strings

P2, xrefs: 00319D1D

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: _free
String ID: P2
API String ID: 269201875-663966176
Opcode ID: 663047317f63707cf1476f8286f1d8fde919b5aae01fb45e86e26e32c7a4937c
Instruction ID: e5f51b4c5b8e48915e0ff53ad05c5cd2dcae1a3bd5bdf363231f26a56bf9f169
Opcode Fuzzy Hash: 663047317f63707cf1476f8286f1d8fde919b5aae01fb45e86e26e32c7a4937c
Instruction Fuzzy Hash: 8C119371A113109ADB3A9B38FD56B9536A8A759B20F55163AF520CA2D0D770E8934381

Uniqueness

Uniqueness Score: -1.00%

Function 00310900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00310900

Part of subcall function 00310944: InitializeCriticalSectionAndSpinCount.KERNEL32(0032EA40,00000FA0,0B59B22C,?,?,?,?,00322624,000000FF), ref: 00310973
Part of subcall function 00310944: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00322624,000000FF), ref: 0031097E
Part of subcall function 00310944: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00322624,000000FF), ref: 0031098F
Part of subcall function 00310944: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 003109A5
Part of subcall function 00310944: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 003109B3
Part of subcall function 00310944: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 003109C1
Part of subcall function 00310944: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 003109EC
Part of subcall function 00310944: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 003109F7

___scrt_fastfail.LIBCMT ref: 00310921

Part of subcall function 00310F59: __onexit.LIBCMT ref: 00310F5F

Strings

h@2, xrefs: 00310911

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: h@2
API String ID: 66158676-3560185323
Opcode ID: 6cc6b999585435c3c2f132d3be00d393e6d60616d6dd1c4696b84db8b1570711
Instruction ID: 16e83fd25f71219f7931a78f652ca33ff243b3325e5b15b59f8ab7234c44183d
Opcode Fuzzy Hash: 6cc6b999585435c3c2f132d3be00d393e6d60616d6dd1c4696b84db8b1570711
Instruction Fuzzy Hash: BAC0482669824A66E85F76B8A837BDD02020B5EB2AF244449F34CAD4E7CEE090C52026

Uniqueness

Uniqueness Score: -1.00%

Function 0030FAC0 Relevance: 5.2, APIs: 4, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 0030FC26
HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 0030FC2D
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 0030FC4D
HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 0030FC54

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 00843aa52e65e9a204324340eb18213aca963433b0017780de71ccfbc21188cc
Instruction ID: c1274beb71eeb2adf75e7ea7b3f5b454b0dc5a6bc92d74693cd9a31342640bf4
Opcode Fuzzy Hash: 00843aa52e65e9a204324340eb18213aca963433b0017780de71ccfbc21188cc
Instruction Fuzzy Hash: 5D518171E012199FDB21DFA4C895BEEB7B8EF08314F054168E814AB391D775AE46CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0030F800 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000004,?,?,?,0030FCED,?,00000000,?,?,?,00000000), ref: 0030F814
HeapAlloc.KERNEL32(00000000,?,0030FCED,?,00000000,?,?,?,00000000), ref: 0030F81B
GetProcessHeap.KERNEL32(00000000,?,0030FCED,?,00000000,?,?,?,00000000), ref: 0030F85A
HeapFree.KERNEL32(00000000), ref: 0030F861

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 648f8c580cb566e8863711e82ead4a49bd2aed55ce9ffa3020736181192fcdc9
Instruction ID: 3dd62403b3571bb1135b940bd6ffd50565aa828cc9b483dbdb064ccc66d9124f
Opcode Fuzzy Hash: 648f8c580cb566e8863711e82ead4a49bd2aed55ce9ffa3020736181192fcdc9
Instruction Fuzzy Hash: 8B11C1B1601521ABD7229F69DC05FA6F768FF44364F04C624F919DBA80C731E961CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0030F080 Relevance: 5.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,0030FCDE,?,?,?,?,?,00000000), ref: 0030F0A3
HeapAlloc.KERNEL32(00000000,?,0030FCDE,?,?,?,?,?,00000000), ref: 0030F0AA
GetProcessHeap.KERNEL32(00000000,00000000,0030FCDE,?,?,?,?,?,00000000), ref: 0030F0E2
HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 0030F0E9

Memory Dump Source

Source File: 0000000A.00000002.2573662130.0000000000301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000A.00000002.2573599436.0000000000300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573778029.0000000000323000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573869572.000000000032E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2573929258.0000000000331000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_300000_avast_free_antivirus_setup_online.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 811e07e3c9b097ee6a17a1af966bbe3a0b9b001ddbcf6a3b6fe088d8b78799f5
Instruction ID: 9de2e4d4fd740d089b9e10838cac7afd18b82295fe7f2d41fbd1ee703833fcf4
Opcode Fuzzy Hash: 811e07e3c9b097ee6a17a1af966bbe3a0b9b001ddbcf6a3b6fe088d8b78799f5
Instruction Fuzzy Hash: F601D271201205AFE7229F99DC45A67B79CEB40320F04C52EF51AC6AA1D731E8408B60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: avast_free_antivirus_setup_online_x64.exePID: 2848, Parent PID: 5336COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	583
Total number of Limit Nodes:	17

Executed Functions

Function 00007FF751C52A20 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF751C52A2F
FlsGetValue.KERNEL32 ref: 00007FF751C52A44
FlsSetValue.KERNEL32 ref: 00007FF751C52A65
FlsSetValue.KERNEL32 ref: 00007FF751C52A92
FlsSetValue.KERNEL32 ref: 00007FF751C52AA3
FlsSetValue.KERNEL32 ref: 00007FF751C52AB4
SetLastError.KERNEL32 ref: 00007FF751C52ACF
FlsGetValue.KERNEL32 ref: 00007FF751C52B05
FlsSetValue.KERNEL32 ref: 00007FF751C52B24

Part of subcall function 00007FF751C52FB0: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF751C52BFA,?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C53005

FlsSetValue.KERNEL32 ref: 00007FF751C52B4C

Part of subcall function 00007FF751C52DE4: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF751C52DFA
Part of subcall function 00007FF751C52DE4: GetLastError.KERNEL32 ref: 00007FF751C52E04

FlsSetValue.KERNEL32 ref: 00007FF751C52B5D
FlsSetValue.KERNEL32 ref: 00007FF751C52B6E

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Value$ErrorLast$AllocateHeapLanguagesPreferredRestoreThread
String ID:
API String ID: 356650666-0
Opcode ID: 6df840f33b8ff500b75778a9e80f08f82df9a7a68eaf32c6a8c1001dac348767
Instruction ID: bb577a0549080e91d2993a99a42b658922ad6c710b149748e0bd1c8d0c61a45d
Opcode Fuzzy Hash: 6df840f33b8ff500b75778a9e80f08f82df9a7a68eaf32c6a8c1001dac348767
Instruction Fuzzy Hash: 5A4193A0E0924281FB29B7715432179E2C25F407B6FFE4734D83F46ADEEEAEB4014620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751BB2EB0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF751BB2EB9
GetModuleHandleA.KERNEL32 ref: 00007FF751BB2EEE
GetProcAddress.KERNEL32 ref: 00007FF751BB2EFE

Strings

ntdll, xrefs: 00007FF751BB2EE7
LdrEnumerateLoadedModules, xrefs: 00007FF751BB2EF7
asw::main::impl::at_exit_action_node::action_failed_exception::action_failed_exception: atexit action throws exception!, xrefs: 00007FF751C19514

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: AddressFeatureHandleModulePresentProcProcessor
String ID: LdrEnumerateLoadedModules$asw::main::impl::at_exit_action_node::action_failed_exception::action_failed_exception: atexit action throws exception!$ntdll
API String ID: 431857297-521359223
Opcode ID: dd8f60824a193151926e75dd87d3c1fda839cd61a075ad9d69e9516f9280571c
Instruction ID: 8aa0acc5f8cae7f815a7ab0f22c1cc777267d0c55595d758999fcb923677fa30
Opcode Fuzzy Hash: dd8f60824a193151926e75dd87d3c1fda839cd61a075ad9d69e9516f9280571c
Instruction Fuzzy Hash: 0431B0A1E4C64292FB14B721E4413B9A390AF45742FEC1034D68E0BBDEDEAEB454C371

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C54100 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,?,00007FF751C516BD,?,?,?,?,00007FF751C2701C,?,?,00000000,00007FF751C26CEE), ref: 00007FF751C5427F
GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF751C516BD,?,?,?,?,00007FF751C2701C,?,?,00000000,00007FF751C26CEE), ref: 00007FF751C5428B

Strings

ext-ms-, xrefs: 00007FF751C541DC
api-ms-, xrefs: 00007FF751C541C9

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: c3e8b629507090b9d7be623ded371ebec7ff601412032955322ca3ea2833716f
Instruction ID: bd8d195e0b026696c6bf14cf1bd4e5819aaaaf961bdf477d1e977ae40d51cbed
Opcode Fuzzy Hash: c3e8b629507090b9d7be623ded371ebec7ff601412032955322ca3ea2833716f
Instruction Fuzzy Hash: 9B4125A1B1961291FB12EB16AC10175A3D2BF44BE2F9E4139DD1D8B74CEE7DE8408360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751B7C0F0 Relevance: 3.0, APIs: 2, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF751B7C146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF751B7C14C

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 852b7c7e172e4ac812436f4dd43074d3340c379c97bedfab4b998fe7524e98aa
Instruction ID: 61fda7b0c4d0cd58865e4bf2809c5a6bb4b74bf3fb807413bb5bb82ab86b4783
Opcode Fuzzy Hash: 852b7c7e172e4ac812436f4dd43074d3340c379c97bedfab4b998fe7524e98aa
Instruction Fuzzy Hash: 37F08291F1A60745EE48B35694A623991905F44762FE81F38D26D01BCDEE9DD1914710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C28B6C Relevance: 3.0, APIs: 2, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF751C28B9C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF751C28BA2

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 21e9db8c7cf910a0b477a3470f38705bd072f9075a6caa2dfa35862bc3a55719
Instruction ID: f4a8c9f654763e9abd635d4f2314eca200607937aac7accaed52ff1876100732
Opcode Fuzzy Hash: 21e9db8c7cf910a0b477a3470f38705bd072f9075a6caa2dfa35862bc3a55719
Instruction Fuzzy Hash: C1E09AD0E1D10747FB69B561191607581800F15772DBC1BB8D9BE049CBBDDFA4519234

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C52DE4 Relevance: 3.0, APIs: 2, Instructions: 18
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF751C52DFA
GetLastError.KERNEL32 ref: 00007FF751C52E04

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: e64f3f595fc15bf38720328d9ed4b57487a68eb9fb9313cf6daf3d051aefbe32
Instruction ID: da30dd1cd7191e8048b0e4c39572e24feb22af086546be562359cf26ad967ea2
Opcode Fuzzy Hash: e64f3f595fc15bf38720328d9ed4b57487a68eb9fb9313cf6daf3d051aefbe32
Instruction Fuzzy Hash: D6E08CC0F1920286FF087BB2585513591C21F84753FEC4034C90E8625AEEDE64508220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C52FB0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF751C52BFA,?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C53005

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3fdd6eab09de938825e1d38bdbf211b8db5cea1d69b3d13befd58bad4c215daf
Instruction ID: 7d5cda5ddb1f26fbe07f668f1f6b256c68ea425433544bb17e82e4733f1f4c12
Opcode Fuzzy Hash: 3fdd6eab09de938825e1d38bdbf211b8db5cea1d69b3d13befd58bad4c215daf
Instruction Fuzzy Hash: 0BF062D4B0D30381FF55B66168246B5D2855F84B92FED5530C90F463C9EEDEE4809230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C52D84 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF751C5866D,?,?,00000000,00007FF751C52663,?,?,?,00007FF751C5207F,?,?,?,00007FF751C51F75), ref: 00007FF751C52DC2

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0b1020424cecb39bed94fcbabcea1f7f5295cbe6e883ee52df47b61afa3af6d0
Instruction ID: c65fe63066d2d6041fc4377f048b2f0dabbe098bf084db454c1cd081f1efc6b9
Opcode Fuzzy Hash: 0b1020424cecb39bed94fcbabcea1f7f5295cbe6e883ee52df47b61afa3af6d0
Instruction Fuzzy Hash: F2F05890F1C20689FB55BAA158202B5D1C15F44BA2FEE4630DC2F862CDEEEEE480C131

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF751C296DC Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF751C296F8
RtlCaptureContext.NTDLL ref: 00007FF751C29725
RtlLookupFunctionEntry.NTDLL ref: 00007FF751C2973F
RtlVirtualUnwind.NTDLL ref: 00007FF751C29780
IsDebuggerPresent.KERNEL32 ref: 00007FF751C297D4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF751C297F1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF751C297FC

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: bce1a87e6b3a1a5fc249787ee806e8b5f1e0d901e6af8faf1dd568f01602fd43
Instruction ID: fa03e036e7b38f86053589f001a9d826cd97b9d7d2823b29639e1a1fef9815c8
Opcode Fuzzy Hash: bce1a87e6b3a1a5fc249787ee806e8b5f1e0d901e6af8faf1dd568f01602fd43
Instruction Fuzzy Hash: 5A3198B2604B819AEB60DF64E8803ED73A0F785745F98443ADA4D47B98DF7DD548C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C38770 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF751C387E9
RtlLookupFunctionEntry.NTDLL ref: 00007FF751C38801
RtlVirtualUnwind.NTDLL ref: 00007FF751C3883C
IsDebuggerPresent.KERNEL32 ref: 00007FF751C38875
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF751C3887F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF751C3888A

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7ebc3e740caaa38044f504a66d7389bfab10c03e195e7626b7c764adefabef52
Instruction ID: 4f9b3d8705f32702d40754b29f990aa29c2ecaf219cc4113bb8a8daa7b4aa544
Opcode Fuzzy Hash: 7ebc3e740caaa38044f504a66d7389bfab10c03e195e7626b7c764adefabef52
Instruction Fuzzy Hash: 9831B676618F8186EB60DF24E8402AEB3A0FB85795FA80135EA9D43B9CDF7DC545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C37254 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF751C37506,?,?,?,00007FF751C371C0,?,?,?,00007FF751C2BDE9), ref: 00007FF751C372D9
GetLastError.KERNEL32(?,?,?,00007FF751C37506,?,?,?,00007FF751C371C0,?,?,?,00007FF751C2BDE9), ref: 00007FF751C372E7
LoadLibraryExW.KERNEL32(?,?,?,00007FF751C37506,?,?,?,00007FF751C371C0,?,?,?,00007FF751C2BDE9), ref: 00007FF751C37311
FreeLibrary.KERNEL32(?,?,?,00007FF751C37506,?,?,?,00007FF751C371C0,?,?,?,00007FF751C2BDE9), ref: 00007FF751C3737F
GetProcAddress.KERNEL32(?,?,?,00007FF751C37506,?,?,?,00007FF751C371C0,?,?,?,00007FF751C2BDE9), ref: 00007FF751C3738B

Strings

api-ms-, xrefs: 00007FF751C372F9

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 562e4862db9cea0dee6eeb492764c21e552bd9b73d6d80741240bdd4eb1b1bc6
Instruction ID: e5a07c1be29579723291171090e50fc184a0a47b017d60f7ed69f4b7b4e26f99
Opcode Fuzzy Hash: 562e4862db9cea0dee6eeb492764c21e552bd9b73d6d80741240bdd4eb1b1bc6
Instruction Fuzzy Hash: F0311261A0AB46D0EF61FB029840678A3E8BF08BA2FAD0135DD1D47798DFBDE4408320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C6071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 00007FF751C6074D
GetLastError.KERNEL32 ref: 00007FF751C60759
CloseHandle.KERNEL32 ref: 00007FF751C60771
CreateFileW.KERNEL32 ref: 00007FF751C6079C
WriteConsoleW.KERNEL32 ref: 00007FF751C607BB

Strings

CONOUT$, xrefs: 00007FF751C6077D

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f436f3598382d4eae56956204aea27485fc900eea33688375395fea7cb0cb7b6
Instruction ID: 64aab84588a2fff5cdc233b1dc8b334b57afe3d4a084d28d33f166c587d3c331
Opcode Fuzzy Hash: f436f3598382d4eae56956204aea27485fc900eea33688375395fea7cb0cb7b6
Instruction Fuzzy Hash: C1119A71B18A8186F350AB46EC54329A3E0FB48FE6FA84234E95D47B9CCFBDD4548750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C52B98 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52BA7
FlsSetValue.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52BDD
FlsSetValue.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52C0A
FlsSetValue.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52C1B
FlsSetValue.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52C2C
SetLastError.KERNEL32(?,?,?,00007FF751C4571D,?,?,?,?,00007FF751C52E18), ref: 00007FF751C52C47

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1a1e0b917bed27e8c667c7a5048fdf470074f8fd93482e47d5ccccfcfc5a2393
Instruction ID: 5f81a6869977a0340d57aa607ea14070921b3f62741005346cf19357093c8033
Opcode Fuzzy Hash: 1a1e0b917bed27e8c667c7a5048fdf470074f8fd93482e47d5ccccfcfc5a2393
Instruction Fuzzy Hash: 221192A0A0C24281F758B7715961079E2D25F447F2FFE4334D83F46ADEEEAEB4414620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C52C60 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF751C386FF,?,?,00000000,00007FF751C3899A,?,?,?,?,?,00007FF751C38926), ref: 00007FF751C52C7F
FlsSetValue.KERNEL32(?,?,?,00007FF751C386FF,?,?,00000000,00007FF751C3899A,?,?,?,?,?,00007FF751C38926), ref: 00007FF751C52C9E
FlsSetValue.KERNEL32(?,?,?,00007FF751C386FF,?,?,00000000,00007FF751C3899A,?,?,?,?,?,00007FF751C38926), ref: 00007FF751C52CC6
FlsSetValue.KERNEL32(?,?,?,00007FF751C386FF,?,?,00000000,00007FF751C3899A,?,?,?,?,?,00007FF751C38926), ref: 00007FF751C52CD7
FlsSetValue.KERNEL32(?,?,?,00007FF751C386FF,?,?,00000000,00007FF751C3899A,?,?,?,?,?,00007FF751C38926), ref: 00007FF751C52CE8

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d68b06d165530f3a290ecc6e339b30d3165b4a00eead9396f17aa3313851699f
Instruction ID: 4e3aa9b5787caed6856e2cb9f443f3592a924b26f2ff315f472ea8a3ac320da2
Opcode Fuzzy Hash: d68b06d165530f3a290ecc6e339b30d3165b4a00eead9396f17aa3313851699f
Instruction Fuzzy Hash: 711193A0E0C24281F758B365A561179E1C15F403B2EEE4334D83F467DEEE9EF4018621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C504A0 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF751C50527
WriteFile.KERNEL32 ref: 00007FF751C507EE
WriteFile.KERNEL32 ref: 00007FF751C50837
GetLastError.KERNEL32 ref: 00007FF751C508F8

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: cdcbf96a7943b5a26f16623fc8a31838fc1e5a9d5b53931d0011764705b6c040
Instruction ID: 7a0f2b0ea292f16a50de86e55a6164d5a8432ebdeb24d18a57c29b45e91cd506
Opcode Fuzzy Hash: cdcbf96a7943b5a26f16623fc8a31838fc1e5a9d5b53931d0011764705b6c040
Instruction Fuzzy Hash: 2CD14F62B08A8589E710DF78D4502BCB7B1FB44B99FA94232CE4D97B8DDE7AD416C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C50E7C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF751C50E1C), ref: 00007FF751C50F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF751C50E1C), ref: 00007FF751C51029

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 51e994d2c4a1c3eb4be4e93091f3271c3eb4fa59fed731ea0944c899e11818fd
Instruction ID: 3231de236e21eb8d19669ef1934a784b793b25317cb450028a2e357ac2e79dca
Opcode Fuzzy Hash: 51e994d2c4a1c3eb4be4e93091f3271c3eb4fa59fed731ea0944c899e11818fd
Instruction Fuzzy Hash: BE9127B2F1869285FB50EB6594942BDB7A0FB4478AFA90135DE0E5368CDFBED441C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751BAF4D0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF751BAF537
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF751BAF54A
__std_exception_copy.LIBVCRUNTIME ref: 00007FF751BAF558
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF751BAF567

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: __std_exception_copy__std_exception_destroy
String ID:
API String ID: 2960854011-0
Opcode ID: 66f3a3b1fe0d55b18bb0f0d5a67fce6a11adc169c06312464a3e0e9a3d384224
Instruction ID: 4b741d4872ac15c7c5a6a0731a4d76728341d7d8861a9a5a5d6729b7bbde5a99
Opcode Fuzzy Hash: 66f3a3b1fe0d55b18bb0f0d5a67fce6a11adc169c06312464a3e0e9a3d384224
Instruction Fuzzy Hash: DF11B472A28B4082E700DF10E8800ACB3A5FB98784FE95135FA9D07B59DF7AD9D1C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C29970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF751C2999C
GetCurrentThreadId.KERNEL32 ref: 00007FF751C299AA
GetCurrentProcessId.KERNEL32 ref: 00007FF751C299B6
QueryPerformanceCounter.KERNEL32 ref: 00007FF751C299C6

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 479cdb42449afa573d09263ea83df1eb4bca29146fdf0dc9855922d2313494eb
Instruction ID: 18fd368c3cf5a4c2a540d759be01a9abd615623721ed78ee65adb589754df93a
Opcode Fuzzy Hash: 479cdb42449afa573d09263ea83df1eb4bca29146fdf0dc9855922d2313494eb
Instruction Fuzzy Hash: 0A118276B14F018AFB00DF60E8442B873A4FB19759F880E35EA6D86BA8DFBDD1548350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C50B4C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF751C50C63
GetLastError.KERNEL32 ref: 00007FF751C50C85

Strings

U, xrefs: 00007FF751C50C0F

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 49fb905a3f19960e75a3b58e4bc55de85c056c642bf6e9c17ad93766622785f7
Instruction ID: 21e893fe93bc2b968254441db2afd14d468898b6bd74409154f1ea9bccc666e5
Opcode Fuzzy Hash: 49fb905a3f19960e75a3b58e4bc55de85c056c642bf6e9c17ad93766622785f7
Instruction Fuzzy Hash: 6841E562B18B4182EB20AF25E8543BAB7A0FB84795FD94031EE4D87B88DFBDD401C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF751C2BAB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00007FF751C2BB00
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF751B7DB8F), ref: 00007FF751C2BB41

Strings

csm, xrefs: 00007FF751C2BB2E

Memory Dump Source

Source File: 0000000C.00000002.2582754821.00007FF751B71000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF751B70000, based on PE: true

Associated: 0000000C.00000002.2582699824.00007FF751B70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2582980761.00007FF751C81000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583145567.00007FF751CE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583294489.00007FF751CE7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583388792.00007FF751CEA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2583462033.00007FF751CF0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff751b70000_avast_free_antivirus_setup_online_x64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7c125bd4f6e4af7f8638ae7d265f6471ca0060ccfa351db131177b8e71ce99dd
Instruction ID: f7539d83f806f03cd48e86bb8b8f98e319436324a4b68d31c04d701bc0b60b33
Opcode Fuzzy Hash: 7c125bd4f6e4af7f8638ae7d265f6471ca0060ccfa351db131177b8e71ce99dd
Instruction Fuzzy Hash: 29114C72618B4082EB219F15E48025AB7E4FB88B85FAC4270EADC07B58DF7ED551C700

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Instup.exePID: 1436, Parent PID: 2848COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	1413
Total number of Limit Nodes:	59

Executed Functions

Function 00007FF7AC4F14D0 Relevance: 59.8, APIs: 23, Strings: 11, Instructions: 267
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F14F9
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F1510
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F1534
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F1558
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F157C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F15A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AC3A2089), ref: 00007FF7AC4F1608
GetLastError.KERNEL32 ref: 00007FF7AC4F1645
GetLastError.KERNEL32 ref: 00007FF7AC4F1682
GetLastError.KERNEL32 ref: 00007FF7AC4F16BF
GetLastError.KERNEL32 ref: 00007FF7AC4F16FC
GetCurrentThread.KERNEL32 ref: 00007FF7AC4F17BA
OpenThreadToken.ADVAPI32 ref: 00007FF7AC4F17CF
GetLastError.KERNEL32 ref: 00007FF7AC4F17D9
ImpersonateSelf.KERNELBASE ref: 00007FF7AC4F17EB
GetCurrentThread.KERNEL32 ref: 00007FF7AC4F17F9
OpenThreadToken.ADVAPI32 ref: 00007FF7AC4F180E
GetLastError.KERNEL32 ref: 00007FF7AC4F1825
GetLastError.KERNEL32 ref: 00007FF7AC4F1851
GetLastError.KERNEL32 ref: 00007FF7AC4F187C
CloseHandle.KERNEL32 ref: 00007FF7AC4F18C7
RevertToSelf.ADVAPI32 ref: 00007FF7AC4F18DA
CloseHandle.KERNEL32 ref: 00007FF7AC4F18F3

Strings

LdrUnlockLoaderLock, xrefs: 00007FF7AC4F151F, 00007FF7AC4F176E
RtlDllShutdownInProgress, xrefs: 00007FF7AC4F158B
ntdll.dll, xrefs: 00007FF7AC4F14F0
RtlIsCriticalSectionLockedByThread, xrefs: 00007FF7AC4F1543
Unable to assign the process impersonation token to the thread!, xrefs: 00007FF7AC4F1884
Unable to adjust token privilege '{}'!, xrefs: 00007FF7AC4F1BB2
RtlGetCurrentPeb, xrefs: 00007FF7AC4F1567
Unable to obtain the thread access token!, xrefs: 00007FF7AC4F182E, 00007FF7AC4F1859
Unable to lookup privilege '{}'!, xrefs: 00007FF7AC4F1B76
LdrLockLoaderLock, xrefs: 00007FF7AC4F14FF
GetProcAddress ({}), xrefs: 00007FF7AC4F160E, 00007FF7AC4F164B, 00007FF7AC4F1688, 00007FF7AC4F16C5, 00007FF7AC4F1702

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$AddressProc$Thread$Handle$CloseCurrentOpenSelfToken$ImpersonateModuleRevert
String ID: GetProcAddress ({})$LdrLockLoaderLock$LdrUnlockLoaderLock$RtlDllShutdownInProgress$RtlGetCurrentPeb$RtlIsCriticalSectionLockedByThread$Unable to adjust token privilege '{}'!$Unable to assign the process impersonation token to the thread!$Unable to lookup privilege '{}'!$Unable to obtain the thread access token!$ntdll.dll
API String ID: 2587333650-4197750046
Opcode ID: c1942809da15b64efe451dd72b79aecbea634a861fbae2d07e0f8e438b520965
Instruction ID: 260db754f978c5b63c54a060fe49e4671c6fd49474748c2301dfc56a013e1c0e
Opcode Fuzzy Hash: c1942809da15b64efe451dd72b79aecbea634a861fbae2d07e0f8e438b520965
Instruction Fuzzy Hash: 13C16D61E0AA06B5FB11EBA0E8443BDB3A5BF44748FE25036D94E426B5DF3CE549C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A9980 Relevance: 49.9, APIs: 13, Strings: 15, Instructions: 911timememoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32 ref: 00007FF7AC3A99C6

Part of subcall function 00007FF7AC509F90: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A013
Part of subcall function 00007FF7AC509F90: EnterCriticalSection.KERNEL32 ref: 00007FF7AC50A090

GetProcessHeap.KERNEL32 ref: 00007FF7AC3A9A51
HeapSetInformation.KERNEL32 ref: 00007FF7AC3A9A69
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AC3A9A76
FileTimeToSystemTime.KERNEL32 ref: 00007FF7AC3A9A94
GetCommandLineW.KERNEL32 ref: 00007FF7AC3A9B0A

Part of subcall function 00007FF7AC3A7900: __std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3A79D8

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3AA083
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3AA0EC
GetFileAttributesW.KERNEL32 ref: 00007FF7AC3AA3EC
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AC3AA862
FileTimeToSystemTime.KERNEL32 ref: 00007FF7AC3AA876
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3AA97D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3AAA52

Strings

debug, xrefs: 00007FF7AC3A9DAA
START: Avast installer/updater, xrefs: 00007FF7AC3A9FF4
Logs, xrefs: 00007FF7AC3AA59F, 00007FF7AC3AA641
clear, xrefs: 00007FF7AC3A9CFA
13DA, xrefs: 00007FF7AC3AA927
config.def, xrefs: 00007FF7AC3AA32D
A5C8, xrefs: 00007FF7AC3AA931
\Logs\Clear.log, xrefs: 00007FF7AC3A9D63
asw::settings::SettingsConfig::StorePathIni, xrefs: 00007FF7AC3AA089
sfx, xrefs: 00007FF7AC3A9B72
asw::settings::SettingsConfig::StorePathDef, xrefs: 00007FF7AC3AA0B9
\Logs\Update.log, xrefs: 00007FF7AC3A9D94
\Logs\Setup.log, xrefs: 00007FF7AC3A9D5C
sfxstorage, xrefs: 00007FF7AC3AA0F5
END: Avast installer/updater, return code {}, xrefs: 00007FF7AC3AA8DE

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Time$File$CriticalSectionSystem$Heap$EnterInformation__std_exception_destroy$AttributesCommandInitializeLeaveLineProcess_invalid_parameter_noinfo_noreturn
String ID: 13DA$A5C8$END: Avast installer/updater, return code {}$Logs$START: Avast installer/updater$\Logs\Clear.log$\Logs\Setup.log$\Logs\Update.log$asw::settings::SettingsConfig::StorePathDef$asw::settings::SettingsConfig::StorePathIni$clear$config.def$debug$sfx$sfxstorage
API String ID: 2117034901-3944194623
Opcode ID: ad61bd6dd8822def89542f175e1330c419c64824f180441524df7747ac616ff0
Instruction ID: dae5e3aa245c991a09bce2b025faa49e96ef9895f705cda262a4bb3707d5a97e
Opcode Fuzzy Hash: ad61bd6dd8822def89542f175e1330c419c64824f180441524df7747ac616ff0
Instruction Fuzzy Hash: C0A2A262A06FC5A9EB21EF34C8402EDB3A0FB54748F854136DA4D5BA79EF38D694C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC507190 Relevance: 23.1, APIs: 10, Strings: 2, Instructions: 2077encryptiontimethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC5071D6
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC507434
GetCurrentThreadId.KERNEL32 ref: 00007FF7AC50756E
GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC5076E0
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC507BDC
GetSystemTimes.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC507E57
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC5085DF
CryptAcquireContextW.ADVAPI32 ref: 00007FF7AC508AEB
CryptGenRandom.ADVAPI32 ref: 00007FF7AC508B13
CryptReleaseContext.ADVAPI32 ref: 00007FF7AC508D8F

Strings

@, xrefs: 00007FF7AC508AD3
Microsoft Base Cryptographic Provider v1.0, xrefs: 00007FF7AC508ADB

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Crypt$ContextCurrentSystemTime$AcquireCounterDiskFileFreeGlobalMemoryPerformanceProcessQueryRandomReleaseSpaceStatusThreadTimes
String ID: @$Microsoft Base Cryptographic Provider v1.0
API String ID: 1216455848-3036034798
Opcode ID: fa57735537a9b1017d61a1d15f725277dd4c5318cb6fc04052fa061541c975e5
Instruction ID: ed81dbceca75aa624b6cce3253d9656f9b79888bda87e5df64b42d210412e15a
Opcode Fuzzy Hash: fa57735537a9b1017d61a1d15f725277dd4c5318cb6fc04052fa061541c975e5
Instruction Fuzzy Hash: 821350B36186829BEB549F2CD45027AB7B0F796345FA5003AF38DC7699EB2DD904CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4F13C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC4FE054), ref: 00007FF7AC4F140B
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC4FE054), ref: 00007FF7AC4F141B

Part of subcall function 00007FF7AC55C7E4: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C7F4
Part of subcall function 00007FF7AC55C7E4: ReleaseSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C834

GetCurrentProcess.KERNEL32 ref: 00007FF7AC4F1458
NtQueryInformationProcess.NTDLL ref: 00007FF7AC4F147D

Part of subcall function 00007FF7AC55C850: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A85E1), ref: 00007FF7AC55C860

Strings

ntdll.dll, xrefs: 00007FF7AC4F1404
NtQueryInformationProcess, xrefs: 00007FF7AC4F1414

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ExclusiveLock$AcquireProcess$AddressCurrentHandleInformationModuleProcQueryRelease
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 259813251-2906145389
Opcode ID: 3f0f91a739c4d3d94a0e1eb81421d2eaac21fe05956b9cff31deb9a3a2afeb54
Instruction ID: 6105b75cd72c4622ab529305a404b413442ae544349bc2e4fd9c4fe87f408f72
Opcode Fuzzy Hash: 3f0f91a739c4d3d94a0e1eb81421d2eaac21fe05956b9cff31deb9a3a2afeb54
Instruction Fuzzy Hash: F9219332E1AA42A5EB51EB10E8511B5B3A5FF89B94FD21136EA5E43371DF3CE005C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC508F90 Relevance: 2.9, APIs: 2, Instructions: 380COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7AC508FC2

Part of subcall function 00007FF7AC55C850: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A85E1), ref: 00007FF7AC55C860

Part of subcall function 00007FF7AC507190: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-0000009F,00007FF7AC509003), ref: 00007FF7AC5071D6

Part of subcall function 00007FF7AC55C7E4: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C7F4
Part of subcall function 00007FF7AC55C7E4: ReleaseSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C834

LeaveCriticalSection.KERNEL32 ref: 00007FF7AC50951F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalSectionTime$EnterFileLeaveReleaseSystem
String ID:
API String ID: 516957425-0
Opcode ID: 41953c836ed5aa28c6a7ea5c3725346d4a3bed20ec0aa8e491f6388f4df98add
Instruction ID: 4522a4430b17ac293eee19d1e938c84d6e689cc0209953a3c1fa62bac435ec31
Opcode Fuzzy Hash: 41953c836ed5aa28c6a7ea5c3725346d4a3bed20ec0aa8e491f6388f4df98add
Instruction Fuzzy Hash: 5A02A472A1D6829BE705DB6CE850179F7A0FB95310F850039E68DC77A6EFACD504CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A8E28 Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 333
memorynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7AC3A8E2E
GetCurrentProcessId.KERNEL32 ref: 00007FF7AC3A8E4A

Part of subcall function 00007FF7AC500260: CreateFileW.KERNEL32 ref: 00007FF7AC50032C
Part of subcall function 00007FF7AC500260: GetLastError.KERNEL32 ref: 00007FF7AC50033F
Part of subcall function 00007FF7AC500260: CloseHandle.KERNEL32 ref: 00007FF7AC500419

InstupInit.INSTUP ref: 00007FF7AC3A8FC3
GetCommandLineW.KERNEL32 ref: 00007FF7AC3A907D
InstupRun.INSTUP ref: 00007FF7AC3A9086
EnterCriticalSection.KERNEL32 ref: 00007FF7AC3A90DD
TlsAlloc.KERNEL32 ref: 00007FF7AC3A90FC
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A9110
InternetGetConnectedState.WININET ref: 00007FF7AC3A91E1

Part of subcall function 00007FF7AC3A7900: __std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3A79D8

LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A9124
TlsGetValue.KERNEL32 ref: 00007FF7AC3A9130
LocalAlloc.KERNEL32 ref: 00007FF7AC3A9159
TlsSetValue.KERNEL32 ref: 00007FF7AC3A91B5
LocalFree.KERNEL32 ref: 00007FF7AC3A91CD
TlsGetValue.KERNEL32 ref: 00007FF7AC3A9281
InstupCleanup.INSTUP ref: 00007FF7AC3A92D1

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

TlsSetValue.KERNEL32 ref: 00007FF7AC3A92BE
LocalFree.KERNEL32 ref: 00007FF7AC3A92CB

Strings

', xrefs: 00007FF7AC3A935F
X, xrefs: 00007FF7AC3A903D
n, xrefs: 00007FF7AC3A934C
Cannot initialize Instup, return code {}, xrefs: 00007FF7AC3A9045
avast! Self-Defense trust was successfully acquired., xrefs: 00007FF7AC3A8EBC
A5C8, xrefs: 00007FF7AC3A9324
(, xrefs: 00007FF7AC3A924E
Error in Instup cleanup, return code {}, xrefs: 00007FF7AC3A9353
M, xrefs: 00007FF7AC3A8E98
Error returned by Instup, return code {}, xrefs: 00007FF7AC3A9242
ctx, xrefs: 00007FF7AC3A918C, 00007FF7AC3A91A0
avast! Self-Defense trust was not acquired. Code {}, xrefs: 00007FF7AC3A8F8B
13DA, xrefs: 00007FF7AC3A8E90

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Value$CriticalInstupLocalSection$AllocCurrentFreeLeaveProcess$CleanupCloseCommandConnectedCreateEnterErrorFileHandleInitInternetLastLineState__std_exception_destroy_invalid_parameter_noinfo
String ID: '$($13DA$A5C8$Cannot initialize Instup, return code {}$Error in Instup cleanup, return code {}$Error returned by Instup, return code {}$M$X$avast! Self-Defense trust was not acquired. Code {}$avast! Self-Defense trust was successfully acquired.$ctx$n
API String ID: 2420363499-3272715000
Opcode ID: be0a6f7bd777f0f877df24110c115ee8a66f78dec83dd417f836a9af4adb5508
Instruction ID: b8e08eb57cf59ad4fde0994850fe2ca3bd0fe200c2c42a8c1064154267375522
Opcode Fuzzy Hash: be0a6f7bd777f0f877df24110c115ee8a66f78dec83dd417f836a9af4adb5508
Instruction Fuzzy Hash: F6F19031E0AB42AAE700EB64E8406BDB3A1FB45744F964539DA0E577B4DF3CE844CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4F1940 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7AC4F1992

Strings

Unable to adjust token privilege '{}'!, xrefs: 00007FF7AC4F1BB2
Unable to lookup privilege '{}'!, xrefs: 00007FF7AC4F1B76
Unable to remove the impersonation token from the thread!, xrefs: 00007FF7AC4F190E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID: Unable to adjust token privilege '{}'!$Unable to lookup privilege '{}'!$Unable to remove the impersonation token from the thread!
API String ID: 3899507212-1021965375
Opcode ID: ed690c49e0bf829af4511c160d9430229ce9932dfad6710cc485c1fa25a6691e
Instruction ID: dc368498ba0891938ffbdd1d925005b380f04533b9c9843ea737beb3f02c7477
Opcode Fuzzy Hash: ed690c49e0bf829af4511c160d9430229ce9932dfad6710cc485c1fa25a6691e
Instruction Fuzzy Hash: BB519472B09B46A5EB10EB60E9503ADB3B5FB44B88F950032EA4D43A79DF3CD515C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FEC00 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF7AC4FEC56

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00007FF7AC4FEFAB
ProgramFiles, xrefs: 00007FF7AC4FF326
Unable to retrieve a path of the known folder ({})!, xrefs: 00007FF7AC4FF0E3, 00007FF7AC4FF12D, 00007FF7AC4FF16D, 00007FF7AC4FF1BC, 00007FF7AC4FF202, 00007FF7AC4FF250, 00007FF7AC4FF29B
Local AppData, xrefs: 00007FF7AC4FEF96
3, xrefs: 00007FF7AC4FF2A7
3, xrefs: 00007FF7AC4FF20E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: FolderPath
String ID: 3$3$Local AppData$ProgramFiles$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Unable to retrieve a path of the known folder ({})!
API String ID: 1514166925-2527072505
Opcode ID: 5ad6913c21f319c501deb90b04cdd61c4f27478e25e20fcc255519c35c236711
Instruction ID: 19b8be7ca2d3a4ca46ce9155859bd4a28bdfc142588ee68135317b2e99b94f0e
Opcode Fuzzy Hash: 5ad6913c21f319c501deb90b04cdd61c4f27478e25e20fcc255519c35c236711
Instruction Fuzzy Hash: 25A18272919BC6A2EB20EB10F4507EAB3A4FBC4744F911132E68D43AA9DF7CD645CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FCCE0 Relevance: 13.6, APIs: 9, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD10
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD1E
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD38
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD50
CreateDirectoryW.KERNEL32 ref: 00007FF7AC4FCDFF
CreateDirectoryW.KERNEL32 ref: 00007FF7AC4FCE32
GetLastError.KERNEL32 ref: 00007FF7AC4FCE3C
GetFileAttributesW.KERNEL32 ref: 00007FF7AC4FCE51
SetLastError.KERNEL32 ref: 00007FF7AC4FCE62

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$CreateDirectory$AttributesFile
String ID:
API String ID: 2650082360-0
Opcode ID: 19b1f99b811ab83084c1f30bea47b9700e0085b431ec0c79540f97e1c2b46c5e
Instruction ID: 66f96a1b3bb9d887bcd6ebc70c463006b3e72013944b9fd0804d56ecf7066667
Opcode Fuzzy Hash: 19b1f99b811ab83084c1f30bea47b9700e0085b431ec0c79540f97e1c2b46c5e
Instruction Fuzzy Hash: 7941D132E0DA81A1E720AF21E40017DA7A1EB85F98FD54131EA5E436B9DF3CE496C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC438A00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 185
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000007), ref: 00007FF7AC438A8E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000007), ref: 00007FF7AC438AA8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000007), ref: 00007FF7AC438B55

Part of subcall function 00007FF7AC55F230: RtlPcToFileHeader.NTDLL ref: 00007FF7AC55F280
Part of subcall function 00007FF7AC55F230: RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFE,00007FF7AC55A36A), ref: 00007FF7AC55F2C1

LockFileEx.KERNEL32 ref: 00007FF7AC438BDC
GetLastError.KERNEL32 ref: 00007FF7AC438BEB

Strings

couldn't obtain exclusive file lock, xrefs: 00007FF7AC438BF3
couldn't open file, xrefs: 00007FF7AC438B7E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateExceptionHandleHeaderLockRaise
String ID: couldn't obtain exclusive file lock$couldn't open file
API String ID: 3557019546-1370462906
Opcode ID: 4161c7c054975a9656f5271ce70bb22ca61778ace1a9903db281745346fe7512
Instruction ID: c67bb2851890092a536adf9133c515d2b247020637aad56a821595505e36fe3e
Opcode Fuzzy Hash: 4161c7c054975a9656f5271ce70bb22ca61778ace1a9903db281745346fe7512
Instruction Fuzzy Hash: 2A61A276A19B42A6E710EF14E8403A9F7A0FB847A8F914232EAAD437E5DF3DD445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC583950 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FF7AC584288,?,?,?,?,00007FF7AC57FBBD,?,?,?,?,00007FF7AC55A080), ref: 00007FF7AC583ACF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AC584288,?,?,?,?,00007FF7AC57FBBD,?,?,?,?,00007FF7AC55A080), ref: 00007FF7AC583ADB

Strings

ext-ms-, xrefs: 00007FF7AC583A2C
api-ms-, xrefs: 00007FF7AC583A19

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: e93aacc49461d32dc26f6f0034173139520bb090f443e84bbe61087ac6c34991
Instruction ID: 0534496a6f5b1d5f1722c40213c3e6fb6634514148084fe649660bb54b8930b4
Opcode Fuzzy Hash: e93aacc49461d32dc26f6f0034173139520bb090f443e84bbe61087ac6c34991
Instruction Fuzzy Hash: AF417C21B1BA0261FB02FB1AD904575A396FF45BD0FDA4135ED0E877A4EE3DE0458360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC502630 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

There is no resource section in module, xrefs: 00007FF7AC50266B
StringFileInfo, xrefs: 00007FF7AC502710, 00007FF7AC5028FC
Resource section is empty, xrefs: 00007FF7AC50269C
Unable to determine product identifier from resources!, xrefs: 00007FF7AC50297A

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID:
String ID: Resource section is empty$StringFileInfo$There is no resource section in module$Unable to determine product identifier from resources!
API String ID: 0-3023212541
Opcode ID: d1561d102b8fd0a2bbcc0e70d26fa40d9568f5e3c4aa53905ea6eabccc06b5cf
Instruction ID: 93deb415682d0eb280492a19fa332bdafe1a3f22ece537433eaa2eeeea3ffebb
Opcode Fuzzy Hash: d1561d102b8fd0a2bbcc0e70d26fa40d9568f5e3c4aa53905ea6eabccc06b5cf
Instruction Fuzzy Hash: 18A1E172A05B9186E710DB18E844369B7A1FB41BB4FA58325EABD837E4EF3CD485C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC503770 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32 ref: 00007FF7AC5037DC
RegCloseKey.KERNEL32 ref: 00007FF7AC50380C
SetLastError.KERNEL32 ref: 00007FF7AC503818

Part of subcall function 00007FF7AC55F230: RtlPcToFileHeader.NTDLL ref: 00007FF7AC55F280
Part of subcall function 00007FF7AC55F230: RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFE,00007FF7AC55A36A), ref: 00007FF7AC55F2C1

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AC5038B6

Strings

Cannot query registry value, xrefs: 00007FF7AC5037E2

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CloseErrorExceptionFileHeaderLastQueryRaiseValue__std_exception_copy
String ID: Cannot query registry value
API String ID: 1422943749-1100310711
Opcode ID: 02e0ac4e388c980c9f4ebb21afde93ec445046b5e4907cb375197d590281ffde
Instruction ID: ffe977ed708aceeb1f2a6f59ec71213dd94ded84fbaacee5a75946043ea016f9
Opcode Fuzzy Hash: 02e0ac4e388c980c9f4ebb21afde93ec445046b5e4907cb375197d590281ffde
Instruction Fuzzy Hash: 5541C372A09B4196EB10EF25E59026DB3A0FB88780FA15135EB8D43B68DF3CE554CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FBBA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AC4FBAD0: InitializeCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB11
Part of subcall function 00007FF7AC4FBAD0: DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB2A
Part of subcall function 00007FF7AC4FBAD0: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB87

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBBF4
FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBC15
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC4FBC3F

Strings

asw::lifetime::impl::lifetime_creation_monitor_holder::set_created, xrefs: 00007FF7AC4FBC60

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CriticalSection$ChangeCloseDeleteEnterEventFindInitializeLeaveNotification
String ID: asw::lifetime::impl::lifetime_creation_monitor_holder::set_created
API String ID: 2148637788-3605786268
Opcode ID: 9dd432d20c9328343f620b40d78ba352de4252280ab23e3a00d36ba4b100d6f4
Instruction ID: c76fe86c70bfacb5db246d82337e5601acdbadc767c571270edc6df0d510b9a1
Opcode Fuzzy Hash: 9dd432d20c9328343f620b40d78ba352de4252280ab23e3a00d36ba4b100d6f4
Instruction Fuzzy Hash: 5921F432A0AB46A2EB00FB20E85417AB360FF88B84F964131EA1D43675DF2CE491C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3AE280 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AC3A72B0: CloseHandle.KERNEL32(?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC3A7310
Part of subcall function 00007FF7AC3A72B0: LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A7351

WaitForSingleObject.KERNEL32 ref: 00007FF7AC3AE39D
CloseHandle.KERNEL32 ref: 00007FF7AC3AE3BF

Part of subcall function 00007FF7AC4FBBA0: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBBF4
Part of subcall function 00007FF7AC4FBBA0: FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBC15
Part of subcall function 00007FF7AC4FBBA0: LeaveCriticalSection.KERNEL32 ref: 00007FF7AC4FBC3F

Strings

lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00007FF7AC3AE3FE, 00007FF7AC3AE41F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Close$CriticalHandleLeaveSection$ChangeEventFindNotificationObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 2569023850-2706815617
Opcode ID: ab2fb0127242beeae68b85312b0cfc8a17d964d1bf1154567057026e5113ad96
Instruction ID: 43079c30b08176ce3f6f813052333818f0d62c084e8a8fef1690a2487900a148
Opcode Fuzzy Hash: ab2fb0127242beeae68b85312b0cfc8a17d964d1bf1154567057026e5113ad96
Instruction Fuzzy Hash: 98517132A1AB41E9EB10EF20D4401EDB3A5FB44748F961539EB4D07BA9DF38E566C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3AE440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AC3A72B0: CloseHandle.KERNEL32(?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC3A7310
Part of subcall function 00007FF7AC3A72B0: LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A7351

WaitForSingleObject.KERNEL32 ref: 00007FF7AC3AE55D
CloseHandle.KERNEL32 ref: 00007FF7AC3AE57F

Part of subcall function 00007FF7AC4FBBA0: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBBF4
Part of subcall function 00007FF7AC4FBBA0: FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC3AE541), ref: 00007FF7AC4FBC15
Part of subcall function 00007FF7AC4FBBA0: LeaveCriticalSection.KERNEL32 ref: 00007FF7AC4FBC3F

Strings

lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00007FF7AC3AE5BE, 00007FF7AC3AE5DF

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Close$CriticalHandleLeaveSection$ChangeEventFindNotificationObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 2569023850-2706815617
Opcode ID: 55b6512206c000e03b6f4d218f88aeb9f434fe62bd0e58d38b2103d398f83083
Instruction ID: 935220a8a5ed7f59506794e20ea9741ae0d447d9244a1a621e33ce90294473f8
Opcode Fuzzy Hash: 55b6512206c000e03b6f4d218f88aeb9f434fe62bd0e58d38b2103d398f83083
Instruction Fuzzy Hash: 06518432A16B41E9EB10EF20E4401EDB3A5FB44748F961535EB4D07BA9EF38E566C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55F230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlPcToFileHeader.NTDLL ref: 00007FF7AC55F280
RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFE,00007FF7AC55A36A), ref: 00007FF7AC55F2C1

Strings

csm, xrefs: 00007FF7AC55F2AE

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 93875e533b80c5b33e1e0c7099ddd82550034a01b900a24934021f87f93a35b1
Instruction ID: 50c47e8e1b586155d39015c5c459aae147c0ecdf6be71bdba51421883fbc9c26
Opcode Fuzzy Hash: 93875e533b80c5b33e1e0c7099ddd82550034a01b900a24934021f87f93a35b1
Instruction Fuzzy Hash: 90116076609B4592EB209F15F90026AB7E0FB88B84FA94230FF8C07B69DF3CC5518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3AC470 Relevance: 3.3, APIs: 2, Instructions: 301COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3AC50A

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2bdab512405c68312a00e5ea636ffdd290b5a149c5f76514621f88ddbe62b964
Instruction ID: 5c17e6bb81cf54789021423c777d0656d86316a0c1d104ba532d376941660128
Opcode Fuzzy Hash: 2bdab512405c68312a00e5ea636ffdd290b5a149c5f76514621f88ddbe62b964
Instruction Fuzzy Hash: 40B11772A05B8091DB14AF26E50426CB3A5FB44BE4F598635DB7C07BE5DF7EE4A08340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A7900 Relevance: 3.1, APIs: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3A79D8
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3A7A07

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: __std_exception_destroy
String ID:
API String ID: 2453523683-0
Opcode ID: 8ba9aa2a4e7f67bf66e5fc9569850e7a9caad549f82e1d5dd7adf39494361ba8
Instruction ID: a85ced782e7eb73db103f86fb0aa46c60e3742c7f0515f3dd52566c02e8506e4
Opcode Fuzzy Hash: 8ba9aa2a4e7f67bf66e5fc9569850e7a9caad549f82e1d5dd7adf39494361ba8
Instruction Fuzzy Hash: 42418132A0AB41D6EB10DB16D58063DF3A4FB45B90FAA813ADA9D43760DF3ED851C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B9310 Relevance: 2.5, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDF80B934B
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B936C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 68c330fe6670181e2a730212d2b734b7f1becf170376018d40afb2a0a558a6e8
Instruction ID: b13a61a1c8f11fe60008389fb73043db8e8006fa6fdb21fbca2018748b2e2762
Opcode Fuzzy Hash: 68c330fe6670181e2a730212d2b734b7f1becf170376018d40afb2a0a558a6e8
Instruction Fuzzy Hash: A3F06221B1878182DB18DB16F55556E67A0EB89BC0F981030EEAD43B98EE3CD4909B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55C8D8 Relevance: 1.6, APIs: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC55C908

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f05b859e722efe2ab98d1bfa31860fd92849cb151de5480d1fc5f14489abbb37
Instruction ID: 4b201fc449cf40a8db138469fee0c0b17d6fafe116ea8fdae7510dc953ed042e
Opcode Fuzzy Hash: f05b859e722efe2ab98d1bfa31860fd92849cb151de5480d1fc5f14489abbb37
Instruction Fuzzy Hash: 6B510871D1E20666F715EF25E446335BA90EB09390FA25139F6AD43BB1DE3CF8508B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC542A50 Relevance: 1.5, APIs: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC445BD0: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C26
Part of subcall function 00007FF7AC445BD0: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C3B

GetSystemTimes.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7AC3A3257), ref: 00007FF7AC542A81

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProcSystemTimes
String ID:
API String ID: 368006440-0
Opcode ID: 36025f84aa50649acd6f11ae2b9d4fa7be7672b16cd9358470827b4423444915
Instruction ID: 87e581fc7fd086ff3292942a3f97b6c553435d4cd608eeaca8b2377789d1cd44
Opcode Fuzzy Hash: 36025f84aa50649acd6f11ae2b9d4fa7be7672b16cd9358470827b4423444915
Instruction Fuzzy Hash: 40119476619B848AC764DF15F49045AB7A1F7CCB88B50522AFA8E83B28DF3CD654CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC5809D0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7AC5825DA,?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC580A25

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 84d85e1ccbbe0f9afc68a6ec186aea587bdc816e6567106437ab46a9947dfea7
Instruction ID: 64b756bbe3f2075a34960c8c0ac6c7c04cf8e111d03b70087fd9027741bba243
Opcode Fuzzy Hash: 84d85e1ccbbe0f9afc68a6ec186aea587bdc816e6567106437ab46a9947dfea7
Instruction Fuzzy Hash: D2F06254B4B307A1FE54776296112B592C09FC8B81FEE5432E90E867F2ED1CE5819730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC580B3C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7AC585F49,?,?,00000000,00007FF7AC580997,?,?,?,00007FF7AC5804B7,?,?,?,00007FF7AC5803AD), ref: 00007FF7AC580B7A

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1f30cb8872701429da35b61176d857d9ea2083c022aa2d567f3bf12d41318aaf
Instruction ID: aee3ae5415a673955065c8e8bf11ad5dfe66931dda7e8d1e4897850f118a69c8
Opcode Fuzzy Hash: 1f30cb8872701429da35b61176d857d9ea2083c022aa2d567f3bf12d41318aaf
Instruction Fuzzy Hash: ACF03054F0B306A5FE5437615A0127991C05F84BAAFAA4A30F92E452E1DE2CE4409734

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837BDD4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FFDF83861C1,?,?,00000000,00007FFDF837575F,?,?,?,00007FFDF837A88F,?,?,?,00007FFDF837A785), ref: 00007FFDF837BE12

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a863322afd983e3cfd97970bcd1aadd9155acc746af44e1472394843e53131e9
Instruction ID: 611577874d90d1a44ccdca1a0607369fd35a5e4d0094204ba3d3e6972771211e
Opcode Fuzzy Hash: a863322afd983e3cfd97970bcd1aadd9155acc746af44e1472394843e53131e9
Instruction Fuzzy Hash: 96F03A20F0C20646FB583A617861A7C51E15F447A1F5C4630DB3EC67E9EE6CE440615B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1A70 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7AC3A1A93

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 06a38cd6b763722a2837df46c729e912678b70657e6abf6c598ac965c28e9bf1
Instruction ID: 45a0f0c2d5770ae2ae221f885222cbe4ba0602da6112a0540b378e1f99a8d09a
Opcode Fuzzy Hash: 06a38cd6b763722a2837df46c729e912678b70657e6abf6c598ac965c28e9bf1
Instruction Fuzzy Hash: C9E01A31E1A646E5FA61FB24E8663B9B360FB89344FD20036E64D56771DE2CE0058B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8334144 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2595005f0834aceb0ed1fac787210b200394326058b962bd28a268667c017e2c
Instruction ID: fff146639ba85f095b4c2118a7b700c32e07ae528b84cbc8d11d58cfcba455ca
Opcode Fuzzy Hash: 2595005f0834aceb0ed1fac787210b200394326058b962bd28a268667c017e2c
Instruction Fuzzy Hash: DDD06C00F19A1702FB7A33A119329B904C45F35771E1D0B30A83DC52FAAD1CA481A25B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A3230 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7AC3A323B

Part of subcall function 00007FF7AC445BD0: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C26
Part of subcall function 00007FF7AC445BD0: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C3B

Part of subcall function 00007FF7AC542A50: GetSystemTimes.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7AC3A3257), ref: 00007FF7AC542A81

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressCriticalHandleInitializeModuleProcSectionSystemTimes
String ID:
API String ID: 1646434232-0
Opcode ID: f1c9cc6927b916c8238c627b2e5b928b3550474ba0a81561b731deaf227d2586
Instruction ID: f9d9dfe855059a86533e25c0582d4932fd2a6705b116c437a354d2c5b02a6ce6
Opcode Fuzzy Hash: f1c9cc6927b916c8238c627b2e5b928b3550474ba0a81561b731deaf227d2586
Instruction Fuzzy Hash: 16F0FF11D2EA86A1E602EB24ED65175A361BFA9304FE37231E94D41172AF2CF2D5C320

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFDF80F29D0 Relevance: 49.4, APIs: 21, Strings: 7, Instructions: 404registryCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32 ref: 00007FFDF80F2A41
GetStockObject.GDI32 ref: 00007FFDF80F2A4E
RegisterClassExA.USER32 ref: 00007FFDF80F2A74
GetVersionExA.KERNEL32 ref: 00007FFDF80F2ADB
GetVersionExA.KERNEL32 ref: 00007FFDF80F2AF2
LoadCursorA.USER32 ref: 00007FFDF80F2C13
GetStockObject.GDI32 ref: 00007FFDF80F2C20
RegisterClassExA.USER32 ref: 00007FFDF80F2C46
GetVersionExA.KERNEL32 ref: 00007FFDF80F2C95
GetVersionExA.KERNEL32 ref: 00007FFDF80F2CAC
LoadCursorA.USER32 ref: 00007FFDF80F2DD1
GetStockObject.GDI32 ref: 00007FFDF80F2DE1
RegisterClassExA.USER32 ref: 00007FFDF80F2E07
LoadCursorA.USER32 ref: 00007FFDF80F2E3A
GetStockObject.GDI32 ref: 00007FFDF80F2E47
RegisterClassA.USER32 ref: 00007FFDF80F2E68
GetVersionExA.KERNEL32 ref: 00007FFDF80F2EB7
GetVersionExA.KERNEL32 ref: 00007FFDF80F2ECE
LoadCursorA.USER32 ref: 00007FFDF80F2FE7
GetStockObject.GDI32 ref: 00007FFDF80F2FF7
RegisterClassA.USER32 ref: 00007FFDF80F3018

Strings

-HTMLAYOUT-POPUP, xrefs: 00007FFDF80F2DF6
P, xrefs: 00007FFDF80F2D9F
HTMLAYOUT, xrefs: 00007FFDF80F2A54, 00007FFDF80F3046
HTMLAYOUT-POPUP, xrefs: 00007FFDF80F2C35
(@, xrefs: 00007FFDF80F2A2F
HTMLAYOUT-TOOL, xrefs: 00007FFDF80F2E5C
-HTMLAYOUT-TOOL, xrefs: 00007FFDF80F300C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Version$ClassCursorLoadObjectRegisterStock
String ID: (@$-HTMLAYOUT-POPUP$-HTMLAYOUT-TOOL$HTMLAYOUT$HTMLAYOUT-POPUP$HTMLAYOUT-TOOL$P
API String ID: 2620246556-1650735011
Opcode ID: 4bcf85258f5375545c7f721fa82571aa8ea3369c4c1f0ad3e1ac71c2c660e45d
Instruction ID: d3178e9a2326d10107492fbe9c95dc11a2e76d0c169d8e5d6034edf7960df171
Opcode Fuzzy Hash: 4bcf85258f5375545c7f721fa82571aa8ea3369c4c1f0ad3e1ac71c2c660e45d
Instruction Fuzzy Hash: 74122132F1C68387F7208B54E8606B973E4EB95344F544135EAAD866ECDF7CE580AB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F3050 Relevance: 49.4, APIs: 21, Strings: 7, Instructions: 400registryCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32 ref: 00007FFDF80F30B9
GetStockObject.GDI32 ref: 00007FFDF80F30C7
RegisterClassW.USER32 ref: 00007FFDF80F30E8
GetVersionExA.KERNEL32 ref: 00007FFDF80F3147
GetVersionExA.KERNEL32 ref: 00007FFDF80F315E
LoadCursorA.USER32 ref: 00007FFDF80F327F
GetStockObject.GDI32 ref: 00007FFDF80F328C
RegisterClassW.USER32 ref: 00007FFDF80F32AD
GetVersionExA.KERNEL32 ref: 00007FFDF80F32FC
GetVersionExA.KERNEL32 ref: 00007FFDF80F3313
LoadCursorA.USER32 ref: 00007FFDF80F3438
GetStockObject.GDI32 ref: 00007FFDF80F3448
RegisterClassExW.USER32 ref: 00007FFDF80F346E
LoadCursorA.USER32 ref: 00007FFDF80F34A1
GetStockObject.GDI32 ref: 00007FFDF80F34AE
RegisterClassW.USER32 ref: 00007FFDF80F34CF
GetVersionExA.KERNEL32 ref: 00007FFDF80F351E
GetVersionExA.KERNEL32 ref: 00007FFDF80F3535
LoadCursorA.USER32 ref: 00007FFDF80F364E
GetStockObject.GDI32 ref: 00007FFDF80F365E
RegisterClassW.USER32 ref: 00007FFDF80F367F

Strings

-HTMLAYOUT-TOOL-W, xrefs: 00007FFDF80F3673
(@, xrefs: 00007FFDF80F30A7
HTMLAYOUT-TOOL-W, xrefs: 00007FFDF80F34C3
HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80F32A1
P, xrefs: 00007FFDF80F3406
-HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80F345D
HTMLAYOUT-W, xrefs: 00007FFDF80F30CD, 00007FFDF80F36AD

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Version$ClassCursorLoadObjectRegisterStock
String ID: (@$-HTMLAYOUT-POPUP-W$-HTMLAYOUT-TOOL-W$HTMLAYOUT-POPUP-W$HTMLAYOUT-TOOL-W$HTMLAYOUT-W$P
API String ID: 2620246556-2858749733
Opcode ID: e1ff05cffae27ee595081eb6c19b275901260582f90e83d50f730d29e4cc16d0
Instruction ID: 4e729f9e447fbe77ed7be8e32022513088896eb3444624f9c52e87b95221d481
Opcode Fuzzy Hash: e1ff05cffae27ee595081eb6c19b275901260582f90e83d50f730d29e4cc16d0
Instruction Fuzzy Hash: F0125231F0C68286F7608B24E86067D73E0FB95754F558135E6AD8A6ECDF3CE580AB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FDF90 Relevance: 44.1, APIs: 13, Strings: 12, Instructions: 371fileCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF7AC4FE1F1

Part of subcall function 00007FF7AC55C850: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A85E1), ref: 00007FF7AC55C860

GetFileVersionInfoW.VERSION ref: 00007FF7AC4FE22A
VerQueryValueW.VERSION ref: 00007FF7AC4FE252

Part of subcall function 00007FF7AC55C7E4: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C7F4
Part of subcall function 00007FF7AC55C7E4: ReleaseSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A861C), ref: 00007FF7AC55C834

Part of subcall function 00007FF7AC55F230: RtlPcToFileHeader.NTDLL ref: 00007FF7AC55F280
Part of subcall function 00007FF7AC55F230: RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFE,00007FF7AC55A36A), ref: 00007FF7AC55F2C1

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC4FE351
GetLastError.KERNEL32 ref: 00007FF7AC4FE37F
GetLastError.KERNEL32 ref: 00007FF7AC4FE3B0
GetLastError.KERNEL32 ref: 00007FF7AC4FE3E0
GetLastError.KERNEL32 ref: 00007FF7AC4FE410
CreateFileW.KERNEL32 ref: 00007FF7AC4FE518
WriteFile.KERNEL32 ref: 00007FF7AC4FE54A
CloseHandle.KERNEL32 ref: 00007FF7AC4FE557
GetLastError.KERNEL32 ref: 00007FF7AC4FE579
GetLastError.KERNEL32 ref: 00007FF7AC4FE5C8

Strings

GetFileVersionInfoSizeW, xrefs: 00007FF7AC4FE387
VerQueryValueW, xrefs: 00007FF7AC4FE3E8
asw, xrefs: 00007FF7AC4FE0A7
Unable to make a .sys copy, xrefs: 00007FF7AC4FE357
set_file_content '{}', xrefs: 00007FF7AC4FE5CE
6, xrefs: 00007FF7AC4FE307
GetFileVersionInfoW, xrefs: 00007FF7AC4FE3B8
VerQueryValueW signature is invalid, xrefs: 00007FF7AC4FE418
Cannot query a .sys file version from PPL process '{}', xrefs: 00007FF7AC4FE2F8
set_file_content, xrefs: 00007FF7AC4FE582
tmp, xrefs: 00007FF7AC4FE074
set_file_content content is too large, xrefs: 00007FF7AC4FE5A5

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$File$ExclusiveLock$AcquireInfoVersion$CloseCreateExceptionHandleHeaderQueryRaiseReleaseSizeValueWrite_invalid_parameter_noinfo_noreturn
String ID: 6$Cannot query a .sys file version from PPL process '{}'$GetFileVersionInfoSizeW$GetFileVersionInfoW$Unable to make a .sys copy$VerQueryValueW$VerQueryValueW signature is invalid$asw$set_file_content$set_file_content '{}'$set_file_content content is too large$tmp
API String ID: 3080410690-613824156
Opcode ID: 34bf942f27b29e8d6ce452b2db0d8057a77923a3b3e35dbb629312734e5fad24
Instruction ID: aaa4aee34d7f663f76694b179a904335de6f5cd14da7a8d1d3e8c134608955d0
Opcode Fuzzy Hash: 34bf942f27b29e8d6ce452b2db0d8057a77923a3b3e35dbb629312734e5fad24
Instruction Fuzzy Hash: E302C472A1AB82A1EB21EB14E8403EEB361FB85784FD15132E68D436B5DF3CE545C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6F8C Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 428windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FFDF80B6FAF
BeginPaint.USER32 ref: 00007FFDF80B701C

Part of subcall function 00007FFDF8135540: CreateDIBSection.GDI32 ref: 00007FFDF81355AE

SetWindowOrgEx.GDI32 ref: 00007FFDF80B71D3
CreateCompatibleDC.GDI32 ref: 00007FFDF80B723A
SelectObject.GDI32 ref: 00007FFDF80B724D
BitBlt.GDI32 ref: 00007FFDF80B7292
SelectObject.GDI32 ref: 00007FFDF80B729E
DeleteDC.GDI32 ref: 00007FFDF80B72A7
EndPaint.USER32 ref: 00007FFDF80B72B4
GetWindowLongA.USER32 ref: 00007FFDF80B7331
BeginPaint.USER32 ref: 00007FFDF80B736C
EndPaint.USER32 ref: 00007FFDF80B7379
GetWindowLongA.USER32 ref: 00007FFDF80B7394
EndPaint.USER32 ref: 00007FFDF80B7509

Part of subcall function 00007FFDF80B6C80: GetParent.USER32 ref: 00007FFDF80B6CAD
Part of subcall function 00007FFDF80B6C80: IsWindow.USER32 ref: 00007FFDF80B6CB9
Part of subcall function 00007FFDF80B6C80: MapWindowPoints.USER32 ref: 00007FFDF80B6CE9
Part of subcall function 00007FFDF80B6C80: GetClipBox.GDI32 ref: 00007FFDF80B6CF7
Part of subcall function 00007FFDF80B6C80: SaveDC.GDI32 ref: 00007FFDF80B6D00
Part of subcall function 00007FFDF80B6C80: GetWindowLongA.USER32 ref: 00007FFDF80B6D10
Part of subcall function 00007FFDF80B6C80: GetWindowRect.USER32 ref: 00007FFDF80B6D24
Part of subcall function 00007FFDF80B6C80: SetViewportOrgEx.GDI32 ref: 00007FFDF80B6D4F
Part of subcall function 00007FFDF80B6C80: SetLayout.GDI32 ref: 00007FFDF80B6D5D
Part of subcall function 00007FFDF80B6C80: SendMessageA.USER32 ref: 00007FFDF80B6D97
Part of subcall function 00007FFDF80B6C80: SendMessageA.USER32 ref: 00007FFDF80B6DB1
Part of subcall function 00007FFDF80B6C80: RestoreDC.GDI32 ref: 00007FFDF80B6DBC

BeginPaint.USER32 ref: 00007FFDF80B73AB

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

BeginPaint.USER32 ref: 00007FFDF80B76D8
EndPaint.USER32 ref: 00007FFDF80B76E5
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Strings

, xrefs: 00007FFDF80B7269

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ObjectPaint$Window$Select$Begin$LongStock$CreateMessageRectSectionSend$AlignClientClipCompatibleCriticalDeleteLayoutLeaveModeParentPointsRestoreSaveTextViewport
String ID:
API String ID: 401802432-3916222277
Opcode ID: 007d4f0a41bd7e2f3f22e8f6122a1ca4e22b1cd165f78c9556d1a2e748fe9028
Instruction ID: fefdfbfafa626d7ef8dd4f719465c093bee9eac4cf337c9aa45c78f8785f8dba
Opcode Fuzzy Hash: 007d4f0a41bd7e2f3f22e8f6122a1ca4e22b1cd165f78c9556d1a2e748fe9028
Instruction Fuzzy Hash: FD224C72B14BC18ADB24DF34D8A0AE833A0FB84758F404235DA5D9BBA9DF38D645E705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A7AA0 Relevance: 33.6, APIs: 8, Strings: 11, Instructions: 316processCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF7AC3A7BC3
GetFileAttributesW.KERNEL32 ref: 00007FF7AC3A7CB8
CreateProcessW.KERNEL32 ref: 00007FF7AC3A7F54
CloseHandle.KERNEL32 ref: 00007FF7AC3A7F65
CloseHandle.KERNEL32 ref: 00007FF7AC3A7F72

Part of subcall function 00007FF7AC3A7900: __std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3A79D8

GetLastError.KERNEL32 ref: 00007FF7AC3A7FF1
GetLastError.KERNEL32 ref: 00007FF7AC3A8012
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3A805A

Strings

C1AF, xrefs: 00007FF7AC3A7F85
epor, xrefs: 00007FF7AC3A7F97
37C8, xrefs: 00007FF7AC3A7CFD
bugr, xrefs: 00007FF7AC3A7D19
t, xrefs: 00007FF7AC3A7CF5
@, xrefs: 00007FF7AC3A7F40
bugr, xrefs: 00007FF7AC3A7F8D
6, xrefs: 00007FF7AC3A7D07
epor, xrefs: 00007FF7AC3A7CED
--guid , xrefs: 00007FF7AC3A7EBB
Bugreporter dumper doesn't exist in path ', xrefs: 00007FF7AC3A7D31

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AttributesCloseErrorFileHandleLast$CreateProcess__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: --guid $37C8$6$@$Bugreporter dumper doesn't exist in path '$C1AF$bugr$bugr$epor$epor$t
API String ID: 1408558107-1922087432
Opcode ID: 9031a0d8c5c3187c810398d1983c9c907cc8ebcd160b8efa47dd475b84c9f18f
Instruction ID: 02fd78ca977b8d471fc93506810e83c33bf2d7047eb928000872b4cdd12a7ce1
Opcode Fuzzy Hash: 9031a0d8c5c3187c810398d1983c9c907cc8ebcd160b8efa47dd475b84c9f18f
Instruction Fuzzy Hash: EAF1A432915FC5E9E720EF20D8407EDB360FB95748F815239EA4D4AAA9DF78D294C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EF890 Relevance: 33.4, APIs: 22, Instructions: 421COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FFDF80EF94C
GetWindowLongPtrA.USER32 ref: 00007FFDF80EF95A
SetWindowOrgEx.GDI32 ref: 00007FFDF80EFA9C
GetWindowLongPtrA.USER32 ref: 00007FFDF80EFBCE
GetParent.USER32 ref: 00007FFDF80EFBDA
SetWindowLongPtrA.USER32 ref: 00007FFDF80EFBEF
GetWindowLongPtrA.USER32 ref: 00007FFDF80EFC6E
GetWindowLongPtrA.USER32 ref: 00007FFDF80EFCF4
GetClientRect.USER32 ref: 00007FFDF80EFD1B
GetStockObject.GDI32 ref: 00007FFDF80EFD23
FillRect.USER32 ref: 00007FFDF80EFD33
GetWindowLongPtrA.USER32 ref: 00007FFDF80EFD41
SetWindowOrgEx.GDI32 ref: 00007FFDF80EFE49

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$Long$Rect$Client$FillObjectParentStock
String ID:
API String ID: 116929244-0
Opcode ID: 83d4e0bf6598a12f68106ffd508de36e987e112b72fc03b1ab5515557e51eb40
Instruction ID: ca9df366d0268eb0cf6c491a0825dedaea2397923606efafe1968e6a8b46bcd2
Opcode Fuzzy Hash: 83d4e0bf6598a12f68106ffd508de36e987e112b72fc03b1ab5515557e51eb40
Instruction Fuzzy Hash: 26125B72B14B828AEB14DF65D8605BD33A0FB89B94F444235DE6E57BA8DF38E580D304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F0720 Relevance: 31.9, APIs: 21, Instructions: 393windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FFDF80F07CF
GetWindowLongPtrA.USER32 ref: 00007FFDF80F07DD
SetWindowOrgEx.GDI32 ref: 00007FFDF80F091F
SetTextAlign.GDI32 ref: 00007FFDF80F0982
SelectObject.GDI32 ref: 00007FFDF80F09BB
DeleteObject.GDI32 ref: 00007FFDF80F09C9
SelectObject.GDI32 ref: 00007FFDF80F09D7
DeleteObject.GDI32 ref: 00007FFDF80F09E5
SelectObject.GDI32 ref: 00007FFDF80F09F3
ReleaseDC.USER32 ref: 00007FFDF80F0A05
GetWindowLongPtrA.USER32 ref: 00007FFDF80F0A51
GetParent.USER32 ref: 00007FFDF80F0A5D
SetWindowLongPtrA.USER32 ref: 00007FFDF80F0A72
GetWindowLongPtrA.USER32 ref: 00007FFDF80F0B21
GetClientRect.USER32 ref: 00007FFDF80F0B48
GetStockObject.GDI32 ref: 00007FFDF80F0B50
FillRect.USER32 ref: 00007FFDF80F0B60
GetWindowLongPtrA.USER32 ref: 00007FFDF80F0B6E
SetWindowOrgEx.GDI32 ref: 00007FFDF80F0C76
GetParent.USER32 ref: 00007FFDF80F0D0E
SendMessageA.USER32 ref: 00007FFDF80F0D1F

Part of subcall function 00007FFDF80B5E80: BeginPaint.USER32 ref: 00007FFDF80B5EC0
Part of subcall function 00007FFDF80B5E80: GetClientRect.USER32 ref: 00007FFDF80B5EF4
Part of subcall function 00007FFDF80B5E80: CreateCompatibleDC.GDI32 ref: 00007FFDF80B5EFE
Part of subcall function 00007FFDF80B5E80: LPtoDP.GDI32 ref: 00007FFDF80B5F22
Part of subcall function 00007FFDF80B5E80: CreateCompatibleBitmap.GDI32 ref: 00007FFDF80B5F3D
Part of subcall function 00007FFDF80B5E80: SelectObject.GDI32 ref: 00007FFDF80B5F50
Part of subcall function 00007FFDF80B5E80: GetStockObject.GDI32 ref: 00007FFDF80B5F5F
Part of subcall function 00007FFDF80B5E80: SelectObject.GDI32 ref: 00007FFDF80B5F6F
Part of subcall function 00007FFDF80B5E80: GetMapMode.GDI32 ref: 00007FFDF80B5F7D
Part of subcall function 00007FFDF80B5E80: SetMapMode.GDI32 ref: 00007FFDF80B5F8C
Part of subcall function 00007FFDF80B5E80: GetWindowExtEx.GDI32 ref: 00007FFDF80B5F9B
Part of subcall function 00007FFDF80B5E80: SetWindowExtEx.GDI32 ref: 00007FFDF80B5FB4
Part of subcall function 00007FFDF80B5E80: GetViewportExtEx.GDI32 ref: 00007FFDF80B5FC3
Part of subcall function 00007FFDF80B5E80: SetViewportExtEx.GDI32 ref: 00007FFDF80B5FDC
Part of subcall function 00007FFDF80B5E80: DPtoLP.GDI32 ref: 00007FFDF80B5FF0
Part of subcall function 00007FFDF80B5E80: SetViewportOrgEx.GDI32 ref: 00007FFDF80B600C

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Window$Select$LongStock$Rect$ClientModeViewport$AlignCompatibleCreateDeleteParentText$BeginBitmapFillMessagePaintReleaseSend
String ID:
API String ID: 557926025-0
Opcode ID: 4ead9d91b0981e1a9dc0a3d0b6d44c0078a6e14e5c95bc4d313ebb62f661c09c
Instruction ID: 30e12e49bc4bd3db033b2fe746e533c9c0753d6159e11b20b852786b01b1f95b
Opcode Fuzzy Hash: 4ead9d91b0981e1a9dc0a3d0b6d44c0078a6e14e5c95bc4d313ebb62f661c09c
Instruction Fuzzy Hash: 80124C32B15B828AEB14DF75D8605AC33A0FB88794F449235EE6D53BA8DF38E584D704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BE890 Relevance: 22.7, APIs: 15, Instructions: 199timekeyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 00007FFDF80BE918
GetDoubleClickTime.USER32 ref: 00007FFDF80BE94B
SetTimer.USER32 ref: 00007FFDF80BE966
KillTimer.USER32 ref: 00007FFDF80BE8F4

Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF14
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF28
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF3E

GetAsyncKeyState.USER32 ref: 00007FFDF80BE9B3
KillTimer.USER32 ref: 00007FFDF80BE9F0

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AsyncState$Timer$Kill$ClickDoubleTime
String ID:
API String ID: 1542649206-0
Opcode ID: c78836339f50b7761ccd296e39af06ab887935f78ba4712e3767a92d4b997012
Instruction ID: d7ce204e24afe9d05130777652f59e407083574c3b35dbbca4c6963643d40f4b
Opcode Fuzzy Hash: c78836339f50b7761ccd296e39af06ab887935f78ba4712e3767a92d4b997012
Instruction Fuzzy Hash: 77918F76B14A4286EF14AF75E864ABD23A1FB48B94F004135CE6E877E8DF3CE0459345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B6850 Relevance: 16.7, APIs: 10, Strings: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B6899
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B68A0
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B68CA
HeapAlloc.KERNEL32 ref: 00007FF7AC3B6926
HeapAlloc.KERNEL32 ref: 00007FF7AC3B6969
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B6987
HeapFree.KERNEL32 ref: 00007FF7AC3B69DF
HeapFree.KERNEL32 ref: 00007FF7AC3B6A09
HeapFree.KERNEL32 ref: 00007FF7AC3B6A42
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B6A54

Strings

asw::settings::SettingsConfig::Lock, xrefs: 00007FF7AC3B69B2

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$Free$CriticalSection$Alloc$ClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep
String ID: asw::settings::SettingsConfig::Lock
API String ID: 2061331858-4244600543
Opcode ID: 1a24c86d375ef18f977248080338c17249c0e7665b37ad9727d5d0d3d20a78e1
Instruction ID: f6a04121c86ced6fa6ece177e4c44831b13a4e502be940b12df7499c49e510ba
Opcode Fuzzy Hash: 1a24c86d375ef18f977248080338c17249c0e7665b37ad9727d5d0d3d20a78e1
Instruction Fuzzy Hash: E3718F66E0AF42E5EB04FB61D8106B9B3B0AF48788F924535E91D12AB6DF3CE545C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4F9C10 Relevance: 16.7, APIs: 10, Strings: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC4F9C59
GetProcessHeap.KERNEL32 ref: 00007FF7AC4F9C60
GetProcessHeap.KERNEL32 ref: 00007FF7AC4F9C8A
HeapAlloc.KERNEL32 ref: 00007FF7AC4F9CE6
HeapAlloc.KERNEL32 ref: 00007FF7AC4F9D29
GetProcessHeap.KERNEL32 ref: 00007FF7AC4F9D47
HeapFree.KERNEL32 ref: 00007FF7AC4F9D9E
HeapFree.KERNEL32 ref: 00007FF7AC4F9DC8
HeapFree.KERNEL32 ref: 00007FF7AC4F9E01
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC4F9E13

Strings

asw::log::context::TlsIndex, xrefs: 00007FF7AC4F9D71

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$Free$CriticalSection$Alloc$ClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep
String ID: asw::log::context::TlsIndex
API String ID: 2061331858-143919551
Opcode ID: 35f3829cd99490305ba84810ce0e5bb8c5a7c545e5e8e634f087e8ca1b9a74b5
Instruction ID: 36e01c96a0c5a7d7ef965769542750d948f8dddba8d0bb659de434c7650cbedf
Opcode Fuzzy Hash: 35f3829cd99490305ba84810ce0e5bb8c5a7c545e5e8e634f087e8ca1b9a74b5
Instruction Fuzzy Hash: 5D71B022E0AB42E5EB00EF61D8002BDB7A5BF58B88F964535E91E136B5DF3CE445C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E55C0 Relevance: 15.3, APIs: 10, Instructions: 282COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32 ref: 00007FFDF80E566B
GetWindowLongA.USER32 ref: 00007FFDF80E5757
DeferWindowPos.USER32 ref: 00007FFDF80E57C2
GetWindowRect.USER32 ref: 00007FFDF80E580A
MapWindowPoints.USER32 ref: 00007FFDF80E581F
EndDeferWindowPos.USER32 ref: 00007FFDF80E587A
BeginDeferWindowPos.USER32 ref: 00007FFDF80E5897
DeferWindowPos.USER32 ref: 00007FFDF80E5986
EndDeferWindowPos.USER32 ref: 00007FFDF80E59A4
UpdateWindow.USER32 ref: 00007FFDF80E59E2

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$Defer$Begin$LongPointsRectUpdate
String ID:
API String ID: 3279777782-0
Opcode ID: 7cd009121dcd090d037d396048f8d7aee686735c34bdeb4e3d99846c5481b5e0
Instruction ID: efee384292e6650f8c42981325b3c2ca674a6642295cbbca14037f9ca1aec858
Opcode Fuzzy Hash: 7cd009121dcd090d037d396048f8d7aee686735c34bdeb4e3d99846c5481b5e0
Instruction Fuzzy Hash: E6C1B136B097418AEB14CF65E8A0AAE77B0FB48B88F454435CE6E57798DF38E401E705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8258AF0 Relevance: 15.1, APIs: 10, Instructions: 89clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF82990FC: WideCharToMultiByte.KERNEL32 ref: 00007FFDF8299137
Part of subcall function 00007FFDF82990FC: WideCharToMultiByte.KERNEL32 ref: 00007FFDF8299179

OpenClipboard.USER32 ref: 00007FFDF8258B2F
GlobalAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDF8258A55), ref: 00007FFDF8258B62
GlobalAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDF8258A55), ref: 00007FFDF8258B77
GlobalLock.KERNEL32 ref: 00007FFDF8258B83
GlobalUnlock.KERNEL32(?,?,?,?,?,00000000,00007FFDF8258A55), ref: 00007FFDF8258BAF
GlobalLock.KERNEL32 ref: 00007FFDF8258BB8
GlobalUnlock.KERNEL32(?,?,?,?,?,00000000,00007FFDF8258A55), ref: 00007FFDF8258BE6
SetClipboardData.USER32 ref: 00007FFDF8258BF4
SetClipboardData.USER32 ref: 00007FFDF8258C02
CloseClipboard.USER32(?,?,?,?,?,00000000,00007FFDF8258A55), ref: 00007FFDF8258C08

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Global$Clipboard$AllocByteCharDataLockMultiUnlockWide$CloseOpen
String ID:
API String ID: 2505041382-0
Opcode ID: 4bf77bd10f3d03aeb6e0757a34b07a51781f6553b17533bad72f1d3484344723
Instruction ID: a0fd1cf2ab79d145f20b2738c556533c521abb999fac3d3f3319edd6624ed2ce
Opcode Fuzzy Hash: 4bf77bd10f3d03aeb6e0757a34b07a51781f6553b17533bad72f1d3484344723
Instruction Fuzzy Hash: 84418E62B0AB8286EB18AB11E46456973A0FB48BD5F484031DEAE877ECDF3CE450D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B6290 Relevance: 12.7, APIs: 10, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B62DC
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B62E3
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B630D
HeapAlloc.KERNEL32 ref: 00007FF7AC3B6372
HeapAlloc.KERNEL32 ref: 00007FF7AC3B63B7
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B63D5
HeapFree.KERNEL32 ref: 00007FF7AC3B6429
HeapFree.KERNEL32 ref: 00007FF7AC3B6453
HeapFree.KERNEL32 ref: 00007FF7AC3B6484
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B6496

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$Free$CriticalSection$Alloc$ClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep
String ID:
API String ID: 2061331858-0
Opcode ID: ac7fad7d679a62b1b547f3ab00112ef58c9bdf18bf28de73c4d235d4a6427485
Instruction ID: dd5abc76fe11679878c4e7ec8df439b59f6818dba8042a53a15b16cecab379f8
Opcode Fuzzy Hash: ac7fad7d679a62b1b547f3ab00112ef58c9bdf18bf28de73c4d235d4a6427485
Instruction Fuzzy Hash: 20719026E0AF42E5EB04FB6198506BDB3A1BF48798F864539E91D126B6DF3CE1458320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8258570 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42clipboardregistrymemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FFDF825857B
GlobalAlloc.KERNEL32(?,?,?,?,00007FFDF82584EE,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDF82585A9
GlobalLock.KERNEL32 ref: 00007FFDF82585B5
GlobalUnlock.KERNEL32(?,?,?,?,00007FFDF82584EE,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDF82585D8
RegisterClipboardFormatW.USER32 ref: 00007FFDF82585F9
SetClipboardData.USER32 ref: 00007FFDF825860A

Strings

HTML Format, xrefs: 00007FFDF82585F2

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ClipboardGlobal$AllocDataFormatLockOpenRegisterUnlock
String ID: HTML Format
API String ID: 175603225-1098232656
Opcode ID: c8df38e7a3bd123ec06d38ea86e87d0eb7d898257052e031b4b65d932d39675b
Instruction ID: 69218d08f97bb723ece66ee346178ff85304d68fdd69ac4aa4061cfbe86f509a
Opcode Fuzzy Hash: c8df38e7a3bd123ec06d38ea86e87d0eb7d898257052e031b4b65d932d39675b
Instruction Fuzzy Hash: E71100A5F1AA8183E708AF12E96452973A1FB48BC4F484035DA6E877ACDF3CE4519705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EEFA0 Relevance: 12.2, APIs: 8, Instructions: 234COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00007FFDF80EEFEC
GetWindowRect.USER32 ref: 00007FFDF80EF013
GetWindowLongPtrA.USER32 ref: 00007FFDF80EF029

Part of subcall function 00007FFDF8135540: CreateDIBSection.GDI32 ref: 00007FFDF81355AE

SetWindowOrgEx.GDI32 ref: 00007FFDF80EF25E
CreateCompatibleDC.GDI32 ref: 00007FFDF80EF2B0
SelectObject.GDI32 ref: 00007FFDF80EF2C0
SelectObject.GDI32 ref: 00007FFDF80EF31B
DeleteDC.GDI32 ref: 00007FFDF80EF324

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$CreateLongObjectSelect$CompatibleDeleteRectSection
String ID:
API String ID: 3118830011-0
Opcode ID: d78f25981b20db85a12dfefa2a48371d634c93f1073e5d7118523960567bb6b5
Instruction ID: e88a7734c34c40669245b68f154dddb82d18ba673e5fb137ba7c765f57cc7314
Opcode Fuzzy Hash: d78f25981b20db85a12dfefa2a48371d634c93f1073e5d7118523960567bb6b5
Instruction Fuzzy Hash: BAC18C36B08B858AEB14DF35E854AAD73A0FB88B84F444136DA5D53BACCF38D145DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF81CB730 Relevance: 12.1, APIs: 8, Instructions: 134threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB75B
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB765
CreateEventA.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB775
CreateThread.KERNEL32 ref: 00007FFDF81CB79C
CreateThread.KERNEL32 ref: 00007FFDF81CB7E4
CreateThread.KERNEL32 ref: 00007FFDF81CB82C
CreateThread.KERNEL32 ref: 00007FFDF81CB874
CreateThread.KERNEL32 ref: 00007FFDF81CB8BC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Create$Thread$CriticalInitializeSection$Event
String ID:
API String ID: 1305097065-0
Opcode ID: 2f466ac1f6b91d6da7fba6c3bc10f612a0a69e630dbb037edf73bae96f291eed
Instruction ID: f15128eaac4a771495cbd5ca87f737dd38dd0509085840088208cf9386f086e1
Opcode Fuzzy Hash: 2f466ac1f6b91d6da7fba6c3bc10f612a0a69e630dbb037edf73bae96f291eed
Instruction Fuzzy Hash: 99517D77A04B1186E728DF25E4205A973A1FB88B88B094232DE5E877ACCF3CE505D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EC810 Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

GetObjectA.GDI32 ref: 00007FFDF80EC897
EnterCriticalSection.KERNEL32 ref: 00007FFDF80EC9F0
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80ECA2D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObject
String ID:
API String ID: 103721977-0
Opcode ID: 6a464ceee0aa46f1dca823bee50d1914782c57ce521967e761e8ab386bd76d68
Instruction ID: eafcc6dee13493e975a0945c6719a831d10458923422b16c1bfd73c2a7ae688c
Opcode Fuzzy Hash: 6a464ceee0aa46f1dca823bee50d1914782c57ce521967e761e8ab386bd76d68
Instruction Fuzzy Hash: ACE1A472724A81DAEB64DF25D850BED77A0FB84B88F444132EA5E83AE8CF38D545D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC589328 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7AC582400: GetLastError.KERNEL32 ref: 00007FF7AC58240F
Part of subcall function 00007FF7AC582400: FlsGetValue.KERNEL32 ref: 00007FF7AC582424
Part of subcall function 00007FF7AC582400: SetLastError.KERNEL32 ref: 00007FF7AC5824AF

TranslateName.LIBCMT ref: 00007FF7AC589395
TranslateName.LIBCMT ref: 00007FF7AC5893D0
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7AC57D220), ref: 00007FF7AC589415
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7AC57D220), ref: 00007FF7AC58943D

Strings

utf8, xrefs: 00007FF7AC589521

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 2293bfaf72900b686e807b5f5de8f29a9136cc1d830ddd4e3e3b1b36c882dfef
Instruction ID: 5c1a3bd43efbc91f56d7e565c93e92e094cc2cff21fc8d755628ac96116846ca
Opcode Fuzzy Hash: 2293bfaf72900b686e807b5f5de8f29a9136cc1d830ddd4e3e3b1b36c882dfef
Instruction Fuzzy Hash: EE91C132A0A742A1EB64BF21D6412B9B3A4FF44B81FA64131EA5D477E6DF3CE541D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC589D64 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7AC582400: GetLastError.KERNEL32 ref: 00007FF7AC58240F
Part of subcall function 00007FF7AC582400: FlsGetValue.KERNEL32 ref: 00007FF7AC582424
Part of subcall function 00007FF7AC582400: SetLastError.KERNEL32 ref: 00007FF7AC5824AF

Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC582445
Part of subcall function 00007FF7AC582400: FlsGetValue.KERNEL32 ref: 00007FF7AC5824E5

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7AC589ED4

Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC582472
Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC582483
Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC582494
Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC582504
Part of subcall function 00007FF7AC582400: FlsSetValue.KERNEL32 ref: 00007FF7AC58252C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7AC57D219), ref: 00007FF7AC589EBB
ProcessCodePage.LIBCMT ref: 00007FF7AC589EFE
IsValidCodePage.KERNEL32 ref: 00007FF7AC589F10
IsValidLocale.KERNEL32 ref: 00007FF7AC589F26
GetLocaleInfoW.KERNEL32 ref: 00007FF7AC589F82
GetLocaleInfoW.KERNEL32 ref: 00007FF7AC589F9E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 95f13fb64fc5e8e9105bf8da82851d45f158945a349597de67726eccfeb57371
Instruction ID: 90ac8ee5a237deb573b780ef53259939f7ba843cdc66af92aa4173990c79f05d
Opcode Fuzzy Hash: 95f13fb64fc5e8e9105bf8da82851d45f158945a349597de67726eccfeb57371
Instruction Fuzzy Hash: 8571AC22B1A602A9FB11BF20D5502BDB7A0BF44749FA64135EA4D43AA5EF3CE841D370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC571844 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7AC5718BD
RtlLookupFunctionEntry.NTDLL ref: 00007FF7AC5718D5
RtlVirtualUnwind.NTDLL ref: 00007FF7AC571910
IsDebuggerPresent.KERNEL32 ref: 00007FF7AC571949
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AC571953
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AC57195E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c96ca89f4f9398d8288dda1ac37004421fbc1262667d1c5cc6431f3b1f47c90d
Instruction ID: 2d3846c97bc3b0750d098170a2f3e148b54d26dc85520f85c08444773d49a781
Opcode Fuzzy Hash: c96ca89f4f9398d8288dda1ac37004421fbc1262667d1c5cc6431f3b1f47c90d
Instruction Fuzzy Hash: 9C319732A19F8199DB60DF25E8402AEB3A0FB84754FA50135FA9D43B65DF3CD145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8374B74 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDF8374BED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDF8374C05
RtlVirtualUnwind.KERNEL32 ref: 00007FFDF8374C40
IsDebuggerPresent.KERNEL32 ref: 00007FFDF8374C79
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDF8374C83
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDF8374C8E

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 9603bfcd7ec9ab17c348f56aca8f175d4cb2340f22ca4ef12617b67ba2aea569
Instruction ID: 61efce917ad2805b1f10d4166e9e8a0a8fdc168469566f1570f3fd54b0d2b9e1
Opcode Fuzzy Hash: 9603bfcd7ec9ab17c348f56aca8f175d4cb2340f22ca4ef12617b67ba2aea569
Instruction Fuzzy Hash: 8C318332708B8196D764DF25E8506AE73E4FB88758F580136EAAD83BA8DF3CD145CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F0210 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FFDF80F02A0
WindowFromPoint.USER32(?,?,?,?,?,?,?,00007FFDF80B6969), ref: 00007FFDF80F02EF

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$FromPoint
String ID:
API String ID: 2501751775-0
Opcode ID: fe73b1b185ceb9d26b7f7146317ba9fc52fb26274534e5e78b324e57979880ae
Instruction ID: 59a26d235d4a36775a8e7ae058f78c4ea9e0b00a0e1ba4bf24961e1973081c8e
Opcode Fuzzy Hash: fe73b1b185ceb9d26b7f7146317ba9fc52fb26274534e5e78b324e57979880ae
Instruction Fuzzy Hash: 7C518FB7B09A4186EF54CF15D86467963A0FF88B88F59C131CA5D833E8DF3CE441A249

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF836BCD0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFDF836BD3A
memcpy_s.LIBCPMT ref: 00007FFDF836BD65

Strings

, xrefs: 00007FFDF836BE98

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 3cfb5c3b9e944fc4b0e5d5a68e91cfb76fa6e5b1e78fcb6c67f41162daa79726
Instruction ID: a08d5eee1af0d0246a8bbdb32ccba364c383f00fd06d3567a7d7651c86183cc1
Opcode Fuzzy Hash: 3cfb5c3b9e944fc4b0e5d5a68e91cfb76fa6e5b1e78fcb6c67f41162daa79726
Instruction Fuzzy Hash: 85C1F372B1928687E720DF19E058E6AB7D1F784788F488135DB5B87B98DB3CE801DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55D66C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7AC55D6CD
IsDebuggerPresent.KERNEL32 ref: 00007FF7AC55D6E5
OutputDebugStringW.KERNEL32 ref: 00007FF7AC55D6F6

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7AC55D6EF

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e7c0d040efd2bd70ed9f2adb80ba95a2050988227c85a76eec2643c6a05e5947
Instruction ID: 8bdae3cec8af3755a0b2b9d70505abc20f2e5b4bde202c34f4011d56dfe23d84
Opcode Fuzzy Hash: e7c0d040efd2bd70ed9f2adb80ba95a2050988227c85a76eec2643c6a05e5947
Instruction Fuzzy Hash: 57118F32A15B42A6F704EB22E644379B2A4FB04344F915135D74D86AA1EF7CE0B4CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E6210 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FFDF80E629D
ScrollWindowEx.USER32 ref: 00007FFDF80E6329
GetWindowLongA.USER32 ref: 00007FFDF80E637D
GetWindow.USER32 ref: 00007FFDF80E63B8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$LongScroll
String ID:
API String ID: 3844982632-0
Opcode ID: ccff8482c6d66ad1ebd2a38ee5766f8b4e6531826236130fe95563bba1bf95d5
Instruction ID: ea12afba190995178a41052237f58982eaf99947871251fd3d77517c769422c0
Opcode Fuzzy Hash: ccff8482c6d66ad1ebd2a38ee5766f8b4e6531826236130fe95563bba1bf95d5
Instruction Fuzzy Hash: FA716B76B05B1186EB04DF26E8609AD37A4FB48F94F484136EE6E43BA8CF38D045D305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EE620 Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FFDF80EE6B0
WindowFromPoint.USER32(?,?,?,?,?,?,?,00007FFDF80B695A), ref: 00007FFDF80EE6FF

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$FromPoint
String ID:
API String ID: 2501751775-0
Opcode ID: 820556ac91aa88a7dc0d093d3532adc6b84dfa6d55e18a06f8a5fb14e1fd411b
Instruction ID: 768c9079588fcb83285e06d8baaabf9a8bb13bba3dd4427f2563f7da97184647
Opcode Fuzzy Hash: 820556ac91aa88a7dc0d093d3532adc6b84dfa6d55e18a06f8a5fb14e1fd411b
Instruction Fuzzy Hash: 3D51A176B09B0586EB24CF15D4A0A7A73A0FF88BC4F998131DA5D833E8DF7CD441A649

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC583DB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7AC57D3F2), ref: 00007FF7AC583E24

Strings

GetLocaleInfoEx, xrefs: 00007FF7AC583DCC, 00007FF7AC583DDD

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 2e82ed7d18db73120a9b6c3b7839f754300ed29e28b43a129d74ce5b00ccbcc3
Instruction ID: 5ba1ed007ebe41bb3d15d970bf4c573512b8eb8b7c28eece8c6eaafe3aaab2af
Opcode Fuzzy Hash: 2e82ed7d18db73120a9b6c3b7839f754300ed29e28b43a129d74ce5b00ccbcc3
Instruction Fuzzy Hash: 20016721B09A41D5E704EB56F5401AAE761FF84BC0FA94436EF4D17B76DE3CD5418350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B7E67 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 00007FFDF80B7E7A
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalInfoLeaveLocaleSection
String ID:
API String ID: 1229108425-0
Opcode ID: b38bc3e53c943742c51471315cb5abe0a8cbba3f87fa76cacc0217c14aad936a
Instruction ID: 5de433e5e58a591355b938e3170da46495da660d957d7eedeee2ac87d773d9a1
Opcode Fuzzy Hash: b38bc3e53c943742c51471315cb5abe0a8cbba3f87fa76cacc0217c14aad936a
Instruction Fuzzy Hash: BC019266B0468187EB0ADF25E860AA86390FF48B99F454032CE1E477F8CE3CD486E305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC589678 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7AC582400: GetLastError.KERNEL32 ref: 00007FF7AC58240F
Part of subcall function 00007FF7AC582400: FlsGetValue.KERNEL32 ref: 00007FF7AC582424
Part of subcall function 00007FF7AC582400: SetLastError.KERNEL32 ref: 00007FF7AC5824AF

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7AC589E67,?,00000000,00000092,?,?,00000000,?,00007FF7AC57D219), ref: 00007FF7AC589716

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 09907d3169c8fb9c950c7f0bc8b51aa1a72fb972abe4bb123a62ce2b652bef93
Instruction ID: d122c06cb7d8e7ff21290342cd0fb4f78de4481052cf73ee7fff887e20a00904
Opcode Fuzzy Hash: 09907d3169c8fb9c950c7f0bc8b51aa1a72fb972abe4bb123a62ce2b652bef93
Instruction Fuzzy Hash: DF113673E096019AEB14AF26D1402BCBBA0FB50FE1FA68135E629433E4CE38D5D1D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC589748 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7AC582400: GetLastError.KERNEL32 ref: 00007FF7AC58240F
Part of subcall function 00007FF7AC582400: FlsGetValue.KERNEL32 ref: 00007FF7AC582424
Part of subcall function 00007FF7AC582400: SetLastError.KERNEL32 ref: 00007FF7AC5824AF

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7AC589E23,?,00000000,00000092,?,?,00000000,?,00007FF7AC57D219), ref: 00007FF7AC5897C6

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 5fd4c29f616ca2d104068801dfa279140a558c7b156e82ed3eac69f0de8ce493
Instruction ID: f56f6548a21e9690c29e3e059b51b3551a5588b9c3bec13053faadb7111bf688
Opcode Fuzzy Hash: 5fd4c29f616ca2d104068801dfa279140a558c7b156e82ed3eac69f0de8ce493
Instruction Fuzzy Hash: CC012D72F0D24156EB106F15F5407B9B6D1EB41B55FA68231E229436E9CF7CD4C0D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC5838D4 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7AC583D7F,?,?,?,?,?,?,?,?,00000000,00007FF7AC588CB8), ref: 00007FF7AC583923

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 76b797fdc748012a44d6ba44187b4d3ec2b7fc75de5f7bc98380afcf16f90fee
Instruction ID: 614a39e8c1700436cec9bf1095b171b579ef8b4cf71b42615518db775e519c9e
Opcode Fuzzy Hash: 76b797fdc748012a44d6ba44187b4d3ec2b7fc75de5f7bc98380afcf16f90fee
Instruction Fuzzy Hash: 29F08176B0AB4193E704EB19E8515A9A3A1FB887C0F965136EA0D83775CF3CD550C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF81459D0 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FFDF8145A84
GetVersionExA.KERNEL32 ref: 00007FFDF8145A9B
LoadLibraryA.KERNEL32 ref: 00007FFDF8145BA9
GetProcAddress.KERNEL32 ref: 00007FFDF8145BC9
GetProcAddress.KERNEL32 ref: 00007FFDF8145BE4
GetProcAddress.KERNEL32 ref: 00007FFDF8145BFF
GetProcAddress.KERNEL32 ref: 00007FFDF8145C1A
GetProcAddress.KERNEL32 ref: 00007FFDF8145C35
GetProcAddress.KERNEL32 ref: 00007FFDF8145C50
GetProcAddress.KERNEL32 ref: 00007FFDF8145C64
GetProcAddress.KERNEL32 ref: 00007FFDF8145C7F
GetProcAddress.KERNEL32 ref: 00007FFDF8145C9A

Strings

OpenThemeData, xrefs: 00007FFDF8145BBF
DrawThemeBackground, xrefs: 00007FFDF8145BD6
UXTHEME.DLL, xrefs: 00007FFDF8145BA2
SetWindowTheme, xrefs: 00007FFDF8145C42
CloseThemeData, xrefs: 00007FFDF8145BF1
DrawThemeText, xrefs: 00007FFDF8145C0C
IsThemeBackgroundPartiallyTransparent, xrefs: 00007FFDF8145C8C
GetThemePartSize, xrefs: 00007FFDF8145C71
A, xrefs: 00007FFDF8145B57
GetThemeBackgroundContentRect, xrefs: 00007FFDF8145C27
GetThemeInt, xrefs: 00007FFDF8145C5D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AddressProc$Version$LibraryLoad
String ID: A$CloseThemeData$DrawThemeBackground$DrawThemeText$GetThemeBackgroundContentRect$GetThemeInt$GetThemePartSize$IsThemeBackgroundPartiallyTransparent$OpenThemeData$SetWindowTheme$UXTHEME.DLL
API String ID: 29192645-1228588308
Opcode ID: d1b90b9494a495b6d96edd82e2ba10971f795cb03655433f9aac1ab95a5401bf
Instruction ID: 02b1c76bbef9646d46435b1375512ccc08eeb2c5c337cf07c84867447aa28a2c
Opcode Fuzzy Hash: d1b90b9494a495b6d96edd82e2ba10971f795cb03655433f9aac1ab95a5401bf
Instruction Fuzzy Hash: C2A12E22F0D74382FB609B10BCA4BB923A1FB45745F550235D47D866ECDE7CE688E60A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C8BC0 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 355COMMON

Download Yara Rule

APIs

SetWindowLongPtrA.USER32 ref: 00007FFDF80C8C0C

Part of subcall function 00007FFDF80F29D0: LoadCursorA.USER32 ref: 00007FFDF80F2A41
Part of subcall function 00007FFDF80F29D0: GetStockObject.GDI32 ref: 00007FFDF80F2A4E
Part of subcall function 00007FFDF80F29D0: RegisterClassExA.USER32 ref: 00007FFDF80F2A74
Part of subcall function 00007FFDF80F29D0: GetVersionExA.KERNEL32 ref: 00007FFDF80F2ADB
Part of subcall function 00007FFDF80F29D0: GetVersionExA.KERNEL32 ref: 00007FFDF80F2AF2
Part of subcall function 00007FFDF80F29D0: LoadCursorA.USER32 ref: 00007FFDF80F2C13
Part of subcall function 00007FFDF80F29D0: GetStockObject.GDI32 ref: 00007FFDF80F2C20
Part of subcall function 00007FFDF80F29D0: RegisterClassExA.USER32 ref: 00007FFDF80F2C46

CreateWindowExA.USER32 ref: 00007FFDF80C8C5D
EnterCriticalSection.KERNEL32 ref: 00007FFDF80C8CCE
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80C8CE6
EnterCriticalSection.KERNEL32 ref: 00007FFDF80C8D09
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80C8D1D
SetWindowTextA.USER32 ref: 00007FFDF80C8E37

Part of subcall function 00007FFDF80B9640: EnterCriticalSection.KERNEL32 ref: 00007FFDF80B9672
Part of subcall function 00007FFDF80B9640: LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B9697

GetWindowLongA.USER32 ref: 00007FFDF80C8E8B
GetWindowLongA.USER32 ref: 00007FFDF80C8E9B
AdjustWindowRectEx.USER32 ref: 00007FFDF80C8EAD
GetParent.USER32 ref: 00007FFDF80C8EC5
GetWindowRect.USER32 ref: 00007FFDF80C8EDF
GetDesktopWindow.USER32 ref: 00007FFDF80C8F76
GetClientRect.USER32 ref: 00007FFDF80C8F83
SetWindowPos.USER32 ref: 00007FFDF80C901F
GetClientRect.USER32 ref: 00007FFDF80C902C
SetWindowPos.USER32 ref: 00007FFDF80C905F

Strings

title, xrefs: 00007FFDF80C8D7F

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$CriticalSection$Rect$EnterLeaveLong$ClassClientCursorLoadObjectRegisterStockVersion$AdjustCreateDesktopParentText
String ID: title
API String ID: 2376530372-724990059
Opcode ID: 018a44ae7102a756e5555ea748817041c10e1545ada4e5ec59b6d623e8bdab64
Instruction ID: 35a2eff8bd24e2a1bd4e5180e896e28adc19ac4a9c7ea227afd33a594217bf39
Opcode Fuzzy Hash: 018a44ae7102a756e5555ea748817041c10e1545ada4e5ec59b6d623e8bdab64
Instruction Fuzzy Hash: 31F1A172B086028BEB18DF65E4609AD73A1FB45B88B844535DE2D53BE8DF3CE504E309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC50A7E0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 165memorysleepregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
GetClassInfoExW.USER32 ref: 00007FF7AC50A863
GetLastError.KERNEL32 ref: 00007FF7AC50A871
Sleep.KERNEL32 ref: 00007FF7AC50A87E
GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
RegisterClassExW.USER32 ref: 00007FF7AC50A90F
HeapFree.KERNEL32 ref: 00007FF7AC50A93A
DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
HeapFree.KERNEL32 ref: 00007FF7AC50A975
GetLastError.KERNEL32 ref: 00007FF7AC50A986
GetLastError.KERNEL32 ref: 00007FF7AC50A9D8

Strings

{9C7565A2-47C2-4869-B388-8C7F9AD8E577}, xrefs: 00007FF7AC50A844
P, xrefs: 00007FF7AC50A819

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$ErrorLast$ClassCriticalFreeSection$AllocDeleteHandleInfoInitializeModuleRegisterSleep
String ID: P${9C7565A2-47C2-4869-B388-8C7F9AD8E577}
API String ID: 1585186069-2048047006
Opcode ID: c32dd9bbe92c2f0d7b93b0a981418db6e3c56a5bb6b8a91ff2515e26d7c17970
Instruction ID: efdd25e6cc4097189a25ef825c574ac74c98814e69fbbfc86b2a83235761ea85
Opcode Fuzzy Hash: c32dd9bbe92c2f0d7b93b0a981418db6e3c56a5bb6b8a91ff2515e26d7c17970
Instruction Fuzzy Hash: 48715221E1AB42E5EB10AB61E84017DB3A4FF48B84FA25536EA4D43775EF3CE541C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BF040 Relevance: 31.7, APIs: 21, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00007FFDF80BF088
GetWindowLongA.USER32 ref: 00007FFDF80BF0A4
GetWindowDC.USER32 ref: 00007FFDF80BF0C9
GetSystemMetrics.USER32 ref: 00007FFDF80BF0D7
GetSystemMetrics.USER32 ref: 00007FFDF80BF0E5
GetWindowRect.USER32 ref: 00007FFDF80BF12B
GetSystemMetrics.USER32 ref: 00007FFDF80BF136
GetSystemMetrics.USER32 ref: 00007FFDF80BF144
InflateRect.USER32 ref: 00007FFDF80BF15C
CreateRectRgnIndirect.GDI32 ref: 00007FFDF80BF166
CombineRgn.GDI32 ref: 00007FFDF80BF18C
OffsetRect.USER32 ref: 00007FFDF80BF1A2
OffsetRect.USER32 ref: 00007FFDF80BF1B2
ExcludeClipRect.GDI32 ref: 00007FFDF80BF1CD
InflateRect.USER32 ref: 00007FFDF80BF1DD
GetClassLongPtrA.USER32 ref: 00007FFDF80BF22C
InflateRect.USER32 ref: 00007FFDF80BF245
FillRect.USER32 ref: 00007FFDF80BF255
DefWindowProcA.USER32 ref: 00007FFDF80BF26D
DeleteObject.GDI32 ref: 00007FFDF80BF279
ReleaseDC.USER32 ref: 00007FFDF80BF289

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Rect$Window$MetricsSystem$InflateLong$Offset$ClassClipCombineCreateDeleteExcludeFillIndirectObjectProcRelease
String ID:
API String ID: 273201684-0
Opcode ID: 7dcb4a5c0edf8d6c0c8212128ece4bad30eac2d425a56e6f38ad513122417302
Instruction ID: a5a2a8ac7cde6f0b4027594312f24d6cd0dbf1264d8f42374d521c5fb2167a36
Opcode Fuzzy Hash: 7dcb4a5c0edf8d6c0c8212128ece4bad30eac2d425a56e6f38ad513122417302
Instruction Fuzzy Hash: 6D619275F04A4187FB04AF61E868AA937A0FB88B94F444531CE2E977A8DF3CD445D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E5A10 Relevance: 30.5, APIs: 20, Instructions: 492COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDF80E5CAD
ScrollDC.USER32 ref: 00007FFDF80E5CE9
GetStockObject.GDI32 ref: 00007FFDF80E5E60
SelectObject.GDI32 ref: 00007FFDF80E5E6D
DeleteObject.GDI32 ref: 00007FFDF80E5E7B
GetStockObject.GDI32 ref: 00007FFDF80E5E86
SelectObject.GDI32 ref: 00007FFDF80E5E93
DeleteObject.GDI32 ref: 00007FFDF80E5EA1
RestoreDC.GDI32 ref: 00007FFDF80E5ED7
RestoreDC.GDI32 ref: 00007FFDF80E5EF8
SetTextAlign.GDI32 ref: 00007FFDF80E60E2
SelectObject.GDI32 ref: 00007FFDF80E6118
DeleteObject.GDI32 ref: 00007FFDF80E6126
SelectObject.GDI32 ref: 00007FFDF80E6134
DeleteObject.GDI32 ref: 00007FFDF80E6142
SelectObject.GDI32 ref: 00007FFDF80E6150
ReleaseDC.USER32 ref: 00007FFDF80E6162
ReleaseDC.USER32 ref: 00007FFDF80E61AD
ValidateRect.USER32 ref: 00007FFDF80E61BA

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Delete$ReleaseRestoreStock$AlignRectScrollTextValidate
String ID:
API String ID: 3282784917-0
Opcode ID: 35811859055a911cac63c8ac71128aba253671cdea1070ce496615ef7750ea00
Instruction ID: 24b9841bc737048be1ed35c49e8df270ead88a49ee7514d86d4168e232e44f38
Opcode Fuzzy Hash: 35811859055a911cac63c8ac71128aba253671cdea1070ce496615ef7750ea00
Instruction Fuzzy Hash: CA328C76B04B818AEB14DF65E8606AD77B0FB88B88F048136DE5D47BA8CF38D544DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F36C0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 166COMMON

Download Yara Rule

APIs

UnregisterClassA.USER32 ref: 00007FFDF80F37AF
UnregisterClassA.USER32 ref: 00007FFDF80F37C3
GetVersionExA.KERNEL32 ref: 00007FFDF80F3827
GetVersionExA.KERNEL32 ref: 00007FFDF80F383E
UnregisterClassA.USER32 ref: 00007FFDF80F393B
UnregisterClassW.USER32 ref: 00007FFDF80F3958
UnregisterClassW.USER32 ref: 00007FFDF80F396C
UnregisterClassW.USER32 ref: 00007FFDF80F3980

Strings

A, xrefs: 00007FFDF80F38FA
-HTMLAYOUT-POPUP, xrefs: 00007FFDF80F3934
HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80F3965
HTMLAYOUT, xrefs: 00007FFDF80F37A8
HTMLAYOUT-POPUP, xrefs: 00007FFDF80F37BC
-HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80F3979
HTMLAYOUT-W, xrefs: 00007FFDF80F3951

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ClassUnregister$Version
String ID: -HTMLAYOUT-POPUP$-HTMLAYOUT-POPUP-W$A$HTMLAYOUT$HTMLAYOUT-POPUP$HTMLAYOUT-POPUP-W$HTMLAYOUT-W
API String ID: 2397417282-2431013298
Opcode ID: 6b97b28615848281a326c6b681fefe11a4b1cc39a61b6d05a7b2198f2698e071
Instruction ID: c185a93d08b161f0931db785bec9355022b902f5c91787b2c33e50da1150471a
Opcode Fuzzy Hash: 6b97b28615848281a326c6b681fefe11a4b1cc39a61b6d05a7b2198f2698e071
Instruction Fuzzy Hash: FA818221F0D68782FB249B14F870E7923A1EF94B54F468135D56D8A2ECDF2CE580B70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC509B80 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 164libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC509BCB
GetProcAddress.KERNEL32 ref: 00007FF7AC509BE8
GetModuleHandleW.KERNEL32 ref: 00007FF7AC509CBC
GetProcAddress.KERNEL32 ref: 00007FF7AC509CD9
GetLastError.KERNEL32 ref: 00007FF7AC509D27
GetLastError.KERNEL32 ref: 00007FF7AC509D64
GetLastError.KERNEL32 ref: 00007FF7AC509DD6
GetLastError.KERNEL32 ref: 00007FF7AC509E13

Strings

RtlGetVersion, xrefs: 00007FF7AC509BDA
ntdll, xrefs: 00007FF7AC509BBA
Unable to convert processor architecture ({}) to platform enumeration!, xrefs: 00007FF7AC509DA1
GetModuleHandleW ({}), xrefs: 00007FF7AC509D2D, 00007FF7AC509DDC
GetProcAddress ({}), xrefs: 00007FF7AC509D6A, 00007FF7AC509E19
GetProductInfo, xrefs: 00007FF7AC509CCB
kernel32, xrefs: 00007FF7AC509CB1

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc
String ID: GetModuleHandleW ({})$GetProcAddress ({})$GetProductInfo$RtlGetVersion$Unable to convert processor architecture ({}) to platform enumeration!$kernel32$ntdll
API String ID: 1762409328-1915291428
Opcode ID: 9996522448433dddce6c5df2feeac9e5e47c97cd607a577df27241518ea673e5
Instruction ID: 4b85c865ca7738ceb41d9751a0df2aba0fbc9e41d9b03314007c483c7210ccf8
Opcode Fuzzy Hash: 9996522448433dddce6c5df2feeac9e5e47c97cd607a577df27241518ea673e5
Instruction Fuzzy Hash: B1816C71A0AA46B9FB10EF20D4503ECB3A1FB54708FD55036E60E46AA9EF3CE645C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF819E5B0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FFDF819E666
GetVersionExA.KERNEL32 ref: 00007FFDF819E681

Strings

Unknown, xrefs: 00007FFDF819E5F5
htmlayout 3.3; %s; www.terrainformatica.com ), xrefs: 00007FFDF819E82C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Version
String ID: Unknown$htmlayout 3.3; %s; www.terrainformatica.com )
API String ID: 1889659487-1358869720
Opcode ID: ab6c408a64c7ae63e27e14503d808d91f63b4f495dc0da2a797418011dde4dc4
Instruction ID: ab6b679cc998176b9ad25f73c41940631eb5596ef0abde8f7bc9fb172de35c17
Opcode Fuzzy Hash: ab6c408a64c7ae63e27e14503d808d91f63b4f495dc0da2a797418011dde4dc4
Instruction Fuzzy Hash: D5B16236F0868286F7648F20D8A0BF923A1FB55748F540235D52D866ECDF7CE584D346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EE250 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32 ref: 00007FFDF80EE300
CreateWindowExA.USER32 ref: 00007FFDF80EE3E3

Part of subcall function 00007FFDF80F3050: LoadCursorA.USER32 ref: 00007FFDF80F30B9
Part of subcall function 00007FFDF80F3050: GetStockObject.GDI32 ref: 00007FFDF80F30C7
Part of subcall function 00007FFDF80F3050: RegisterClassW.USER32 ref: 00007FFDF80F30E8
Part of subcall function 00007FFDF80F3050: GetVersionExA.KERNEL32 ref: 00007FFDF80F3147
Part of subcall function 00007FFDF80F3050: GetVersionExA.KERNEL32 ref: 00007FFDF80F315E
Part of subcall function 00007FFDF80F3050: LoadCursorA.USER32 ref: 00007FFDF80F327F
Part of subcall function 00007FFDF80F3050: GetStockObject.GDI32 ref: 00007FFDF80F328C
Part of subcall function 00007FFDF80F3050: RegisterClassW.USER32 ref: 00007FFDF80F32AD

CreateWindowExW.USER32 ref: 00007FFDF80EE375
SetWindowLongPtrA.USER32 ref: 00007FFDF80EE41F

Part of subcall function 00007FFDF80B6A00: TlsAlloc.KERNEL32 ref: 00007FFDF80B6A0F
Part of subcall function 00007FFDF80B6A00: TlsGetValue.KERNEL32 ref: 00007FFDF80B6A22
Part of subcall function 00007FFDF80B6A00: GetCurrentThreadId.KERNEL32 ref: 00007FFDF80B6A2D
Part of subcall function 00007FFDF80B6A00: SetWindowsHookExA.USER32 ref: 00007FFDF80B6A44

GetWindowLongA.USER32 ref: 00007FFDF80EE448
ShowWindow.USER32 ref: 00007FFDF80EE45D
UpdateWindow.USER32 ref: 00007FFDF80EE466
UpdateWindow.USER32 ref: 00007FFDF80EE46F
GetClientRect.USER32 ref: 00007FFDF80EE491

Strings

-HTMLAYOUT-POPUP, xrefs: 00007FFDF80EE384
HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80EE322
HTMLAYOUT-POPUP, xrefs: 00007FFDF80EE390
RUNTIME ERROR: unable to create popup window., xrefs: 00007FFDF80EE3F1
-HTMLAYOUT-POPUP-W, xrefs: 00007FFDF80EE316

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$ClassCreateCursorLoadLongObjectRegisterStockUpdateVersion$AllocClientCurrentHookRectShowThreadUnicodeValueWindows
String ID: -HTMLAYOUT-POPUP$-HTMLAYOUT-POPUP-W$HTMLAYOUT-POPUP$HTMLAYOUT-POPUP-W$RUNTIME ERROR: unable to create popup window.
API String ID: 4161899599-509921070
Opcode ID: 43d786ee69e2e11d093280ef3f9b7cfe77da5a5a22630fa5a84f811fb2368c90
Instruction ID: 58d1668a604b2ba7c70b66b67210ebcc9f196b1cbf744f5989fe1ae9f88096ae
Opcode Fuzzy Hash: 43d786ee69e2e11d093280ef3f9b7cfe77da5a5a22630fa5a84f811fb2368c90
Instruction Fuzzy Hash: B461B472B08B4A87D704DF25F860A6977A0FB84B90F044135EAAD837A8DF3CD404DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8132F30 Relevance: 24.1, APIs: 16, Instructions: 124windowCOMMON

Download Yara Rule

APIs

CreateBitmap.GDI32 ref: 00007FFDF8132F82
CreatePatternBrush.GDI32 ref: 00007FFDF8132F8E
SelectObject.GDI32 ref: 00007FFDF8132F9F
SetBrushOrgEx.GDI32(?,?,?,?,00007FFDF80DAF22,?,00000000,000000F0808B4801,?,?,00007FFDF8213D2D), ref: 00007FFDF8132FE2
SetBkColor.GDI32 ref: 00007FFDF8132FF2
SetTextColor.GDI32 ref: 00007FFDF8133001
PatBlt.GDI32 ref: 00007FFDF8133036
SetBkColor.GDI32 ref: 00007FFDF8133043

Part of subcall function 00007FFDF8130DB0: GetSysColor.USER32 ref: 00007FFDF8130DED
Part of subcall function 00007FFDF8130DB0: GetSysColor.USER32 ref: 00007FFDF8130DFA

SetTextColor.GDI32 ref: 00007FFDF8133057
PatBlt.GDI32 ref: 00007FFDF8133088
SetBkColor.GDI32 ref: 00007FFDF8133095
SetTextColor.GDI32 ref: 00007FFDF81330A2
SelectObject.GDI32 ref: 00007FFDF81330B0
DeleteObject.GDI32 ref: 00007FFDF81330BE
DeleteObject.GDI32 ref: 00007FFDF81330CC
SetBrushOrgEx.GDI32 ref: 00007FFDF81330E3

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Color$Object$BrushText$CreateDeleteSelect$BitmapPattern
String ID:
API String ID: 800347078-0
Opcode ID: b84ab2b38b4368bf2e2671a82ed6620176b486d3b19abfdc2170cf987e279093
Instruction ID: d3519cc25255be1ee8d31eed4df450122fc3bb645d3adf55347b1c86bdba3754
Opcode Fuzzy Hash: b84ab2b38b4368bf2e2671a82ed6620176b486d3b19abfdc2170cf987e279093
Instruction Fuzzy Hash: B9516876B08A9087D748DF62E868C2A77A4FB89BD4B158031DE5E83768CF3CD486C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B5E80 Relevance: 24.1, APIs: 16, Instructions: 99windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FFDF80B5EC0
GetClientRect.USER32 ref: 00007FFDF80B5EF4
CreateCompatibleDC.GDI32 ref: 00007FFDF80B5EFE
LPtoDP.GDI32 ref: 00007FFDF80B5F22
CreateCompatibleBitmap.GDI32 ref: 00007FFDF80B5F3D
SelectObject.GDI32 ref: 00007FFDF80B5F50
GetStockObject.GDI32 ref: 00007FFDF80B5F5F
SelectObject.GDI32 ref: 00007FFDF80B5F6F
GetMapMode.GDI32 ref: 00007FFDF80B5F7D
SetMapMode.GDI32 ref: 00007FFDF80B5F8C
GetWindowExtEx.GDI32 ref: 00007FFDF80B5F9B
SetWindowExtEx.GDI32 ref: 00007FFDF80B5FB4
GetViewportExtEx.GDI32 ref: 00007FFDF80B5FC3
SetViewportExtEx.GDI32 ref: 00007FFDF80B5FDC
DPtoLP.GDI32 ref: 00007FFDF80B5FF0
SetViewportOrgEx.GDI32 ref: 00007FFDF80B600C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ObjectViewport$CompatibleCreateModeSelectWindow$BeginBitmapClientPaintRectStock
String ID:
API String ID: 3586948744-0
Opcode ID: 395c0d5d5c264ae5d11bcc9ce1fb231b35f6cac10f5ffe085525c990ee6a8496
Instruction ID: 2feaefadd3d00fc5144bd7d313a57415ccb6ad8f21f17fb6b02756438fd196ce
Opcode Fuzzy Hash: 395c0d5d5c264ae5d11bcc9ce1fb231b35f6cac10f5ffe085525c990ee6a8496
Instruction Fuzzy Hash: 86512776704A8186E718DF25E865A6973A0FB88F88F448135CE9D8B76CDF3CD484DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A8710 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 279memoryCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3A88F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3A88F9
InitializeCriticalSection.KERNEL32 ref: 00007FF7AC3A89B4

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3A89D4
GetProcessHeap.KERNEL32 ref: 00007FF7AC3A8A15
HeapFree.KERNEL32 ref: 00007FF7AC3A8A8B
HeapFree.KERNEL32 ref: 00007FF7AC3A8AC7
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A8AD9
DeleteCriticalSection.KERNEL32 ref: 00007FF7AC3A8AEE

Part of subcall function 00007FF7AC3AAF70: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC3BA1D4,?,?,?,?,?,?,00000000), ref: 00007FF7AC3AAF9F

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

Part of subcall function 00007FF7AC3B6850: EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B6899
Part of subcall function 00007FF7AC3B6850: GetProcessHeap.KERNEL32 ref: 00007FF7AC3B68A0
Part of subcall function 00007FF7AC3B6850: GetProcessHeap.KERNEL32 ref: 00007FF7AC3B68CA
Part of subcall function 00007FF7AC3B6850: HeapAlloc.KERNEL32 ref: 00007FF7AC3B6926
Part of subcall function 00007FF7AC3B6850: HeapAlloc.KERNEL32 ref: 00007FF7AC3B6969
Part of subcall function 00007FF7AC3B6850: GetProcessHeap.KERNEL32 ref: 00007FF7AC3B6987

Strings

asw::settings::SettingsConfig::ProductPluginUnloadFn, xrefs: 00007FF7AC3A87EF
asw::settings::SettingsConfig::ProductPluginLoadFn, xrefs: 00007FF7AC3A872B
asw::settings::SettingsConfig::Lock, xrefs: 00007FF7AC3A89FE

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$CriticalSection$AllocFree$ClassDeleteEnterErrorInitializeLast_invalid_parameter_noinfo_noreturn$HandleInfoLeaveModuleRegisterSleep_invalid_parameter_noinfo
String ID: asw::settings::SettingsConfig::Lock$asw::settings::SettingsConfig::ProductPluginLoadFn$asw::settings::SettingsConfig::ProductPluginUnloadFn
API String ID: 3963010532-3014327910
Opcode ID: 37cbb287942ccb6d1bb596861698dc94d680f801ff06f9ce65dfe4fec6422169
Instruction ID: bb8143827ccaaa55852360cb05e239ed58da4f079161afcb314bf9b6882002c3
Opcode Fuzzy Hash: 37cbb287942ccb6d1bb596861698dc94d680f801ff06f9ce65dfe4fec6422169
Instruction Fuzzy Hash: 01C1B132A0AF41A5EA14EF15E44466DB3E4FB48B80F964139DA8D43B71EF7DE4A1C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6C80 Relevance: 19.6, APIs: 13, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FFDF80B6CAD
IsWindow.USER32 ref: 00007FFDF80B6CB9
MapWindowPoints.USER32 ref: 00007FFDF80B6CE9
GetClipBox.GDI32 ref: 00007FFDF80B6CF7
SaveDC.GDI32 ref: 00007FFDF80B6D00
GetWindowLongA.USER32 ref: 00007FFDF80B6D10
GetWindowRect.USER32 ref: 00007FFDF80B6D24
SetViewportOrgEx.GDI32 ref: 00007FFDF80B6D4F
SetLayout.GDI32 ref: 00007FFDF80B6D5D
SetViewportOrgEx.GDI32 ref: 00007FFDF80B6D84
SendMessageA.USER32 ref: 00007FFDF80B6D97
SendMessageA.USER32 ref: 00007FFDF80B6DB1
RestoreDC.GDI32 ref: 00007FFDF80B6DBC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$MessageSendViewport$ClipLayoutLongParentPointsRectRestoreSave
String ID:
API String ID: 1374418031-0
Opcode ID: 8feb470ddaf31239c70104988785c159dde7981b8ccd4a021e7ed8e0ad66822b
Instruction ID: 69368226fee090ea022a356ccfde82e170d9f3a75181b483ede809516a01e163
Opcode Fuzzy Hash: 8feb470ddaf31239c70104988785c159dde7981b8ccd4a021e7ed8e0ad66822b
Instruction Fuzzy Hash: 7231847170864587E7249F15F824A6977A0FBC9B85F484230EE5E47BACCF3CE5059B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BA9B0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

LoadCursorA.USER32 ref: 00007FFDF80BAA70
LoadCursorA.USER32 ref: 00007FFDF80BAA9D
SetCursor.USER32 ref: 00007FFDF80BACF2

Strings

, xrefs: 00007FFDF80BACDA

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Cursor$Load
String ID:
API String ID: 1675784387-3916222277
Opcode ID: c07dd71851a95b003605c5021686e0452f42416c29dcbcaf094368acbd215302
Instruction ID: 3d3602d24137e16c8d72f95038278b6608d2a9df460473d25682c5659c409562
Opcode Fuzzy Hash: c07dd71851a95b003605c5021686e0452f42416c29dcbcaf094368acbd215302
Instruction Fuzzy Hash: C8A16331F0E6428AFB149B10D871E7923A2BF54744F954135D92D876ECEE2CF944B34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C90F0 Relevance: 18.2, APIs: 12, Instructions: 155COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FFDF80C9154
GetWindowLongPtrA.USER32 ref: 00007FFDF80C916A
EndDialog.USER32 ref: 00007FFDF80C91BC

Part of subcall function 00007FFDF80C8BC0: SetWindowLongPtrA.USER32 ref: 00007FFDF80C8C0C
Part of subcall function 00007FFDF80C8BC0: CreateWindowExA.USER32 ref: 00007FFDF80C8C5D
Part of subcall function 00007FFDF80C8BC0: EnterCriticalSection.KERNEL32 ref: 00007FFDF80C8CCE
Part of subcall function 00007FFDF80C8BC0: LeaveCriticalSection.KERNEL32 ref: 00007FFDF80C8CE6
Part of subcall function 00007FFDF80C8BC0: EnterCriticalSection.KERNEL32 ref: 00007FFDF80C8D09
Part of subcall function 00007FFDF80C8BC0: LeaveCriticalSection.KERNEL32 ref: 00007FFDF80C8D1D

IsWindow.USER32 ref: 00007FFDF80C91CA
GetClientRect.USER32 ref: 00007FFDF80C91EE
GetWindow.USER32 ref: 00007FFDF80C91FC
IsWindow.USER32 ref: 00007FFDF80C9208
SetWindowPos.USER32 ref: 00007FFDF80C9247
GetWindowLongPtrA.USER32 ref: 00007FFDF80C926C
GetWindow.USER32 ref: 00007FFDF80C927D
EnterCriticalSection.KERNEL32 ref: 00007FFDF80C929E
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80C92B2

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$CriticalSection$EnterLeaveLong$ClientCreateDialogRect
String ID:
API String ID: 795340837-0
Opcode ID: a0313c62a5e7160e3436fd1c23a67822178ac3cbfb9bff9feb0a84e5b7beacae
Instruction ID: 3483f1da5db0be5dcbe38ec1306f6a592791d2d65fdc5c43f719d8b0dd2f4725
Opcode Fuzzy Hash: a0313c62a5e7160e3436fd1c23a67822178ac3cbfb9bff9feb0a84e5b7beacae
Instruction Fuzzy Hash: D361A371B0874283EB18DF25A869A7977A0FF85B80F954035DA6D877E8DF3CE401A705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC582400 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7AC58240F
FlsGetValue.KERNEL32 ref: 00007FF7AC582424
FlsSetValue.KERNEL32 ref: 00007FF7AC582445
FlsSetValue.KERNEL32 ref: 00007FF7AC582472
FlsSetValue.KERNEL32 ref: 00007FF7AC582483
FlsSetValue.KERNEL32 ref: 00007FF7AC582494
SetLastError.KERNEL32 ref: 00007FF7AC5824AF
FlsGetValue.KERNEL32 ref: 00007FF7AC5824E5
FlsSetValue.KERNEL32 ref: 00007FF7AC582504

Part of subcall function 00007FF7AC5809D0: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7AC5825DA,?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC580A25

FlsSetValue.KERNEL32 ref: 00007FF7AC58252C

Part of subcall function 00007FF7AC580B00: HeapFree.KERNEL32 ref: 00007FF7AC580B16
Part of subcall function 00007FF7AC580B00: GetLastError.KERNEL32 ref: 00007FF7AC580B20

FlsSetValue.KERNEL32 ref: 00007FF7AC58253D
FlsSetValue.KERNEL32 ref: 00007FF7AC58254E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocateFree
String ID:
API String ID: 3174826731-0
Opcode ID: 3354e8449244df90471308d2898077ead99aceec25d09238b769b96723c6ab43
Instruction ID: d508b04fe0323f57803b0a5bcea3b6a3b59cad37882e764774d83e0b68a4e85b
Opcode Fuzzy Hash: 3354e8449244df90471308d2898077ead99aceec25d09238b769b96723c6ab43
Instruction Fuzzy Hash: E0413D60F0F20361FA59B325AB5117995824F947B2FF68634F83E0A6F2DD2CE8516370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC500260 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 95fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7AC50032C
GetLastError.KERNEL32 ref: 00007FF7AC50033F
DeviceIoControl.KERNEL32 ref: 00007FF7AC5003EC
GetLastError.KERNEL32 ref: 00007FF7AC5003F6
CloseHandle.KERNEL32 ref: 00007FF7AC500419

Strings

\\.\ASWSP_Open, xrefs: 00007FF7AC5002CA
\\.\AVGSP_Open, xrefs: 00007FF7AC5002D8
\\.\NLLSP_Open, xrefs: 00007FF7AC5002E6
\\.\AVRSP_Open, xrefs: 00007FF7AC5002F4
mtps, xrefs: 00007FF7AC50035F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID: \\.\ASWSP_Open$\\.\AVGSP_Open$\\.\AVRSP_Open$\\.\NLLSP_Open$mtps
API String ID: 1177325624-1521275592
Opcode ID: 691df89e8996e5b807327df32539be00cbcc98396244bfdf2cc431d6e0fa62c7
Instruction ID: 2ba395e81a870739182871daf2eb391f2091d6f48b200b02975d768da74469b3
Opcode Fuzzy Hash: 691df89e8996e5b807327df32539be00cbcc98396244bfdf2cc431d6e0fa62c7
Instruction Fuzzy Hash: EF51FC3250EB819AE7609B14F45436AF7E0F7853A4FA10235E69E82BA8EF7DD444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF825A820 Relevance: 16.9, APIs: 4, Strings: 7, Instructions: 416COMMON

Download Yara Rule

Strings

url, xrefs: 00007FFDF825AB05
rgb, xrefs: 00007FFDF825AE0F
calc, xrefs: 00007FFDF825AC46
rgba(, xrefs: 00007FFDF825AD17, 00007FFDF825AD69
rgb(, xrefs: 00007FFDF825AE47, 00007FFDF825AE99
selector, xrefs: 00007FFDF825AF43
rgba, xrefs: 00007FFDF825ACE7

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID:
String ID: calc$rgb$rgb($rgba$rgba($selector$url
API String ID: 0-3527232651
Opcode ID: 1a4f4f5b393ca29ba3f8ce04e01a2ea11771a66b66ae7219f609434d81f2b843
Instruction ID: 165dba40e1a3c7db7b9e36493e1eeccc3004d3db3340d8cad53dca1b2d65d30a
Opcode Fuzzy Hash: 1a4f4f5b393ca29ba3f8ce04e01a2ea11771a66b66ae7219f609434d81f2b843
Instruction Fuzzy Hash: 57127172B4861297EB649B15D12297833A0FF54B54F844231D76E8BAD8DF3CF4A1E30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8148EF0 Relevance: 16.7, APIs: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDF8149020
EnumFontFamiliesExA.GDI32 ref: 00007FFDF8149042
ReleaseDC.USER32 ref: 00007FFDF814904D
GetDC.USER32 ref: 00007FFDF81490E5
GetObjectA.GDI32 ref: 00007FFDF8149136
GetDeviceCaps.GDI32 ref: 00007FFDF814914F
SelectObject.GDI32 ref: 00007FFDF814916D
GetTextMetricsA.GDI32 ref: 00007FFDF8149181
GetDeviceCaps.GDI32 ref: 00007FFDF814918F
SelectObject.GDI32 ref: 00007FFDF81491B1
ReleaseDC.USER32 ref: 00007FFDF81491BC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$CapsDeviceReleaseSelect$EnumFamiliesFontMetricsText
String ID:
API String ID: 4007977802-0
Opcode ID: ffb9d3f4ca10275a5d686bcca3d82fc54a42b2e8884e3f34bc4de34b661fa361
Instruction ID: 6535a00405bd909fe413bf30d7b8483bcb003c3772d58f0f08164907e82f45db
Opcode Fuzzy Hash: ffb9d3f4ca10275a5d686bcca3d82fc54a42b2e8884e3f34bc4de34b661fa361
Instruction Fuzzy Hash: 22914232B0978286EB14DB21E428A79B7A1FB8AB94F044231DA6D477ECDF3CE541D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C9930 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDF80C99DE
MultiByteToWideChar.KERNEL32 ref: 00007FFDF80C9A20
FlushViewOfFile.KERNEL32 ref: 00007FFDF80C9B3D
UnmapViewOfFile.KERNEL32 ref: 00007FFDF80C9B56
CloseHandle.KERNEL32 ref: 00007FFDF80C9B64
SetFilePointer.KERNEL32 ref: 00007FFDF80C9B86
SetEndOfFile.KERNEL32 ref: 00007FFDF80C9B8F
CloseHandle.KERNEL32 ref: 00007FFDF80C9B98

Strings

Could not flush memory to disk., xrefs: 00007FFDF80C9B47

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: File$ByteCharCloseHandleMultiViewWide$FlushPointerUnmap
String ID: Could not flush memory to disk.
API String ID: 3763602750-1683962931
Opcode ID: f9cf810ea14263cca74a04cfe99c5683b7697d36df78fd736ef1df7fb079a700
Instruction ID: 4d43217b8b4feac7d4100226240fbfa59943f6e64f77e66ee2bcdcb25fdebf08
Opcode Fuzzy Hash: f9cf810ea14263cca74a04cfe99c5683b7697d36df78fd736ef1df7fb079a700
Instruction Fuzzy Hash: C881A232B05B4186FB149F61E864AA927A0BF49BA8F484135DE2D577ECDF3CE441E305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B88A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B892A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3B8975
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B8AB9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B8ADC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B8AEF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B8AF5

Strings

true, xrefs: 00007FF7AC3B8A1D
bad locale name, xrefs: 00007FF7AC3B8AE2
false, xrefs: 00007FF7AC3B89ED

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 4121308752-1062449267
Opcode ID: 3c1ec006099db71a3dc91ab4dc2974e913e148f6dc0d6aa64288054debee8935
Instruction ID: 8528f1b64d25ae34f3e5b8aa70705efdf0ac225e4d8f2c553b4066fcd570a881
Opcode Fuzzy Hash: 3c1ec006099db71a3dc91ab4dc2974e913e148f6dc0d6aa64288054debee8935
Instruction Fuzzy Hash: 0D61A132A0AB419AEB11EF60D4402BDB3B1EF84748F964139EB8D23A69DF3CE451D355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EFFE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32 ref: 00007FFDF80F009F
CreateWindowExW.USER32 ref: 00007FFDF80F011B
CreateWindowExA.USER32 ref: 00007FFDF80F0190
SetWindowLongPtrA.USER32 ref: 00007FFDF80F01D2

Strings

-HTMLAYOUT-TOOL-W, xrefs: 00007FFDF80F00B1
HTMLAYOUT-TOOL-W, xrefs: 00007FFDF80F00BC
RUNTIME ERROR: unable to create popup window., xrefs: 00007FFDF80F019E
HTMLAYOUT-TOOL, xrefs: 00007FFDF80F0131
-HTMLAYOUT-TOOL, xrefs: 00007FFDF80F0126

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$Create$LongUnicode
String ID: -HTMLAYOUT-TOOL$-HTMLAYOUT-TOOL-W$HTMLAYOUT-TOOL$HTMLAYOUT-TOOL-W$RUNTIME ERROR: unable to create popup window.
API String ID: 3856304439-2965759816
Opcode ID: e3a27a502394ab8a0fec9cc4b90a3749568c97236f799dc748e0de72fd98ec6e
Instruction ID: 69626d41bfb22af35775ef4f9ebf66a24935cf6f80fa138cb1182e2a29b0681f
Opcode Fuzzy Hash: e3a27a502394ab8a0fec9cc4b90a3749568c97236f799dc748e0de72fd98ec6e
Instruction Fuzzy Hash: 6B51847270868586EB14DB14E860B7877A1FF44BA4F548135EA6D437E8CF3DE881E709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6040 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SetViewportOrgEx.GDI32 ref: 00007FFDF80B6076
SetWindowOrgEx.GDI32 ref: 00007FFDF80B608F
BitBlt.GDI32 ref: 00007FFDF80B60D1
SelectObject.GDI32 ref: 00007FFDF80B60E2
SelectObject.GDI32 ref: 00007FFDF80B60F3
DeleteObject.GDI32 ref: 00007FFDF80B60FC
DeleteDC.GDI32 ref: 00007FFDF80B6109
EndPaint.USER32 ref: 00007FFDF80B6117

Strings

, xrefs: 00007FFDF80B60B0

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$DeleteSelect$PaintViewportWindow
String ID:
API String ID: 644032327-3916222277
Opcode ID: d6959a74546adbf7c3c2dbdda886a1304d129828dbe93b65badcbaf83d8fd773
Instruction ID: 1275787fe691ed649a17bd7692da87ab9675e8f3aea76448e05c3eec9823de18
Opcode Fuzzy Hash: d6959a74546adbf7c3c2dbdda886a1304d129828dbe93b65badcbaf83d8fd773
Instruction Fuzzy Hash: EB210676714A8187DB54EF25E4A0A2977A0FB88F98F488135DE5D87768CF38D485CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6DE0 Relevance: 15.4, APIs: 10, Instructions: 350COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF80B6720: EnterCriticalSection.KERNEL32 ref: 00007FFDF80B6749
Part of subcall function 00007FFDF80B6720: LeaveCriticalSection.KERNEL32(?), ref: 00007FFDF80B6816

EnterCriticalSection.KERNEL32 ref: 00007FFDF80B6E7F

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 62022dc78a8271a6cb1fce53fe823f8e0ebbc68f3c8af55d2dfcc5fbe9be7abb
Instruction ID: 27021e259cbfb38f811f17774aabc248426c60c5742fde6b31b6c62eeb240225
Opcode Fuzzy Hash: 62022dc78a8271a6cb1fce53fe823f8e0ebbc68f3c8af55d2dfcc5fbe9be7abb
Instruction Fuzzy Hash: 05F1A532B0878286EB688F25D960FB863A0FF447D4F444131DA6D97BE9DF38E554A305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C5870 Relevance: 15.2, APIs: 10, Instructions: 202windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 00007FFDF80C58C5
GetDlgCtrlID.USER32 ref: 00007FFDF80C5909
GetParent.USER32 ref: 00007FFDF80C5943
SendMessageA.USER32 ref: 00007FFDF80C5958
IsWindow.USER32 ref: 00007FFDF80C5968
SendMessageA.USER32 ref: 00007FFDF80C5A7D
GetWindowRect.USER32 ref: 00007FFDF80C5A97
GetDlgCtrlID.USER32 ref: 00007FFDF80C5ACE
GetParent.USER32 ref: 00007FFDF80C5B23
SendMessageA.USER32 ref: 00007FFDF80C5B38

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CtrlMessageSend$ParentWindow$Rect
String ID:
API String ID: 3091584759-0
Opcode ID: 9372351045963e77afa06d2a81f1be299db286ca39ed37aaf3032b279f0788dd
Instruction ID: bb4b335c6f3dee037e596fb6a8bc6e2c36fadcc7739674f3b28ea9d7f4f3e3f5
Opcode Fuzzy Hash: 9372351045963e77afa06d2a81f1be299db286ca39ed37aaf3032b279f0788dd
Instruction Fuzzy Hash: F691AD76B09A4186EB08DF21D860AAD37A0FB49B84F444032DE6E577E8CF3CE545E349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C5640 Relevance: 15.1, APIs: 10, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00007FFDF80C5698
GetWindowLongA.USER32 ref: 00007FFDF80C56E2
GetWindowLongA.USER32 ref: 00007FFDF80C56F2
AdjustWindowRectEx.USER32 ref: 00007FFDF80C5713
GetWindowDC.USER32 ref: 00007FFDF80C571C
SendMessageA.USER32 ref: 00007FFDF80C5732
SelectObject.GDI32 ref: 00007FFDF80C573E
GetTextMetricsA.GDI32 ref: 00007FFDF80C574F
SelectObject.GDI32 ref: 00007FFDF80C575B
ReleaseDC.USER32 ref: 00007FFDF80C5767

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$LongMessageObjectSelectSend$AdjustMetricsRectReleaseText
String ID:
API String ID: 3035035113-0
Opcode ID: 7c9554134f26068ccad6e678c9eb7e26ef66babac475ec778803b2a5b45bee57
Instruction ID: 28f9c24cf49963c5f3f1821b324bc9a200c28fc24d8e1e857e23fb6897c9534e
Opcode Fuzzy Hash: 7c9554134f26068ccad6e678c9eb7e26ef66babac475ec778803b2a5b45bee57
Instruction Fuzzy Hash: 35415F72B086418BD764DF25F454B6AB3A0FB88B84F448135EA9D83BA8DF3CD4448B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3C7980 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 361COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3C79AF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3C79D2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3C79FD
std::_Facet_Register.LIBCPMT ref: 00007FF7AC3C7A43
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3C7A64
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3C7A89

Part of subcall function 00007FF7AC55A56C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC55A589
Part of subcall function 00007FF7AC55A56C: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7AC55A5AC
Part of subcall function 00007FF7AC55A56C: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC55A641

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3C7EBC

Strings

integral cannot be stored in wchar_t, xrefs: 00007FF7AC3C7EC2

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocale_invalid_parameter_noinfo_noreturnstd::locale::_
String ID: integral cannot be stored in wchar_t
API String ID: 1468110720-1689078516
Opcode ID: bd6ec2d6afb82967205289be667fee6c318acbea282c82a09467bad39d8d37cb
Instruction ID: cab8cc2da8b0c0b45734d546e5331d1e935b18f04ddb8ddbaec89d49f9f3994c
Opcode Fuzzy Hash: bd6ec2d6afb82967205289be667fee6c318acbea282c82a09467bad39d8d37cb
Instruction Fuzzy Hash: 69F1B022A0DB81E5EB10EB24E4406BDB7B1FB85784F954139EE8D03BA9DF3CE5498711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF81568D0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF829BA7C: CreateFileW.KERNEL32 ref: 00007FFDF829BAD0
Part of subcall function 00007FFDF829BA7C: GetFileSize.KERNEL32 ref: 00007FFDF829BAE4
Part of subcall function 00007FFDF829BA7C: CreateFileMappingA.KERNEL32 ref: 00007FFDF829BB21

FlushViewOfFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156B4B
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156B64
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156B72
SetFilePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156B94
SetEndOfFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156B9D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00007FFDF8156BA6

Strings

file://%s, xrefs: 00007FFDF8156A73
Could not flush memory to disk., xrefs: 00007FFDF8156B55

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: File$CloseCreateHandleView$FlushMappingPointerSizeUnmap
String ID: Could not flush memory to disk.$file://%s
API String ID: 409709207-3906887048
Opcode ID: 0aa6a19ba304f1296970b8ac80788be4c3d4e10c03559670a150c78ed8812ac7
Instruction ID: a74fc601d1fb89f80bd4ff85a8339b195cf844f6cd94371880529e0bfeabdc7a
Opcode Fuzzy Hash: 0aa6a19ba304f1296970b8ac80788be4c3d4e10c03559670a150c78ed8812ac7
Instruction Fuzzy Hash: F691B023F19A429AFB109B61D5605FD33B0AB44BA8F444231DE2D57AEDDF38E801E349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8134E60 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 214libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF8134F03
GetProcAddress.KERNEL32 ref: 00007FFDF8134F1C
CreateCompatibleDC.GDI32 ref: 00007FFDF8134F61
SelectObject.GDI32 ref: 00007FFDF8134F71
SelectObject.GDI32 ref: 00007FFDF8134FF4
DeleteObject.GDI32 ref: 00007FFDF8134FFD

Strings

AlphaBlend, xrefs: 00007FFDF8134F12
Msimg32.dll, xrefs: 00007FFDF8134EFC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$AddressCompatibleCreateDeleteLibraryLoadProc
String ID: AlphaBlend$Msimg32.dll
API String ID: 1553575486-1584225664
Opcode ID: 8667c589a7afcb15f25208498ab3cf2e046de6812832ad5e469a0cdaecaae4c7
Instruction ID: 0e45aacc158a1063b017daa49e22184536f98d096d57e634fe1e94428e44e53a
Opcode Fuzzy Hash: 8667c589a7afcb15f25208498ab3cf2e046de6812832ad5e469a0cdaecaae4c7
Instruction Fuzzy Hash: 40A19F73B08B818AE714CF29E854AAD77A4FB88B84F144135DE5D43BA8CF38E485DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EC5C0 Relevance: 13.6, APIs: 9, Instructions: 145COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDF80EC62C
SetTextAlign.GDI32 ref: 00007FFDF80EC724
SelectObject.GDI32 ref: 00007FFDF80EC75A
DeleteObject.GDI32 ref: 00007FFDF80EC768
SelectObject.GDI32 ref: 00007FFDF80EC776
DeleteObject.GDI32 ref: 00007FFDF80EC784
SelectObject.GDI32 ref: 00007FFDF80EC792
ReleaseDC.USER32 ref: 00007FFDF80EC7A4

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Delete$AlignCriticalEnterReleaseSectionText
String ID:
API String ID: 993868725-0
Opcode ID: a784622a30f5e13d6fad10299460b7bfdc04eba82cc7472b9c796fb77a5c38cd
Instruction ID: eb9fdcb9194fea0c1728950ec941bc49de57146b8ad11b523d16527d7f738da5
Opcode Fuzzy Hash: a784622a30f5e13d6fad10299460b7bfdc04eba82cc7472b9c796fb77a5c38cd
Instruction Fuzzy Hash: DA717C76B18B418AE714DFB4E4906AD33B1EB44798F000235DEAD67AACCF38E455E744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E4FF0 Relevance: 13.6, APIs: 9, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00007FFDF80E5042
ShowWindow.USER32 ref: 00007FFDF80E5065
GetFocus.USER32 ref: 00007FFDF80E5070
SetFocus.USER32 ref: 00007FFDF80E5082
ShowWindow.USER32 ref: 00007FFDF80E508D
GetWindowRect.USER32 ref: 00007FFDF80E50AD
GetParent.USER32 ref: 00007FFDF80E50B6
GetWindowRect.USER32 ref: 00007FFDF80E50C4
MoveWindow.USER32 ref: 00007FFDF80E512C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$FocusRectShow$LongMoveParent
String ID:
API String ID: 4135828658-0
Opcode ID: 6bdd4bf070169ead557975b1c267524dc81210e25fcec65cc28e58d2e432384c
Instruction ID: e7800953d2094d36f737a62db54b852faff1d18b7c26c348110c0a094fde9af0
Opcode Fuzzy Hash: 6bdd4bf070169ead557975b1c267524dc81210e25fcec65cc28e58d2e432384c
Instruction Fuzzy Hash: 7B41A3727186418BE724DF15F964A2E73A1FB847C0F504135DAAE43BA8CF3DE8459B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8131D30 Relevance: 13.6, APIs: 9, Instructions: 77windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32 ref: 00007FFDF8131D80
GetStockObject.GDI32 ref: 00007FFDF8131DB4
SelectObject.GDI32 ref: 00007FFDF8131DC1
DeleteObject.GDI32 ref: 00007FFDF8131DCA
GetStockObject.GDI32 ref: 00007FFDF8131DD5
SelectObject.GDI32 ref: 00007FFDF8131DE2
DeleteObject.GDI32 ref: 00007FFDF8131DEB
SaveDC.GDI32 ref: 00007FFDF8131DF5
IntersectClipRect.GDI32(?,?,?,?,?,?,?,?,?,?,?,00007FFDF8133920), ref: 00007FFDF8131E39

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$DeleteRectSelectStock$ClipIntersectSaveVisible
String ID:
API String ID: 1353815414-0
Opcode ID: fe9df8852b91a8ed93d47f61638fa5880d9a0a868887594fa4c2d46a93532b82
Instruction ID: 061fa276b642346d3e6eba5fa256a6dde4a5746286c1c49a4deb4745256f7c1f
Opcode Fuzzy Hash: fe9df8852b91a8ed93d47f61638fa5880d9a0a868887594fa4c2d46a93532b82
Instruction Fuzzy Hash: 3F311876B08A8187EB44DF16F464529B3A0FB88B94F044435EF9E87B68DF3CE4918B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8130E40 Relevance: 13.6, APIs: 9, Instructions: 53COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDF8130E64
SetTextAlign.GDI32 ref: 00007FFDF8130EA0
GetStockObject.GDI32 ref: 00007FFDF8130EAE
SelectObject.GDI32 ref: 00007FFDF8130EBB
GetStockObject.GDI32 ref: 00007FFDF8130ECA
SelectObject.GDI32 ref: 00007FFDF8130ED7
GetStockObject.GDI32 ref: 00007FFDF8130EE6
SelectObject.GDI32 ref: 00007FFDF8130EF3
SetBkMode.GDI32 ref: 00007FFDF8130F06

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$SelectStock$AlignModeText
String ID:
API String ID: 120275662-0
Opcode ID: 20d4aa56110a090100b6536145906f7eae33c8c6d8754a5993a9cfad8f89b3fb
Instruction ID: 022838fc74988f661077ad03765a84d14a1b8795288a02597e67ac1948992256
Opcode Fuzzy Hash: 20d4aa56110a090100b6536145906f7eae33c8c6d8754a5993a9cfad8f89b3fb
Instruction Fuzzy Hash: 0E21D8B6A08B8182DB089F61E46462977A0FB88F58F088135CE5E8B3A8DF3CD484D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC5720C8 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57210C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC5724E4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57278F

Strings

0, xrefs: 00007FF7AC572534
f, xrefs: 00007FF7AC57222E
p, xrefs: 00007FF7AC572236
p, xrefs: 00007FF7AC5721BE

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: bcece133b641e7548acf6dc282a16165f19e5be3bcbf4fc74e5f0e06a67feb01
Instruction ID: 83bf810a69308284475229a02af7eacce068e0c64cee343e59275bccd55a6784
Opcode Fuzzy Hash: bcece133b641e7548acf6dc282a16165f19e5be3bcbf4fc74e5f0e06a67feb01
Instruction Fuzzy Hash: 9012C271E0E143E6FB20BA159856279B252FB50750FE64836F69907EE4DE3CE6C09F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3BC200 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 214COMMON

Download Yara Rule

Strings

Dynamic width or precision index too large., xrefs: 00007FF7AC3BC374
Number is too big, xrefs: 00007FF7AC3BC34D
Invalid format string., xrefs: 00007FF7AC3BC35A
Precision not allowed for this argument type., xrefs: 00007FF7AC3BC333
Can not switch from automatic to manual indexing, xrefs: 00007FF7AC3BC340
Can not switch from manual to automatic indexing, xrefs: 00007FF7AC3BC367

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID:
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Dynamic width or precision index too large.$Invalid format string.$Number is too big$Precision not allowed for this argument type.
API String ID: 0-1651902013
Opcode ID: cbac36b40b140baba22158f8a63e0def545954ead84a1be9f5792296d0dc89eb
Instruction ID: 092f71a323d005a41a0122930b82618165bd53c09522218796ff08f4c653a14f
Opcode Fuzzy Hash: cbac36b40b140baba22158f8a63e0def545954ead84a1be9f5792296d0dc89eb
Instruction Fuzzy Hash: 7A712422A0AE8591DA24EB19E0405BDB3A0FB81BD0FE5413ADBAD036B5CF3CD591C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3C9FD0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3CA06D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3CA0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3CA25A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3CA289

Strings

true, xrefs: 00007FF7AC3CA158
bad locale name, xrefs: 00007FF7AC3CA28F
false, xrefs: 00007FF7AC3CA142

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 3230409043-1062449267
Opcode ID: f804923dc4d2f6bd83f2ec516e01a187c78b4bb40098afbe570d6af8c39016d5
Instruction ID: 3c9dc6254a0592e1cb30fb3bf39a4b9943b74b55b4b4258edd086d1de5b5d374
Opcode Fuzzy Hash: f804923dc4d2f6bd83f2ec516e01a187c78b4bb40098afbe570d6af8c39016d5
Instruction Fuzzy Hash: C881812290AB81A6E711EF30D4402ADB7A0FF84748F955135FB8D27A69DF3CD194D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55F014 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00007FF7AC55F08B
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FF7AC55F0E7

Strings

Access violation - no RTTI data!, xrefs: 00007FF7AC55F207
Bad read pointer - no RTTI data!, xrefs: 00007FF7AC55F1E4
Attempted a typeid of nullptr pointer!, xrefs: 00007FF7AC55F1C1
Bad dynamic_cast!, xrefs: 00007FF7AC55F156

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: FileFindHeaderInstanceTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 746355257-928371585
Opcode ID: b0405faec312698d2ca0de4ea4a0f11074925f3730a8e6648c9c45c251907e4a
Instruction ID: 2e4fec552a406ffc72721cde6e047a954eddab7651b02d40c35fc153d55c8633
Opcode Fuzzy Hash: b0405faec312698d2ca0de4ea4a0f11074925f3730a8e6648c9c45c251907e4a
Instruction Fuzzy Hash: 4D51A372A1AA4AA2EE20EB51E840679A360FF44B84FA64531FB4E43774DF7CE505C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A8E0B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 96libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7AC3A8E19
GetLastError.KERNEL32 ref: 00007FF7AC3A93A8
GetLastError.KERNEL32 ref: 00007FF7AC3A93E8

Strings

SetProcessDPIAware, xrefs: 00007FF7AC3A8E0B
GetProcAddress ({}), xrefs: 00007FF7AC3A93AE
GetModuleHandleW ({}), xrefs: 00007FF7AC3A93EE
--product 5, xrefs: 00007FF7AC3A94D3

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$AddressProc
String ID: --product 5$GetModuleHandleW ({})$GetProcAddress ({})$SetProcessDPIAware
API String ID: 1975335638-2397380106
Opcode ID: a0ed3988ffc7921abcb2860fe5042918c85906331fe602cd71b8419138f53765
Instruction ID: 18e0455767138cd774be93fee7ab805a909a4d23353e30bf9af1333070400db2
Opcode Fuzzy Hash: a0ed3988ffc7921abcb2860fe5042918c85906331fe602cd71b8419138f53765
Instruction Fuzzy Hash: 00419222E19A46A5FB00EBA4E8406EDB371FB84308F911136EA4E53AB9DF3CD545C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF829BB90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

FlushViewOfFile.KERNEL32 ref: 00007FFDF829BBC5
UnmapViewOfFile.KERNEL32 ref: 00007FFDF829BBDF
CloseHandle.KERNEL32 ref: 00007FFDF829BBF3
SetFilePointer.KERNEL32 ref: 00007FFDF829BC1E
SetEndOfFile.KERNEL32 ref: 00007FFDF829BC28
CloseHandle.KERNEL32 ref: 00007FFDF829BC32

Strings

Could not flush memory to disk., xrefs: 00007FFDF829BBCF

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: File$CloseHandleView$FlushPointerUnmap
String ID: Could not flush memory to disk.
API String ID: 519454899-1683962931
Opcode ID: ec4e2684c4bb911e20722ca3fd1a75787e63573ec4145c91333ce21edfeb93cb
Instruction ID: 7e5211bc87da8f16bdc01b092e2b3a497ce9e7d33dbe0a24fd178c98fd75814e
Opcode Fuzzy Hash: ec4e2684c4bb911e20722ca3fd1a75787e63573ec4145c91333ce21edfeb93cb
Instruction Fuzzy Hash: 342121A1B0554982EB289F20D4B5B3823A0EF44F5CF184235D92D860ECCF7CE894E349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC56CB0C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC56CB4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC56CEF8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC56D1A3

Strings

p, xrefs: 00007FF7AC56CBD2
f, xrefs: 00007FF7AC56CC42
p, xrefs: 00007FF7AC56CC4A

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 82370194359c115f7e877a4752653bd48a82769e4f579e4bcd21c57a5e2ac23a
Instruction ID: 9a37a69dff0c9f1c7bec7622edeaa55e196928903f7aae13567bb6476ee7236a
Opcode Fuzzy Hash: 82370194359c115f7e877a4752653bd48a82769e4f579e4bcd21c57a5e2ac23a
Instruction Fuzzy Hash: 0212B221E0E143A6FB60BE15E04467AF661FB51750FEE4431F6894A6E4DE7CF980CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80CA120 Relevance: 10.7, APIs: 7, Instructions: 203COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

SetTextAlign.GDI32 ref: 00007FFDF80CA366
SelectObject.GDI32 ref: 00007FFDF80CA39F
DeleteObject.GDI32 ref: 00007FFDF80CA3AD
SelectObject.GDI32 ref: 00007FFDF80CA3BC
DeleteObject.GDI32 ref: 00007FFDF80CA3CA
SelectObject.GDI32 ref: 00007FFDF80CA3D9
ReleaseDC.USER32 ref: 00007FFDF80CA3ED

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Stock$AlignDeleteText$ModeRelease
String ID:
API String ID: 3346625119-0
Opcode ID: 66e791ad7f2512c0bed776c04b19c3ea74b6e2c1127849c8b800c78c837d904f
Instruction ID: 0b54d23399711cf7ae4f9f3ea4a06fc996dcf925f7176f116df24af9e1d8dadd
Opcode Fuzzy Hash: 66e791ad7f2512c0bed776c04b19c3ea74b6e2c1127849c8b800c78c837d904f
Instruction Fuzzy Hash: 71A16B73B18B818AE714CF65E4506ADB7B0FB88B94F005235EA9D53BA8DF78D445DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80CA460 Relevance: 10.7, APIs: 7, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

SetTextAlign.GDI32 ref: 00007FFDF80CA6A5
SelectObject.GDI32 ref: 00007FFDF80CA6DE
DeleteObject.GDI32 ref: 00007FFDF80CA6EC
SelectObject.GDI32 ref: 00007FFDF80CA6FB
DeleteObject.GDI32 ref: 00007FFDF80CA709
SelectObject.GDI32 ref: 00007FFDF80CA718
ReleaseDC.USER32 ref: 00007FFDF80CA72C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Stock$AlignDeleteText$ModeRelease
String ID:
API String ID: 3346625119-0
Opcode ID: d6ca2868f77abe0fc05a4468d628d733d811a1c7bf1c9a599806de7c8bd21bae
Instruction ID: b819375c65b88bbed8404e320af9baf22cd095f0acb883bbfc0304155040cb15
Opcode Fuzzy Hash: d6ca2868f77abe0fc05a4468d628d733d811a1c7bf1c9a599806de7c8bd21bae
Instruction Fuzzy Hash: 41A15D72B18B818AEB04DF65E8507AD77B0F789794F145235EA9D53BA8CF38E481DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E78F0 Relevance: 10.7, APIs: 7, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

SetTextAlign.GDI32 ref: 00007FFDF80E7AE5
SelectObject.GDI32 ref: 00007FFDF80E7B1E
DeleteObject.GDI32 ref: 00007FFDF80E7B2C
SelectObject.GDI32 ref: 00007FFDF80E7B3B
DeleteObject.GDI32 ref: 00007FFDF80E7B49
SelectObject.GDI32 ref: 00007FFDF80E7B58
ReleaseDC.USER32 ref: 00007FFDF80E7B6C

Part of subcall function 00007FFDF8134E60: CreateCompatibleDC.GDI32 ref: 00007FFDF8134F61
Part of subcall function 00007FFDF8134E60: SelectObject.GDI32 ref: 00007FFDF8134F71
Part of subcall function 00007FFDF8134E60: SelectObject.GDI32 ref: 00007FFDF8134FF4
Part of subcall function 00007FFDF8134E60: DeleteObject.GDI32 ref: 00007FFDF8134FFD

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$DeleteStock$AlignText$CompatibleCreateModeRelease
String ID:
API String ID: 3369458553-0
Opcode ID: a891d7145882e6ad57906125c3e28888611580f8e5322457f2f133010296040e
Instruction ID: 940a8fca30c8cf168035d387b10bef48679d9bad8963321b3655ba351ba32783
Opcode Fuzzy Hash: a891d7145882e6ad57906125c3e28888611580f8e5322457f2f133010296040e
Instruction Fuzzy Hash: C0914F73A19B818AE744CF64E4507AEB7B0F788794F141225EA9D53AACDF7CE480DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C9E70 Relevance: 10.7, APIs: 7, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8130E40: GetDC.USER32 ref: 00007FFDF8130E64
Part of subcall function 00007FFDF8130E40: SetTextAlign.GDI32 ref: 00007FFDF8130EA0
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EAE
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EBB
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130ECA
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130ED7
Part of subcall function 00007FFDF8130E40: GetStockObject.GDI32 ref: 00007FFDF8130EE6
Part of subcall function 00007FFDF8130E40: SelectObject.GDI32 ref: 00007FFDF8130EF3
Part of subcall function 00007FFDF8130E40: SetBkMode.GDI32 ref: 00007FFDF8130F06

SetTextAlign.GDI32 ref: 00007FFDF80CA036
SelectObject.GDI32 ref: 00007FFDF80CA06F
DeleteObject.GDI32 ref: 00007FFDF80CA07D
SelectObject.GDI32 ref: 00007FFDF80CA08C
DeleteObject.GDI32 ref: 00007FFDF80CA09A
SelectObject.GDI32 ref: 00007FFDF80CA0A9
ReleaseDC.USER32 ref: 00007FFDF80CA0BD

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Stock$AlignDeleteText$ModeRelease
String ID:
API String ID: 3346625119-0
Opcode ID: 76150faadf6d74056e290d295bc84678eda9428d991f917c3c89932d039c2be1
Instruction ID: 0468a6ad08d2826292ce17f1f380324a2cdff135c43e914ae3ac0ae8a64b0597
Opcode Fuzzy Hash: 76150faadf6d74056e290d295bc84678eda9428d991f917c3c89932d039c2be1
Instruction Fuzzy Hash: F0816D73B19B818AE700DF65E45066EB7A0FB88798F100235EE9D53BA8DF78D445DB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BAD10 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FFDF80BAD4D
GetTempFileNameA.KERNEL32 ref: 00007FFDF80BAD6A
LoadCursorFromFileA.USER32 ref: 00007FFDF80BADF3

Strings

cur, xrefs: 00007FFDF80BAD5B
wb+, xrefs: 00007FFDF80BAD70

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: FileTemp$CursorFromLoadNamePath
String ID: cur$wb+
API String ID: 2710153881-2052460546
Opcode ID: eda999a48203e9b3c00245e82114b8f2fa3e7402ac1ffc3bb0970bec5c78957f
Instruction ID: 43f6b5d9832b638721b2aef003b0cd74b7b292a2fa30760bda00ad5e787e28bf
Opcode Fuzzy Hash: eda999a48203e9b3c00245e82114b8f2fa3e7402ac1ffc3bb0970bec5c78957f
Instruction Fuzzy Hash: F7716471B0AA4286EB209F14E465ABC63A1BF45B94F844131DA7D876ECDE3CE841E309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8149240 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF81492BD

Part of subcall function 00007FFDF8333F88: AcquireSRWLockExclusive.KERNEL32 ref: 00007FFDF8333F98
Part of subcall function 00007FFDF8333F88: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDF8333FD8

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF81492E2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF814939C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF8149422
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF814944A
DeleteObject.GDI32 ref: 00007FFDF814946B

Part of subcall function 00007FFDF8333FF4: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FFDF80B65E9), ref: 00007FFDF8334004

LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00007FFDF8149499

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$ExclusiveLock$AcquireEnterInitializeLeave$DeleteObjectRelease
String ID:
API String ID: 2258696684-0
Opcode ID: 9e5cedf0f41c8dd6b5ad3a24a112e869b8f626d480bc209d5c1664de147d0ab5
Instruction ID: 1671eb3e0e39e0485e3ea59ff1295d317e4cfcfa51e1d58c934c7f32d09c564b
Opcode Fuzzy Hash: 9e5cedf0f41c8dd6b5ad3a24a112e869b8f626d480bc209d5c1664de147d0ab5
Instruction Fuzzy Hash: D9715A32F08B029AF700EB60F860AAC33B5AB45744F854136D97D566EDDF3CA559E30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F1E30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

DISPLAY, xrefs: 00007FFDF80F1EC6

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID:
String ID: DISPLAY
API String ID: 0-865373369
Opcode ID: 358b16e3c623c49d03856ba94773be9feb10b956b46ef271584ee3f311921d7c
Instruction ID: 12463b3af6493afb5b9b2d0836590d07ca4650fe797029206acb9af7e7de22ac
Opcode Fuzzy Hash: 358b16e3c623c49d03856ba94773be9feb10b956b46ef271584ee3f311921d7c
Instruction Fuzzy Hash: 00616E33B186828BE754DF65E850AAD77A0FB84744F448036EA5D87BACDF38E404DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A4620 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3A4696
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3A46DE
_Getctype.LIBCPMT ref: 00007FF7AC3A46F6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3A47AE
_Getwctype.LIBCPMT ref: 00007FF7AC3A4802

Strings

bad locale name, xrefs: 00007FF7AC3A47D1

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: c6ff50564003776c1d35139b74242cfe411fa7cf8f48b00488c1c6074099aa67
Instruction ID: 749f2e14fb855800374eb3ee695ab28ba365498cf046a148e631640a41bd8405
Opcode Fuzzy Hash: c6ff50564003776c1d35139b74242cfe411fa7cf8f48b00488c1c6074099aa67
Instruction Fuzzy Hash: 8A518D22A0AB81AAEB10EBB0D4402ADB375FF50784F555039EF4D23A6ADF38E565C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A4250 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3A42C6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3A430E
_Getctype.LIBCPMT ref: 00007FF7AC3A4326
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3A43B6

Strings

bad locale name, xrefs: 00007FF7AC3A43D9
false, xrefs: 00007FF7AC3A4266

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false
API String ID: 2967684691-2236580902
Opcode ID: ad704fa9723f95c17442fb4e8d74200914be129f07d483a6ff4264a6ff5f30c3
Instruction ID: cf472a8e71988006ad310763e0492e268988d43a4726fb3c17790cf9073d35fc
Opcode Fuzzy Hash: ad704fa9723f95c17442fb4e8d74200914be129f07d483a6ff4264a6ff5f30c3
Instruction Fuzzy Hash: 4B518E22B0AB41E9EB10EFB1D4502BDB364EF40788F595439EE4D23AA9DF38D1669310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BEC80 Relevance: 10.6, APIs: 7, Instructions: 85timewindowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 00007FFDF80BECE2
GetParent.USER32 ref: 00007FFDF80BED1F
SendMessageA.USER32 ref: 00007FFDF80BED35
KillTimer.USER32 ref: 00007FFDF80BED9D
KillTimer.USER32 ref: 00007FFDF80BEDAF
GetDoubleClickTime.USER32 ref: 00007FFDF80BEDC2
GetTickCount.KERNEL32 ref: 00007FFDF80BEDCA

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: KillTimer$ClickCountCtrlDoubleMessageParentSendTickTime
String ID:
API String ID: 4083620262-0
Opcode ID: 982140dafa9b70a18c03bf39dc5540d9cf532fa3720f47d708a3afe282c79de1
Instruction ID: 831892a072653526619f748892ff6eb3e61f9f0b1c1871a48ca0170ff2a3bd86
Opcode Fuzzy Hash: 982140dafa9b70a18c03bf39dc5540d9cf532fa3720f47d708a3afe282c79de1
Instruction Fuzzy Hash: 7A418F72B08B8687DB1CDF21E464A6973A0FB88B91F540135EA6E877A8CF3CE450D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6EC3 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B6ED0
EnterCriticalSection.KERNEL32 ref: 00007FFDF80B6F2E
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B6F4C
TlsGetValue.KERNEL32 ref: 00007FFDF80B6F61
UnhookWindowsHookEx.USER32 ref: 00007FFDF80B6F73
TlsSetValue.KERNEL32 ref: 00007FFDF80B6F81
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$Leave$Value$EnterHookUnhookWindows
String ID:
API String ID: 1904704018-0
Opcode ID: fea04cd36470748b934d21915401d02c057c5dcb955f65e2760876d03ee4f74b
Instruction ID: 5b84106cd4a6ab392f124d876e4e1a001e4519a55fedec35c428b183249eacb2
Opcode Fuzzy Hash: fea04cd36470748b934d21915401d02c057c5dcb955f65e2760876d03ee4f74b
Instruction Fuzzy Hash: 74318166F05A4283EB49EB25E974A7863A0FF45F95B494031CD2E477F8CF3CE446A209

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF813EA10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF813E920: CreateDIBSection.GDI32 ref: 00007FFDF813E9B7

CreateCompatibleDC.GDI32 ref: 00007FFDF813EA8F
SelectObject.GDI32 ref: 00007FFDF813EA9F
BitBlt.GDI32 ref: 00007FFDF813EAE9
SelectObject.GDI32 ref: 00007FFDF813EAF5
DeleteDC.GDI32 ref: 00007FFDF813EAFE

Strings

, xrefs: 00007FFDF813EAC7

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CreateObjectSelect$CompatibleDeleteSection
String ID:
API String ID: 1921846281-3916222277
Opcode ID: 63df13dad9187d17600eaa5c2d2291a23636cf86c904a231afe644d1760e6f1a
Instruction ID: 0cc3b55b293b129e94c4f0083007689e185b88b425f77f9373a6c3787af5b508
Opcode Fuzzy Hash: 63df13dad9187d17600eaa5c2d2291a23636cf86c904a231afe644d1760e6f1a
Instruction Fuzzy Hash: 76217872614B908AD718DF69E458A2E77A4F789B90F068034DE5D83B68DF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FD760 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC4FCCE0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD10
Part of subcall function 00007FF7AC4FCCE0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD1E
Part of subcall function 00007FF7AC4FCCE0: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD38
Part of subcall function 00007FF7AC4FCCE0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AC4FE4DB), ref: 00007FF7AC4FCD50

CreateFileW.KERNEL32 ref: 00007FF7AC4FD7B7
GetLastError.KERNEL32 ref: 00007FF7AC4FD7D5
GetLastError.KERNEL32 ref: 00007FF7AC4FD816

Strings

Unable to create directory '{}'!, xrefs: 00007FF7AC4FD7DB
*, xrefs: 00007FF7AC4FD823
Unable to open directory '{}' for writing!, xrefs: 00007FF7AC4FD81C

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$CreateFile$AttributesDirectory
String ID: *$Unable to create directory '{}'!$Unable to open directory '{}' for writing!
API String ID: 2112330871-2911474180
Opcode ID: 7626910c016869f81bd9071795f301ffe33e1cbd3142aeabc8b95cc84cae279d
Instruction ID: 883f55fbeecd48ed37ce83beef9d386cd1a228448f319e8c5cd80e96e5b4fd89
Opcode Fuzzy Hash: 7626910c016869f81bd9071795f301ffe33e1cbd3142aeabc8b95cc84cae279d
Instruction Fuzzy Hash: B321A432A09B42A2EB10EF50F4543AAB3B0FB84798F910231E69D47AA5DF7DD50DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8131E70 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00007FFDF8131EA5
SelectObject.GDI32 ref: 00007FFDF8131EB2
DeleteObject.GDI32 ref: 00007FFDF8131EC0
GetStockObject.GDI32 ref: 00007FFDF8131ECB
SelectObject.GDI32 ref: 00007FFDF8131ED8
DeleteObject.GDI32 ref: 00007FFDF8131EE6
RestoreDC.GDI32 ref: 00007FFDF8131F17

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$DeleteSelectStock$Restore
String ID:
API String ID: 1965476268-0
Opcode ID: 51759bc30722370a9696efc018581a087fd37a64b68a2bb6f6e04bd12db54d52
Instruction ID: a662555f19079c31c44adcc6951e1ad7321c684656ef1e112c52065dd5a94e7a
Opcode Fuzzy Hash: 51759bc30722370a9696efc018581a087fd37a64b68a2bb6f6e04bd12db54d52
Instruction Fuzzy Hash: 91213066B09A4282EF589F51E064A3963A1EB88F85F084135EE1D473DCDF3CE885E745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8130F30 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

SetTextAlign.GDI32 ref: 00007FFDF8130F6E
SelectObject.GDI32 ref: 00007FFDF8130FA2
DeleteObject.GDI32 ref: 00007FFDF8130FB0
SelectObject.GDI32 ref: 00007FFDF8130FBE
DeleteObject.GDI32 ref: 00007FFDF8130FCC
SelectObject.GDI32 ref: 00007FFDF8130FDA
ReleaseDC.USER32 ref: 00007FFDF8130FEC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$Delete$AlignReleaseText
String ID:
API String ID: 2724912489-0
Opcode ID: 1c848aa1e7e1d619c17e8305ae4828f57f9b039607acc1f5b37222993f8ae57b
Instruction ID: 051a284561c7b2d67ad286c4fa5df3117d7151043168ae3e4a62885de49303c9
Opcode Fuzzy Hash: 1c848aa1e7e1d619c17e8305ae4828f57f9b039607acc1f5b37222993f8ae57b
Instruction Fuzzy Hash: 6121F8A6B04A4583DB589F25D4A472963E0FB88F88F088135CE5D473ACDF3CD885D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF838C05C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDF838C08D
GetLastError.KERNEL32 ref: 00007FFDF838C099
CloseHandle.KERNEL32 ref: 00007FFDF838C0B1
CreateFileW.KERNEL32 ref: 00007FFDF838C0DC
WriteConsoleW.KERNEL32 ref: 00007FFDF838C0FB

Strings

CONOUT$, xrefs: 00007FFDF838C0BD

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 61c7f9d67f1748150c89e7948b3a2b97e78f0e4595999dbdc5ac83b3dcc9c3b1
Instruction ID: 2409560f18ec11cac9ccad947056b50955dd4c2c00adb151032f46f90de3027d
Opcode Fuzzy Hash: 61c7f9d67f1748150c89e7948b3a2b97e78f0e4595999dbdc5ac83b3dcc9c3b1
Instruction Fuzzy Hash: 7A119661B18A4187E3549B46E864725A2E0FB48BE4F444234D93DC77E8DF3CD4448749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F39F8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 36registrywindowCOMMON

Download Yara Rule

APIs

RegisterWindowMessageA.USER32 ref: 00007FFDF80F3A67
RegisterWindowMessageA.USER32 ref: 00007FFDF80F3A7A

Strings

English, xrefs: 00007FFDF80F3A1F
HTMLayoutWhois, xrefs: 00007FFDF80F3A60
L#', xrefs: 00007FFDF80F3A2B
HTMLayoutTransferFocus, xrefs: 00007FFDF80F3A6D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: MessageRegisterWindow
String ID: English$HTMLayoutTransferFocus$HTMLayoutWhois$L#'
API String ID: 1814269913-115249506
Opcode ID: 94b68b436db08bb716ab3e7eb86fb57a5b277aa08f41482d94d2094d997d837d
Instruction ID: 2eafe78610c29fdf1ff63f33daa1c81d852ce9f25a3010ab5f14282355e4b3c4
Opcode Fuzzy Hash: 94b68b436db08bb716ab3e7eb86fb57a5b277aa08f41482d94d2094d997d837d
Instruction Fuzzy Hash: 2B115A61F4AB83C1FB559B55E870A7437E0DF40B50F898536C92E4B2D9CF2D6441B30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55C3F4 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7AC55C466
MultiByteToWideChar.KERNEL32 ref: 00007FF7AC55C50E
LCMapStringEx.KERNEL32 ref: 00007FF7AC55C545
LCMapStringEx.KERNEL32 ref: 00007FF7AC55C59E
LCMapStringEx.KERNEL32 ref: 00007FF7AC55C64B
WideCharToMultiByte.KERNEL32 ref: 00007FF7AC55C68D

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 008c34b03aff8c4fd995adbc0886c99d170b1a9084371c2b9de37eecde7ae6d9
Instruction ID: f033696ffc68130722492d8ccf96796aa208a2eebf225d0ccd60eb4d92ee5835
Opcode Fuzzy Hash: 008c34b03aff8c4fd995adbc0886c99d170b1a9084371c2b9de37eecde7ae6d9
Instruction Fuzzy Hash: 5E81D432A0A74596EB209F15D44037AA2E1FF897A8F651235FB1E07BE9DF3CE5418710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF810FC70 Relevance: 9.2, APIs: 6, Instructions: 189COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FFDF810FD27
MulDiv.KERNEL32 ref: 00007FFDF810FD3B
CreateFontA.GDI32 ref: 00007FFDF810FDF2
SelectObject.GDI32 ref: 00007FFDF810FE26
DeleteObject.GDI32 ref: 00007FFDF810FE33
SelectObject.GDI32 ref: 00007FFDF810FEF6

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$CreateDeleteFont
String ID:
API String ID: 1981917228-0
Opcode ID: 9587cf9e029df7125524b81277e7d0757bc9793583e1b557446faca1df330e83
Instruction ID: 4fcbdd4a1cf20c96c0369f95567f3906d1cac5dc2e19b2e67ddc679366fde343
Opcode Fuzzy Hash: 9587cf9e029df7125524b81277e7d0757bc9793583e1b557446faca1df330e83
Instruction Fuzzy Hash: 75816AB3A08A8086DB54DF25D460A6D7BA1FB88F88F195235DE5D433A9CF38E841CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC566480 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF7AC566532
DName::operator+.LIBVCRUNTIME ref: 00007FF7AC566542
DName::operator+.LIBVCRUNTIME ref: 00007FF7AC56655F
DName::operator+.LIBVCRUNTIME ref: 00007FF7AC5665D2
DName::operator+.LIBVCRUNTIME ref: 00007FF7AC5665FB

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 30b0b679aeb681b02b069238eda25bfc6ae96d9d0d38df7ebeaecf34db854bca
Instruction ID: 8e18c9aaeeb90e6e9e52e44b979deca77e83b6dee889d45cb746a4a575fbf98f
Opcode Fuzzy Hash: 30b0b679aeb681b02b069238eda25bfc6ae96d9d0d38df7ebeaecf34db854bca
Instruction Fuzzy Hash: 4E71BF76A0AA96E9F700EF64E8403BCB3A5BB44744FEA8035EA4D177A5CF79D805C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B7F3E Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00007FFDF80B7F4D
SetWindowLongA.USER32 ref: 00007FFDF80B7F69
EnterCriticalSection.KERNEL32 ref: 00007FFDF80B7F7E
EnterCriticalSection.KERNEL32 ref: 00007FFDF80B80D0
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B8113
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLongWindow
String ID:
API String ID: 1534508445-0
Opcode ID: 13c773e0f6de8768aa64a1e220a9d7418e0a23346b7c4463fa10aa6f1b5dd5ef
Instruction ID: a43a7576a4538a6bea722b7d3db4da3e292d3ee1f4499d6fd06ae0d3c88fffb8
Opcode Fuzzy Hash: 13c773e0f6de8768aa64a1e220a9d7418e0a23346b7c4463fa10aa6f1b5dd5ef
Instruction Fuzzy Hash: 97515C22B05B8193DB0DDB35E6A46A8B7A8FB44B80F444035CB6D537B5DF38A175E309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EEDF0 Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FFDF80EEF39
GetParent.USER32 ref: 00007FFDF80EEF46
DestroyWindow.USER32 ref: 00007FFDF80EEF52
IsWindow.USER32 ref: 00007FFDF80EEF5B
UpdateWindow.USER32 ref: 00007FFDF80EEF68
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF80EEF96

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$Concurrency::cancel_current_taskDestroyParentUpdate
String ID:
API String ID: 2364769541-0
Opcode ID: c0aaa4c9190f473fbee9f25ac152a2c6e990085b528d67f52ba74cc5aec2e7c3
Instruction ID: df30468aaa910d4a1e3bcdf39cd1ee348b99d24e917878b340c7adb4d12078ab
Opcode Fuzzy Hash: c0aaa4c9190f473fbee9f25ac152a2c6e990085b528d67f52ba74cc5aec2e7c3
Instruction Fuzzy Hash: 1C413D76B09B4982EB18DF15E860A2963A4FB89FC0F584031DAAD437B8CF7DD445A705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B7AC0 Relevance: 9.1, APIs: 6, Instructions: 100timeCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00007FFDF80B7ACF
ScreenToClient.USER32 ref: 00007FFDF80B7B21
SetTimer.USER32 ref: 00007FFDF80B7B76
GetDoubleClickTime.USER32 ref: 00007FFDF80B7B7C
SetTimer.USER32 ref: 00007FFDF80B7B95
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Timer$ClickClientCriticalDoubleLeaveLongScreenSectionTimeWindow
String ID:
API String ID: 3215539043-0
Opcode ID: f7779b805fbc2cf004535556b2b7e3d6b17d9ce1da4b4f629485e49a963ead1a
Instruction ID: 4d22ab2ab381fa984ff9da080cbccd987b40181efb1de5f69ccfb4201b02947b
Opcode Fuzzy Hash: f7779b805fbc2cf004535556b2b7e3d6b17d9ce1da4b4f629485e49a963ead1a
Instruction Fuzzy Hash: EC419D72B046818BD759DF24D5A4AA977E4FB48B94F444132DB2D837E8CF38E851E704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B7780 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B77AF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B77D2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B77FD

Part of subcall function 00007FF7AC3B8B00: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B8B76
Part of subcall function 00007FF7AC3B8B00: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3B8BBE
Part of subcall function 00007FF7AC3B8B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B8C4E

std::_Facet_Register.LIBCPMT ref: 00007FF7AC3B7843
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B7864
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B7889

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 3702003507-0
Opcode ID: da7ef63e1b2fd6a97403faa30e5434948325801002b8eeb1225a9e4377f41100
Instruction ID: 5da5efd073a345e68497e3be65de2a1c22d873c2d2282a48d9a3cfead96bbebb
Opcode Fuzzy Hash: da7ef63e1b2fd6a97403faa30e5434948325801002b8eeb1225a9e4377f41100
Instruction Fuzzy Hash: E441DF62A0AB41A0EA14EB11E44117AF3A0FF89BD0F864139EA5C437B5DF3CE451C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B830A Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

SetTextColor.GDI32 ref: 00007FFDF80B837F
GetSysColor.USER32 ref: 00007FFDF80B839C
SetBkColor.GDI32 ref: 00007FFDF80B83AA
DeleteObject.GDI32 ref: 00007FFDF80B83BC
CreateSolidBrush.GDI32 ref: 00007FFDF80B83C5
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Color$BrushCreateCriticalDeleteLeaveObjectSectionSolidText
String ID:
API String ID: 2652430139-0
Opcode ID: 651050456e8fd6ebb1d590c555fe67d8531b05c85589d1ffe89735de548ea913
Instruction ID: da8063c04b37aa043404c03603bbf56ff448440edd627342c16a5b4ead805f0a
Opcode Fuzzy Hash: 651050456e8fd6ebb1d590c555fe67d8531b05c85589d1ffe89735de548ea913
Instruction Fuzzy Hash: FB316125B09A0286EB5DAB25E970A7817A1BF88FD5F444431CD2F877F8DE3CD441A206

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B7CA2 Relevance: 9.1, APIs: 6, Instructions: 78timeCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32 ref: 00007FFDF80B7CD1

Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF14
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF28
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF3E

KillTimer.USER32 ref: 00007FFDF80B7D29
KillTimer.USER32 ref: 00007FFDF80B7D3B
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8
GetDoubleClickTime.USER32 ref: 00007FFDF80B8747
GetTickCount.KERNEL32 ref: 00007FFDF80B874F

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AsyncState$KillTimer$ClickClientCountCriticalDoubleLeaveScreenSectionTickTime
String ID:
API String ID: 2332058121-0
Opcode ID: 31033cd9a06de0671ca390b536008c9d7deffd363755a899959ac8e57122a829
Instruction ID: 920689c368a27b902c28e5649317defcc215835ec6a2a7267daba379f351123e
Opcode Fuzzy Hash: 31033cd9a06de0671ca390b536008c9d7deffd363755a899959ac8e57122a829
Instruction Fuzzy Hash: B3316D76B04A8187DB1DDF25D5A4AB863A0FB48BA5F444132CA2E837E8CF3CE455E705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B7BEF Relevance: 9.1, APIs: 6, Instructions: 70timeCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32 ref: 00007FFDF80B7C1E
GetDoubleClickTime.USER32 ref: 00007FFDF80B7C24
SetTimer.USER32 ref: 00007FFDF80B7C3D
GetDoubleClickTime.USER32 ref: 00007FFDF80B7C43
GetTickCount.KERNEL32 ref: 00007FFDF80B7C4B

Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF14
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF28
Part of subcall function 00007FFDF80BEF00: GetAsyncKeyState.USER32 ref: 00007FFDF80BEF3E

LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AsyncState$ClickDoubleTime$ClientCountCriticalLeaveScreenSectionTickTimer
String ID:
API String ID: 1680461691-0
Opcode ID: 6001fd77beedf26637b6b1bfddcb32aa2d056441ab9d01b5e2e282855a6afdc6
Instruction ID: ec90cd97181a51444e8d19ec45fbae0e719634b7954f7890276f20994b2b462f
Opcode Fuzzy Hash: 6001fd77beedf26637b6b1bfddcb32aa2d056441ab9d01b5e2e282855a6afdc6
Instruction Fuzzy Hash: 61315E72B0468187DB1DDF25E964AAC73A0FB48B95F054136CA2E837A8DF3CE455D708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B7FE0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B800F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B8032
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B805D
std::_Facet_Register.LIBCPMT ref: 00007FF7AC3B80A3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B80C4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B80E9

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d4bfd7575ca1d61c4c6a608049d38e8ce6f06da7cfb9edca0078088f3b4bdeb1
Instruction ID: e9710b0d7bc812be8200018bfb0b98c6b71310e37da923286bb92631bb8da424
Opcode Fuzzy Hash: d4bfd7575ca1d61c4c6a608049d38e8ce6f06da7cfb9edca0078088f3b4bdeb1
Instruction Fuzzy Hash: E6316F21A0EA46A0EA14FB15E84057AF3A0FF88BD4F961136EA5D077B6DF3CE541C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B5930 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B595F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B5982
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B59AD
std::_Facet_Register.LIBCPMT ref: 00007FF7AC3B59F3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B5A14
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3B5A39

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2c49d97eb0321ecf0447d99140f6d680438a4c94cf50152affb2df8876d665ba
Instruction ID: 81b8e99d545dae6c0dc78c92210a290bca912617d0ecf55a8e8b262c452b0945
Opcode Fuzzy Hash: 2c49d97eb0321ecf0447d99140f6d680438a4c94cf50152affb2df8876d665ba
Instruction Fuzzy Hash: 8C317E61A1BE41A0EA24FB15E84017AF3A0FF88BD4F8A5236EA5D037B5DF3CE4018710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3AF4A0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3AF4CF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3AF4F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3AF51D
std::_Facet_Register.LIBCPMT ref: 00007FF7AC3AF563
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3AF584
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AC3AF5A9

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 68a060f83c1414f75e9e45679ac81ce856e77ec60f99233e20a36c873d5303cd
Instruction ID: 67803205bc3d5a7688336d7931b83b880540bcca8fc2846d349d314cec776d92
Opcode Fuzzy Hash: 68a060f83c1414f75e9e45679ac81ce856e77ec60f99233e20a36c873d5303cd
Instruction Fuzzy Hash: 22315E61A0EE01A0EA24FB15E84117AE3A0FF88BD4F9A1235EA5D077B5DF3CE5518710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F10B0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

SetViewportOrgEx.GDI32 ref: 00007FFDF80F10E2
SetMapMode.GDI32 ref: 00007FFDF80F10F0
SetViewportExtEx.GDI32 ref: 00007FFDF80F1106
SetWindowExtEx.GDI32 ref: 00007FFDF80F111C
DPtoLP.GDI32 ref: 00007FFDF80F1156
IntersectClipRect.GDI32 ref: 00007FFDF80F1175

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Viewport$ClipIntersectModeRectWindow
String ID:
API String ID: 694020364-0
Opcode ID: d6d5cbcc393cd81bda433c4566a9d78cfde7b3f3e46090bab2bbe8654e2b34c3
Instruction ID: f5633678489f37625b95a7f3b1beb65a99f956482dd7fffd2a0e8a1edd406d1e
Opcode Fuzzy Hash: d6d5cbcc393cd81bda433c4566a9d78cfde7b3f3e46090bab2bbe8654e2b34c3
Instruction Fuzzy Hash: CB211B76704A848BD318DF16EA50A1AB7A0FB89B84B14C125DF9947B28CF3CE865CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8169C70 Relevance: 9.1, APIs: 6, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169C95
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169CD6
EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169CE8
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D1C
SetEvent.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D34
Sleep.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D3F

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$EventSleep
String ID:
API String ID: 2153927836-0
Opcode ID: 7278a1362f3d4346be7c0b85785ddb1b928e599313cddfab48fe39b61ad57e52
Instruction ID: 8ed13047df7415f0582dd8a2e34d792633683ee40643a9e11dcfcff5027083d1
Opcode Fuzzy Hash: 7278a1362f3d4346be7c0b85785ddb1b928e599313cddfab48fe39b61ad57e52
Instruction Fuzzy Hash: 5521F936B05A4187DB189F25E56466AB7B0FB88B80F484131DB9E43BA8CF3CE445D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC582578 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC582587
FlsSetValue.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC5825BD
FlsSetValue.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC5825EA
FlsSetValue.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC5825FB
FlsSetValue.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC58260C
SetLastError.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7AC571D75,?,?,?,?,00007FF7AC580B34), ref: 00007FF7AC582627

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 65bf4cbe142cd8d6246a5feaffa5363cc415a429d8c9dc52d0ff728b6589d62c
Instruction ID: a0f2e8b2b34d224fb7c20dc820bf22c200881f442789beb913bef30a6f888a61
Opcode Fuzzy Hash: 65bf4cbe142cd8d6246a5feaffa5363cc415a429d8c9dc52d0ff728b6589d62c
Instruction Fuzzy Hash: AF118E20F0F24262FA55B325AB5103995825F947B2FB68634F82E0B6F6DE2CE4416720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837C5BC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C5CB
FlsSetValue.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C601
FlsSetValue.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C62E
FlsSetValue.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C63F
FlsSetValue.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C650
SetLastError.KERNEL32(?,?,?,00007FFDF836DD31,?,?,?,?,00007FFDF83861DA,?,?,00000000,00007FFDF837575F,?,?,?), ref: 00007FFDF837C66B

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 2f47c32ef32c89a1b6850bbc4c4a2933a487e96f368d46135bc1fb15b4f2d97f
Instruction ID: 0e56a31594f9610cf6e97f99f2e59d1d07d348230de83cf5d3a83f09c2216c07
Opcode Fuzzy Hash: 2f47c32ef32c89a1b6850bbc4c4a2933a487e96f368d46135bc1fb15b4f2d97f
Instruction Fuzzy Hash: 59115B20F0D24243F7587721B5B193D62D28F48BB4F8C4734E83E866EEDE2CE442660A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BEE00 Relevance: 9.1, APIs: 6, Instructions: 56timewindowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00007FFDF80BEE40
SetFocus.USER32 ref: 00007FFDF80BEE55
GetDoubleClickTime.USER32 ref: 00007FFDF80BEE6C
SetTimer.USER32 ref: 00007FFDF80BEE85
GetDoubleClickTime.USER32 ref: 00007FFDF80BEE8B
GetTickCount.KERNEL32 ref: 00007FFDF80BEE93

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ClickDoubleFocusTime$CountTickTimer
String ID:
API String ID: 4271707189-0
Opcode ID: 89f7877877a3f451f48298d7d6ee09d2c364d43111bf073d87d46e5397f5f927
Instruction ID: bb62d8572ec49abaf874a1bf6e1af457eef1fa577b765ff33c0a6bb7584c28ee
Opcode Fuzzy Hash: 89f7877877a3f451f48298d7d6ee09d2c364d43111bf073d87d46e5397f5f927
Instruction Fuzzy Hash: FB216872B0878197D70CDF25E558A69B7A0FB88780F448135DBAD837A8CF3CE0648B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C57C0 Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32 ref: 00007FFDF80C57EB
SendMessageA.USER32 ref: 00007FFDF80C5801
SelectObject.GDI32 ref: 00007FFDF80C580D
GetTextMetricsA.GDI32 ref: 00007FFDF80C581E
SelectObject.GDI32 ref: 00007FFDF80C582A
ReleaseDC.USER32 ref: 00007FFDF80C5836

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ObjectSelect$MessageMetricsReleaseSendTextWindow
String ID:
API String ID: 2831084787-0
Opcode ID: bdf0c94ab331665e17225516546e209d0bcc7b98a7e31213630b4c84e3b69dc1
Instruction ID: b4f35c1a6fe6faeb44f26a32e135f27921f73b71c842f42b242b34d90acd61b8
Opcode Fuzzy Hash: bdf0c94ab331665e17225516546e209d0bcc7b98a7e31213630b4c84e3b69dc1
Instruction Fuzzy Hash: 4511A0B270868183EB18AB25E969979B3A5FB88FC1F444130DE1D87BA8DE3CD4458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C3770 Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FFDF80C3794
IsWindow.USER32 ref: 00007FFDF80C37A0
IsWindowEnabled.USER32 ref: 00007FFDF80C37AD
SendMessageA.USER32 ref: 00007FFDF80C37CF
GetFocus.USER32 ref: 00007FFDF80C37DD
SendMessageA.USER32 ref: 00007FFDF80C380E

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: MessageSendWindow$EnabledFocusParent
String ID:
API String ID: 1851739627-0
Opcode ID: 328abaf77893cd59f1cff57bd2cb1f778dd4b0c552eed8474b94bef4d0fb0fc2
Instruction ID: 34643b3f8a4629fb0d5220b481e2f836586b6d0d771465b8793adad0479136cb
Opcode Fuzzy Hash: 328abaf77893cd59f1cff57bd2cb1f778dd4b0c552eed8474b94bef4d0fb0fc2
Instruction Fuzzy Hash: 31119022F1868182EB149F62F554B6923A0EB89BC4F480131EE6D47BECCE3CD881A705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A6BD6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7AC3A6C85
WideCharToMultiByte.KERNEL32 ref: 00007FF7AC3A6CD1
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AC3A6DD1

Strings

to_narrow<wchar_t>::WideCharToMultiByte, xrefs: 00007FF7AC3A6D56, 00007FF7AC3A6D79
to_narrow<wchar_t> invalid arguments, xrefs: 00007FF7AC3A6D33

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ByteCharMultiWide$__std_exception_copy
String ID: to_narrow<wchar_t> invalid arguments$to_narrow<wchar_t>::WideCharToMultiByte
API String ID: 2551222438-1534530176
Opcode ID: efe5b6286d6c5b0a6c062d1ec861595a2cdeab86af0eefe8746ff375716474dc
Instruction ID: 2d2028962f1a64b6b77e1d584c3ca770b809f035c925bb51b70d036027863947
Opcode Fuzzy Hash: efe5b6286d6c5b0a6c062d1ec861595a2cdeab86af0eefe8746ff375716474dc
Instruction Fuzzy Hash: 5551F561A0AB46A1EB00FF25E480579A7B0FF84794F9A1135EB5D03AB5EF3DD5A2C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FD230 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7AC4FD29E
GetLastError.KERNEL32 ref: 00007FF7AC4FD6E4
GetLastError.KERNEL32 ref: 00007FF7AC4FD70F

Strings

Unable to expand %TMP{} environment variable!, xrefs: 00007FF7AC4FD6EC
%TMP%, xrefs: 00007FF7AC4FD297

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandStrings
String ID: %TMP%$Unable to expand %TMP{} environment variable!
API String ID: 2871630417-2940734617
Opcode ID: 758227cbdc7a4d776dd2f56a6231cbcfe5fb69d7f02a1fe9e6fb4b6287456cae
Instruction ID: a1bff9f0b3cc2d9f15e53e89742966478cce5efd021d29268202f3843d491f53
Opcode Fuzzy Hash: 758227cbdc7a4d776dd2f56a6231cbcfe5fb69d7f02a1fe9e6fb4b6287456cae
Instruction Fuzzy Hash: 8751B222A19AC2A1EA30EF10E4103EEB361FB84784F919132D68D47A69EF7CE585C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8257F40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103clipboardregistryCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32 ref: 00007FFDF8257F6E
OpenClipboard.USER32 ref: 00007FFDF8257F7C
EmptyClipboard.USER32(?,?,?,?,?,?,?,00000000,00000000,00007FFDF81CFA44), ref: 00007FFDF8257F86
CloseClipboard.USER32(?,?,?,?,?,?,?,00000000,00000000,00007FFDF81CFA44), ref: 00007FFDF8257F8C

Strings

HTML Format, xrefs: 00007FFDF8257F67

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Clipboard$CloseEmptyFormatOpenRegister
String ID: HTML Format
API String ID: 2398088879-1098232656
Opcode ID: 3a843edfda840e51e8375d7befbe6a01c590b2b780abbf8cdb59f56be92babad
Instruction ID: 60ca0cc9d04b76ef5d71681c551cb3056eb9e28d26e50db0df6d836206b09ca8
Opcode Fuzzy Hash: 3a843edfda840e51e8375d7befbe6a01c590b2b780abbf8cdb59f56be92babad
Instruction Fuzzy Hash: C5414736B15B058AFB08DF65E8A04AC37B4FB48B88B044536DE6D97BA8CF38E450D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1100 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B110B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1127
FreeLibrary.KERNEL32 ref: 00007FFDF80B1145

Strings

imm32.dll, xrefs: 00007FFDF80B1104
ImmReleaseContext, xrefs: 00007FFDF80B111D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ImmReleaseContext$imm32.dll
API String ID: 145871493-791212443
Opcode ID: 8a29f8f2688b1faad1094b92cc9587e126a0d5c9d35f80fe77071e675488320f
Instruction ID: 3ad9322b371725f72c3ac3c30dc37ad3397ea7d61efe4daac51556524e99226b
Opcode Fuzzy Hash: 8a29f8f2688b1faad1094b92cc9587e126a0d5c9d35f80fe77071e675488320f
Instruction Fuzzy Hash: FB01DE60F1AF0786EB09E754A97687062E1AF58740F844536C46FC37F8EE3CA195B31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1200 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B120B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1227
FreeLibrary.KERNEL32 ref: 00007FFDF80B1245

Strings

imm32.dll, xrefs: 00007FFDF80B1204
ImmSetCompositionWindow, xrefs: 00007FFDF80B121D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ImmSetCompositionWindow$imm32.dll
API String ID: 145871493-3301410851
Opcode ID: 8b9a57e75bbf520d75b3c10848b03bc33e967ed2bddb93120a39a4185c55bf1f
Instruction ID: 82828b0a716e31a9e59df2d36c336997b8af36c83b3d845614e9b15ac6e3e69b
Opcode Fuzzy Hash: 8b9a57e75bbf520d75b3c10848b03bc33e967ed2bddb93120a39a4185c55bf1f
Instruction Fuzzy Hash: 7501D264F1AF0782EB48E754A87597062E1BF54740F840536C42FC36F8EE3CA195B31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1300 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B130B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1327
FreeLibrary.KERNEL32 ref: 00007FFDF80B1345

Strings

ImmAssociateContext, xrefs: 00007FFDF80B131D
imm32.dll, xrefs: 00007FFDF80B1304

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ImmAssociateContext$imm32.dll
API String ID: 145871493-3574938153
Opcode ID: fe98563d1ba8e942816a05232ef5563ad7ca5d55643bbe0049e262ccc8f33408
Instruction ID: 4f790486309404c2b3823c0c7b6c2dd211d65d285a234475f88b5cf67280286d
Opcode Fuzzy Hash: fe98563d1ba8e942816a05232ef5563ad7ca5d55643bbe0049e262ccc8f33408
Instruction Fuzzy Hash: 1501DE64F1EE0792EB08EB55A87287062E17F58700F880135C43EC36F8EE3CA195A31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B143B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1457
FreeLibrary.KERNEL32 ref: 00007FFDF80B1475

Strings

user32.dll, xrefs: 00007FFDF80B1434
MonitorFromPoint, xrefs: 00007FFDF80B144D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: MonitorFromPoint$user32.dll
API String ID: 145871493-355800951
Opcode ID: 69a9d034160bfb4b7b2dda9558480edc0f208fdac75711de411995288723e243
Instruction ID: b26243d1495588d32e76432d2725d41d1578444ebcd99ef8c727ef65fcb5f6ce
Opcode Fuzzy Hash: 69a9d034160bfb4b7b2dda9558480edc0f208fdac75711de411995288723e243
Instruction Fuzzy Hash: C6012161F1AE0786EB09EB54A8B183022E16F58754F880135C42EC33F8EF3CA095A30B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B153B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1557
FreeLibrary.KERNEL32 ref: 00007FFDF80B1575

Strings

GetMonitorInfoA, xrefs: 00007FFDF80B154D
user32.dll, xrefs: 00007FFDF80B1534

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetMonitorInfoA$user32.dll
API String ID: 145871493-48335910
Opcode ID: a0b910bd160fc3a925ac3e4d7a53ab8d07dd0991f1bcbd37548f2548844f20b3
Instruction ID: 7c45ba25320e1dca3e09e5ec2e3783999320b557e2a8be67346d15b61b2a3c48
Opcode Fuzzy Hash: a0b910bd160fc3a925ac3e4d7a53ab8d07dd0991f1bcbd37548f2548844f20b3
Instruction Fuzzy Hash: 3B011A60F1AE47C2EB08EB55A87183022E1AF58740F880535C42EC33F8EE3CA095B31B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B1630 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDF80B163B
GetProcAddress.KERNEL32 ref: 00007FFDF80B1657
FreeLibrary.KERNEL32 ref: 00007FFDF80B1675

Strings

user32.dll, xrefs: 00007FFDF80B1634
UpdateLayeredWindow, xrefs: 00007FFDF80B164D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: UpdateLayeredWindow$user32.dll
API String ID: 145871493-1015952547
Opcode ID: c570a2c3ed5d5412b07cf3985b4669ffe1c97e48ea5008e42bfcdefc400b97e9
Instruction ID: 3887f158453eddcdcf6ef239752472858a6cf9e6d449d2ee6c5761bf49c58b36
Opcode Fuzzy Hash: c570a2c3ed5d5412b07cf3985b4669ffe1c97e48ea5008e42bfcdefc400b97e9
Instruction Fuzzy Hash: 8601D264F1AE0782EB49E754A87583062E1AF55744F880535C52EC32F8DE3CA195B31B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BD690 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFDF80B9DEE), ref: 00007FFDF80BD81B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFDF80B9DEE), ref: 00007FFDF80BD874

Strings

image/png, xrefs: 00007FFDF80BD7F1
image/gif, xrefs: 00007FFDF80BD7DF
image/jpeg, xrefs: 00007FFDF80BD7E8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: image/gif$image/jpeg$image/png
API String ID: 626452242-935766689
Opcode ID: 92ff42cbd56281dee70954d4917e5ffac5abd3cf757bfa96b534708547cafd48
Instruction ID: 7302715cf5d0906d633d2590d847e6a8983e6286c6787806286b85fe917585c6
Opcode Fuzzy Hash: 92ff42cbd56281dee70954d4917e5ffac5abd3cf757bfa96b534708547cafd48
Instruction Fuzzy Hash: D1916D32B09B4182EB18DF15E460A79A7A0FB88B94F484135DE6D837E8DF3CE445E709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80BDA70 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFDF80B9D69), ref: 00007FFDF80BDBEB
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFDF80B9D69), ref: 00007FFDF80BDC44

Strings

image/png, xrefs: 00007FFDF80BDBC1
image/gif, xrefs: 00007FFDF80BDBAF
image/jpeg, xrefs: 00007FFDF80BDBB8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: image/gif$image/jpeg$image/png
API String ID: 626452242-935766689
Opcode ID: 015ec3631a550448094f46c7bee248cd3ff5b943543e26c77c1262076c354b5c
Instruction ID: aaabbeaa0914d5da739e2335037d0f8abf619096d41789cbbc6be0882a32e273
Opcode Fuzzy Hash: 015ec3631a550448094f46c7bee248cd3ff5b943543e26c77c1262076c354b5c
Instruction Fuzzy Hash: DF917472B09B4682EB58DF15E460979A7A0FB48B94F484135DE6D877E8CF3CE841E309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8155A90 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFDF8155AB7
InitializeCriticalSection.KERNEL32 ref: 00007FFDF8155AF3
InitializeCriticalSection.KERNEL32 ref: 00007FFDF8155CA0

Strings

screen,desktop, xrefs: 00007FFDF8155CEC
Verdana, xrefs: 00007FFDF8155DD1

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Verdana$screen,desktop
API String ID: 32694325-708148380
Opcode ID: acfb8da60ac6c6d5bc2a9584030e0144a46fedafa0cc054cbdb84b118d7d9e18
Instruction ID: 907173da0a8923a8577c389d256edff9de8f275e02a3e12212ec14e3bcee0439
Opcode Fuzzy Hash: acfb8da60ac6c6d5bc2a9584030e0144a46fedafa0cc054cbdb84b118d7d9e18
Instruction Fuzzy Hash: BDB12833B05B81AAE7088F25E9547A8B7A4F744B04F584229CB6C473A4DF38F4B5D309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC582C20 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7AC582C63
_set_statfp.LIBCMT ref: 00007FF7AC582C81
_set_statfp.LIBCMT ref: 00007FF7AC582CAA
_set_statfp.LIBCMT ref: 00007FF7AC582EE3

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70b35ffa683413022d09c24b36942113d2b44dc7c1b5d7274996baac1dbbc2d7
Instruction ID: f764f3c30ab9a85cc1b9667f455c1e472de7b6f8462e16837c11fc946b8bacd0
Opcode Fuzzy Hash: 70b35ffa683413022d09c24b36942113d2b44dc7c1b5d7274996baac1dbbc2d7
Instruction Fuzzy Hash: E5815C1290EA4665F332AB34A94037AEB50BF65395FA64231FE4D265F1DF3CE4819720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EF3D0 Relevance: 7.7, APIs: 5, Instructions: 193COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FFDF80EF426

Part of subcall function 00007FFDF8135540: CreateDIBSection.GDI32 ref: 00007FFDF81355AE

CreateCompatibleDC.GDI32 ref: 00007FFDF80EF5F8
SelectObject.GDI32 ref: 00007FFDF80EF608
SelectObject.GDI32 ref: 00007FFDF80EF67B
DeleteDC.GDI32 ref: 00007FFDF80EF684

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CreateObjectSelect$CompatibleDeleteRectSectionWindow
String ID:
API String ID: 837537399-0
Opcode ID: afa21e5618685d0d6e9fe0da2980b5f47aa1a537750b51f5d152446d7b5e17f2
Instruction ID: a9215c0c8faccc160424ccbef178470a2947482a4c8e860a06e40d6f539464e8
Opcode Fuzzy Hash: afa21e5618685d0d6e9fe0da2980b5f47aa1a537750b51f5d152446d7b5e17f2
Instruction Fuzzy Hash: 09A18932B08B858AEB04DF64E8A06AD77B1FB88784F444136DA5D47BA8DF38E144DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B9E10 Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

GetObjectA.GDI32 ref: 00007FFDF80B9E77
EnterCriticalSection.KERNEL32 ref: 00007FFDF80B9EE4
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B9F27

Part of subcall function 00007FFDF81339D0: SelectObject.GDI32 ref: 00007FFDF8133A6E
Part of subcall function 00007FFDF81339D0: GetStockObject.GDI32 ref: 00007FFDF8133A79
Part of subcall function 00007FFDF81339D0: SelectObject.GDI32 ref: 00007FFDF8133A85
Part of subcall function 00007FFDF81339D0: DeleteDC.GDI32 ref: 00007FFDF8133A8E

EnterCriticalSection.KERNEL32 ref: 00007FFDF80B9FC3
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80BA006

Part of subcall function 00007FFDF813EB20: GetObjectA.GDI32 ref: 00007FFDF813EB86

Part of subcall function 00007FFDF8133820: CreateCompatibleDC.GDI32 ref: 00007FFDF81338BE
Part of subcall function 00007FFDF8133820: SelectObject.GDI32 ref: 00007FFDF81338CE

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$CriticalSection$Select$EnterLeave$CompatibleCreateDeleteStock
String ID:
API String ID: 1060921341-0
Opcode ID: d86a5fe03e351adfea04f2fba82d996d3ec54d626f847caa3fee4eea85d28e0f
Instruction ID: 7a9aacfb8e4fe06c512e067130166218bf0c516fcb607d3e3a0d128010f03714
Opcode Fuzzy Hash: d86a5fe03e351adfea04f2fba82d996d3ec54d626f847caa3fee4eea85d28e0f
Instruction Fuzzy Hash: 00719032B19A8186EB24DF25E8606ED73A0FB88784F444132DA6E83BE8DF7CD544D744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8148C60 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32 ref: 00007FFDF8148CEF
MulDiv.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-0000000C), ref: 00007FFDF8148D04
CreateFontA.GDI32 ref: 00007FFDF8148DB1
CreateFontA.GDI32 ref: 00007FFDF8148E7E

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CreateFont$CapsDevice
String ID:
API String ID: 3852243758-0
Opcode ID: 8b9f34415f542c85c0553978b29112bf19fa1b44da6a65487ca9b0bc65f67f89
Instruction ID: e77210515d89a2b180b4cf8c6fb8982df78b131597737e0babbcc6ae6d06dbc2
Opcode Fuzzy Hash: 8b9f34415f542c85c0553978b29112bf19fa1b44da6a65487ca9b0bc65f67f89
Instruction Fuzzy Hash: 55518D72A186C187E364CF15E850B6ABBA0F7D5784F145228EA9843BA8DF7CD1A0DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F04E5 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF80EFFE0: IsWindowUnicode.USER32 ref: 00007FFDF80F009F
Part of subcall function 00007FFDF80EFFE0: CreateWindowExW.USER32 ref: 00007FFDF80F011B

GetWindowLongA.USER32 ref: 00007FFDF80F0612
ShowWindow.USER32 ref: 00007FFDF80F0627
UpdateWindow.USER32 ref: 00007FFDF80F0630
UpdateWindow.USER32 ref: 00007FFDF80F0639
GetClientRect.USER32 ref: 00007FFDF80F0653

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$Update$ClientCreateLongRectShowUnicode
String ID:
API String ID: 1151564984-0
Opcode ID: dc1098ed3e42cd9cf85d0234b75b0054f8f32d848c2501dac3de7f87022ef370
Instruction ID: 4dfbe4c4945bfe338888b27befdb0d6145366710a000e256f563b77fb99b4d56
Opcode Fuzzy Hash: dc1098ed3e42cd9cf85d0234b75b0054f8f32d848c2501dac3de7f87022ef370
Instruction Fuzzy Hash: 13414C72B08B459AEB04DF69E8606AC77A0FB88B98F444131DE5D17BA8DF3CD44AD704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A8B30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00007FF7AC3A1B7D), ref: 00007FF7AC3A8B5A

Part of subcall function 00007FF7AC3B1760: EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B17A6
Part of subcall function 00007FF7AC3B1760: GetProcessHeap.KERNEL32 ref: 00007FF7AC3B17E3
Part of subcall function 00007FF7AC3B1760: HeapFree.KERNEL32 ref: 00007FF7AC3B186D
Part of subcall function 00007FF7AC3B1760: LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B187F

Strings

asw::settings::SettingsConfig::StorePathIni, xrefs: 00007FF7AC3A8B8C
asw::settings::SettingsConfig::StorePathDef, xrefs: 00007FF7AC3A8BAE
asw::settings::SettingsConfig::ProductPluginUnloadFn, xrefs: 00007FF7AC3A8C69
asw::settings::SettingsConfig::ProductPluginLoadFn, xrefs: 00007FF7AC3A8C25

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterHeap$FreeLeaveProcess
String ID: asw::settings::SettingsConfig::ProductPluginLoadFn$asw::settings::SettingsConfig::ProductPluginUnloadFn$asw::settings::SettingsConfig::StorePathDef$asw::settings::SettingsConfig::StorePathIni
API String ID: 459308956-613270485
Opcode ID: 4d0fd27694ed84d133b6e6118eeb4f15118fe49ae43ff6f81f1b805fd65e3f0a
Instruction ID: 524850c918b1a3c34bc00843ff70e0e9b66153a4c5ba6e681ef990dcdc3eaaf0
Opcode Fuzzy Hash: 4d0fd27694ed84d133b6e6118eeb4f15118fe49ae43ff6f81f1b805fd65e3f0a
Instruction Fuzzy Hash: F2515C21A1BE42E5EA15FB11E4405BAE3A1FF84B80F8A0039EA4E47776DF7CE541C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C1340 Relevance: 7.6, APIs: 5, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 00007FFDF80C1390
MultiByteToWideChar.KERNEL32 ref: 00007FFDF80C13CB
MultiByteToWideChar.KERNEL32 ref: 00007FFDF80C1417
GetParent.USER32 ref: 00007FFDF80C14A0
SendMessageA.USER32 ref: 00007FFDF80C14B8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ByteCharMultiWide$CtrlMessageParentSend
String ID:
API String ID: 2382089286-0
Opcode ID: 08b0aa400d4d01b2c8a5b76d09ca2252c7cea4ee5eccec93e992cca3b4e391cc
Instruction ID: 77f80406df4eacaddd46304e5bbe9c53be78602cdcbc372f2cb5e4d23469fff9
Opcode Fuzzy Hash: 08b0aa400d4d01b2c8a5b76d09ca2252c7cea4ee5eccec93e992cca3b4e391cc
Instruction Fuzzy Hash: 30519C72608B81C6E710DF21E814BA977A4FB88B94F458136EA6D837A8DF3CD841D744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B785C Relevance: 7.6, APIs: 5, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FFDF80B787D
GetDlgCtrlID.USER32 ref: 00007FFDF80B789A
GetParent.USER32 ref: 00007FFDF80B7950
SendMessageA.USER32 ref: 00007FFDF80B7965
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B85A8

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Parent$CriticalCtrlLeaveMessageSectionSend
String ID:
API String ID: 3214112767-0
Opcode ID: e5dba9ef5ff6bfaa654316e1f196820717272439912532f826b02d1d1b117571
Instruction ID: 144131d19196defe0ef69cc2b2ca030c1e49f972ba655af28a1f994926c6ef88
Opcode Fuzzy Hash: e5dba9ef5ff6bfaa654316e1f196820717272439912532f826b02d1d1b117571
Instruction Fuzzy Hash: BD418C62B09B4187EB199F25E964AB863A0FF44B94F480035CE2D57BF8CF3CE455A305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC565FB4 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF7AC56602F
DName::operator+.LIBVCRUNTIME ref: 00007FF7AC566051
DName::DName.LIBVCRUNTIME ref: 00007FF7AC566060
DName::DName.LIBVCRUNTIME ref: 00007FF7AC566097
DName::DName.LIBVCRUNTIME ref: 00007FF7AC5660A2

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: d411532e432acb1be624e800d313d9ca76b8cbad1268244e4cd1b43402f14982
Instruction ID: a3289486518555143b0d23c2e65ced08e614dd95f14c121a2d6a7d965aeb8450
Opcode Fuzzy Hash: d411532e432acb1be624e800d313d9ca76b8cbad1268244e4cd1b43402f14982
Instruction Fuzzy Hash: DF41B376A0AA46E4F710EB21D9501BCB375BF04B90BEA4031EA8D533B5DF39E805C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4F9AE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC4F9B21
GetProcessHeap.KERNEL32 ref: 00007FF7AC4F9B57
HeapFree.KERNEL32 ref: 00007FF7AC4F9BC4
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC4F9BD6

Part of subcall function 00007FF7AC3AAF70: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC3BA1D4,?,?,?,?,?,?,00000000), ref: 00007FF7AC3AAF9F

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

Strings

asw::log::context::TlsIndex, xrefs: 00007FF7AC4F9B40

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$CriticalSection$Free$AllocClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep_invalid_parameter_noinfo
String ID: asw::log::context::TlsIndex
API String ID: 1441953332-143919551
Opcode ID: 5ae336ffb0a4e91ae64152a86e185071b6150dc9cf8a153e73821bfd1ecf1507
Instruction ID: 42f7e77b98957f9023885e8e6ad14a451a23567fb9ee977cfbbde7d378b64ee8
Opcode Fuzzy Hash: 5ae336ffb0a4e91ae64152a86e185071b6150dc9cf8a153e73821bfd1ecf1507
Instruction Fuzzy Hash: DF318322A1AB45D5EA50EB12F84406AF7A5FF98BC0F964036EE4E43736DF3CE4418750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80C5B80 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 00007FFDF80C5BFB
GetParent.USER32 ref: 00007FFDF80C5C38
SendMessageA.USER32 ref: 00007FFDF80C5C4E
IsWindow.USER32 ref: 00007FFDF80C5C5E
DestroyWindow.USER32 ref: 00007FFDF80C5C6D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$CtrlDestroyMessageParentSend
String ID:
API String ID: 2943902463-0
Opcode ID: fa1b026d3b9e797cad471d7b4637ab1a2ccae18ee2d3d70810bd7b92399d91e5
Instruction ID: ba36d1a337af345838d606323e882ff731ebac9dddf232777050408303dddcb1
Opcode Fuzzy Hash: fa1b026d3b9e797cad471d7b4637ab1a2ccae18ee2d3d70810bd7b92399d91e5
Instruction Fuzzy Hash: 23318172708B8186EB18DF11E8A4969B3A4FB89BD0F584035DAAE477E8CF3CE444D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8384BDC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDF8384C04
_set_statfp.LIBCMT ref: 00007FFDF8384C1F
_set_statfp.LIBCMT ref: 00007FFDF8384C3B
_set_statfp.LIBCMT ref: 00007FFDF8384C77

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b279a170408d618237bddf6b9ec99c878b24dd9d163caff4e822d6b1485b2f82
Instruction ID: 5a3b084eef70f6133aeb4ce1bd41f2d280686fa6baec3e58213303f9cf8fa29a
Opcode Fuzzy Hash: b279a170408d618237bddf6b9ec99c878b24dd9d163caff4e822d6b1485b2f82
Instruction Fuzzy Hash: 1E119323F08A0217F7A431A8F5B1B7550E56F94370F1EC634E97E86AFE9F1C9940610A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC582640 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7AC5717D3,?,?,00000000,00007FF7AC571A6E,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7AC5719FA), ref: 00007FF7AC58265F
FlsSetValue.KERNEL32(?,?,?,00007FF7AC5717D3,?,?,00000000,00007FF7AC571A6E,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7AC5719FA), ref: 00007FF7AC58267E
FlsSetValue.KERNEL32(?,?,?,00007FF7AC5717D3,?,?,00000000,00007FF7AC571A6E,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7AC5719FA), ref: 00007FF7AC5826A6
FlsSetValue.KERNEL32(?,?,?,00007FF7AC5717D3,?,?,00000000,00007FF7AC571A6E,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7AC5719FA), ref: 00007FF7AC5826B7
FlsSetValue.KERNEL32(?,?,?,00007FF7AC5717D3,?,?,00000000,00007FF7AC571A6E,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7AC5719FA), ref: 00007FF7AC5826C8

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bf9683265a27353d0f39c1b8468e094270bcab108892c2897be8f9657cb407c8
Instruction ID: 9d578799f832319955bcf410af3dc203693128ff8e1be3bc10cbf1af124e8324
Opcode Fuzzy Hash: bf9683265a27353d0f39c1b8468e094270bcab108892c2897be8f9657cb407c8
Instruction Fuzzy Hash: 74116020B0F20222FA58B326AB5117995415F947B1FBA8334F87E066FADD2CE851A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837C684 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDF8374B03,?,?,00000000,00007FFDF8374D9E,?,?,?,?,?,00007FFDF8374D2A), ref: 00007FFDF837C6A3
FlsSetValue.KERNEL32(?,?,?,00007FFDF8374B03,?,?,00000000,00007FFDF8374D9E,?,?,?,?,?,00007FFDF8374D2A), ref: 00007FFDF837C6C2
FlsSetValue.KERNEL32(?,?,?,00007FFDF8374B03,?,?,00000000,00007FFDF8374D9E,?,?,?,?,?,00007FFDF8374D2A), ref: 00007FFDF837C6EA
FlsSetValue.KERNEL32(?,?,?,00007FFDF8374B03,?,?,00000000,00007FFDF8374D9E,?,?,?,?,?,00007FFDF8374D2A), ref: 00007FFDF837C6FB
FlsSetValue.KERNEL32(?,?,?,00007FFDF8374B03,?,?,00000000,00007FFDF8374D9E,?,?,?,?,?,00007FFDF8374D2A), ref: 00007FFDF837C70C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5eeacc26e579396f6ae48ed08c69bedabe61fbc5bad702b5ff84f2ec60230988
Instruction ID: 919696c001a6f3cdbf1d79da07d49cc7470a156e61929a8c067562524980d4aa
Opcode Fuzzy Hash: 5eeacc26e579396f6ae48ed08c69bedabe61fbc5bad702b5ff84f2ec60230988
Instruction Fuzzy Hash: E0114A20F0D24243FB587725B9B197D61D24F84BE0F9C5734E83E866EEDE2CE442660A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B8770 Relevance: 7.5, APIs: 5, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7AC3B87BC
GetLastError.KERNEL32 ref: 00007FF7AC3B87CB
DeviceIoControl.KERNEL32 ref: 00007FF7AC3B87F9
GetLastError.KERNEL32 ref: 00007FF7AC3B8803
CloseHandle.KERNEL32 ref: 00007FF7AC3B880C

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: f41f36e08775ac2d93d6ce81b72050a246663f8f912a12436b27bc2980ea8876
Instruction ID: 66004b7086516ff7ba924279018ae7f5e2d37175b95703fcdcc812e5fd60d11e
Opcode Fuzzy Hash: f41f36e08775ac2d93d6ce81b72050a246663f8f912a12436b27bc2980ea8876
Instruction Fuzzy Hash: 72115E31A09B4296E750AB21F85152BB6E4FB847E4FA11235FA9E43BB5DF3CE450CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F06A0 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FFDF80F06CF
GetParent.USER32 ref: 00007FFDF80F06E1
DestroyWindow.USER32 ref: 00007FFDF80F06ED
IsWindow.USER32 ref: 00007FFDF80F06F6
UpdateWindow.USER32 ref: 00007FFDF80F0703

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Window$DestroyParentUpdate
String ID:
API String ID: 3315813950-0
Opcode ID: 243f95bbbf6f74b0ac42886334246eb871588f091d50aa1b653c7be253f6bc80
Instruction ID: 60d104bd5e922f662d795281c30de544929916caca5b76fa3864b65135d94719
Opcode Fuzzy Hash: 243f95bbbf6f74b0ac42886334246eb871588f091d50aa1b653c7be253f6bc80
Instruction Fuzzy Hash: DC014F65F09B4682EF08AF12A56453923E0FF89B80B484030DD6E877A8EF3CD495A609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC50AA80 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC50AB29
GetProcAddress.KERNEL32 ref: 00007FF7AC50AB39

Strings

onexit_register_connector_avast_2, xrefs: 00007FF7AC50AB32
{9C7565A2-47C2-4869-B388-8C7F9AD8E577}, xrefs: 00007FF7AC50AA94

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: onexit_register_connector_avast_2${9C7565A2-47C2-4869-B388-8C7F9AD8E577}
API String ID: 1646373207-1060404012
Opcode ID: 07ebd4c735829f5cdd5a5aee4b635e77701fcd519191fca75c120d0535801f9a
Instruction ID: 171b6e455d005b5c69c1c5c8a2610e6d0da0346ce977165a51af89c39c79b854
Opcode Fuzzy Hash: 07ebd4c735829f5cdd5a5aee4b635e77701fcd519191fca75c120d0535801f9a
Instruction Fuzzy Hash: 5261C632A16B4196E710DF25E880669B3A4FB54B90FA68136EE9E43B71EF3CD484C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B8B00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AC3B8B76
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AC3B8BBE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AC3B8C4E

Strings

bad locale name, xrefs: 00007FF7AC3B8C71

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 17e5130a7c5c0463d920e403b92c2abd9fd77c4d676c5e812f70f9f600fbabac
Instruction ID: fee2c70d1d16203e992eeecda592250092e3431c75d485040fef99b970364f95
Opcode Fuzzy Hash: 17e5130a7c5c0463d920e403b92c2abd9fd77c4d676c5e812f70f9f600fbabac
Instruction Fuzzy Hash: 8D41AD32B0BB41A9EB10EF70D4906BCB3A4EF44788F450439EA4D23A69DE38E525D325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC50A330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AC4FF335), ref: 00007FF7AC50A385
GetLastError.KERNEL32 ref: 00007FF7AC50A3FA

Strings

-, xrefs: 00007FF7AC50A3F1
Unable to retrieve environment variable '{}'!, xrefs: 00007FF7AC50A3E5

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: EnvironmentErrorLastVariable
String ID: -$Unable to retrieve environment variable '{}'!
API String ID: 3114522214-584169599
Opcode ID: be26311538b01c755f89e3d1d3fee1b897889f1ebc2ddbf6ee98763c43e8ea6b
Instruction ID: 73e1f2c1d1214060f19913bf62d2f47ed682f22c14122a2de978095ab13b9c6a
Opcode Fuzzy Hash: be26311538b01c755f89e3d1d3fee1b897889f1ebc2ddbf6ee98763c43e8ea6b
Instruction Fuzzy Hash: 9C31C431A19B8595E710EB11E45436EB3A1FB88784F914135FACD43765DF3CE144CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC445BD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC55C850: AcquireSRWLockExclusive.KERNEL32(?,?,00000161E6BCE520,00007FF7AC3A85E1), ref: 00007FF7AC55C860

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C26
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF7AC3A324D), ref: 00007FF7AC445C3B

Strings

Kernel32.dll, xrefs: 00007FF7AC445C1F
QueryUnbiasedInterruptTime, xrefs: 00007FF7AC445C31

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AcquireAddressExclusiveHandleLockModuleProc
String ID: Kernel32.dll$QueryUnbiasedInterruptTime
API String ID: 956071019-196062801
Opcode ID: 35a6f1de1d14807517f037e49a89b4c6658c9f39c0956a5cb4da6daefe81fd8f
Instruction ID: f728f91125e8aec4c1fc969fa82d42d6c4f6db99aec603a0f93babe10185e9a8
Opcode Fuzzy Hash: 35a6f1de1d14807517f037e49a89b4c6658c9f39c0956a5cb4da6daefe81fd8f
Instruction Fuzzy Hash: 53213E71A1AB0AA2EE15EB10E850275B360FB8C794FD15136E94E4A3B5DF3CE448C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8356D98 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDF8356DF9
IsDebuggerPresent.KERNEL32 ref: 00007FFDF8356E11
OutputDebugStringW.KERNEL32 ref: 00007FFDF8356E22

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FFDF8356E1B

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: c7a5b931e320c613622e774ec9a284f95befe919061ece926cb0586053756653
Instruction ID: 04943149be08898eb34dbfb03423f2c4ab56a7cdbf54126100b55f07b338fc4f
Opcode Fuzzy Hash: c7a5b931e320c613622e774ec9a284f95befe919061ece926cb0586053756653
Instruction Fuzzy Hash: FB119D32B14B4293E748AB22DA207B932E1FB04354F484035CA2D87AA8EF3CF064D709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1F80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A1F8B
GetProcAddress.KERNEL32 ref: 00007FF7AC3A1FAC

Strings

Kernel32.dll, xrefs: 00007FF7AC3A1F84
SetThreadDescription, xrefs: 00007FF7AC3A1FA2

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Kernel32.dll$SetThreadDescription
API String ID: 1646373207-1724334159
Opcode ID: 5dc8d72536a4368b783a44c40a0ad04f083bbe84be18d15f4b7638c6e7b272eb
Instruction ID: 94ded32c47293fb1536b3e58c74661a20c653a4ceb347afa2c373377bfaf426e
Opcode Fuzzy Hash: 5dc8d72536a4368b783a44c40a0ad04f083bbe84be18d15f4b7638c6e7b272eb
Instruction Fuzzy Hash: 64E0EC24E4BB02E1EA08BB81A881034B2A5BF4D721FD21439C44E42332EE2CE5A58720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1FC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A1FCB
GetProcAddress.KERNEL32 ref: 00007FF7AC3A1FEC

Strings

GetThreadDescription, xrefs: 00007FF7AC3A1FE2
Kernel32.dll, xrefs: 00007FF7AC3A1FC4

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadDescription$Kernel32.dll
API String ID: 1646373207-415897907
Opcode ID: 5117a3e866f99692c5432abdee979b35444db74b06aefd3435f8fb85fbbc3595
Instruction ID: a92c05e0bd1bad1f1d1a59b5cf81bf1263bc6b4a08bf628e47a66de7d964cac0
Opcode Fuzzy Hash: 5117a3e866f99692c5432abdee979b35444db74b06aefd3435f8fb85fbbc3595
Instruction Fuzzy Hash: E6E0EC25E5BB02E1EA08BB41B881134B2A57F8D720FD22139C44E42372FF2CE169C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1740 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A174B
GetProcAddress.KERNEL32 ref: 00007FF7AC3A175B

Strings

RtlDllShutdownInProgress, xrefs: 00007FF7AC3A1754
ntdll.dll, xrefs: 00007FF7AC3A1744

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: 0cfaeb0a7ff3e779b2544cc257014b44472d339485341a8b267694f7e3cb2176
Instruction ID: 4d934ae033cedd0a18018e751037e483d41559eeaa3e0bbd1096a53005d09b34
Opcode Fuzzy Hash: 0cfaeb0a7ff3e779b2544cc257014b44472d339485341a8b267694f7e3cb2176
Instruction Fuzzy Hash: 78D09224E0BA03E2E605BB01EC40065A361BB48751BD22532D40E42332EF2CE19ACB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A2270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A227B
GetProcAddress.KERNEL32 ref: 00007FF7AC3A228B

Strings

RtlDllShutdownInProgress, xrefs: 00007FF7AC3A2284
ntdll.dll, xrefs: 00007FF7AC3A2274

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: 7d1fa2e4a57329d410bb3f13259c7d52b97bdbd53645ac4915a0734a5fbfd021
Instruction ID: 9cef2d8821ea4d8d99fe5f9672de113bd45b1721c2716862a0ccd435d57d2944
Opcode Fuzzy Hash: 7d1fa2e4a57329d410bb3f13259c7d52b97bdbd53645ac4915a0734a5fbfd021
Instruction Fuzzy Hash: D1D09224E0BA43E2EA05BB45EC81065A361AB48751BD22432D40E02332EE2CE19ACB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF819DFC0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 381COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDF819E568

Strings

data, xrefs: 00007FFDF819E12B
*;base64, xrefs: 00007FFDF819E219
file, xrefs: 00007FFDF819E47C

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ErrorLast
String ID: *;base64$data$file
API String ID: 1452528299-513602561
Opcode ID: 730b7fda3363a7a97518230974566566fb9f62d7927c9fd2391e28833e49dc55
Instruction ID: 41f9267c6ddae6bbf16060063ea513d897226161c16a29660d77c9715201d199
Opcode Fuzzy Hash: 730b7fda3363a7a97518230974566566fb9f62d7927c9fd2391e28833e49dc55
Instruction Fuzzy Hash: 52027D33B19B8182EB50DF10E4A09AA63A1FB84788F044135EE5D43BE9DF78E454E709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837D03C Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDF837D0C3
WriteFile.KERNEL32 ref: 00007FFDF837D38A
WriteFile.KERNEL32 ref: 00007FFDF837D3D3
GetLastError.KERNEL32 ref: 00007FFDF837D494

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 548bc41e98c4b86e5c757983054e4e622bd0c2875a0bbb22fc31d376d3120db3
Instruction ID: 57c48aa4f4f904f0d8a46bc085449fb60416f532f9176fd60ecdb0bcbb4bb008
Opcode Fuzzy Hash: 548bc41e98c4b86e5c757983054e4e622bd0c2875a0bbb22fc31d376d3120db3
Instruction Fuzzy Hash: 0ED1F522F08A818AE751DF75E4506AC37B1FB44798B184232CE6E97BEDDE38E406D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837DA18 Relevance: 6.2, APIs: 4, Instructions: 217COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00007FFDF837D9B8), ref: 00007FFDF837DB3B
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00007FFDF837D9B8), ref: 00007FFDF837DBC5

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 8a73efa67d0a80e439b16d3a274dfeda73f83794703c4c33bd01d8837c12580b
Instruction ID: e8f16bb741a24a91e810374fedcc0f2dce74c1f9611affe48e1f2c6078265cba
Opcode Fuzzy Hash: 8a73efa67d0a80e439b16d3a274dfeda73f83794703c4c33bd01d8837c12580b
Instruction Fuzzy Hash: 7591F372F1C65286F750AB65A460ABC27E0FB04798F484236DE1E976ECCF78D441E30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF81CBB80 Relevance: 6.2, APIs: 4, Instructions: 167COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF81CBBD6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDF81CBBDC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 088efa5a63bcbd0124b70cdbd42fa55667639c7ac85f8e83b404e42c9efd1787
Instruction ID: 50c01926aebfa80dfbbc0eba8fe6180fa8ebfd05d1900d08ee3d699e128c4219
Opcode Fuzzy Hash: 088efa5a63bcbd0124b70cdbd42fa55667639c7ac85f8e83b404e42c9efd1787
Instruction Fuzzy Hash: 9E410222F09B8586EB24AB21E4607AE6290EB557D4F440630EBAC47BEDDF7CE0D19305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A6E40 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7AC3A6EE2
MultiByteToWideChar.KERNEL32 ref: 00007FF7AC3A6F22

Strings

to_wide<char> invalid arguments, xrefs: 00007FF7AC3A6F84
to_wide<char>::MultiByteToWideChar, xrefs: 00007FF7AC3A6FA7, 00007FF7AC3A6FCA

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: to_wide<char> invalid arguments$to_wide<char>::MultiByteToWideChar
API String ID: 626452242-363086301
Opcode ID: aaffb53e3ba315c5d23f48f8f220c760c2f6781430df8b0b8e744fd1f16e96c8
Instruction ID: 7d7d6c71f3acaf5752588841e23d727d367f7138a7603ec1bbc8c24e25196668
Opcode Fuzzy Hash: aaffb53e3ba315c5d23f48f8f220c760c2f6781430df8b0b8e744fd1f16e96c8
Instruction Fuzzy Hash: C0512972A1AB46A1EB10EF11E440579E3A0FF44784F951139FA5E036B4DF3DE5A1C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80D14B0 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDF80D1551
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80D15B6
UpdateWindow.USER32 ref: 00007FFDF80D15D9

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeaveUpdateWindow
String ID:
API String ID: 419760226-0
Opcode ID: c38023b51ff1f454e59c0dac06bd134d8980f76eb5eac1a23899ffde5e3069da
Instruction ID: 68646b7256dfb5f2ad9c85896b709ca45d52438a61c0464d85c223af227db589
Opcode Fuzzy Hash: c38023b51ff1f454e59c0dac06bd134d8980f76eb5eac1a23899ffde5e3069da
Instruction Fuzzy Hash: 7E413B67B09B4682EB09DB16D864A69A7A0FF88F90F494031DE2E433F8DF3CD445A345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF829BA7C Relevance: 6.1, APIs: 4, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFDF829BAD0
GetFileSize.KERNEL32 ref: 00007FFDF829BAE4
CreateFileMappingA.KERNEL32 ref: 00007FFDF829BB21
MapViewOfFile.KERNEL32 ref: 00007FFDF829BB72

Part of subcall function 00007FFDF829BB90: FlushViewOfFile.KERNEL32 ref: 00007FFDF829BBC5
Part of subcall function 00007FFDF829BB90: UnmapViewOfFile.KERNEL32 ref: 00007FFDF829BBDF
Part of subcall function 00007FFDF829BB90: CloseHandle.KERNEL32 ref: 00007FFDF829BBF3
Part of subcall function 00007FFDF829BB90: SetFilePointer.KERNEL32 ref: 00007FFDF829BC1E
Part of subcall function 00007FFDF829BB90: SetEndOfFile.KERNEL32 ref: 00007FFDF829BC28
Part of subcall function 00007FFDF829BB90: CloseHandle.KERNEL32 ref: 00007FFDF829BC32

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: File$View$CloseCreateHandle$FlushMappingPointerSizeUnmap
String ID:
API String ID: 3155271917-0
Opcode ID: 62ea8aac5d68d08669b2edcb40b9ba728acba27dfe05417d750dd6746aa25f17
Instruction ID: 36590d39066d4b4d5e613b0a0144a4154354abc4cbb5c7f8f5f864b7e450b267
Opcode Fuzzy Hash: 62ea8aac5d68d08669b2edcb40b9ba728acba27dfe05417d750dd6746aa25f17
Instruction Fuzzy Hash: 3031E1B2B05B5586E724DF24E464B6C33A0E784BA8F188234CA6D477D8CF3CE856E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A72B0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC4FBAD0: InitializeCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB11
Part of subcall function 00007FF7AC4FBAD0: DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB2A
Part of subcall function 00007FF7AC4FBAD0: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7AC3A72F1,?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC4FBB87

CloseHandle.KERNEL32(?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC3A7310
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A7351
CreateEventW.KERNEL32(?,?,?,?,00000000,00000008,?,00007FF7AC3AE4A5), ref: 00007FF7AC3A7385
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A739F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CriticalSection$Leave$CloseCreateDeleteEnterEventHandleInitialize
String ID:
API String ID: 3435541109-0
Opcode ID: 0fe896305dea0f118f384761f22f6f32620a06d632e2b9d8d3add85babf520b7
Instruction ID: 31a50f929b1bb363017a5626d9fee537852496faf503bb162d62a0cf0216a0df
Opcode Fuzzy Hash: 0fe896305dea0f118f384761f22f6f32620a06d632e2b9d8d3add85babf520b7
Instruction Fuzzy Hash: B831E232909B41D6E720AF20E48077EB3A0FB89784F9A5535EA8D03AA5DF3CE4D0C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6A70 Relevance: 6.1, APIs: 4, Instructions: 71timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF80B6720: EnterCriticalSection.KERNEL32 ref: 00007FFDF80B6749
Part of subcall function 00007FFDF80B6720: LeaveCriticalSection.KERNEL32(?), ref: 00007FFDF80B6816

EnterCriticalSection.KERNEL32 ref: 00007FFDF80B6ACB
KillTimer.USER32 ref: 00007FFDF80B6AFA
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80B6B16
KillTimer.USER32 ref: 00007FFDF80B6B24

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterKillLeaveTimer
String ID:
API String ID: 610966039-0
Opcode ID: 868e3b62bdc0e598769bf47c514ee1bb38954fd9c6d129a3984b25e98c581eb6
Instruction ID: a1832da5545a81131872208c71342e637d6400474385b2e24b104f10bd5ffd89
Opcode Fuzzy Hash: 868e3b62bdc0e598769bf47c514ee1bb38954fd9c6d129a3984b25e98c581eb6
Instruction Fuzzy Hash: 34216262B08A4482EB149F11E864E7977A0FB45FD5F484131DD6E573E8CF3CD4469305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF81339D0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8131E70: GetStockObject.GDI32 ref: 00007FFDF8131EA5
Part of subcall function 00007FFDF8131E70: SelectObject.GDI32 ref: 00007FFDF8131EB2
Part of subcall function 00007FFDF8131E70: DeleteObject.GDI32 ref: 00007FFDF8131EC0
Part of subcall function 00007FFDF8131E70: GetStockObject.GDI32 ref: 00007FFDF8131ECB
Part of subcall function 00007FFDF8131E70: SelectObject.GDI32 ref: 00007FFDF8131ED8
Part of subcall function 00007FFDF8131E70: DeleteObject.GDI32 ref: 00007FFDF8131EE6
Part of subcall function 00007FFDF8131E70: RestoreDC.GDI32 ref: 00007FFDF8131F17

SelectObject.GDI32 ref: 00007FFDF8133A6E
GetStockObject.GDI32 ref: 00007FFDF8133A79
SelectObject.GDI32 ref: 00007FFDF8133A85
DeleteDC.GDI32 ref: 00007FFDF8133A8E

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Object$Select$DeleteStock$Restore
String ID:
API String ID: 1104070528-0
Opcode ID: 169e6997262693d51f6c91a7e7944431bef4d0fa5a52395bc94de3ff481a0b20
Instruction ID: 69e95fb8b41eaeda2b5b05c44681154542adab7b005845b847e86adab8092e00
Opcode Fuzzy Hash: 169e6997262693d51f6c91a7e7944431bef4d0fa5a52395bc94de3ff481a0b20
Instruction Fuzzy Hash: 9221287AB09B8682DB08DB12E86466973A4FB89FD4F084032DE5E577A8CF3CD045D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B1CFD Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7AC3B1D17
HeapFree.KERNEL32 ref: 00007FF7AC3B1D84
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B1D96

Part of subcall function 00007FF7AC3AAF70: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC3BA1D4,?,?,?,?,?,?,00000000), ref: 00007FF7AC3AAF9F

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

Strings

asw::settings::SettingsConfig::Lock, xrefs: 00007FF7AC3B1D00

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$AllocCriticalFreeLeaveProcessSection_invalid_parameter_noinfo
String ID: asw::settings::SettingsConfig::Lock
API String ID: 1860411460-4244600543
Opcode ID: a3431ffb01c8752c0459e60361d80abf56599cb0010e015a764c6f3a5f976a27
Instruction ID: 113ef0814bb6fa6f4ad74795f5c8e69ba4bdbba9cb28eee059e0fbe1bcf9e9e3
Opcode Fuzzy Hash: a3431ffb01c8752c0459e60361d80abf56599cb0010e015a764c6f3a5f976a27
Instruction Fuzzy Hash: 8E116F62B1AF01D5EE55EB12A44046AF3A1FF48BC0B9A503AEE4E43776DF3CE4418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3D1FF0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL ref: 00007FF7AC3D2062
VerSetConditionMask.NTDLL ref: 00007FF7AC3D2071
VerSetConditionMask.NTDLL ref: 00007FF7AC3D2080
VerifyVersionInfoW.KERNEL32 ref: 00007FF7AC3D20A1

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 244745c17877ecc77a36fb6513cd60ea0fcf648e17026c4b458af686d9f60069
Instruction ID: 047740b2eace5ed71f72154f57d4f5bb0f045364f2774a2d9166be6d0a6e5467
Opcode Fuzzy Hash: 244745c17877ecc77a36fb6513cd60ea0fcf648e17026c4b458af686d9f60069
Instruction Fuzzy Hash: 74114D3291964196E730DF21E4442AEB3A0FB88784F515135EA9E87764EB3CE605CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B5D10 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AC3B5D77
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3B5D8A
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AC3B5D98
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7AC3B5DA7

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: __std_exception_copy__std_exception_destroy
String ID:
API String ID: 2960854011-0
Opcode ID: 13766101f340d7005c7a869c4a109c56e9c6d1540d1a448687c1a557bd7f1d31
Instruction ID: 1731f22837c49ade4d12468cbabfbeaddb1135f87a912599a5f8a3aa3df80828
Opcode Fuzzy Hash: 13766101f340d7005c7a869c4a109c56e9c6d1540d1a448687c1a557bd7f1d31
Instruction Fuzzy Hash: A611B472A29B8495E700EF10E4500ACB3A4FB947C4FA65235FB5D03665DF7CD991C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FDEF0 Relevance: 6.0, APIs: 4, Instructions: 47sleepfileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF7AC4FE806), ref: 00007FF7AC4FDF1D
SetFileAttributesW.KERNEL32(?,?,?,00007FF7AC4FE806), ref: 00007FF7AC4FDF40
DeleteFileW.KERNEL32(?,?,?,00007FF7AC4FE806), ref: 00007FF7AC4FDF53
Sleep.KERNEL32(?,?,?,00007FF7AC4FE806), ref: 00007FF7AC4FDF68

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: File$Attributes$DeleteSleep
String ID:
API String ID: 3341637309-0
Opcode ID: c102666145b868bb3223bac7765f40a3efb43ca477195d0a9a0191fc825a3e78
Instruction ID: 59ced85197385e41415b1dc918e79d8c12742f23bb1ba47002c3f0827dc70ad0
Opcode Fuzzy Hash: c102666145b868bb3223bac7765f40a3efb43ca477195d0a9a0191fc825a3e78
Instruction Fuzzy Hash: 4311EB22E0A901E1F754AF25E44057D67A0EB84F5CFD64630E65E4B2E9CF2CD844C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80F3AF0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FFDF80F3B1B
LoadResource.KERNEL32 ref: 00007FFDF80F3B33
LockResource.KERNEL32 ref: 00007FFDF80F3B41
SizeofResource.KERNEL32 ref: 00007FFDF80F3B5E

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: e15c9f133b7b604955dbcc2f1b1702a26ffbdd3715efe7df973d7b6ba4b63b38
Instruction ID: b4a2d9ac34596754d3a12f38d0a8005d5ce939724f3d8de5f5a57ffc3e977046
Opcode Fuzzy Hash: e15c9f133b7b604955dbcc2f1b1702a26ffbdd3715efe7df973d7b6ba4b63b38
Instruction Fuzzy Hash: CA010C71B0AB4281EB149B0AF86446963A0EF89BD4F499035DA6D4B7ACEF3CD490A705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8169D60 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDF8169C70: EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169C95
Part of subcall function 00007FFDF8169C70: LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169CD6
Part of subcall function 00007FFDF8169C70: EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169CE8
Part of subcall function 00007FFDF8169C70: LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D1C
Part of subcall function 00007FFDF8169C70: SetEvent.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D34
Part of subcall function 00007FFDF8169C70: Sleep.KERNEL32(?,?,?,?,?,00007FFDF8169E39,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D3F

CloseHandle.KERNEL32(?,?,?,00007FFDF8169E47,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169D9A
CloseHandle.KERNEL32(?,?,?,00007FFDF8169E47,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169DAA
DeleteCriticalSection.KERNEL32(?,?,?,00007FFDF8169E47,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169DB4
DeleteCriticalSection.KERNEL32(?,?,?,00007FFDF8169E47,?,?,?,?,?,00007FFDF81565A0), ref: 00007FFDF8169DBE

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave$EventSleep
String ID:
API String ID: 466394505-0
Opcode ID: 6c91f359a65cff02480ddf6adbf3c623b61f5d6339468b833ee91256196738aa
Instruction ID: 2c2daf44356f054c68e2f1f14464f09803ba5d7348d5759ec0b682760ddd5a8b
Opcode Fuzzy Hash: 6c91f359a65cff02480ddf6adbf3c623b61f5d6339468b833ee91256196738aa
Instruction Fuzzy Hash: 0B113022B1994283EB04EF25E5A463923A0FF84F94F184231DA6E872EDDF3DE445D345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC55D550 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AC55D57C
GetCurrentThreadId.KERNEL32 ref: 00007FF7AC55D58A
GetCurrentProcessId.KERNEL32 ref: 00007FF7AC55D596
QueryPerformanceCounter.KERNEL32 ref: 00007FF7AC55D5A6

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1a71555d3ac75d1b5b29c508cce9c43e83cb3c577c55058c65f55adaec4114c7
Instruction ID: 82ca8b168a5053341f5d38ce8b90913d4d8879ada17725c8305ce3034a3c40b2
Opcode Fuzzy Hash: 1a71555d3ac75d1b5b29c508cce9c43e83cb3c577c55058c65f55adaec4114c7
Instruction Fuzzy Hash: 01117026F19F019AEB00EF60E8542B973B4FB18758F851E31EA2D86BA4DF3CD1948350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8334BD4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDF8334C00
GetCurrentThreadId.KERNEL32 ref: 00007FFDF8334C0E
GetCurrentProcessId.KERNEL32 ref: 00007FFDF8334C1A
QueryPerformanceCounter.KERNEL32 ref: 00007FFDF8334C2A

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3311d8900f50d74eed5f0bd0bd167658aa9ceff4b26735e670f77e0f6c0eccac
Instruction ID: 55fc57f28794349bde41aac7d4e27fcedd1f8d214fe875162bdd3b45461e91ff
Opcode Fuzzy Hash: 3311d8900f50d74eed5f0bd0bd167658aa9ceff4b26735e670f77e0f6c0eccac
Instruction Fuzzy Hash: 9E113022B14F018AEB00DF60E8646B833A4F759768F480E35DA7D877A8EF7CE1949345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E0EB0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FFDF80E0EDE
GetDC.USER32 ref: 00007FFDF80E0EF7
GetDeviceCaps.GDI32 ref: 00007FFDF80E0F08
ReleaseDC.USER32 ref: 00007FFDF80E0F19

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-0
Opcode ID: 074dfdf781d8195f9939fc186360330b00a0f7a9974dc9d8f2d1a4f8b3bde94d
Instruction ID: 89caae365e03b3d6ba0fef1df611a32309dcfa2388c8d8f42313078f615a3617
Opcode Fuzzy Hash: 074dfdf781d8195f9939fc186360330b00a0f7a9974dc9d8f2d1a4f8b3bde94d
Instruction Fuzzy Hash: 4E01F471F0960287E75C9B11F87096A63A2FB89751F188038C56D47BECDE3CE841A709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E0EC7 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FFDF80E0EDE
GetDC.USER32 ref: 00007FFDF80E0EF7
GetDeviceCaps.GDI32 ref: 00007FFDF80E0F08
ReleaseDC.USER32 ref: 00007FFDF80E0F19

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-0
Opcode ID: ae3cb80f6c2c2efc911e4c089b7beb7df0c8adc20d42a2af364763170054fe31
Instruction ID: 97c373b4bb2656ea56e5d49e8a3ae46c3dc673b539edb7cbc4f8c8bc406c8f8a
Opcode Fuzzy Hash: ae3cb80f6c2c2efc911e4c089b7beb7df0c8adc20d42a2af364763170054fe31
Instruction Fuzzy Hash: 5801F471F0960287F7185B11F87096A63A2FB89751F188039C56D4BBECDE3CE441A709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80E0ECF Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FFDF80E0EDE
GetDC.USER32 ref: 00007FFDF80E0EF7
GetDeviceCaps.GDI32 ref: 00007FFDF80E0F08
ReleaseDC.USER32 ref: 00007FFDF80E0F19

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-0
Opcode ID: 3a5be9a3e041a85626639533f362eb26931805878ba46ff7c410e41df7de97fa
Instruction ID: 8ec8e3822172aff9a07362218c7c67bb39d60ea3eb23f5766e7b57d25ddcf148
Opcode Fuzzy Hash: 3a5be9a3e041a85626639533f362eb26931805878ba46ff7c410e41df7de97fa
Instruction Fuzzy Hash: 87011271F0960287F7189B11F87096A63A2EB89751F188039C56D8BBECDE3CE8419709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B6A00 Relevance: 6.0, APIs: 4, Instructions: 26memorythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00007FFDF80B6A0F
TlsGetValue.KERNEL32 ref: 00007FFDF80B6A22
GetCurrentThreadId.KERNEL32 ref: 00007FFDF80B6A2D
SetWindowsHookExA.USER32 ref: 00007FFDF80B6A44

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AllocCurrentHookThreadValueWindows
String ID:
API String ID: 4130353779-0
Opcode ID: 695f48a55107916c5b5a6fba6d90b5a8c48ff20600f8bdf64f6862ab40be1edf
Instruction ID: d61b7e235850c9a594c22ed7baac585290a4441a659e3f69c90d46fad67afe8d
Opcode Fuzzy Hash: 695f48a55107916c5b5a6fba6d90b5a8c48ff20600f8bdf64f6862ab40be1edf
Instruction Fuzzy Hash: 0BF0FFA1F0A50287FB487B64E8A4D7522D1AF04724F985634D43E872F8DE3CA545FA0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3C3880 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 354COMMON

Download Yara Rule

APIs

__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7AC3C3ADB

Part of subcall function 00007FF7AC559460: MultiByteToWideChar.KERNEL32 ref: 00007FF7AC55947C
Part of subcall function 00007FF7AC559460: GetLastError.KERNEL32 ref: 00007FF7AC55948A

Strings

\u{, xrefs: 00007FF7AC3C3B54
\x{, xrefs: 00007FF7AC3C3C50

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__std_fs_convert_narrow_to_wide
String ID: \u{$\x{
API String ID: 1033888727-3325273574
Opcode ID: 809e52fbce8e94e2fd56dda3eb3427eb0d3c4673802b34b408061996db12673b
Instruction ID: 1122835f9d80c8d39bcdd65d229662052f42dd7d0935e5dd3778bb9ae365a7b6
Opcode Fuzzy Hash: 809e52fbce8e94e2fd56dda3eb3427eb0d3c4673802b34b408061996db12673b
Instruction Fuzzy Hash: ABF19F66A09F8991DB44AF29D58027EBB61F744F88F858476CE9E03368CF3CD865C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8394A88 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDF8394B2D

Strings

!, xrefs: 00007FFDF8394B62
acos, xrefs: 00007FFDF8394B40

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 31be59d681f5875a1ea6259157b6e7771ad8ef8f1f89de3d94bc0a52fbaf5065
Instruction ID: 4a075c4387d883a236c47ce1d6ef408781352a1ecd6baf8f5721a29dccf7cd38
Opcode Fuzzy Hash: 31be59d681f5875a1ea6259157b6e7771ad8ef8f1f89de3d94bc0a52fbaf5065
Instruction Fuzzy Hash: CA612921E1CF458AE7238B3594706369359AF663D5F158333E96E71AF8CF2CE042A609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC4FD860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF7AC4FD9BC
GetFileAttributesW.KERNEL32 ref: 00007FF7AC4FD9DC

Strings

{}\{}{:016x}.{}, xrefs: 00007FF7AC4FD8C8

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AttributesFile
String ID: {}\{}{:016x}.{}
API String ID: 3188754299-3450286142
Opcode ID: 2911f7890d37736a94a44eb4c2f84950d19dcf31205bc55ad938dcb0d63bfe6b
Instruction ID: 4a0eddc9b9459afa543a4e95f227e227050a75811e5f8e9f29b88b54aa993282
Opcode Fuzzy Hash: 2911f7890d37736a94a44eb4c2f84950d19dcf31205bc55ad938dcb0d63bfe6b
Instruction Fuzzy Hash: A1515632A05F4499E3109F69E4407ADB3B5FB48B48F510235EE8C57B68EF38D555C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF837D6E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDF837D7FF
GetLastError.KERNEL32 ref: 00007FFDF837D821

Strings

U, xrefs: 00007FFDF837D7AB

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 3e4dc0de5496bb7f6f60efda645c781ac199ee03f67e19b995998c2c02a26386
Instruction ID: 12e5d05a8e79d99f6a8a41ba3f5c5369b95915c722cba8d0af9ec183ed2658b5
Opcode Fuzzy Hash: 3e4dc0de5496bb7f6f60efda645c781ac199ee03f67e19b995998c2c02a26386
Instruction Fuzzy Hash: 0941F232B1CA8192EB20AF65F854BA967A0FB88794F844131EE4D877ACEF3CD001D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8134D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32 ref: 00007FFDF8134D96
StretchDIBits.GDI32 ref: 00007FFDF8134E36

Strings

, xrefs: 00007FFDF8134DFC

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: Stretch$BitsMode
String ID:
API String ID: 661349847-3916222277
Opcode ID: 9d0d8c99162b6b7d63b3ac01ed0f341d15b9ba6278a4d7d8de03f50186e73d33
Instruction ID: fea85f778b36f42cc1dee11d19cd2cdbcf0e3226dec9682e3fa012a613bfd7c8
Opcode Fuzzy Hash: 9d0d8c99162b6b7d63b3ac01ed0f341d15b9ba6278a4d7d8de03f50186e73d33
Instruction Fuzzy Hash: FC315C73608A848BD715CF26E454A19B7A4F748BD4F658125EF9D43B28DF38D846CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC565BB8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF7AC565CB6

Strings

void, xrefs: 00007FF7AC565C18
void , xrefs: 00007FF7AC565C40

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: cbccd6729ac87af23c1493244350e918ef8c2e518f8752da95b1fcefee041e97
Instruction ID: e4be18e49e95dfcf449b569f643de18fbe658a4e05a5edf53d3ac66ae6d51775
Opcode Fuzzy Hash: cbccd6729ac87af23c1493244350e918ef8c2e518f8752da95b1fcefee041e97
Instruction Fuzzy Hash: CE313A62E1AB55A8FB01EF64E8400FCB7B4BB48748BD90136EE4E22B65DF38D144C765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC5832B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7AC583308
_set_errno_from_matherr.LIBCMT ref: 00007FF7AC583375

Strings

exp, xrefs: 00007FF7AC5832E3

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: f6b9bc5e40071cab9e310c735c9e1d05dd44e2e9ab1708e762b4a8c21344be52
Instruction ID: a1aa6adef0ae38ca9412086186a722dbdc3fc5e155a79057b61853037ae145ac
Opcode Fuzzy Hash: f6b9bc5e40071cab9e310c735c9e1d05dd44e2e9ab1708e762b4a8c21344be52
Instruction Fuzzy Hash: B4217732F16A159EE740EF78C5412AD73B0FB48348B911539FA0E92B5AEF38E4408B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3BBF69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3BBFDE

Strings

Number is too big., xrefs: 00007FF7AC3BBF9B
Negative width., xrefs: 00007FF7AC3BBF8E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Negative width.$Number is too big.
API String ID: 3668304517-1861685508
Opcode ID: 7bd07b5eccc1329f156ea8c071d2a0358385e527aad461eb1319b04b588604e8
Instruction ID: 594c785ba85e351d703bd040e956a5bd37a0d39e3a54499940ec9d2b4aa1405d
Opcode Fuzzy Hash: 7bd07b5eccc1329f156ea8c071d2a0358385e527aad461eb1319b04b588604e8
Instruction Fuzzy Hash: 611177A2C0A60BAFF2953B6854154B9B1515FA0351FE34D38D36C026F3ED1DFD524672

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3BBF88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AC3BBFDE

Strings

Number is too big., xrefs: 00007FF7AC3BBF9B
Negative width., xrefs: 00007FF7AC3BBF8E

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Negative width.$Number is too big.
API String ID: 3668304517-1861685508
Opcode ID: e1d6b30f7944a1ac4984f6983089539d2072ca0afee551bd582940e79c6e3d2a
Instruction ID: 83012c49c55e2cc821bae56adc996a1a6bf8c44eb04c9e5f312314d7050ce645
Opcode Fuzzy Hash: e1d6b30f7944a1ac4984f6983089539d2072ca0afee551bd582940e79c6e3d2a
Instruction Fuzzy Hash: BF0161A2C0AA0BAFF2993B7C50154B9B1619FA0311FE34C38D35843AB3ED1DFD528261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF8358530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDF81CBB2F), ref: 00007FFDF8358580
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDF81CBB2F), ref: 00007FFDF83585C1

Strings

csm, xrefs: 00007FFDF83585AE

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 33d794527ea33cd3a38fa723c04cbc8dfab6a1452d2c543ff12ab3a9dd5318ca
Instruction ID: 7df5649e50e0bae1a340913107a47fa7c6332c92a74c318e57e8957397f0d77a
Opcode Fuzzy Hash: 33d794527ea33cd3a38fa723c04cbc8dfab6a1452d2c543ff12ab3a9dd5318ca
Instruction Fuzzy Hash: 91115B32718B4182EB659F15E41066A77E0FB88B94F184630DF9C4BBA8DF3CD551CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80B101D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFDF80B1027
FreeLibrary.KERNEL32 ref: 00007FFDF80B1045

Strings

GetLayeredWindowAttributes, xrefs: 00007FFDF80B101D

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetLayeredWindowAttributes
API String ID: 3013587201-2043642294
Opcode ID: 59af1b8a7a66b1cc024bc8ff406001f10c387c2e99cf1d6b3eaad134a9fc14e5
Instruction ID: 5746cc6556f90017466e0e99c29f089c9092ac45c3c4a8d729dae772516812f4
Opcode Fuzzy Hash: 59af1b8a7a66b1cc024bc8ff406001f10c387c2e99cf1d6b3eaad134a9fc14e5
Instruction Fuzzy Hash: A6F0FF60F1AF4782EB08A764A9B183122E17F54740F840536C42EC36F8DE3DA192A71B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A1996
GetProcAddress.KERNEL32 ref: 00007FF7AC3A19A6

Strings

asw_process_storage_allocate_connector, xrefs: 00007FF7AC3A199F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: asw_process_storage_allocate_connector
API String ID: 1646373207-1936732423
Opcode ID: bddf03f05db5bf1f2295faf40668240c51f5cf75a6778015398a54d3ba80e799
Instruction ID: 71899f65a5e413e644a0924d4489fe4a5bf2b14ef79dce09ce5cfcd0a64bfde1
Opcode Fuzzy Hash: bddf03f05db5bf1f2295faf40668240c51f5cf75a6778015398a54d3ba80e799
Instruction Fuzzy Hash: 82D01234E47B42E1DA097B11EC8103963617F08741FE1343AD40F01332DE2CD1A5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A19F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A19F6
GetProcAddress.KERNEL32 ref: 00007FF7AC3A1A06

Strings

asw_process_storage_allocate_connector, xrefs: 00007FF7AC3A19FF

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: asw_process_storage_allocate_connector
API String ID: 1646373207-1936732423
Opcode ID: 4cde390bed373a02219460c863a0d707832ace016cd7337d857a0d13a726623d
Instruction ID: 6d5613a1b830c7f871b9d98551f7d2869032c912c82770f8c5bab91847194fd9
Opcode Fuzzy Hash: 4cde390bed373a02219460c863a0d707832ace016cd7337d857a0d13a726623d
Instruction Fuzzy Hash: 22D01234E47B42E1DA097B11EC4103963617F08741FD1253AD40F01332DF2CD165CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A19C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A19C6
GetProcAddress.KERNEL32 ref: 00007FF7AC3A19D6

Strings

asw_process_storage_deallocate_connector, xrefs: 00007FF7AC3A19CF

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: asw_process_storage_deallocate_connector
API String ID: 1646373207-2412585098
Opcode ID: 3018f2c42f9e25589326e1f9cee47b04a66c4d3dd75728fea171755971e20def
Instruction ID: af5ffb936d5eb419b8b77e3e9b4e4fec342df1898c0f558910ad942f56658314
Opcode Fuzzy Hash: 3018f2c42f9e25589326e1f9cee47b04a66c4d3dd75728fea171755971e20def
Instruction Fuzzy Hash: 76D01224E47B02E1D6497B21EC41039A3617F48741FD12536C40F01332DF2CD196CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AC3A1A26
GetProcAddress.KERNEL32 ref: 00007FF7AC3A1A36

Strings

asw_process_storage_deallocate_connector, xrefs: 00007FF7AC3A1A2F

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: asw_process_storage_deallocate_connector
API String ID: 1646373207-2412585098
Opcode ID: c4904a1d661f34ce7bf7fb1091902149370f4d093c8fe0d8049141bd8b727eb6
Instruction ID: d08dfa3d475070581e6e29e505c0e6cb7f6923544dadf274f43051568e78d737
Opcode Fuzzy Hash: c4904a1d661f34ce7bf7fb1091902149370f4d093c8fe0d8049141bd8b727eb6
Instruction Fuzzy Hash: C1D01224E47B02E1E6497721EC41039A3616F48741FE13436C40F01332DE2CD195CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF819EAD0 Relevance: 5.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDF819EB80
LeaveCriticalSection.KERNEL32 ref: 00007FFDF819EC02
EnterCriticalSection.KERNEL32 ref: 00007FFDF819EC0D
LeaveCriticalSection.KERNEL32 ref: 00007FFDF819EC23

Part of subcall function 00007FFDF819E5B0: GetVersionExA.KERNEL32 ref: 00007FFDF819E666
Part of subcall function 00007FFDF819E5B0: GetVersionExA.KERNEL32 ref: 00007FFDF819E681

Part of subcall function 00007FFDF81CB730: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB75B
Part of subcall function 00007FFDF81CB730: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB765
Part of subcall function 00007FFDF81CB730: CreateEventA.KERNEL32(?,?,?,?,?,00007FFDF819EB3B), ref: 00007FFDF81CB775
Part of subcall function 00007FFDF81CB730: CreateThread.KERNEL32 ref: 00007FFDF81CB79C
Part of subcall function 00007FFDF81CB730: CreateThread.KERNEL32 ref: 00007FFDF81CB7E4
Part of subcall function 00007FFDF81CB730: CreateThread.KERNEL32 ref: 00007FFDF81CB82C
Part of subcall function 00007FFDF81CB730: CreateThread.KERNEL32 ref: 00007FFDF81CB874

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$Create$Thread$EnterInitializeLeaveVersion$Event
String ID:
API String ID: 1428177548-0
Opcode ID: 65fabc98668ba1631a572e9c572512547e7929f4190ccd30efe1f85db9ed1bfd
Instruction ID: f00652ba09a5e9c6857aac666c68e4b30058d89ecd5ffae919b95aace01dcd04
Opcode Fuzzy Hash: 65fabc98668ba1631a572e9c572512547e7929f4190ccd30efe1f85db9ed1bfd
Instruction Fuzzy Hash: ED416C33E09B8186D714DF21E8A056977B0FB98B54B094235EB9E83BA4DF78E4E1D304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDF80EDB90 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDF80EDBFF
EnterCriticalSection.KERNEL32 ref: 00007FFDF80EDC54
EnterCriticalSection.KERNEL32 ref: 00007FFDF80EDC75
LeaveCriticalSection.KERNEL32 ref: 00007FFDF80EDCBD

Memory Dump Source

Source File: 0000000D.00000002.2594674802.00007FFDF80B1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDF80B0000, based on PE: true

Associated: 0000000D.00000002.2594633727.00007FFDF80B0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595014753.00007FFDF83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595115077.00007FFDF8465000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595189171.00007FFDF8466000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595238931.00007FFDF8467000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595316461.00007FFDF8468000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595363528.00007FFDF8469000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595450387.00007FFDF846C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595493897.00007FFDF8472000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2595555388.00007FFDF8476000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdf80b0000_Instup.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 3a93f4549bb2683d1f824d4875882c976e09b7ed53900bae051f908dfeea241f
Instruction ID: 60e609e5764ed5f62b369b95043ac982f242e09bea3a3b2edc226ba876f6666f
Opcode Fuzzy Hash: 3a93f4549bb2683d1f824d4875882c976e09b7ed53900bae051f908dfeea241f
Instruction Fuzzy Hash: 9A31ACB6B0560287EB68DB19E96496977A0EB48BD0F844031CF5D837E4CF38E896E701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B1760 Relevance: 5.1, APIs: 4, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B17A6
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B17E3
HeapFree.KERNEL32 ref: 00007FF7AC3B186D
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B187F

Part of subcall function 00007FF7AC3AAF70: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC3BA1D4,?,?,?,?,?,?,00000000), ref: 00007FF7AC3AAF9F

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$CriticalSection$Free$AllocClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep_invalid_parameter_noinfo
String ID:
API String ID: 1441953332-0
Opcode ID: db53254fb5677c16b5077442e10ba5c190c6863e13045877f15d4e7ad99a0c1e
Instruction ID: 4a57fd6e6773c0ce2ab3e2bdc945eab385bf57278660ef2c6df9dbc1e1e8cbe3
Opcode Fuzzy Hash: db53254fb5677c16b5077442e10ba5c190c6863e13045877f15d4e7ad99a0c1e
Instruction Fuzzy Hash: AF31B122A1AF4195EA40FB12A80456AB3A5FF89BC0F965139EE4D43B25DF3DE441C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3A1B0B Relevance: 5.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3A1B20
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A1B34
EnterCriticalSection.KERNEL32 ref: 00007FF7AC3A1BD1
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3A1BE5

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6372e71e2edd9afbd0eae549d8dae9e9a080560acd2f415b211a4e39a77431c5
Instruction ID: c9925935fd9dcd91269a6aef85d1f596d571adc07886ff38a97bd37798a48c9b
Opcode Fuzzy Hash: 6372e71e2edd9afbd0eae549d8dae9e9a080560acd2f415b211a4e39a77431c5
Instruction Fuzzy Hash: AD412F22B0AE41A9EB00FF60D4516EC7371EB54748FC60435EA0E57AAADF39D564C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3B1630 Relevance: 5.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AC50A7E0: GetModuleHandleW.KERNEL32 ref: 00007FF7AC50A852
Part of subcall function 00007FF7AC50A7E0: GetClassInfoExW.USER32 ref: 00007FF7AC50A863
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A871
Part of subcall function 00007FF7AC50A7E0: Sleep.KERNEL32 ref: 00007FF7AC50A87E
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A897
Part of subcall function 00007FF7AC50A7E0: HeapAlloc.KERNEL32 ref: 00007FF7AC50A8B2
Part of subcall function 00007FF7AC50A7E0: InitializeCriticalSection.KERNEL32 ref: 00007FF7AC50A8D4
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8DA
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A8F0
Part of subcall function 00007FF7AC50A7E0: RegisterClassExW.USER32 ref: 00007FF7AC50A90F
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A93A
Part of subcall function 00007FF7AC50A7E0: DeleteCriticalSection.KERNEL32 ref: 00007FF7AC50A953
Part of subcall function 00007FF7AC50A7E0: GetProcessHeap.KERNEL32 ref: 00007FF7AC50A959
Part of subcall function 00007FF7AC50A7E0: HeapFree.KERNEL32 ref: 00007FF7AC50A975
Part of subcall function 00007FF7AC50A7E0: GetLastError.KERNEL32 ref: 00007FF7AC50A986

EnterCriticalSection.KERNEL32 ref: 00007FF7AC3B1673
GetProcessHeap.KERNEL32 ref: 00007FF7AC3B16A5
HeapFree.KERNEL32 ref: 00007FF7AC3B1712
LeaveCriticalSection.KERNEL32 ref: 00007FF7AC3B1724

Part of subcall function 00007FF7AC3AAF70: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AC3BA1D4,?,?,?,?,?,?,00000000), ref: 00007FF7AC3AAF9F

Part of subcall function 00007FF7AC571318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AC57133D

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: Heap$Process$CriticalSection$Free$AllocClassErrorLast$DeleteEnterHandleInfoInitializeLeaveModuleRegisterSleep_invalid_parameter_noinfo
String ID:
API String ID: 1441953332-0
Opcode ID: 825ba16cc609086413fad098d6c8158c0f77f9fc95d98a474b16b1087edd1f14
Instruction ID: 289daee35d78a128d4df32a83c72328d09ef5344acfaa35645969d7032bb911c
Opcode Fuzzy Hash: 825ba16cc609086413fad098d6c8158c0f77f9fc95d98a474b16b1087edd1f14
Instruction Fuzzy Hash: B7318F22A1AB42D5EA50EF12E84456AF3A5FF49BC0B9A5035EE4E43736DF3CE4418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AC3E2E40 Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF7AC41BD59), ref: 00007FF7AC3E2E74
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF7AC41BD59), ref: 00007FF7AC3E2E84
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF7AC41BD59), ref: 00007FF7AC3E2EFC

Memory Dump Source

Source File: 0000000D.00000002.2593098575.00007FF7AC3A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7AC3A0000, based on PE: true

Associated: 0000000D.00000002.2593056152.00007FF7AC3A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593330763.00007FF7AC5E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593449441.00007FF7AC6C1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593499749.00007FF7AC6C3000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593543817.00007FF7AC6CC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593610786.00007FF7AC6CF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593673592.00007FF7AC6D0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593778767.00007FF7AC6D1000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593856051.00007FF7AC6D4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593922560.00007FF7AC6D5000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2593979728.00007FF7AC6DD000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594078916.00007FF7AC6DF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594173364.00007FF7AC6E1000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594260920.00007FF7AC6E2000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC732000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594377742.00007FF7AC737000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.2594541157.00007FF7AC73C000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7ac3a0000_Instup.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 50c2c71fe0541e78d2491bccc275f6e62d8fe3db30d2ed1de8ca2838d8a80932
Instruction ID: fbbdb7ba726b5167729cb566e2d1535088d93de6631698b56b363261ca1419e0
Opcode Fuzzy Hash: 50c2c71fe0541e78d2491bccc275f6e62d8fe3db30d2ed1de8ca2838d8a80932
Instruction Fuzzy Hash: A1316D62A09B41E2EB14AB25E504329A7A0FB85B84F998035DB5E03BB1CF7DE4A4C311

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log

C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log

C:\Users\user\Downloads\51922015-367a-49cc-ab83-0c843030d492.tmp

C:\Users\user\Downloads\Unconfirmed 663905.crdownload

C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe (copy)

C:\Windows\Temp\asw.00abf38d93c5fa0f\HTMLayout.dll

C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.dll

C:\Windows\Temp\asw.00abf38d93c5fa0f\Instup.exe

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.ini

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.tmp (copy)

C:\Windows\Temp\asw.00abf38d93c5fa0f\asw1375e63c8da87c9a.tmp.new

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.def

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.def.vpx

C:\Windows\Temp\asw.00abf38d93c5fa0f\config.ini (copy)

C:\Windows\Temp\asw.00abf38d93c5fa0f\cookie.bin (copy)

C:\Windows\Temp\asw.00abf38d93c5fa0f\eref.edat (copy)

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-jrog2-132c.vpx

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-prg_ais-180117d3.vpx

C:\Windows\Temp\asw.00abf38d93c5fa0f\part-setup_ais-180117d3.vpx

Windows Analysis Report
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre