Edit tour

Windows Analysis Report
ccsetup621.zip

Overview

General Information

Sample name:	ccsetup621.zip
Analysis ID:	1399806
MD5:	ba0be409f31455daa2e64193336f1563
SHA1:	e41bdc0a093639ea987e2e749b5f7702a5964513
SHA256:	8e5144c8b2bfb7c48bcc9cc82d272b784b90f289fab7c3410769c59a1f2415d6
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to infect the boot sector

Disables Windows system restore

Found stalling execution ending in API Sleep call

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 2816 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

ccsetup621.exe (PID: 1272 cmdline: "C:\Users\user\Desktop\ccsetup621.exe" MD5: D95266F76CEC3966255AA2B586693DD8)

ccsetup621.exe (PID: 3708 cmdline: "C:\Users\user\Desktop\ccsetup621.exe" MD5: D95266F76CEC3966255AA2B586693DD8)

CCleaner64.exe (PID: 400 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC MD5: ED9773FFAC49BB95523BB5044924B108)

CCUpdate.exe (PID: 3460 cmdline: "C:\Program Files\CCleaner\CCUpdate.exe" /reg MD5: 0F0B90A01F049665CA511335F9F0BF2E)

CCUpdate.exe (PID: 5836 cmdline: CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll" MD5: 0F0B90A01F049665CA511335F9F0BF2E)

chrome.exe (PID: 4072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1984,i,18427538024496017406,4920338381488815578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

CCleaner64.exe (PID: 1820 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" MD5: ED9773FFAC49BB95523BB5044924B108)

CCleaner64.exe (PID: 3612 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" /monitor MD5: ED9773FFAC49BB95523BB5044924B108)

Microstub.exe (PID: 6248 cmdline: "C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a MD5: 0CCDF8EDAF3A0FB11856FEE1690E2957)

avg_antivirus_free_online_setup.exe (PID: 6312 cmdline: "C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:a08dcfa1-7b47-48ad-af19-cdaa4e470b06 /edat_dir:C:\Windows\Temp\asw.d2a83021bf4cad31 MD5: 62D68511172418FBE4A8C75E1BE49913)

CCleaner64.exe (PID: 7088 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" MD5: ED9773FFAC49BB95523BB5044924B108)

CCleaner.exe (PID: 6272 cmdline: "C:\Program Files\CCleaner\CCleaner.exe" /uac MD5: 09CBECE85B34B40B5D330654575F9EF8)

CCleaner64.exe (PID: 6224 cmdline: "C:\Program Files\CCleaner\CCleaner.exe" /uac MD5: ED9773FFAC49BB95523BB5044924B108)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR, EventID: 13, EventType: SetValue, Image: C:\Program Files\CCleaner\CCleaner64.exe, ProcessId: 3612, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CCleaner Smart Cleaning

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9966ff98-a

Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaheap.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwalocal.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaresource.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwautils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\uninst.exe	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Setup\config.def	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\a6ad0008-1852-4a11-a99f-a3ca58c3b06c.ini	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\a7887a58-7a5c-4d85-8db0-b95adb9d8dee.xml	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log.tmp.ea34edac-a738-4056-86b8-7fc90986768f
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEng.log.tmp.e770f7c5-9a42-4d4c-8de7-e65d4e42b61a
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log.tmp.667ab01a-733c-4148-8f63-f096c3bbf913
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\journal
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\log
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\report
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\chest
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\moved
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\fw
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\event_manager.log.tmp.8194fb94-41b5-4cf2-a8ca-4a838fd8a882
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\usercfg.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\BackupStorage
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a755d00f-9c7c-43f1-9c4d-4a5ce0a5a18e
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll

Source: C:\Users\user\Desktop\ccsetup621.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.134:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.17:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49977 version: TLS 1.2

Source:	Binary string: gcapi_dll.dll.pdb\| source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfBL_link.pdb source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfBL_link.pdb# source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x64\CCleaner64.pdb source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\work\848d668bab18d6e2\bin_x86\v142\Release Static\neutral\ServiceUninstaller_link.pdb source: ccsetup621.exe, 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfUI_link.pdb source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x86\AvastAdSDK_Release Static.pdb source: ccsetup621.exe, ccsetup621.exe, 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfUI_link.pdb# source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: gcapi_dll.dll.pdb source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C2DE76 FindFirstFileExW,

15_2_69C2DE76

Source: unknown

Network traffic detected: DNS query count 51

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 146.75.28.157 146.75.28.157
Source: Joe Sandbox View	IP Address: 34.149.149.62 34.149.149.62
Source: Joe Sandbox View	IP Address: 104.18.32.137 104.18.32.137

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RAvA9Dno27h14MB&MD=4Cg9+NHD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?p_elm=76&action=1&p_age=0&p_bau=0&p_bsls=0&p_chcc=2&p_chr=0&p_dvt=3&p_fds=172544&p_gis=0&p_hid=88804a8d-d694-4779-ab31-d171f97a6233&p_lid=en-CH&p_lng=en&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_osv=10.0&p_pro=90&p_sbi=0&p_scbu=0&p_tos=0&p_vbd=10918&p_vep=6&p_ves=21&p_wid=1657563960 HTTP/1.1Connection: Keep-AliveUser-Agent: Avast AntivirusHost: ipm-provider.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /?p_vep=6&p_ves=21&p_vbd=10918&p_lit=0&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_pro=90&p_osv=10.0&p_gksw=0&p_lng=en&p_lid=en-us HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918)Host: shepherd.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RAvA9Dno27h14MB&MD=4Cg9+NHD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /v2/info HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: CCleaner Update AgentHost: ip-info.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /v2/info HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: CCleaner Update AgentHost: ip-info.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/OtAutoBlock.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?onload=ccleaner_recaptcha_onloadCallback&render=explicit HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1709055523652 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: symantec.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=64982516487112820180108176489468717949
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1709055523652 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=64982516487112820180108176489468717949
Source: global traffic	HTTP traffic detected: GET /wi/ytc.js HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-857043.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zd4eJQAAAG_qkwMv HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=64982516487112820180108176489468717949
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/config/10180940.json HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tags/563151391133/tag.js HTTP/1.1Host: www.mczbf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s56254480568556?AQB=1&ndh=1&pf=1&t=27%2F1%2F2024%2018%3A38%3A44%202%20-60&mid=65137400602583208510129276808489166796&aamlh=7&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-02-06&c48=CCleaner%20v6.21.10918&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=65137400602583208510129276808489166796&c59=ccleaner%3Aknowledge%3Accleaner-v6-21-10918&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.edfa88fa094af2bba7f9.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zd4eJQAAAG_qkwMv HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=64982516487112820180108176489468717949; dpm=64982516487112820180108176489468717949
Source: global traffic	HTTP traffic detected: GET /api/mhubc.js HTTP/1.1Host: mstatic.ccleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19781%7CMCMID%7C65137400602583208510129276808489166796%7CMCAAMLH-1709660324%7C7%7CMCAAMB-1709660324%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1709062724s%7CNONE%7CvVersion%7C5.5.0; _gcl_au=1.1.514650152.1709055524; __srcCookie=007_z8b\|\|source=(Other)\|medium=(none)\|campaign=(not set)\|segmentCode=z; pglpid=undefined; s_nr=1709055524593-New; event69=event69; channelStack=s_eVar72~ccleaner; s_tbm=true; s_gpv=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918; s_gpv_custom=ccleaner%3Aknowledge%3Accleaner-v6-21-10918; s_cc=true
Source: global traffic	HTTP traffic detected: GET /wi/config/10180940.json HTTP/1.1Host: s.yimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /711037.gif?partner_uid=82ab0b25-a8ef-4fef-8435-1de230d584d8 HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s56254480568556?AQB=1&ndh=1&pf=1&t=27%2F1%2F2024%2018%3A38%3A44%202%20-60&mid=65137400602583208510129276808489166796&aamlh=7&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-02-06&c48=CCleaner%20v6.21.10918&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=65137400602583208510129276808489166796&c59=ccleaner%3Aknowledge%3Accleaner-v6-21-10918&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=1692164b-248c-485d-99bb-aee2b9f7031b
Source: global traffic	HTTP traffic detected: GET /563151391133/pageInfo HTTP/1.1Host: www.mczbf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1000.gif?memo=CP2yKxIwCiwIARCl_gkaJDgyYWIwYjI1LWE4ZWYtNGZlZi04NDM1LTFkZTIzMGQ1ODRkOBAAGg0Iprz4rgYSBQjoBxAAQgBKAA HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rlas3=ktTeDD6OzBnt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; pxrc=CAA=
Source: global traffic	HTTP traffic detected: GET /sessions/857043?s=0.25&r=0.21376483259072088 HTTP/1.1Host: vc.hotjar.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/2679475345708101?v=2.9.147&r=stable&domain=www.ccleaner.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j.php?a=176159&u=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&r=0.19947545942317246 HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cachedClickId?marketerId=001ac0827d67b7b38319c9517e7fa2f4cc HTTP/1.1Host: tr.outbrain.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=D7AC5573972C60564976E18E332F56DDF&h=e9c9db551c738e08dbc441ee457e4a33&t=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adalyser.js?cid=ccleaner HTTP/1.1Host: c5.adalyser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: personalization_id="v1_4rWWlcFOBsWfnSQ45pGHjA=="
Source: global traffic	HTTP traffic detected: GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=D7AC5573972C60564976E18E332F56DDF&h=e9c9db551c738e08dbc441ee457e4a33&t=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&_u=YCDAgEABAAAAAGAEK~&z=1906304434 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /1000.gif?memo=CP2yKxIwCiwIARCl_gkaJDgyYWIwYjI1LWE4ZWYtNGZlZi04NDM1LTFkZTIzMGQ1ODRkOBAAGg0Iprz4rgYSBQjoBxAAQgBKAA HTTP/1.1Host: idsync.rlcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rlas3=IM4UTIqonsTt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; pxrc=CKe8+K4GEgUI6AcQAA==
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&gjid=1101255825&_gid=1089165544.1709055527&_u=YCDAgEABAAAAAGAEK~&z=1769775916 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tracking/track/v3/p?stm=1709055527601&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cid=ccleaner&p=%7B%22et%22%3A1709055527598%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22e28a0d0b-2e22-444a-8d15-a30e979a3fd7%22%2C%22duid%22%3A%222587d276-e759-468f-83a2-75971f1649a6%22%2C%22cw%22%3A1709055527598%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1Host: c5.adalyser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&_u=YCDAgEABAAAAAGAEK~&z=1906304434 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /tracking/track/v3/p?stm=1709055527601&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cid=ccleaner&p=%7B%22et%22%3A1709055527598%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22e28a0d0b-2e22-444a-8d15-a30e979a3fd7%22%2C%22duid%22%3A%222587d276-e759-468f-83a2-75971f1649a6%22%2C%22cw%22%3A1709055527598%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1Host: c5.adalyser.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&_u=aCDAAEABAAAAAGAEK~&z=930998961 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&gjid=91779804&_gid=1089165544.1709055527&_u=aCDAAEABAAAAAGAEK~&z=1791724118 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?action=1&p_elm=229&p_lng=en&p_lid=en-us&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_b8b_m&p_dols=0&p_pro=90&p_vep=6&p_ves=21&p_vbd=10918&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240227 HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918)Host: ipm-provider.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /v1/info HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918)Host: ip-info.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?action=1&p_elm=260&p_lng=en&p_lid=en-us&p_geo=US&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_b8b_m&p_dols=0&p_pro=90&p_vep=6&p_ves=21&p_vbd=10918&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_avt=cc-pro-trial&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240227 HTTP/1.1User-Agent: CCleanerHost: ipm-provider.ff.avast.comCache-Control: no-cacheCookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6
Source: global traffic	HTTP traffic detected: GET /v4/receive/get/json/10?data={"record":[{"event":{"type":10,"subtype":2,"request_id":"b1b77453-6bf3-4c86-b304-e1942a376416"},"identity":{"guid":"5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6","hwid":"0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B"},"product":{"id":104,"lang":"en-us","version_app":"6.21.10918.mmm_ccl_003_999_b8b_m","build":10918,"ipm_product":90},"platform":{"version":"10.0","lang":"en-us"},"license":{"subscription_mode":false,"stack":"STACK_AVAST","gen_license":{"state":"EXPIRED"}},"shepherd":{},"ab_test":{},"ipm":{"common":{"element":260,"license_type":"STANDARD","licensing_stage":"LICENSED","installation_age":0,"remaining_days_to_expiration":-1,"flow_id":"b1b77453-6bf3-4c86-b304-e1942a376416"},"content":{"content_identifier":"ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html","content_type":"SCREEN","screen_language":"en","screen_name":"tutorial-260_crosssell-ccleaner-post-installer-group-a-avg"},"action":{}}}]} HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918)Host: analytics.ff.avast.comCache-Control: no-cache

Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp

String found in binary or memory: the next 30 days.Welcome!CCleaner Professional TrialOKPopup/HealthCheck/PostAnalysis/UpgradedToProPopup/HealthCheck/PostAnalysis/UpgradedToTrialYour upgrade is complete.Thank you for purchasing CCleaner Professional.mail.google.comlogin.live.comLatestICS*.avast.com*.ccleanercloud.com*.ccleaner.com*.piriform.commail.yahoo.commail.netscape.comwebmail.earthlink.netaccounts.google.comwww.google.comgoogle.comgoogle.com/accountswww.google.com/accountsovi.com/services/signinauth.me.commail.rumail.lycos.comfastmail.fmmy.screenname.aol.comwebmail.aol.comyahoo.comtwitter.comfacebook.comaol.comscreenname.aol.comicloud.commail.aol.comwww.mail.lycos.comlogin.comcast.net5.41ProblemregReg Files (*.reg)*.regcc_%d%02d%02d_%02d%02d%02d.regFix selected issues...CIssuesCtrl::SetControlsUsernameRegistry KeyDataCCScanreg.txt/bkpregistry.txtScan For IssuesScan For Issues + CancelSystem.IO.File:GetDirectory() - FullPath: , Extension: , Filename: , Directory: , Drive: System.IO.File:GetDirectory() - DirectoryName after removing trailing slash : Piriform::IO::File::GetDirectorySystem.IO.File:GetDirectory() - Error code returned from _tsplitpath_s: BNBK6NameLicenseLicenseKeyautotrial.datbusiness.datlicense.ini25BrandoverBRANDING, Name: Registering Trial License. Days: Piriform::CLicense::OnTrialingRegistering License. Filename: Piriform::CLicense::OnRegisterExpiredActiveInvalid KeyCheck Trial Offer cancelled by userActivation cancelled by user%s equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: analytics.avcdn.net

Source: unknown

HTTP traffic detected: POST /receive3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-enc-sbUser-Agent: Avast AntivirusContent-Length: 290Host: analytics.avcdn.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0Connection: closeDate: Tue, 27 Feb 2024 17:38:47 GMTX-Request-ID: 0f8a3d8b-d597-11ee-aa65-3353c84f96ebServer: nginxX-Robots-Tag: noindex, nofollowX-Cache: Error from cloudfrontVia: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront)X-Amz-Cf-Pop: IAD50-C2X-Amz-Cf-Id: 8pDVhwAAIfXS5gN7x4C6KKBFs3uSdtUCutv9k-p0S3SZTI2qzYBtXg==

Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%s:%d;https=https://%s:%dHTTP/1.0%u.%u.%u.%u01234567890123456789abcdef0123456789ABCDEFCONOUT$
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: ccsetup621.exe, 0000000F.00000003.1495932825.00000000063C6000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ccsetup621.exe, 0000000F.00000003.1495932825.00000000063C6000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://files.avast.com/beta9x/avast_free_antivirus_setup_online.exeASWSig2A5549FF2866EA44F68D28FB2B1
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://files.avast.com/iavs9x/avast_premier_antivirus_setup_online.exeASWSig2A5FB1A9FDC683FA551EB348
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avast-tu/beta/avast_cleanup_online_setup.exeASWSig2A1E3DD1C1B204ED89FD
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avast-tu/release/avast_cleanup_online_setup.exeASWSig2A4C1A1197A19B18F
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-bs/beta/avg_battery_saver_online_setup.exeASWSig2A4D178CA216002CE0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exeASWSig2A7E478FFFFFA84
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-tu/beta/avg_tuneup_online_setup.exeASWSig2A51F05E8C170B452F21205C3
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-tu/release/avg_tuneup_online_setup.exeASWSig2A19497FDBA8D930F12196
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avira-tu/beta/avira_tuneup_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avira-tu/release/avira_tuneup_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/norton-tu/beta/norton_tuneup_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/norton-tu/release/norton_tuneup_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://keys.backup.norton.com
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://liveupdate.norton.com/upgrade/NAT/installer/Norton_AntiTrack_Installer.exeASWSig2A38B0EC9B645
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txt
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txtCommChannel.dllinvalid
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txtavast_activationcodefull://C-type
Source: CCleaner64.exe, 00000012.00000002.1803161842.0000027DEFA9F000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1722646795.0000027DEFAA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ncc.avast.com:80/ncc.txt
Source: CCleaner64.exe, 00000012.00000002.1810182711.0000027DF1F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ncpQ.a
Source: ccsetup621.exe, 0000000C.00000000.1311174917.000000000040A000.00000008.00000001.01000000.00000006.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000040A000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ccsetup621.exe, 0000000F.00000003.1495932825.00000000063C6000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/MD/Protocol.Write()
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/MD/avast_streambacksubmit_%03d://asw::commchannel::Channel::ReadCall
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/PD/avast_streambackraw_%03d://http:Do
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/PD/avast_streambacksubmit_%03d://http://p%03d.sb.avast.com/V1/MD/https:
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/PD/https:http:Canceling
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://posttestserver.com/avast_sitecorrect://http://ta.ff.avast.com/avast_softwareupdater://http://
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLCopyright
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://streamback-test.ff.avast.com/V1/PD/browsercleanup://http://sea20.ff.avast.com/jumpshot_silent
Source: ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.avast.com0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.avast.com0/
Source: ccsetup621.exe, 0000000F.00000003.1621886165.0000000006B20000.00000004.00000800.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/ccleaner
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_license?p=1&l=
Source: ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_license?p=1&l=1033&a=0l
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_privacy?p=1&l=
Source: ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_privacy?p=1&l=1033&a=0
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1902417072.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000049D000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0
Source: ccsetup621.exe, 0000000F.00000003.1719294849.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0C:
Source: ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0M
Source: ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0UserWdtH
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0X
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0h
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.ccleaner.com/inapp/notificationsCCleaner
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.ccleaner.com/inapp/notificationsContent-Type:
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.comopen
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllNUL
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zkysky.com.ar/This
Source: ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: ccsetup621.exe, 0000000F.00000003.1495932825.00000000063C6000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://akbr-api.avast.com/acquisition?https://akbr-api.avast.com/activation?avast_activationcodeleg
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://akbr-api.avast.com/activation?https://akbr-api.avast.com/acquisition?avast_activationcodenoc
Source: ccsetup621.exe, 0000000F.00000003.1536689883.0000000003EFC000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1720154457.0000027DF1FB7000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/
Source: CCleaner64.exe, 00000012.00000002.1803161842.0000027DEFAA9000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1722646795.0000027DEFAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/.dll
Source: ccsetup621.exe, 0000000F.00000003.1445576669.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1427707615.0000000000A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/TIno
Source: ccsetup621.exe, 0000000F.00000003.1820207443.00000000063EB000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1719499978.00000000063E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/Wv
Source: CCleaner64.exe, 00000012.00000003.1720154457.0000027DF1FB7000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1F9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/receive3
Source: ccsetup621.exe, 0000000F.00000003.1427569539.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/receive322
Source: CCleaner64.exe, 00000012.00000003.1720154457.0000027DF1FB7000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/~
Source: CCleaner64.exe, 00000012.00000002.1810182711.0000027DF1F33000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net:443/receive3
Source: ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://auth-test.ff.avast.com/V1/REGavast_streambackkey_test://https://auth.ff.avast.com/V1/REGavas
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://bits.avcdn.net/gen?productid=%PRODUCTID%&applicationid=%APPLICATIONID%&releasetype=%RELEASET
Source: ccsetup621.exe, ccsetup621.exe, 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build
Source: ccsetup621.exe	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN_AVG/installertype_ONLINE/b
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_FREE/platform_WIN/installertype_ONLINE/b
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_PRO/platform_WIN/installertype_ONLINE/bu
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://brain.jumpshot.com/dropbox/tagjumpshot_dropboxtag://https://brain.jumpshot.com/dropbox/reque
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_acknowledgements
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_license_agreement
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_data_factsheet
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_policy
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_product_policy
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://cdn-download.securebrowser.com/norton/norton_private_browser_setup.exeASWSig2A41D20C1042F8C7
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://download.avira.com/download/opswat-sdk-database/asw::su_controller::ControllerConfiguration:
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exeASWSig2A532CCF5ABF
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/beta/avast_breach_guard_online_setup.exeASWSig2A6DF674D10553
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeASWSig2A2457920CE
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/beta/avast_battery_saver_online_setup.exeASWSig2A3A3BE3789E6
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exeASWSig2A072492C0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/beta/avast_driver_updater_online_setup.exeASWSig2A3CBDA28891
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_online_setup.exeASWSig2A021F36B
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exeASWSig2A06FCDABA5742BE662
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exeASWSig2A2B99C8EA31CB6D
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/beta/avg_breach_guard_online_setup.exeASWSig2A56213C511B9A9241
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exeASWSig2A14AA13983E189
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-du/beta/avg_driver_updater_online_setup.exeASWSig2A667B4A5D8ECDBD
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-du/release/avg_driver_updater_online_setup.exeASWSig2A24A39E8D727
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-vpn/release/avg_vpn_online_setup.exeASWSig2A27B1BBBA8E4138C4EDCFD
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-atrk/release/avira_antitrack_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/beta/avira_free_security_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/beta/avira_internet_security_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/beta/avira_prime_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/release/avira_free_security_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/release/avira_internet_security_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-av/release/avira_prime_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-bg/beta/avira_breach_guard_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-bg/release/avira_breach_guard_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-du/beta/avira_driver_updater_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-du/release/avira_driver_updater_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avira-vpn/release/avira_vpn_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-atrk/release/norton_antitrack_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-av/beta/norton_free_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-av/beta/norton_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-av/release/norton_free_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-av/release/norton_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-bg/beta/norton_breach_guard_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-bg/release/norton_breach_guard_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-du/beta/norton_driver_updater_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-du/release/norton_driver_updater_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/norton-vpn/release/norton_vpn_online_setup.exe-TODO
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/avg/beta9x/avg_internet_security_setup.exeASWSig2A7D77EF27F362060AF957E761
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/avg/iavs9x/avg_antivirus_free_setup.exeASWSig2A6E77B27F7EE2335823CCB40049F
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/avg/iavs9x/avg_internet_security_setup.exeASWSig2A123D026AE3BEAC0AC7D4DC35
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/avg/iavs9x/avg_internet_security_setup.exeASWSig2A357ACEF8FE55D8ED7E2EA469
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/beta9x/avast_pro_antivirus_setup_online.exeASWSig2A579D90FED0C6441EE7B258F
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/iavs9x/avast_free_antivirus_setup_online.exeASWSig2A2EC0971AB07DE15C30023C
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://install.avcdn.net/iavs9x/avast_pro_antivirus_setup_online.exeASWSig2A03A4D7B0044FDD707267F64
Source: ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-provider.ff.avast.com/?p_elm=76&action=1&p_age=0&p_bau=0&p_bsls=0&p_chcc=2&p_chr=0&p_dvt
Source: ccsetup621.exe, 0000000F.00000003.1452847076.0000000003ECF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EAC000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipm-static.avcdn.net/content-assets-prod/
Source: ccsetup621.exe, 0000000F.00000003.1452847076.0000000003ECF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EAC000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipmcdn.avast.com/images/
Source: ccsetup621.exe, 0000000F.00000003.1452847076.0000000003ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipmcdn.avast.com/images/Persistent-AuthWWW-AuthenticateVaryClientId=311f90c8-c9b0-47a6-90e4-
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://license.piriform.com/
Source: ccsetup621.exe, 0000000F.00000003.1562981054.00000000063EF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623439928.00000000063E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://license.piriform.com/product/v1/installcheck?p=1&v=6.21.10918&vx=&l=1033&b=1&o=10W6&g=0&i=1&
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://license.piriform.com/update1033lMozilla/4.0lkocvmkAutoUpdateEventsMarshallertdisplayNamepath
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://openid-stage.avast.comhttps://openid-stage.avg.comalpha-license-dealer-stage.ff.avast.commy-
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://openid-stage.avg.comhttps://openid-stage.avast.comalpha-crap-stage.ff.avast.comalpha-iqs-sta
Source: CCleaner64.exe, 00000012.00000003.1787976082.0000027DF193D000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1793896965.0000027DF1940000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1723577996.0000027DF1920000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1737497348.0000027DF193D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://openid.avast.comdler;EB
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://openid.avg.comalpha-rollout-service.ff.avast.commy-devices.avast.comhttps://openid.avast.com
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://openid.avg.comhttps://openid.avast.comaswProperty.dllavcfg://settings/Shepherd/ABTestsSOFTWA
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://posttestserver.com/avast_sitecorrect://http://ai.ff.avast.com/avast_myavast://http://vl.ff.a
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://posttestserver.com/test_channel_s://http://ai.ff.avast.com/avast_myavast://http://vl.ff.avas
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://posttestserver.com/test_channel_utf8://http://posttestserver.com/a
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://s-trackoff.avcdn.net/avg/trackoff/7854df286ff1c4e1f4d81d466f4a1b0243b39837ac99c5b98817907f76
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://s-trackoff.avcdn.net/trackoff/8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850fa
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003EE8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1563153567.0000000003F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service.piriform.com/
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service.piriform.com/installcheck.aspx5.70.7909PrefsPrivacyShareData1stParty
Source: ccsetup621.exe, 0000000F.00000003.1563153567.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1719499978.00000000063DF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1569010896.00000000063E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service.piriform.com/installcheck.aspx?p=1&v=6.21.10918&vx=&l=1033&b=1&o=10W6&g=0&i=1&a=0&e=
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shepherd.ff.avast.com/
Source: ccsetup621.exe, 0000000F.00000003.1569010896.00000000063F5000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1820207443.00000000063EB000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1719499978.00000000063E7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1849860964.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623439928.00000000063E7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1915735046.00000000063F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shepherd.ff.avast.com/?p_vep=6&p_ves=21&p_vbd=10918&p_lit=0&p_midex=0FB1F1D02E97E8CA460C6924
Source: ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shepherd.ff.avast.com/Mozilla/4.0
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://softwareupdatechecker.live-everest-media.net/api/v1/ProgramDefinitions/api/v1/ScanResultshtt
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://softwareupdatechecker.staging-everest-media.netUsing
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_get_update1033Mozilla/4.0https://license.piriform.com/update%d.%d
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_get_updatehttps://license.piriform.com/updateMozilla/4.0cvtvolkmk
Source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_help_preloading
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_pro_trialkeyhttps://license.piriform.com/verify/?p=ccpro&c=cc&lk=
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.ssllabs.com/ssltest/viewMyClient.htmlLoading...

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.134:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.17:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.17:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.17:49977 version: TLS 1.2

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_6BC8CFD0: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,

15_2_6BC8CFD0

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C37700 OpenSCManagerW,OpenServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

15_2_69C37700

Source: C:\Program Files\CCleaner\CCleaner64.exe

File created: C:\Windows\Tasks\CCleanerCrashReporting.job

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_00A0F58B	15_3_00A0F58B
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C319EF	15_2_69C319EF
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C1A997	15_2_69C1A997
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C318CF	15_2_69C318CF
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF4870	15_2_69BF4870
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BECBF0	15_2_69BECBF0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C1FB90	15_2_69C1FB90
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C19A60	15_2_69C19A60
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF5DA0	15_2_69BF5DA0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF4D30	15_2_69BF4D30
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C1DC29	15_2_69C1DC29
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF6FC0	15_2_69BF6FC0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C2BE69	15_2_69C2BE69
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C31E7F	15_2_69C31E7F
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF8160	15_2_69BF8160
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BFC0F0	15_2_69BFC0F0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C2109F	15_2_69C2109F
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF5390	15_2_69BF5390
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF85B0	15_2_69BF85B0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69BF44A0	15_2_69BF44A0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C30450	15_2_69C30450
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C247BB	15_2_69C247BB
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C2B72C	15_2_69C2B72C

Source: Joe Sandbox View

Dropped File: C:\Program Files\CCleaner\CCUpdate.exe 4AD9635351C8E8579C4D4C2BDD679EA7B135EC329ADC6FD5D8211255E2E666BE

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: String function: 69C18245 appears 132 times
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: String function: 69C189A0 appears 39 times
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: String function: 69BECF10 appears 47 times
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: String function: 69C18278 appears 108 times

Source: lang-1032.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1032.dll.15.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1032.dll.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1034.dll.15.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: lang-1036.dll.15.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.109
Source: lang-1036.dll.15.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1038.dll.15.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped
Source: lang-1043.dll.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: lang-1043.dll.15.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1045.dll.15.dr	Static PE information: Resource name: RT_STRING type: 370 XA sysV executable not stripped
Source: lang-1048.dll.15.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1050.dll.15.dr	Static PE information: Resource name: RT_STRING type: iAPX 286 executable large model (COFF) not stripped
Source: lang-1053.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1026.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1026.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1055.dll.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1056.dll.15.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1057.dll.15.dr	Static PE information: Resource name: RT_STRING type: 370 sysV pure executable not stripped
Source: lang-1057.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1057.dll.15.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1058.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1060.dll.15.dr	Static PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: lang-1060.dll.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: lang-1063.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1063.dll.15.dr	Static PE information: Resource name: RT_STRING type: x86 executable (TV) not stripped
Source: lang-1063.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1032.dll0.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1032.dll0.15.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1032.dll0.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1034.dll0.15.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: lang-1036.dll0.15.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.109
Source: lang-1036.dll0.15.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1038.dll0.15.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped
Source: lang-1065.dll.15.dr	Static PE information: Resource name: RT_STRING type: x86 executable (TV) not stripped
Source: lang-1065.dll.15.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1066.dll.15.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1081.dll.15.dr	Static PE information: Resource name: RT_STRING type: x86 executable not stripped
Source: lang-1081.dll.15.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1086.dll.15.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.108

Source: lang-1034.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1068.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1049.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1053.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1036.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1045.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1038.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1057.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1030.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1046.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1056.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1040.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1027.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1067.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1086.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1054.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1031.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1041.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1060.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1038.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1041.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1037.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1031.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1044.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1050.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1063.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1028.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1032.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1079.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1040.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1036.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1066.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1051.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1025.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1032.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1081.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1043.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1059.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1037.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1062.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1035.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1048.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1034.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1029.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1065.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1071.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1052.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1026.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1058.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1035.dll0.15.dr	Static PE information: No import functions for PE file found
Source: lang-1042.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1055.dll.15.dr	Static PE information: No import functions for PE file found
Source: lang-1061.dll.15.dr	Static PE information: No import functions for PE file found

Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbgcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mstask.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: version.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wldp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: profapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: atlthunk.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: webio.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mswsock.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winnsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winsta.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d2d1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwrite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d11.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dcomp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: textshaping.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wscapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netprofm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: gpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: newdev.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: devobj.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: devrtl.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: amsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: xmllite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: schannel.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appresolver.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: slc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sppc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: propsys.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: linkinfo.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntshrui.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cscapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: policymanager.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskflowdataengine.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cdp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dsreg.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: esent.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msimg32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: edputil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wininet.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: apphelp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: pcacli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sfc_os.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mrmcorer.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.ui.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: inputhost.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: languageoverlayutil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mrmdeploy.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: xmllite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winsta.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbgcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mstask.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: version.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wldp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: profapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: atlthunk.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: webio.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mswsock.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winnsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winsta.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d2d1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwrite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d11.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dcomp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: textshaping.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wscapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netprofm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: gpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: amsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: schannel.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: propsys.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: esent.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: netprofm.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: npmproxy.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Section loaded: dnsapi.dll

Source: classification engine

Classification label: mal60.spyw.evad.winZIP@37/428@138/36

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C371C0 StopService,

15_2_69C371C0

Source: C:\Users\user\Desktop\ccsetup621.exe

File created: C:\Program Files\CCleaner

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\ZZ1FDLIH.txt

Jump to behavior

Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTraySingleIcon
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_Monitoring
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_MainInstance
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_PreventSecondInstance
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_Checking_for_Updates
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTrayMonitorIconActive
Source: C:\Program Files\CCleaner\CCUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\CCleanerSetupMutex
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTrayIconActive

Source: C:\Users\user\Desktop\ccsetup621.exe

File created: C:\Users\user\AppData\Local\Temp\nstDDA9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor

Source: C:\Users\user\Desktop\ccsetup621.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: ccsetup621.exe, 0000000F.00000002.2045926533.000000006B6DE000.00000008.00000001.01000000.0000000D.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: ccsetup621.exe, 0000000F.00000002.2045926533.000000006B6DE000.00000008.00000001.01000000.0000000D.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: ccsetup621.exe	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN_AVG/installertype_ONLINE/build_RELEASE
Source: ccsetup621.exe	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_FREE/platform_WIN/installertype_ONLINE/build_RELEASE
Source: ccsetup621.exe	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build_RELEASE
Source: ccsetup621.exe	String found in binary or memory: productfamily_HMA/insttype_PRO/platform_WIN/installertype_ONLINE/build_RELEASE
Source: ccsetup621.exe	String found in binary or memory: productfamily_BATTERY_SAVER/insttype_PRO/platform_WIN/installertype_ONLINE/build_RELEASE/trialid_mmm_ccl_prm_005_814_m
Source: ccsetup621.exe	String found in binary or memory: productfamily_KAMO/insttype_PRO/platform_WIN/installertype_ONLINE/build_RELEASE

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\ccsetup621.exe "C:\Users\user\Desktop\ccsetup621.exe"
Source: unknown	Process created: C:\Users\user\Desktop\ccsetup621.exe "C:\Users\user\Desktop\ccsetup621.exe"
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll"
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1984,i,18427538024496017406,4920338381488815578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"
Source: unknown	Process created: C:\Program Files\CCleaner\CCleaner.exe "C:\Program Files\CCleaner\CCleaner.exe" /uac
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe "C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Process created: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:a08dcfa1-7b47-48ad-af19-cdaa4e470b06 /edat_dir:C:\Windows\Temp\asw.d2a83021bf4cad31
Source: C:\Program Files\CCleaner\CCleaner.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner.exe" /uac
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1984,i,18427538024496017406,4920338381488815578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\CCleaner\CCleaner.exe "C:\Program Files\CCleaner\CCleaner.exe" /uac	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe "C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a
Source: C:\Program Files\CCleaner\CCleaner.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner.exe" /uac
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Process created: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:a08dcfa1-7b47-48ad-af19-cdaa4e470b06 /edat_dir:C:\Windows\Temp\asw.d2a83021bf4cad31

Source: C:\Users\user\Desktop\ccsetup621.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Program Files\CCleaner\CCUpdate.exe

File written: C:\Program Files\CCleaner\Setup\a6ad0008-1852-4a11-a99f-a3ca58c3b06c.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 12
Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 12
Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 12

Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaheap.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwalocal.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwaresource.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwautils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Directory created: C:\Program Files\CCleaner\uninst.exe	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Setup\config.def	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\a6ad0008-1852-4a11-a99f-a3ca58c3b06c.ini	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\a7887a58-7a5c-4d85-8db0-b95adb9d8dee.xml	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log.tmp.ea34edac-a738-4056-86b8-7fc90986768f
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEng.log.tmp.e770f7c5-9a42-4d4c-8de7-e65d4e42b61a
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log.tmp.667ab01a-733c-4148-8f63-f096c3bbf913
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\journal
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\log
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\report
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\chest
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\moved
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\fw
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\event_manager.log.tmp.8194fb94-41b5-4cf2-a8ca-4a838fd8a882
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\usercfg.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\BackupStorage
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a755d00f-9c7c-43f1-9c4d-4a5ce0a5a18e
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll

Source: C:\Users\user\Desktop\ccsetup621.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner

Jump to behavior

Source: ccsetup621.zip

Static file information: File size 79141752 > 1048576

Source:	Binary string: gcapi_dll.dll.pdb\| source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfBL_link.pdb source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfBL_link.pdb# source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x64\CCleaner64.pdb source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\work\848d668bab18d6e2\bin_x86\v142\Release Static\neutral\ServiceUninstaller_link.pdb source: ccsetup621.exe, 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfUI_link.pdb source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x86\AvastAdSDK_Release Static.pdb source: ccsetup621.exe, ccsetup621.exe, 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\848d668bab18d6e2\bin_x86\v143\Release Static\neutral\pfUI_link.pdb# source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: gcapi_dll.dll.pdb source: CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_00A0D634 push eax; iretd	15_3_00A0D635
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_00A0D634 push eax; iretd	15_3_00A0D635
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_00A0D634 push eax; iretd	15_3_00A0D635
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_00A0D634 push eax; iretd	15_3_00A0D635
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206B99 push esi; ret	15_3_04206B9A
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206B99 push esi; ret	15_3_04206B9A
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BC6 push esi; retf	15_3_04206BDA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BC6 push esi; retf	15_3_04206BDA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206B99 push esi; ret	15_3_04206B9A
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206B99 push esi; ret	15_3_04206B9A
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BC6 push esi; retf	15_3_04206BDA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BC6 push esi; retf	15_3_04206BDA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_042073B9 push ebp; iretd	15_3_042073BA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206BB9 push esi; iretd	15_3_04206BBA
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206781 push 89000420h; ret	15_3_04206786
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_3_04206B99 push esi; ret	15_3_04206B9A

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive

15_2_6BC8CFD0

Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\pfBL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\dump_process.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1040.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCUpdate.exe	File created: C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwaheap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1026.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\bug_report.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1028.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1062.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwalocal.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_mod.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwaapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwaresource.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1043.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_17090555793612.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\libwautils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\pfUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	File created: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_17090555521820.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\a\asdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\g\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\ServiceUninstaller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1052.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_ui.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\CCleaner.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to dropped file

Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\dump_process.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_ui.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\bug_report.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_mod.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	File created: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive

15_2_6BC8CFD0

Source: C:\Program Files\CCleaner\CCleaner64.exe

File created: C:\Windows\Tasks\CCleanerCrashReporting.job

Jump to behavior

Source: C:\Program Files\CCleaner\CCleaner64.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C37526 OpenSCManagerW,OpenServiceW,QueryServiceStatusEx,CloseServiceHandle,GetTickCount64,Sleep,QueryServiceStatusEx,GetTickCount64,StartServiceW,QueryServiceStatusEx,GetTickCount64,Sleep,QueryServiceStatusEx,GetTickCount64,GetTickCount64,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

15_2_69C37526

Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CCleaner Smart Cleaning
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CCleaner Smart Cleaning

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C04470 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_69C04470

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\ccsetup621.exe

Stalling execution: Execution stalls by calling Sleep

graph_15-42688

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ccsetup621.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation

Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Horizon View Client
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Player
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Workstation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Player
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Horizon View Client
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Workstation

Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\pfBL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-5146.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\dump_process.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1040.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCUpdate.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwaheap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\INetC.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1026.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\bug_report.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1028.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1062.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwalocal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_mod.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwaapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwaresource.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1043.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_17090555793612.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwautils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\pfUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_17090555521820.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\a\asdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\g\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\ServiceUninstaller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_ui.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup621.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to dropped file

Source: C:\Users\user\Desktop\ccsetup621.exe

API coverage: 4.4 %

Source: C:\Users\user\Desktop\ccsetup621.exe TID: 2804	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 1872	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 4796	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 4108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 3612	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 5532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 6836	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 7124	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe TID: 6608	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe TID: 6316	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\Desktop\ccsetup621.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup621.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Users\user\Desktop\ccsetup621.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\ccsetup621.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor

Source: C:\Users\user\Desktop\ccsetup621.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C2DE76 FindFirstFileExW,

15_2_69C2DE76

Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: ActionLauncher.exeShowVideoPadVideoEditorCleanSuspendedWarningvideopad.exeShowNoxplayerCleanSuspendedWarningShowEdgePreloadingWarningShowActionCleanSuspendedWarningShowOpenVPNConnectCleanSuspendedWarningOpenVPNConnect.exeShowPostboxCleanSuspendedWarningpostbox.exeNoxVMHandle.exeNoxVMSVC.exeMultiPlayerManager.exeNox.exeShowWallpaperEngineCleanSuspendedWarningui32.exeShowGoToMeetingCleanSuspendedWarningGoTo.exeShowTeraBoxCleanSuspendedWarningTeraBox.exeShowiTopPDFCleanSuspendedWarningiTopPDF.exeBox Edit.exeShowBoxDriveCleanSuspendedWarningBox.exeShowBlueJeansCleanSuspendedWarningShowIcecreamScreenRecorderCleanSuspendedWarningrecorder.exeShowBoxEditCleanSuspendedWarningBox Local Com Service.execalibre-parallel.exeShowVMwareHorizonClientCleanSuspendedWarningvmwetlm.exevmware-view.exeBlueJeans.exeShowBitCometCleanSuspendedWarningBitComet.exeShowCalibreCleanSuspendedWarningPlex HTPC.exeShowNextcloudDesktopClientCleanSuspendedWarningnextcloud.exeShowCyberLinkYouCam10CleanSuspendedWarninghorizon_client_service.exeShowVNCViewerCleanSuspendedWarningvncviewer.exeShowPlexHTPCCleanSuspendedWarningPlex Media Server.exeShowXmindCleanSuspendedWarningXmind.exeShowCutePDFCleanSuspendedWarningYouCamService10.exeYouCam10.exeShowPlexMediaServerCleanSuspendedWarningPlexScriptHost.exeCorel PaintShop Pro.exeShowGoogleDriveCleanSuspendedWarningShowCodeCompareCleanSuspendedWarningccsa.exeCutePDFE.exeShowGoodSyncCleanSuspendedWarningGoodSync.exeShowCorelPaintShopProCleanSuspendedWarningShowDouyinCleanSuspendedWarningDouyin.exeShowWebexCleanSuspendedWarningCiscoCollabHost.exeShowZoomCleanSuspendedWarningZoom.exeShoWYoutuPlayCleanSuspendedWarningYouTubePlayer.UWP.exeShowCapCutCleanSuspendedWarningparfait_crash_handler.exeCapCut.exeShowDrawboardPDFCleanSuspendedWarningShowMessengerCleanSuspendedWarningMessenger.exeShowWPSOfficeCleanSuspendedWarningwps.exeClipchamp.exeShowRessoCleanSuspendedWarningresso.exeShowRealPlayerCleanSuspendedWarningDb.App.exeShowLineCleanSuspendedWarningLINE.exeShowClipchampCleanSuspendedWarningShowTeamsCleanSuspendedWarningTeams.exeShowiCloudCleanSuspendedWarningrealplay.exeShowSkypeCleanSuspendedWarningShowOneDriveCleanSuspendedWarningAPSDaemon.exeAppleIEDAV.exeApplePhotoStreams.exeiCloudFirefox.exeiCloud.exeAppleMobileDeviceProcess.exeAppleFirefoxHost.exesecd.exeiCloudCKKS.exeiCloudPrefs.exeShowMicrosoftStickyNotesCleanSuspendedWarningMicrosoft.Notes.exeiCloudDrive.exeiCloudPhotos.exeiCloudIE.exeiCloudServices.exeShowAdobeAcrobatReaderCleanSuspendedWarningAcrobat.exeShowTelegramCleanSuspendedWarningTelegram.exeShowMicrosoftPhotosCleanSuspendedWarningMicrosoft.Photos.exeShowDiscordCleanSuspendedWarningDiscord.exeShowItunesCleanSuspendedWarningShowAmazonMusicCleanSuspendedWarningShowDolbyAccessCleanSuspendedWarningDolbyAccess.exeShowMicrosoftToDoCleanSuspendedWarningShowWhatsAppCleanSuspendedWarningShowSpotifyCleanSuspendedWarningShowOutlookCleanSuspendedWarningShowWindowsExplorerCleanWarningShowAVGBrowserCleanSuspendedWarningShowAmazonPrimeCleanSusp
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: Application Started/cleanie/export/ccinfo/ccupdate/scanreg/options/monitoring/advanced/scheduling/unregister/sysrestore(/[s\|S][y\|Y][s\|S][r\|R][e\|E][s\|S][t\|T][o\|O][r\|R][e\|E] +{[0-9]+}) /[l\|L][i\|I][s\|S][t\|T] +"?{[^"]+})/createskipuac/register( [n\|N][a\|A][m\|M][e\|E]=+?"{[^"]+})( [k\|K][e\|E][y\|Y]=+?"{[^"]+})PiriformRegistrationNumOfUpToDateDriversNumOfIssueDetectedDriverson/restoreccb/restoreccb/du/issuesSmartCleanSmartClean:JunkAlertsSmartClean:BrowserAlertsSkipUACoffActivationUpdateNotificationsAutoUpdatescc6 researchcc6 research - DetectionLikelyVirtualMachineccleaner startup eventIsAdminIsElevatedwebview2 :: DetectionGamerScoreVersion/AUTOJL/CLEANER/REGISTRYmonitoringgui openStartupGamerScoreShowTrialDiscountOffer3.19.3.18.1708CCInfo.txt/TOOLS/OPTIONSuninst.exeUninstall.lnkCCREGISTERED={}
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey4=%LocalAppData%\VMware\|*.log
Source: CCleaner64.exe, 00000012.00000002.1799081585.0000027DEFA57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey6=%LocalAppData%\Temp\|VMware_Horizon_Client*.log
Source: ccsetup621.exe, 0000000F.00000002.1908739232.00000000040BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvpci.inf,%vpci.SVCDESC%;Microsoft Hyper-V Virtual PCI BusK
Source: ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E20000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1427569539.0000000003E52000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1F7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VMware Horizon Client]
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Horizon View Client
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey6=%ProgramFiles%\VMware\VMware Workstation\ico\|*.ico
Source: ccsetup621.exe, 0000000F.00000003.1444357286.0000000003EBF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1908739232.00000000040BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvmgid.inf,%VmGid.SVCDESC%;Microsoft Hyper-V Guest Infrastructure Driver
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: Piriform::CrashSupport::CreateConfigFileCreate config.def file under with [common] values from ShepherdException occured when creating config.def file --send dumps\|report --path " --programpath " --guid "Piriform::CrashSupport::ReadConfigFileGet crash config from config.def fileException while checking if config folder exists--product 90Piriform::CrashSupport::UpdateCrashReportingTaskStatusCrash Reporting scheduled task enableddisabled --version " --silentPiriform::CrashSupport::CrashReportParameters\CCleanerBugReport.exe crash reporting scheduled task - error when loading Add crash reporting scheduled task which runs dailyFailed to enabled disabled crash reporting scheduled task - error when saving: F9FD4EDF-1129-4DBC-9A8C-9EE7271FBE7EA435FAA9-2311-4E23-B944-096D54E9DB31CApplication::~CApplicationApplication Ended4141FCD7-B506-4916-8EC4-D38E4373F47AF16A9578-E0E4-4EA7-8FD7-E91C0061A9FD78E68749-DE5B-404A-9B44-7A5AEDED1CFC7F4CCD0B-B3BE-4FD2-9A26-A0299FDE418B/autorbRun CCleaner/autojlScriptingError typeBroken CountPrevious Count/monitor/autosc/autosc/auto/shutdown()/autojl/autos/autos/delete/method/method %d/delete/shutdown/auto/restart/restart/clean/analyze/analyze/frb/method/update/update/cleanVirtual MachineMicrosoft CorporationCloud PC EnterpriseGoogle Compute EngineOpen CCleanerSYSTEM\CurrentControlSet\Control\SystemInformationVirtualBoxinnotek GmbHParallels Software International Inc.ParallelsQEMU Virtual MachineQEMUGoogleParallels ARM Virtual MachineParallels International GmbH.Parallels Virtual PlatformBaidu Cloud BCCBaidu CloudAmazon EC2VMware, Inc.Virtual serverCOOLHOUSING s.r.o.Alibaba Cloud ECSAlibaba CloudVirtuozzoVultrSystemManufacturerSystemProductNameTencent CloudUpCloudThinCloudQuanta Cloud Technology Inc./updatefailed/debugCApplication::ParseCommandlineArgumentsCCleaner Virtual PlatformVirtual Server/uac/updatesuccess/log/cleaner/registry/toolsUsername:
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey3=%ProgramData%\VMware\VDM\logs\|.
Source: ccsetup621.exe, 0000000F.00000002.1908739232.00000000040BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.inf,%GenCounter.SVCDESC%;Microsoft Hyper-V Generation Counter?
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey2=%ProgramData%\VMware\VDM\logs\|.
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VMware Player]
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Player
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: onBackToCCleaneronManageSubscriptiononActivateNewKeyisPreviousAvailableonLicenseKeyonPasteKeyonUserNameonAlphaUserInforequestactivateconfirmgetKeyboardLanguageCOptionsLicenseSciterCtrl::onPasteKeyCOptionsLicenseSciterCtrl: the license key couldn't be pasted - no key on the clipboardCompanyNameEmailEnablePasteSetLicenseKeySetUserNamesetManageLicenseContextStartWaitingStopWaitingfile://LicenseKeyActivation.htmfile://LicenseUserInfo.htmSurnametitlemessagetracknamelicenseKeylicenseTypedaysLeftexpiryDatefile://LicenseAlphaUserInfo.htmfile://LicenseRegistered.htmfile://ManageLicense.htmnameautoExtensionsubscriptionManagementdataUpdatedLicenseKey_ManageSubscriptionstatusSoftware\Microsoft\Internet Explorer\SettingsAnchor Color VisitedAnchor Colortooltips_class32</A>static<A>TahomaREQUEST_EVENTS_WINDOW_MESSAGE1COMBOBOXuntickOptions/PrivacyPrefsPrivacyShowOffers3rdPartyShowOffers3rdPartyPrefsPrivacyShowOffers1stPartyShowOffers1stPartytickHelp improve CCleanerenable new version notificationOptions/Updatesenable automatic updates/MONITORCCleaner Smart Cleaning%s%s%s%s%s%s%sPiriform_CCleaner_SystemTraySingleIconPiriform_CCleaner_SystemTrayMonitorIconActiveVMware Horizon ClientSoftware\Piriform\CCleanerTaskbarSetProgressStateTaskbarSetProgressValuebinarystringconfig.def()out_of_rangecommandprogramIDignoreError: Warning: Info: Trace: Setuptemp.defDumpReportingDebug: CCleaner::DbgLogger::Log[Named Pipes] Initialize Crash HandlerCreate LOG subfolderException while creating new directory[common]DataFolderProgramFolderPiriform::CrashSupport::InitializeCrashHandler[CrashSupport] Piriform::CrashSupport::UpdateConfigFileUpdate config.def file under Exception occured when reading a config file
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Workstation
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VMware Workstation]
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey4=%LocalAppData%\VMware\VDM\logs\|.
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey4=%LocalAppData%\Temp\vmware-\|.*
Source: ccsetup621.exe, 0000000F.00000003.1465334324.0000000006520000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ZeqHGFSQN=HME31
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey5=%LocalAppData%\Temp\vmware-\|.*
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey5=%ProgramFiles%\Common Files\VMware\InstallerCache\|.
Source: ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: [pythonjava se development kitxamarinwinscpmicrosoft azuremicrosoft r clientbkchemcronosvisual c++ for mobile developmentmysql connector c++microsoft visual c++ build toolsdev-c++cmaketrafico de faunamm7270gnu privacy guarde-readerkokoriginga.arlabcamforcepadkhi3maximamicrosoft emulatorgapminderavidemuxscilabversion imagensongsmithmodellusfusioninventorypilas-enginealice applicationeqtablajetbrainsgit versionmysqlprerequisites for ssdtnode.jsandroid studiowinpcapunityxamppatomblenderarduinonetbeansgithubsourcetreeslackoraclevagrantxmingsdkapache tomcatglassfishsublime texttortoisesvn*iis expressiis express application compatibility databasemicrosoft sql server management studiovmwaremicrosoft system clr types for sql server*microsoft .net framework multi-targeting pack*microsoft sql server management objectswindows software development kitnotepad++*microsoft sql server transact-sql scriptdom*microsoft sql server express localdb*microsoft visual studio shell**intel
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile2=%ProgramFiles%\VMware\VMware Workstation
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey3=%LocalAppData%\Temp\vmware-\|.*
Source: ccsetup621.exe, 0000000F.00000002.1908739232.00000000040BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @virtdisk.inf,%service_desc%;Microsoft Hyper-V VHDPMEM BTT Filterd
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: LikelyVirtualMachine
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: python%02d%d%dxamarinjava se development kitmicrosoft azurewinscpbkchemmicrosoft r clientvisual c++ for mobile developmentcronosxamppunityblenderatomnetbeansarduinosourcetreegithuboracleslackxmingvagrantapache tomcatsdksublime textglassfishscilabavidemuxsongsmithversion imagenfusioninventorymodellusalice applicationpilas-enginejetbrainseqtablamysqlgit versionnode.jsprerequisites for ssdtwinpcapandroid studioSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallpgadminmqsmpfvulvsoActivateTimeSOFTWARE\McAfee\MSCSOFTWARE\McAfee\MSC\AppInfo\SubstituteInstallTStmpbuildLDbuildSOFTWARE\McAfee\MSC\AppInfo\Substitute\QueryParamsaffidculturercodeiis * expresstortoisesvnmicrosoft sql server management studioiis express application compatibility databasemicrosoft system clr types for sql servervmwaremicrosoft sql server * management objects*microsoft .net framework multi-targeting packnotepad++windows software development kit*microsoft sql server express localdb*microsoft sql server transact-sql scriptdom**intel
Source: CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: VMware Horizon Client
Source: ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon Client>""o
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey1=%ProgramData%\VMware\logs\|.
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Player
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey3=%ProgramData%\VMware\vmwetlm\logs\|.
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation
Source: ccsetup621.exe, 0000000F.00000002.1908739232.00000000040BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wstorflt.inf,%service_desc%;Microsoft Hyper-V Storage Accelerator
Source: ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileKey2=%Program Files%\VMware\VMware Player\ico\|.

Source: C:\Users\user\Desktop\ccsetup621.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C200EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_69C200EE

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C29FC7 mov eax, dword ptr fs:[00000030h]	15_2_69C29FC7
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C2A00B mov eax, dword ptr fs:[00000030h]	15_2_69C2A00B
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C25780 mov eax, dword ptr fs:[00000030h]	15_2_69C25780

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C2EF90 GetProcessHeap,

15_2_69C2EF90

Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C200EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_69C200EE
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C1849C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_69C1849C
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: 15_2_69C18699 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_69C18699

Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe "C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a
Source: C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe	Process created: C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:a08dcfa1-7b47-48ad-af19-cdaa4e470b06 /edat_dir:C:\Windows\Temp\asw.d2a83021bf4cad31

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C187BC cpuid

15_2_69C187BC

Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_69C3099F
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_69C30DC0
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: EnumSystemLocalesW,	15_2_69C30D2D
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: EnumSystemLocalesW,	15_2_69C30C92
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoW,	15_2_69C29C96
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: EnumSystemLocalesW,	15_2_69C30C47
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_69C31146
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoW,	15_2_69C31020
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_69C3131B
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoW,	15_2_69C3124C
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: GetLocaleInfoEx,	15_2_69C1727C
Source: C:\Users\user\Desktop\ccsetup621.exe	Code function: EnumSystemLocalesW,	15_2_69C296DD

Source: C:\Users\user\Desktop\ccsetup621.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\CC_logo_72x66.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\CC_Logo_40x96.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\PF_computer.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup621.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C189E5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

15_2_69C189E5

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_69C2D87E _free,GetTimeZoneInformation,_free,

15_2_69C2D87E

Source: C:\Users\user\Desktop\ccsetup621.exe

Code function: 15_2_6BC8CFD0 GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,

15_2_6BC8CFD0

Source: C:\Users\user\Desktop\ccsetup621.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables Windows system restore

Source: C:\Program Files\CCleaner\CCleaner64.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore SystemRestorePointCreationFrequency

Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVKService.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: ccsetup621.exe, 0000000F.00000003.1843064351.0000000004096000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1841988763.0000000004096000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cfp.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVKTray.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVKProxy.exe
Source: ccsetup621.exe, 0000000F.00000002.2054852495.000000006B9E1000.00000002.00000001.01000000.0000000D.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\Malwarebytes' Anti-Malware\mbam.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a2service.exe
Source: ccsetup621.exe, 0000000F.00000003.1805706462.0000000004009000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1829815672.000000000400B000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1824863218.0000000004009000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: guardxservice.exe
Source: ccsetup621.exe, 0000000F.00000003.1833225153.0000000003F6E000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826964498.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1841446710.0000000003F70000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1835801851.0000000003F70000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1843618142.0000000003F74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: ccsetup621.exe, 0000000F.00000003.1841563144.000000000401D000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1824863218.000000000401D000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.000000000401D000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1825245839.000000000401D000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1907121648.000000000401E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: acs.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avguard.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dwservice.exe
Source: ccsetup621.exe, 0000000F.00000003.1843064351.0000000004096000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1907961475.0000000004097000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1838733562.0000000004097000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1841988763.0000000004096000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1840840055.0000000004097000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1832928204.0000000004097000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClamTray.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a2guard.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360Tray.exe
Source: ccsetup621.exe, 0000000F.00000002.2054852495.000000006B9E1000.00000002.00000001.01000000.0000000D.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DetectFile2=%ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FPAVServer.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AYAgent.aye
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FProtTray.exe
Source: ccsetup621.exe, 0000000F.00000002.1907328073.0000000004040000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1830123223.0000000004033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClamWin.exe
Source: ccsetup621.exe, 0000000F.00000003.1844367744.0000000003F9C000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1826559220.0000000003F9A000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1805706462.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: op_mon.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite-wal
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\webappsstore.sqlite-shm
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\webappsstore.sqlite-wal
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000002.dbtmp
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\webappsstore.sqlite
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite-shm
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Inhibit System Recovery
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	22 Windows Service	22 Windows Service	2 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	11 Process Injection	1 DLL Side-Loading	Security Account Manager	66 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	11 Registry Run Keys / Startup Folder	2 Scheduled Task/Job	23 Masquerading	NTDS	171 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	11 Registry Run Keys / Startup Folder	15 Virtualization/Sandbox Evasion	LSA Secrets	15 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bootkit	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Program Files\CCleaner\CCUpdate.exe	0%	ReversingLabs
C:\Program Files\CCleaner\CCleaner.exe	0%	ReversingLabs
C:\Program Files\CCleaner\CCleaner64.exe	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerBugReport.exe	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerDU.dll	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerReactivator.dll	0%	ReversingLabs
C:\Program Files\CCleaner\CCleanerReactivator.exe	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1025.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1026.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1027.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1028.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1029.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1030.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1031.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1032.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1034.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1035.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1036.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1037.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1038.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1040.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1041.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1042.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1043.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1044.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1045.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1046.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1048.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1049.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1050.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1051.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1052.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1053.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1054.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1055.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1056.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1057.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1058.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1059.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1060.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1061.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1062.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1063.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1065.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1066.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1067.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1068.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1071.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1079.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1081.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1086.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1087.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1090.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1092.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1093.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1102.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1104.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1109.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1110.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-1155.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-2052.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-2070.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-2074.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-3098.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-5146.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Lang\lang-9999.dll	0%	ReversingLabs
C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll	0%	ReversingLabs
C:\Program Files\CCleaner\gcapi_17090555521820.dll (copy)	0%	ReversingLabs
C:\Program Files\CCleaner\gcapi_17090555793612.dll (copy)	0%	ReversingLabs
C:\Program Files\CCleaner\gcapi_dll.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwaapi.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwaheap.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwalocal.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwaresource.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwautils.dll	0%	ReversingLabs
C:\Program Files\CCleaner\libwavmodapi.dll	0%	ReversingLabs
C:\Program Files\CCleaner\uninst.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	URL Reputation	safe
http://www.avast.com0/	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	URL Reputation	safe
about:blank	0%	Avira URL Cloud	safe
http://%s:%d;https=https://%s:%dHTTP/1.0%u.%u.%u.%u01234567890123456789abcdef0123456789ABCDEFCONOUT$	0%	Avira URL Cloud	safe
http://p%03d.sb.avast.com/V1/MD/Protocol.Write()	0%	Avira URL Cloud	safe
https://openid.avast.comdler;EB	0%	Avira URL Cloud	safe
https://vc.hotjar.io/sessions/857043?s=0.25&r=0.21376483259072088	0%	Avira URL Cloud	safe
https://openid.avg.comhttps://openid.avast.comaswProperty.dllavcfg://settings/Shepherd/ABTestsSOFTWA	0%	Avira URL Cloud	safe
http://p%03d.sb.avast.com/V1/PD/avast_streambacksubmit_%03d://http://p%03d.sb.avast.com/V1/MD/https:	0%	Avira URL Cloud	safe
https://openid-stage.avg.comhttps://openid-stage.avast.comalpha-crap-stage.ff.avast.comalpha-iqs-sta	0%	Avira URL Cloud	safe
https://softwareupdatechecker.live-everest-media.net/api/v1/ProgramDefinitions/api/v1/ScanResultshtt	0%	Avira URL Cloud	safe
http://www.zkysky.com.ar/This	0%	Avira URL Cloud	safe
http://www.avast.com0	0%	Avira URL Cloud	safe
https://softwareupdatechecker.staging-everest-media.netUsing	0%	Avira URL Cloud	safe
https://posttestserver.com/test_channel_utf8://http://posttestserver.com/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vc-live-cf.hotjar.io	99.86.229.20	true	false	unknown
privacyportal-de.onetrust.com	172.64.155.119	true	false	high
ip-info-gcp.ff.avast.com	34.149.149.62	true	false	high
dev.visualwebsiteoptimizer.com	34.96.102.137	true	false	high
platform.twitter.map.fastly.net	146.75.28.157	true	false	unknown
stats.g.doubleclick.net	172.253.122.156	true	false	high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	44.209.16.161	true	false	high
scontent.xx.fbcdn.net	31.13.66.19	true	false	high
idsync.rlcdn.com	35.244.154.8	true	false	high
t.co	104.244.42.5	true	false	high
script.hotjar.com	99.84.191.43	true	false	high
peso-1422535133.eu-west-1.elb.amazonaws.com	52.30.38.148	true	false	high
norton.com.ssl.sc.omtrdc.net	63.140.39.65	true	false	unknown
www.google.com	142.251.163.103	true	false	high
static-cdn.hotjar.com	52.85.132.5	true	false	high
mstatic.ccleaner.com	20.50.2.53	true	false	high
star-mini.c10r.facebook.com	157.240.229.35	true	false	high
ipm-gcp-prod.ff.avast.com	34.111.24.1	true	false	high
nydc1.outbrain.org	64.202.112.191	true	false	unknown
s.twitter.com	104.244.42.131	true	false	high
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	35.167.214.190	true	false	high
analytics-prod-gcp.ff.avast.com	34.117.223.223	true	false	high
shepherd-gcp.ff.avast.com	34.160.176.28	true	false	high
dcjdc5qmbbux7.cloudfront.net	52.85.132.82	true	false	high
cdn.cookielaw.org	104.18.131.236	true	false	high
geolocation.onetrust.com	104.18.32.137	true	false	high
edge.gycpi.b.yahoodns.net	69.147.92.11	true	false	unknown
static.ads-twitter.com	unknown	unknown	false	unknown
amplify.outbrain.com	unknown	unknown	false	high
bits.avcdn.net	unknown	unknown	false	high
license.piriform.com	unknown	unknown	false	high
emupdate.avcdn.net	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
license-api.ccleaner.com	unknown	unknown	false	high
ipm-provider.ff.avast.com	unknown	unknown	false	high
v7event.stats.avast.com	unknown	unknown	false	high
wave.outbrain.com	unknown	unknown	false	high
static.hotjar.com	unknown	unknown	false	high
oms.norton.com	unknown	unknown	false	high
c5.adalyser.com	unknown	unknown	false	high
honzik.avcdn.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
ipmcdn.avast.com	unknown	unknown	false	high
symantec.demdex.net	unknown	unknown	false	high
s.yimg.com	unknown	unknown	false	high
service.piriform.com	unknown	unknown	false	high
www.mczbf.com	unknown	unknown	false	unknown
shepherd.ff.avast.com	unknown	unknown	false	high
cdn-production.ccleaner.com	unknown	unknown	false	high
vc.hotjar.io	unknown	unknown	false	unknown
www.nortonlifelock.com	unknown	unknown	false	unknown
analytics.avcdn.net	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
s1.pir.fm	unknown	unknown	false	unknown
analytics.ff.avast.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
s7.addthis.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
ncc.avast.com	unknown	unknown	false	high
cdn-uat.ccleaner.com	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
ccleaner.tools.avcdn.net	unknown	unknown	false	high
www.ccleaner.com	unknown	unknown	false	high
ip-info.ff.avast.com	unknown	unknown	false	high
tr.outbrain.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://symantec.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fwww.ccleaner.com	false		high
about:blank	false	Avira URL Cloud: safe	low
https://cdn.cookielaw.org/scripttemplates/6.36.0/assets/v2/otPcCenter.json	false		high
https://vc.hotjar.io/sessions/857043?s=0.25&r=0.21376483259072088	false	Avira URL Cloud: safe	unknown
https://c5.adalyser.com/adalyser.js?cid=ccleaner	false		high
https://connect.facebook.net/signals/config/2679475345708101?v=2.9.147&r=stable&domain=www.ccleaner.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&gjid=91779804&_gid=1089165544.1709055527&_u=aCDAAEABAAAAAGAEK~&z=1791724118	false		high
https://tr.outbrain.com/cachedClickId?marketerId=001ac0827d67b7b38319c9517e7fa2f4cc	false		high
https://static.hotjar.com/c/hotjar-857043.js?sv=6	false		high
https://cdn.cookielaw.org/scripttemplates/6.36.0/assets/otCommonStyles.css	false		high
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&_u=aCDAAEABAAAAAGAEK~&z=930998961	false		high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high
https://ip-info.ff.avast.com/v2/info	false		high
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&_u=YCDAgEABAAAAAGAEK~&z=1906304434	false		high
https://shepherd.ff.avast.com/?p_vep=6&p_ves=21&p_vbd=10918&p_lit=0&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_pro=90&p_osv=10.0&p_gksw=0&p_lng=en&p_lid=en-us	false		high
https://s.yimg.com/wi/ytc.js	false		high
https://script.hotjar.com/modules.edfa88fa094af2bba7f9.js	false		high
https://analytics.avcdn.net/receive3	false		high
https://idsync.rlcdn.com/711037.gif?partner_uid=82ab0b25-a8ef-4fef-8435-1de230d584d8	false		high
https://ip-info.ff.avast.com/v1/info	false		high
https://dev.visualwebsiteoptimizer.com/j.php?a=176159&u=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&r=0.19947545942317246	false		high
https://t.co/i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29	false		high
https://ipm-provider.ff.avast.com/?action=1&p_elm=260&p_lng=en&p_lid=en-us&p_geo=US&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_b8b_m&p_dols=0&p_pro=90&p_vep=6&p_ves=21&p_vbd=10918&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_avt=cc-pro-trial&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240227	false		high
https://mstatic.ccleaner.com/api/mhubc.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ccleaner.com/go/app_cc_get_update1033Mozilla/4.0https://license.piriform.com/update%d.%d	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://honzik.avcdn.net/setup/avira-tu/release/avira_tuneup_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://ccleaner.com/go/app_cc_license_agreement	CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/norton-av/beta/norton_free_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://license.piriform.com/update1033lMozilla/4.0lkocvmkAutoUpdateEventsMarshallertdisplayNamepath	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://honzik.avcdn.net/setup/norton-tu/beta/norton_tuneup_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingaotak	ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	ccsetup621.exe, 0000000F.00000003.1495990001.00000000063C8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s-trackoff.avcdn.net/trackoff/8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850fa	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://install.avcdn.net/avg/iavs9x/avg_internet_security_setup.exeASWSig2A123D026AE3BEAC0AC7D4DC35	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0UserWdtH	ccsetup621.exe, 0000000F.00000002.1898522931.0000000003E38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.avira.com/download/opswat-sdk-database/asw::su_controller::ControllerConfiguration:	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exeASWSig2A06FCDABA5742BE662	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/avira-bg/beta/avira_breach_guard_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://honzik.avcdn.net/setup/avast-tu/release/avast_cleanup_online_setup.exeASWSig2A4C1A1197A19B18F	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://files.avast.com/beta9x/avast_free_antivirus_setup_online.exeASWSig2A5549FF2866EA44F68D28FB2B1	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://s-trackoff.avcdn.net/avg/trackoff/7854df286ff1c4e1f4d81d466f4a1b0243b39837ac99c5b98817907f76	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://install.avcdn.net/beta9x/avast_pro_antivirus_setup_online.exeASWSig2A579D90FED0C6441EE7B258F	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://honzik.avcdn.net/setup/norton-tu/release/norton_tuneup_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0	ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1902417072.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000049D000.00000004.00000001.01000000.00000006.sdmp	false		high
https://www.ccleaner.com/go/app_cc_help_preloading	CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false		high
https://ccleaner.com/go/app_cc_privacy_data_factsheet	CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false		high
https://ipm-provider.ff.avast.com/?p_elm=76&action=1&p_age=0&p_bau=0&p_bsls=0&p_chcc=2&p_chr=0&p_dvt	ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1452876859.0000000003EA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/setup/avast-bs/beta/avast_battery_saver_online_setup.exeASWSig2A3A3BE3789E6	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLCopyright	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeASWSig2A2457920CE	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.ccleaner.com/ccleaner	ccsetup621.exe, 0000000F.00000003.1621886165.0000000006B20000.00000004.00000800.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ccleaner.com/inapp/notificationsContent-Type:	ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.zkysky.com.ar/This	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://honzik.avcdn.net/setup/norton-av/beta/norton_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://service.piriform.com/installcheck.aspx5.70.7909PrefsPrivacyShareData1stParty	ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingrms	ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exeASWSig2A072492C0	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/avira-du/release/avira_driver_updater_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.ccleaner.com/go/app_privacy?p=1&l=	ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shepherd.ff.avast.com/Mozilla/4.0	ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://keys.backup.norton.com	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://akbr-api.avast.com/activation?https://akbr-api.avast.com/acquisition?avast_activationcodenoc	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://analytics.avcdn.net:443/receive3	CCleaner64.exe, 00000012.00000002.1810182711.0000027DF1F33000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000002.1812786749.0000027DF1F84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.avast.com0/	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp, CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false	URL Reputation: safe	unknown
https://honzik.avcdn.net/setup/norton-bg/beta/norton_breach_guard_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.ccleaner.com/inapp/notificationsCCleaner	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://analytics.avcdn.net/TIno	ccsetup621.exe, 0000000F.00000003.1445576669.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1427707615.0000000000A00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/setup/avira-av/beta/avira_internet_security_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://p%03d.sb.avast.com/V1/PD/avast_streambacksubmit_%03d://http://p%03d.sb.avast.com/V1/MD/https:	ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	low
https://shepherd.ff.avast.com/	ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003EE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://p%03d.sb.avast.com/V1/MD/Protocol.Write()	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	low
http://%s:%d;https=https://%s:%dHTTP/1.0%u.%u.%u.%u01234567890123456789abcdef0123456789ABCDEFCONOUT$	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	low
http://www.avast.com0	ccsetup621.exe, 0000000F.00000002.1846883755.000000000041E000.00000004.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ccleaner.com/go/app_license?p=1&l=	ccsetup621.exe, 0000000F.00000002.1849860964.000000000096C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://install.avcdn.net/iavs9x/avast_free_antivirus_setup_online.exeASWSig2A2EC0971AB07DE15C30023C	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exeASWSig2A14AA13983E189	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
http://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exeASWSig2A7E478FFFFFA84	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://brain.jumpshot.com/dropbox/tagjumpshot_dropboxtag://https://brain.jumpshot.com/dropbox/reque	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://license.piriform.com/product/v1/installcheck?p=1&v=6.21.10918&vx=&l=1033&b=1&o=10W6&g=0&i=1&	ccsetup621.exe, 0000000F.00000003.1562981054.00000000063EF000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623439928.00000000063E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://honzik.avcdn.net/setup/avira-av/release/avira_prime_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://service.piriform.com/	ccsetup621.exe, 0000000F.00000003.1821327346.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1623706502.0000000003EE8000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1563153567.0000000003F14000.00000004.00000020.00020000.00000000.sdmp	false		high
https://analytics.avcdn.net/receive322	ccsetup621.exe, 0000000F.00000003.1427569539.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ccleaner.com/go/app_cc_privacy_product_policy	CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=wsb	ccsetup621.exe, 0000000F.00000003.1495932825.00000000063C6000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000003.1501145740.0000000007AE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ccleaner.com/go/app_cc_acknowledgements	CCleaner64.exe, 00000012.00000000.1665552112.00007FF6E41C8000.00000002.00000001.01000000.00000018.sdmp	false		high
https://openid.avg.comhttps://openid.avast.comaswProperty.dllavcfg://settings/Shepherd/ABTestsSOFTWA	ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://openid.avast.comdler;EB	CCleaner64.exe, 00000012.00000003.1787976082.0000027DF193D000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1793896965.0000027DF1940000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1723577996.0000027DF1920000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000012.00000003.1737497348.0000027DF193D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://softwareupdatechecker.live-everest-media.net/api/v1/ProgramDefinitions/api/v1/ScanResultshtt	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://honzik.avcdn.net/setup/avast-tu/beta/avast_cleanup_online_setup.exeASWSig2A1E3DD1C1B204ED89FD	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/norton-du/release/norton_driver_updater_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_FREE/platform_WIN/installertype_ONLINE/b	CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/norton-bg/release/norton_breach_guard_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://honzik.avcdn.net/setup/norton-vpn/release/norton_vpn_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://openid-stage.avg.comhttps://openid-stage.avast.comalpha-crap-stage.ff.avast.comalpha-iqs-sta	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://posttestserver.com/test_channel_utf8://http://posttestserver.com/a	ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://install.avcdn.net/iavs9x/avast_pro_antivirus_setup_online.exeASWSig2A03A4D7B0044FDD707267F64	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://softwareupdatechecker.staging-everest-media.netUsing	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://honzik.avcdn.net/setup/avira-tu/beta/avira_tuneup_online_setup.exe-TODO	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://install.avcdn.net/avg/beta9x/avg_internet_security_setup.exeASWSig2A7D77EF27F362060AF957E761	ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, ccsetup621.exe, 0000000F.00000002.2231413911.000000006C894000.00000002.00000001.01000000.0000000A.sdmp, ccsetup621.exe, 0000000F.00000002.2009737249.000000006B3A7000.00000002.00000001.01000000.0000000D.sdmp, CCleaner64.exe, 00000012.00000000.1652483706.00007FF6E3481000.00000002.00000001.01000000.00000018.sdmp	false		high
https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build	ccsetup621.exe, ccsetup621.exe, 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmp, ccsetup621.exe, 0000000F.00000002.1855298227.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.111.24.1	ipm-gcp-prod.ff.avast.com	United States	15169	GOOGLEUS	false
44.209.16.161	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.251.163.106	unknown	United States	15169	GOOGLEUS	false
52.30.38.148	peso-1422535133.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
146.75.28.157	platform.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
34.149.149.62	ip-info-gcp.ff.avast.com	United States	2686	ATGS-MMD-ASUS	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
142.251.163.103	www.google.com	United States	15169	GOOGLEUS	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
35.167.214.190	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
54.164.110.171	unknown	United States	14618	AMAZON-AESUS	false
63.140.38.236	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
52.85.132.5	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
31.13.66.19	scontent.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
104.244.42.131	s.twitter.com	United States	13414	TWITTERUS	false
157.240.229.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
69.147.92.12	unknown	United States	14777	INKTOMI-LAWSONUS	false
69.147.92.11	edge.gycpi.b.yahoodns.net	United States	14777	INKTOMI-LAWSONUS	false
172.253.122.103	unknown	United States	15169	GOOGLEUS	false
172.64.155.119	privacyportal-de.onetrust.com	United States	13335	CLOUDFLARENETUS	false
63.140.39.65	norton.com.ssl.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.85.132.82	dcjdc5qmbbux7.cloudfront.net	United States	16509	AMAZON-02US	false
20.50.2.53	mstatic.ccleaner.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.122.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.131.236	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
64.202.112.191	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
99.86.229.20	vc-live-cf.hotjar.io	United States	16509	AMAZON-02US	false
34.96.102.137	dev.visualwebsiteoptimizer.com	United States	15169	GOOGLEUS	false
31.13.66.35	unknown	Ireland	32934	FACEBOOKUS	false
104.244.42.67	unknown	United States	13414	TWITTERUS	false
34.160.176.28	shepherd-gcp.ff.avast.com	United States	2686	ATGS-MMD-ASUS	false
104.244.42.5	t.co	United States	13414	TWITTERUS	false
34.117.223.223	analytics-prod-gcp.ff.avast.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
99.84.191.43	script.hotjar.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1399806
Start date and time:	2024-02-27 18:37:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ccsetup621.zip
Detection:	MAL
Classification:	mal60.spyw.evad.winZIP@37/428@138/36
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 7 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.73.228.150, 23.62.230.141, 23.62.230.133, 23.62.230.155, 23.62.230.167, 23.62.230.166, 23.62.230.156, 172.253.122.100, 172.253.122.138, 172.253.122.101, 172.253.122.139, 172.253.122.113, 172.253.122.102, 172.253.115.94, 172.253.62.84, 142.251.167.139, 142.251.167.100, 142.251.167.102, 142.251.167.113, 142.251.167.138, 142.251.167.101, 23.202.154.28, 34.104.35.123, 23.48.104.108, 23.48.104.101, 172.253.62.95, 142.251.167.94, 23.221.241.54, 23.203.177.63, 172.253.63.97, 23.202.152.165, 142.251.167.95, 142.251.163.95, 142.251.111.95, 142.250.31.95, 172.253.122.95, 172.253.63.95, 142.251.16.95, 172.253.115.95, 142.251.179.95, 3.230.212.157, 54.89.1.26, 34.194.137.70, 3.225.109.163, 54.198.147.24, 44.199.56.150, 23.12.145.29, 23.12.145.36, 23.12.145.21, 23.12.145.26, 23.12.145.23, 23.12.145.9, 23.221.241.188, 13.107.42.14, 204.79.197.200, 13.107.21.200, 23.207.202.54, 23.207.202.77, 104.102.130.187, 172.253.115.97, 104.102.130.149, 23.222.201.117
Excluded domains from analysis (whitelisted): license.piriform.com-v2.edgekey.net, slscr.update.microsoft.com, cn-assets.adobedtm.com.edgekey.net, clientservices.googleapis.com, service.piriform.com-v1.edgekey.net, e4682.dscd.akamaiedge.net, l-0005.l-msedge.net, clients2.google.com, ipmcdn.avast.com.edgekey.net, login.live.com, emupdate.avcdn.net.edgesuite.net, www.gstatic.com, e13363.dsca.akamaiedge.net, www.google-analytics.com, www.bing.com, tools.avcdn.net.edgesuite.net, www.ccleaner.com.edgekey.net, fonts.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, dual-a-0001.a-msedge.net, cm.everesttech.net.akadns.net, e4016.a.akamaiedge.net, www.nortonlifelock.com.edgekey.net, od.linkedin.edgesuite.net, wildcard.outbrain.com.edgekey.net, e13223.dscd.akamaiedge.net, s1.pir.fm.edgekey.net, edgedl.me.gvt1.com, e10883.g.akamaiedge.net, clients.l.google.com, a1916.dscg2.akamai.net, cdn-uat.ccleaner.com.edgekey.net, www.googletagmanager.com, e4117.dsca.akamaiedge.net, bat.bing.com, www-linkedin-com.l-
Execution Graph export aborted for target CCleaner.exe, PID 6272 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ccsetup621.zip

Simulations

Behavior and APIs

Time	Type	Description
18:38:09	API Interceptor	4x Sleep call for process: ccsetup621.exe modified
18:38:36	API Interceptor	9x Sleep call for process: CCUpdate.exe modified
18:38:37	API Interceptor	609x Sleep call for process: CCleaner64.exe modified
18:39:19	API Interceptor	2x Sleep call for process: Microstub.exe modified
18:39:26	API Interceptor	7x Sleep call for process: avg_antivirus_free_online_setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
44.209.16.161	qDpEAnF5Ju.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2facrobat.adobe.com%2fid%2furn%3aaaid%3asc%3aVA6C2%3a2a138187%2d69c4%2d4ab4%2d842d%2dee0003585bc9&umid=48a0bf19-c23f-4ede-a21a-c8110fd2ff5e&auth=3396b606d81544f1fa36c033f23b9c9aa919296a-56125daf7e96fa7cc3eab78dc35383db072b630f	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.TScope.Malware-Cryptor.SB.26060.13321.exe	Get hash	malicious	RisePro Stealer	Browse
	http://p2.194-48-251-67.cprapid.com/	Get hash	malicious	HTMLPhisher	Browse
104.18.32.137	https://mydhl-delivery.github.io/express/#rnpc.certidaopermanente@dgrn.mj.pt	Get hash	malicious	Unknown	Browse
	https://today-currently-24-2-1024.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vTda2JGwTXDX-9lU0dkRQadVH1Hh5wZPEJEc8FAXb89CPaMha4gCMlAcqE-Thy-CFb2KIl2zDn9jxfX/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse
	https://new-currently-2-22-2024.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://att-yahoo-mail-109335-106163.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://pub-dbce98adcacd4e49a4cb64cc36d27ee5.r2.dev/login.htm	Get hash	malicious	Unknown	Browse
	https://www.canva.com/design/DAF8Uvq-1MA/-6vkRHXp8bl9cSmhMgAWZA/view?utm_content=DAF8Uvq-1MA&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	https://helpdesk-outlookwmail-7818d396f2473b0.netlify.app/owa	Get hash	malicious	Unknown	Browse
	https://pksgsda.weeblysite.com/	Get hash	malicious	Unknown	Browse
	aol.com).eml	Get hash	malicious	Unknown	Browse
146.75.28.157	https://www.ungrbly.cn/	Get hash	malicious	Unknown	Browse
	https://www.qiodwbu.cn/	Get hash	malicious	Unknown	Browse
	https://www.jfqxpnk.cn/	Get hash	malicious	Unknown	Browse
	https://usps-chentya.165-227-15-167.cprapid.com/	Get hash	malicious	Unknown	Browse
	https://recpointuser.myftp.org/home/	Get hash	malicious	Unknown	Browse
	http://patsnap.com	Get hash	malicious	Unknown	Browse
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse
	https://www.gnno-aozora4.cyou/ibg/client/index.php	Get hash	malicious	Unknown	Browse
	https://www.gnno-aozora5.cyou/ibg/client/index.php	Get hash	malicious	Unknown	Browse
35.167.214.190	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	http://email.technologycurrent.co/c/eJxsyrmypCAYQOGn0ZBikS0wmKmufo1biL9LN7iwqPD0Uzef6ATnG3uuAUvBW-iJxEpSRjlvl56QcaDcWD5KI0FrorVlHVfUTB3DI7RrTzHtMKWMEoo5RwQRLd-KS4nli_1lSjcdTmCXbXf7XGwOAbaE7N66fknpaNifhr4b-k7B2C_6n_z97P0k17CXmAjjklfFYGZf1Qn4uM2LUIiY84ZLXnLNzPKH7ZvGH5l2OMPm64yP232JiNNnr3FYyHOtoR7LYUwJ-KNGO2ttYb3v8r2dA3kcKRWcKCyqwGMvDDpynK3D86U8ucgJB3Q2P-dAOKXjFAB83gwh1blHHnYxQt9ZnuxmfnRHtVcnl3yz6RE6miI8Jn7Tihd5NlTAujTs5fOToCjqGK5zkdGd6rlY9J95qM761FDx8xOTPxr2inq4zNT6XihOueKyDX0Ka1yQ3fcDQtNhA3FH1rSpf1DURmGM6FlPVNTA_PUbGjJa82DdjVSNMCAOdDCISHv-CwAA__-trq8s	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.21247.5426.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
34.149.149.62	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCUpdate.exe	Get hash	malicious	Unknown	Browse
	CCUpdate.exe	Get hash	malicious	Unknown	Browse
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse
	q-dir-11.14-installer_X4iKz-1.exe	Get hash	malicious	RedAlert	Browse
	q-dir-11.14-installer_X4iKz-1.exe	Get hash	malicious	RedAlert	Browse
	https://d1m1511i74zbdu.cloudfront.net/latest/de/v8.844.38.98.59	Get hash	malicious	Unknown	Browse
	https://filehippo.com/download_xumouse	Get hash	malicious	RedAlert	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vc-live-cf.hotjar.io	http://t.co/LqaCO8fscS	Get hash	malicious	HTMLPhisher	Browse	99.86.229.20
	https://logrhythm.com/	Get hash	malicious	Unknown	Browse	18.164.96.95
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse	18.164.96.97
	https://docussign.ws	Get hash	malicious	Unknown	Browse	18.164.96.52
	https://view.storydoc.com/bwCfpdRo	Get hash	malicious	Unknown	Browse	18.164.96.95
	http://proposaldocument.xyz/	Get hash	malicious	Unknown	Browse	18.164.96.54
	http://substack.lol	Get hash	malicious	Unknown	Browse	18.164.96.97
	https://s33753.p222.sites.pressdns.com/	Get hash	malicious	Unknown	Browse	18.164.96.54
	https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=https://birortopedi.com.tr/dev/pwricrqt/bGlzYS5iYWNrQGd0ZmN1Lm9yZw==#&e=7791754263&elqTrackId=ljblszhyhbdpczqbbmaq&elq=7##char20##&elqaid=208402&elqat=1&elqcst=272&elqcsid=1506365&d=DwIFaQ	Get hash	malicious	Unknown	Browse	3.163.115.114
	https://in.xero.com/2wXRHMinS61wphFklre8FF5FmAhBF8wVVKcXareO?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=classicInvoicesEmailV2ExperimentControl&d=DwMFaQ	Get hash	malicious	Unknown	Browse	18.160.46.62
privacyportal-de.onetrust.com	https://mydhl-delivery.github.io/express/#rnpc.certidaopermanente@dgrn.mj.pt	Get hash	malicious	Unknown	Browse	104.18.32.137
	http://dkdeep.com/?placement%5C=Facebook_Desktop_Feed&adset_name%5C=26&ad_name%5C=1_267069722828906&fb%5C=267069722828906&ad_id%5C=120206568353510682&buyer%5C=mk&netProbitiya2k23%5C=w0tth3b3stGmev3R&pre%5C=celeb1&fbclid%5C=IwAR2SLF2yfFVFau_BLIzVYgyo3FnJIWRI2bBRkxat54PFXlIdShtFrFBG6Pg	Get hash	malicious	Unknown	Browse	104.18.32.137
	https://dkdeep.com/	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://protect-eu.mimecast.com/s/msYsCPZNRfgALou0ZlkF?domain=proinvestor.com	Get hash	malicious	Unknown	Browse	104.18.32.137
	index.html	Get hash	malicious	Unknown	Browse	104.18.32.137
	https://spaces.hightail.com/receive/Z4BNlNUQd3/dXMtOThkYmJlNjktYjQ2MC00NWQ0LTgxODAtZTAyMmRhNGJkNmM3	Get hash	malicious	HTMLPhisher	Browse	104.18.32.137
	https://6am8rid67tw.typeform.com/to/HZKTv6iH	Get hash	malicious	Unknown	Browse	104.18.32.137
	https://international.standardbank.com/.	Get hash	malicious	Unknown	Browse	172.64.155.119
	http://www.imt.niu.edu/ipdb3n4m.azodusexz?ccyWVKqcc00VXcyKGjcccWgctcB5J7kxlrcbbb5m======	Get hash	malicious	Phisher	Browse	104.18.29.38
	http://heavenlygem.com	Get hash	malicious	Unknown	Browse	104.18.29.38
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	https://mydhl-delivery.github.io/express/#rnpc.certidaopermanente@dgrn.mj.pt	Get hash	malicious	Unknown	Browse	52.202.146.197
	https://springfield-solutions.com/a2KMY8	Get hash	malicious	Unknown	Browse	3.211.69.59
	http://document-85cc2.web.app	Get hash	malicious	Unknown	Browse	3.209.221.84
	https://65dca88c3cb88e0721d4594e--visionary-daifuku-00a3a7.netlify.app/	Get hash	malicious	Unknown	Browse	34.195.9.80
	http://accedii.194-48-251-87.cprapid.com/index.php	Get hash	malicious	HTMLPhisher	Browse	3.220.247.168
	https://usps-chentya.165-227-15-167.cprapid.com/	Get hash	malicious	Unknown	Browse	54.175.157.16
	https://acrobat.adobe.com/id/urn:aaid:sc:eu:cdb63725-2cb7-4cbc-988d-c28b730d2437	Get hash	malicious	Unknown	Browse	18.211.141.149
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:f1c05e94-5d89-4e6a-985f-81ce98d8c477	Get hash	malicious	Unknown	Browse	52.4.149.116
	SecuriteInfo.com.Win32.TrojanX-gen.9929.25870.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.195.9.80
	https://bs2ymnyy.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.makeuseof.com%2Fbest-microsd-cards%2F%3Futm_medium=newsletter%26utm_campaign=MUO-202402241330%26utm_source=MUO-NL%26user=ZXN0ZWJhbmlAYmVpbi5jb20/1/0100018ddc8709dd-db5c6276-f168-46be-97cc-8849598df3f3-000000/akKk3944VhM--mUZHrRBDhLJ60s=362	Get hash	malicious	Unknown	Browse	35.153.43.184
platform.twitter.map.fastly.net	https://www.ungrbly.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.qiodwbu.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.jfqxpnk.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://usps-chentya.165-227-15-167.cprapid.com/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://recpointuser.myftp.org/home/	Get hash	malicious	Unknown	Browse	146.75.28.157
	http://patsnap.com	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.gnno-aozora4.cyou/ibg/client/index.php	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.gnno-aozora5.cyou/ibg/client/index.php	Get hash	malicious	Unknown	Browse	146.75.28.157
ip-info-gcp.ff.avast.com	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	34.149.149.62
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	34.149.149.62
	CCUpdate.exe	Get hash	malicious	Unknown	Browse	34.149.149.62
	CCUpdate.exe	Get hash	malicious	Unknown	Browse	34.149.149.62
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse	34.149.149.62
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse	34.149.149.62
	CCUpdate.exe	Get hash	malicious	Unknown	Browse	34.149.149.62
	CCUpdate.exe	Get hash	malicious	Unknown	Browse	34.149.149.62

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SCCGOVUS	https://www.ungrbly.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.qiodwbu.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.jfqxpnk.cn/	Get hash	malicious	Unknown	Browse	146.75.28.157
	http://online-aktivierung.com/volks/a1b2c3/e12ffa7c94b1e022bc6fc8a54b52e087/login/?	Get hash	malicious	Unknown	Browse	146.75.28.84
	https://usps-chentya.165-227-15-167.cprapid.com/	Get hash	malicious	Unknown	Browse	146.75.28.84
	https://recpointuser.myftp.org/home/	Get hash	malicious	Unknown	Browse	146.75.28.157
	http://patsnap.com	Get hash	malicious	Unknown	Browse	146.75.28.157
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse	146.75.28.84
	https://www.smore.com/pv6an	Get hash	malicious	Unknown	Browse	146.75.28.84
	https://pub--1e6e9635986941c0b9ce0ea49a72b69b-r2-dev.translate.goog/merlomyscr592424.htm?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#james.smith@test.com	Get hash	malicious	HTMLPhisher	Browse	146.75.28.193
ATGS-MMD-ASUS	nXM6xuJw9q.elf	Get hash	malicious	Mirai	Browse	57.133.138.1
	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	32.224.202.13
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse	34.149.20.76
	cqZmSreb4e.elf	Get hash	malicious	Mirai	Browse	57.13.46.180
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	32.115.95.206
	RShSMrtjcl.elf	Get hash	malicious	Mirai	Browse	32.79.46.48
	WiFMm8X57J.elf	Get hash	malicious	Mirai	Browse	32.159.177.67
	https://cm.cmbuck-oem.com/u?mid=65d71b38d9d0ff0001283556	Get hash	malicious	Unknown	Browse	34.28.233.175
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	34.28.143.171
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	51.1.28.237
AMAZON-AESUS	nXM6xuJw9q.elf	Get hash	malicious	Mirai	Browse	54.134.19.161
	BWV4hz5GdR.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	23.21.40.218
	2.26.2024 WIRE REMITTANCE PDF.xlsb	Get hash	malicious	HTMLPhisher	Browse	52.203.29.35
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse	54.158.243.44
	VOR5qp1nkw.elf	Get hash	malicious	Mirai	Browse	54.140.168.40
	RShSMrtjcl.elf	Get hash	malicious	Mirai	Browse	44.218.149.163
	2.26.2024 WIRE REMITTANCE COPY.xlsb	Get hash	malicious	HTMLPhisher	Browse	18.213.80.41
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	54.138.252.213
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	44.214.105.77
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	54.23.16.247
AMAZON-02US	https://padlet.com/voicereceived2602/17180027621-dut4dexptqi0dpss	Get hash	malicious	HTMLPhisher	Browse	52.85.151.19
	BWV4hz5GdR.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	75.2.81.221
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	13.226.76.32
	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	13.214.81.71
	2.26.2024 WIRE REMITTANCE PDF.xlsb	Get hash	malicious	HTMLPhisher	Browse	99.84.108.122
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse	52.85.132.38
	cqZmSreb4e.elf	Get hash	malicious	Mirai	Browse	63.32.242.19
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	18.191.144.115
	WiFMm8X57J.elf	Get hash	malicious	Mirai	Browse	108.158.116.47
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	13.50.244.49

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://api.onedrive.com/v1.0/shares/s!As1XdTeQ8YH6klUS7tR8LNkVFHbk/root/content	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	https://86be9a55762.chriswsteele.com/4e0740/ef2d127de37b/2d711642#aHBlbmFAZHJpbmtib2R5YXJtb3IuY29t	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	2.26.2024 WIRE REMITTANCE COPY.xlsb	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	https://cm.cmbuck-oem.com/u?mid=65d71b38d9d0ff0001283556	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	file.exe	Get hash	malicious	RisePro Stealer	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	https://app.box.com/s/ufbcj0sgci60l323b31zkyzlvlhw9fgy	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	Re Receipt of your email to Peak Plan Management 6382403052jxmwp3258.msg	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	https://padlet.com/ryansomlai/pride-services-elevator-contract-settlement-payment-approved-po2ondteaozdmf84	Get hash	malicious	Unknown	Browse	23.221.242.90 20.190.151.134 20.12.23.50
	https://conarts.com.au/firstam.html	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 20.190.151.134 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	https://86be9a55762.chriswsteele.com/4e0740/ef2d127de37b/2d711642#aHBlbmFAZHJpbmtib2R5YXJtb3IuY29t	Get hash	malicious	Unknown	Browse	13.107.5.88
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.5.88
	tarasoff duty to warn california law 73153.js	Get hash	malicious	Unknown	Browse	13.107.5.88
	Shipping Documents, Bill Of Ladden, Invoice & Packing List.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
	tarasoff duty to warn california law 73153.js	Get hash	malicious	Unknown	Browse	13.107.5.88
	Re Receipt of your email to Peak Plan Management 6382403052jxmwp3258.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88
	https://padlet.com/ryansomlai/pride-services-elevator-contract-settlement-payment-approved-po2ondteaozdmf84	Get hash	malicious	Unknown	Browse	13.107.5.88
	Arrival Notice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
	SupplierOrder_56000006943.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
	Payment Advice - RefJB11020002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
a0e9f5d64349fb13191bc781f81f42e1	2.26.2024 WIRE REMITTANCE COPY.xlsb	Get hash	malicious	HTMLPhisher	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	E58dRay02f.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	scanned_doc#2024-27-2_4065.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	scanned_doc#2024-27-2_5747.xlsx	Get hash	malicious	Unknown	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	lxGAurRKvR.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	PjgTyZiVh0.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Xmrig	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	https://drive.google.com/uc?export=download&confirm=no_antivirus&id=12nF5JY_PwP6n-vDrlg76g10godbwoUvO	Get hash	malicious	LummaC	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.223.223 34.111.24.1 34.149.149.62
	de askeri darbe.xls	Get hash	malicious	Oilrig	Browse	34.117.223.223 34.111.24.1 34.149.149.62
37f463bf4616ecd445d4a1937da06e19	qvyy5EvDiQ.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	file.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	Booking information.exe	Get hash	malicious	Remcos, GuLoader	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	Stormcentrummers.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	Upgrade Letter _2024pdf.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	Dominobrikkers.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	file.exe	Get hash	malicious	Unknown	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28
	file.exe	Get hash	malicious	Unknown	Browse	34.111.24.1 34.117.223.223 34.149.149.62 34.160.176.28

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\CCleaner\CCUpdate.exe	main.js	Get hash	malicious	Unknown	Browse
	main.js	Get hash	malicious	Unknown	Browse
	1.js	Get hash	malicious	Unknown	Browse
	1.js	Get hash	malicious	Unknown	Browse
	out.js	Get hash	malicious	Unknown	Browse
	out.js	Get hash	malicious	Unknown	Browse
	https://timegroom.com/commerce	Get hash	malicious	Unknown	Browse
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse
	CCleanerBundle-616-Setup.exe	Get hash	malicious	Raccoon Stealer v2, RedAlert	Browse

Created / dropped Files

C:\Program Files\CCleaner\CCUpdate.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	714256
Entropy (8bit):	6.717097807562694
Encrypted:	false
SSDEEP:	12288:VBkGdCMw6KJx17OeNg086YN/ggggMDMCy/VmuqLZeviFGQ2mfzAuEUVoFY:VBkeFw62+ggggMvGmev/6ZEUVoFY
MD5:	0F0B90A01F049665CA511335F9F0BF2E
SHA1:	BAF4016E50050B24925437864BFB3C19D0BAA901
SHA-256:	4AD9635351C8E8579C4D4C2BDD679EA7B135EC329ADC6FD5D8211255E2E666BE
SHA-512:	44DA936D020E857BF3BFA2BCC7A91182DA9C1F320FE041BB2836D4E8AE99D4B939EA27842B49B9A2CD24E09C7698579617584D431A2B2F7EAFDAFA1FB9A59C50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: main.js, Detection: malicious, Browse Filename: main.js, Detection: malicious, Browse Filename: 1.js, Detection: malicious, Browse Filename: 1.js, Detection: malicious, Browse Filename: out.js, Detection: malicious, Browse Filename: out.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: CCleanerBundle-616-Setup.exe, Detection: malicious, Browse Filename: CCleanerBundle-616-Setup.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........d..........pw.....pw..k...pw.....pw......y`.....y......y......y......pw......p.....9k.....}.....pw..................ap.....by......by.....byb..........by.....Rich....................PE..L......c...............".............R.......0....@.......................................@.....................................@........................B.......Y..........................@...........@............0..0............................text...!........................... ..`.rdata..B....0......................@..@.data...X8...@......................@....rsrc................0..............@..@.reloc...Y.......Z...J..............@..B........................................................................................................................................................................................................................

C:\Program Files\CCleaner\CCleaner.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38778272
Entropy (8bit):	7.008296118678147
Encrypted:	false
SSDEEP:	786432:dqa3R36vRYeV68KHCDewqWvwaz8f8zgZi6Bs7e:dqqR36vRXVDDew5Iaz8ftZi6BsS
MD5:	09CBECE85B34B40B5D330654575F9EF8
SHA1:	74F263F08B1E84BAAF3C6FB5D4DF0A80BA2F1A7C
SHA-256:	5C8DC406565C98915FC7A269037EEDED0307BF9422D0FF3F5E168917708E0570
SHA-512:	61D1A6A7CD419F64B5C543121957404A4728AAECFEC520FC0FBAF49B98244A28D21CA3810FBC9A821E26648AE05A0E3701AE8EB90D4F4A4F222D3E9D05B95F19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......]......K...K...K..J-..K..J.K...J...K..nK...K...J...K...J9..K..J..K..J...K...J...K..J...K...Je..K...J...K..J...K...J...K...J...K..J ..K..J...KO..Jl..K...K...K...Kz..K...K:..KO..J1..Ks..J\..Ks..J...Ks.lK...K...K...Ks..J...KRich...K........PE..L......e...............&..2...>..............2...@...........................q.....oGP...@.....................................D....@...m..........H.O.X)....^..(..L.a.T.....................a.......I.@.............2.T............................text.....2.......2................. ..`.rdata...9V...2..:V...2.............@..@.data.....=.. ......................@....didat.......0.....................@....rsrc....m...@...n..................@..@.reloc...(....^..*...b<.............@..B........................................................................................................................................

C:\Program Files\CCleaner\CCleaner64.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45018016
Entropy (8bit):	6.8520832095764
Encrypted:	false
SSDEEP:	393216:IUBbyaw1rYgCbmXhZ418S2PtdZS4tcH3FkFGQrqN6mEV7ZFtlBhSp0huAe9Ynh:IUFyxD/C21dsPXFkFDpV7ZFzBs7e
MD5:	ED9773FFAC49BB95523BB5044924B108
SHA1:	977E08A9B9B29D570EE1729966125F35DE2E32AC
SHA-256:	174CC7E9FC05A2FA1467EC32D67CC6C6AA39C16BF7544825D12EE8E146E51366
SHA-512:	32A8A552706255FF504A10A08EBB9122EFAB8B8FCCBDB4710742E2FD8BF727CB2007AE247537E0F8C408AA6C000DA3895648FADC590C8C76C680110770BF9467
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J..z$..z$..z$...!.#z$...!..z$......z$... ..z$...'..z$.C. ..z$.C.!..{$... ..z$...!..z$...'..z$......z$.F. ..z$... ..y$..z$..z$...'..z$... ..z$...!..z$...!..z$..."..z$...%..z$..z%...$...!..z$...!..z$...-..~$...$..z$......z$..z...z$...&..z$.Rich.z$.................PE..d...;..e.........."....&..s...]......./........@....................................uG....`..........................................X..L....g..D.... 3......@$.....H..X)......tH...H..T....................J..(...`..@.............t..%...C.......................text.....s.......s................. ..`.rdata..d.o...t...o...s.............@..@.data....E@......R..................@....pdata.......@$...... ..............@..@.didat........3.....................@..._RDATA........3.....................@..@.rsrc........ 3.....................@..@.reloc..tH.......J...x..............@..B........................

C:\Program Files\CCleaner\CCleanerBugReport.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4703648
Entropy (8bit):	6.489288954329712
Encrypted:	false
SSDEEP:	49152:ZML9H/ldUeV4fvcom6/7zkUIZdnP+WbfHMIXOfATPAmRPAikFmUhbeCD82JW1OI5:9ea0om6/75e+WbRdP2mKiCul
MD5:	CB4D4D3CC808CCE0729D0E8E45A546D1
SHA1:	073D47C666295862796594E565D1237688826488
SHA-256:	BAD4F1AE2D19B11CE66536E4D54E0703AB4B9692C86BF0FB82F7840D60BBAC59
SHA-512:	C52AABCF6F41CE02D52F092CF9A3805C45328FDFB5ED70EC4DD91CA01033D3605B184270F3AF8E9D9BA635C69B227237CC8C8B6927609068696E18001830A445
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........A..W .^W .^W .^.R._. .^.U._D .^.U.__ .^.T._^ .^.U._! .^1OK^Z .^.R._G .^^X%^U .^.N._Q .^.U._. .^W .^[ .^.U._~ .^.R._r .^.R._~ .^W .^.".^.U._.!.^.U._V .^.UI^V .^W !^U .^.U._V .^RichW .^........PE..d....d.c..........".......0..2.................@.............................@H.......H...`...........................................=.....\|.=.,.....G......PE..G..H.G.X)....G..j....6.......................6.(...@.6.8.............0.x............................text.....0.......0................. ..`.rdata........0.......0.............@..@.data...p.....=.......=.............@....pdata...G...PE..H....D.............@..@_RDATA........G.......G.............@..@.rsrc.........G.......G.............@..@.reloc...j....G..l...0G.............@..B........................................................................................................................................

C:\Program Files\CCleaner\CCleanerDU.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13301152
Entropy (8bit):	6.61107354283772
Encrypted:	false
SSDEEP:	98304:V+FHkS0uHZGALOHsU6MkdabipIeQ4GjijX/rjWwCHcJ/N:VskS0iZGAaMU6cMIeFGW7r7C
MD5:	1A27255A5ADA73BBBA058206C1F42F8F
SHA1:	DA60488617762443BE7235EDC13EF556C1A1A12E
SHA-256:	3252B5873B7A942951FD2E6A099CA8E896F73534A08BBCA2B67C7701F1A03F4E
SHA-512:	B2290CC5F888F0B962B7B4162F0E3457A9B13A0333E2C4E07E8333AE87C6A0D784EFEFCF3EC06E7D3F4AFD98DA504D19DD6A5D197C762526196FCEBB7540294C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........0...^..^..^.W.[.[.^.].[..^. ....^. .Z..^. .[...^. .]..^.W.]..^.W.Z..^....^...Z..^..[..^.F.Z..^..Z...^..^..^.W._..^.._.5.^.W...^.^..^....^.....^.\..^.Rich..^.................PE..d...xU_e.........." ...$.....:......`S......................................@............`A................................................L...................h...H...X).......H...C.......................D..(....B..@...........................................text............................. ..`.rdata...S'.....T'................@..@.data...T....P.......,..............@....pdata..h...........................@..@_RDATA..\............z..............@..@.rsrc................\|..............@..@.reloc...H.......J..................@..B........................................................................................................................

C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6970272
Entropy (8bit):	6.488706110591473
Encrypted:	false
SSDEEP:	98304:KqUX+YMcv+sq0Jz7TZN88Yq5k4wLzWcZQ:Gfd9NDYHQ
MD5:	D5CE4F427F70CEA1EFA0FCC5840A021C
SHA1:	F7A9D5ACAE190E50AD6E03D4396661A0543D5844
SHA-256:	2E94220DAE9E131AACAE5708ACE34D353415F4EA5A3AD63840791F37808D2689
SHA-512:	40CF7BAA34A73FFD34505E6B5E5F8E11078D37ABDA70A16E2AACF3C86E5D692A679D1D6BC3E9911D910AA92BAABC45320F668DE0B99C42E631BAE1311953F4AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$............j...j...j.......j......=j......j......j.....j......j.......j....y..j..\|....j.....j...j...j.......j.......j......j..y....j.......j...j...h..$...k..$....j..$....j...j}..j..$....j..Rich.j..........PE..d....R.c.........." .....jJ..8 ......U+.......................................j.......j...`A........................................0.].....8.].......i.X....@f..f..H2j.X)...Pj.d....3T......................5T.(...04T.8.............J..............................text....iJ......jJ................. ..`.rdata...I....J..J...nJ.............@..@.data....k....].......].............@....pdata...f...@f..h....e.............@..@_RDATA........i.......i.............@..@.rsrc...X.....i.......i.............@..@.reloc..d....Pj.......i.............@..B........................................................................................................................

C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1082784
Entropy (8bit):	6.646387989037068
Encrypted:	false
SSDEEP:	24576:p1KRP3qiPqLVaG5q2+flmtzJNh0lhSMXlsmlpGDl+:pE3qiPAaG5q2+NEzJk5k+
MD5:	265F71A8D8E26E28EB98B57B255B699A
SHA1:	524ED9E60197E9A6BAAB622C5C41412C0FBE7989
SHA-256:	7E6862528073D72BFF90B7069ABDC2432B3AE1F7AB43E2559CFA57B92E1B1E43
SHA-512:	ABF4FB7AF0DC6208795C9A14C2F8B52B2FC035CC9AF6B6197B52F7018055634F1B8ACE83D85FE56A180838C6E348D4EBF302CD39273A8BC0EE06CA4173E8777B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RW9.39j.39j.39jMA:k.39jMA<k-39jMA=k.39j.39j.39j..=k.39j..:k.39j..<k.39j.L<k.39jMA8k.39j.38j939j..0k.39j...j.39j.3.j.39j..;k.39jRich.39j........PE..d...E..e.........."....&............@..........@.....................................L....`.................................................d...<............@..(b..H\..X)..............T.......................(....F..@...............0...H...@....................text............................... ..`.rdata..............................@..@.data............>..................@....pdata..(b...@...d..................@..@.didat..0............(..............@..._RDATA...............*..............@..@.rsrc............ ...,..............@..@.reloc...............L..............@..B................................................................................................................................................

C:\Program Files\CCleaner\CCleanerReactivator.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2180512
Entropy (8bit):	6.4242829753920425
Encrypted:	false
SSDEEP:	49152:12i/j/84UYLVaP0a49ihl/CIcv+MyhcH0jS8fV:P1LVIhl/7
MD5:	6EF92995B1DDEA4546FEF9AFC56B3614
SHA1:	F9595A8B064A1E02211875B7A1F95BB8BA12792F
SHA-256:	206AFD6CBB1F9DD688B5778D9DEC391CA0C1D573E253EE8C43711C10A1176EE5
SHA-512:	A0BCDB2AF5A3BE2453065E986680E97183E57DF30BA804FA3A85D19E84F761FDDAFE251D3DE78058D2D940E709CF5299B0C7AC5869B6B3701F0D3BEDF2BEF368
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......a@..%!..%!..%!..1J...!..1J..;!..1J...!..wT..5!..wT../!..wT..G!..CN[.!!..,Y5.'!..%!..#!..sT..!!..1J..<!..%!... ...T...!...T..$!...TY.$!..%!1.'!...T..$!..Rich%!..................PE..d....R.c.........." .....b...........x........................................!......I!...`A................................................X........P!......0 .,...H.!.X)...`!..B...a.......................c..(...0b..8...............H............................text....`.......b.................. ..`.rdata..............f..............@..@.data...`...........................@....pdata..,....0 .....................@..@_RDATA.......@!....... .............@..@.rsrc........P!....... .............@..@.reloc...B...`!..D.... .............@..B........................................................................................................................................................

C:\Program Files\CCleaner\CCleanerReactivator.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	192928
Entropy (8bit):	6.827353218606139
Encrypted:	false
SSDEEP:	3072:dCvXmthjRa7YzodSub8J0ta8cs0nBiZOuaS+8+/oPyIRNo5HNDCOSp3CvdHOcJnp:dC+7jRaWoMub8iHP0Bq76861SpwlrJiA
MD5:	599ADBA0F124CB6F6AC7854C8700FC4E
SHA1:	65DBD4797269C189732A5988AF25D94BAE8B5921
SHA-256:	6C41C1EF0E003E8A8209663B349CC332CC38C729396FB9D5D3DBD5257779859B
SHA-512:	C625FDDE5C3F52DD52910E9E8F96F820AB1892F5F2F06D59068A4D7B5ACA207C8192F5CF4A4485DFC1E23C6336AC8CAC7793D77F44EEE140E4C5FE9492C36A2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..V...V...V...x......V...W...P...F...P...Y...x..Q...x..Z...x..U...P...}...V.......<...W...<...W...V.t.W...<...W...RichV...........PE..d...B..e.........."....&.......................@.....................................+....`.....................................................(.......X...........H...X)......X....y..p...............................@...............`...$...@....................text...P........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...X........ ..................@..@.reloc..X...........................@..B................................................................................................................................................................................................

C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.541353230083788
Encrypted:	false
SSDEEP:	3:7JWqupL6y3sLy3Eu71/ALTq6mTX8jusLRAp5Crl1T1bP3:Evl6ycO3u/XlU5CrvTFP3
MD5:	CD5C83A8A3455EC17D05928D68361935
SHA1:	C2738808778CDFC511B486E2D914D3B90D964928
SHA-256:	B988E01C97EA89F06D69214F424FC0C2A951565F3B2912913018CB726FC42F62
SHA-512:	C1463900B9A15190F369042D500580912E7DEBBC67FFA1188E8FF173B294229681D4A75FA42BEE3EAF072468159A08D9C6706B58CC0AB517F09FFF3D90E0A4BF
Malicious:	false
Preview:	..nlsbyh20,1..nlsbyh, Inc..&Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz ....*.Intel Corporation2.Intel 806f88..@.H.P.?X..`..

C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a755d00f-9c7c-43f1-9c4d-4a5ce0a5a18e

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	678
Entropy (8bit):	7.342756331168675
Encrypted:	false
SSDEEP:	12:CUkUpreYZpqAV5DhWZX3OgopenHYz5UaLW5jFRYAoigqa3rW6:CUvheY7uOgNHYzmaL2Ro+a3rW6
MD5:	2DA00B40B476AD7D00CFCCB5120D4096
SHA1:	75C7735BA8F5859979335472A7A06E9706B2D5B4
SHA-256:	BC80D77C38B0271A8DCBBB0859723E6CC34E7E6D64FC01EDBB214F8AE393D44E
SHA-512:	9B2D6D43231E3A3EB61734A328C73CBCEDDC4892B7E35966F6E1AE20ACE5EADBB0D0FB8FA498CE008050397406EA33D0E90DF12588DA56C14D68CA7A97EAD5E5
Malicious:	false
Preview:	burgerdata..................................z..O........R...VB...4.5.n...........f...... .....of..^.*u.#...x.L..#....oB............... ...}7.\.."...(....;7K..l....).r......b.`Q.L.;.K.F`].:....2..At.......R.r{.D..L...:...C.I..y..&..DY..;.......e.g.v(?....MFY/y.%.....s....j.3].....<.\|........<S..aY..N.0.......`3....K..J....b.Z..R....B\...\.4.-.^.l7.....SY.D4....B..wX.0...Zu..C@..K4...I...K......vs.....<c=/5..L.C.%....[..z.....2pM}]/.a."2...8..@..R.F...xf...#2..`Ea.R.}X.3...0...1..G43.e.....v..;......".y.d8..`..p.0.$...r.....b..f...g.~..]I."6..&.F.O....r.&....n.n.s..];A^=.o.....8.@...PZ.S. .I...RR.jT`..D...k............,.mT...W]u..Hf-..!.7<..T.;)

C:\Program Files\CCleaner\Data\usercfg.ini

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.658368242872937
Encrypted:	false
SSDEEP:	3:tv+ihaCNGO4JgHLuZ:tmYNnbSZ
MD5:	A85E9E7C24280934AE6AB3C6453584D4
SHA1:	7A5B6AC277D4A0078C3D4FD3C8AB9F36F9421E20
SHA-256:	3992DEBC7C4972F2636B14211B979809FA52008FCE7DE80D90574A7B8AC7C5FA
SHA-512:	1AD72DE83D7BB234696425AE41C6B89AFAB3B018EFD41452170504C8C8678D605A07505F0D0D2B11F9B3D9360393D62CAF7470456561F17864A388EFE8B65F58
Malicious:	false
Preview:	...[GDPR]..thirdPartyAnalyticsEnabled=1..

C:\Program Files\CCleaner\LOG\DriverUpdEng.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.8238521147201725
Encrypted:	false
SSDEEP:	6:cxznNpffp9V7OhXbMGWQwEkKc0ZNpmaJ9V7OhXbMGWQwEkK9:knNZrwhXbMXwdNRLwhXbMXw9
MD5:	E42CC076946B8D073190483AFC45D74B
SHA1:	3586552E0E7904C28AFEC490F2B88678801DD21F
SHA-256:	D0DACFF3B056B4F4E9AC75C8A94828EFADE234C55C7CFC7E0D2DF1E231A52259
SHA-512:	178541B4417A9DF6DA0BFCE26B51A6052EB578CF7BB25CDE795AA8AD0B7535B375CE87DDBA38022D2A6FF57ABF929DEC9106974C3A5B0BC4364715DA226BDCA9
Malicious:	false
Preview:	.[2024-02-27 17:39:14.567] [info ] [DULib ] [ 1820: 7052] [000000: 0] [23.3.4596.0] [DeviceManager.cpp] [219] DriverUpdater::DeviceManager::Init: Initialize Update Engine..[2024-02-27 17:40:12.576] [info ] [DULib ] [ 6224: 3608] [000000: 0] [23.3.4596.0] [DeviceManager.cpp] [219] DriverUpdater::DeviceManager::Init: Initialize Update Engine..

C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5937
Entropy (8bit):	5.265666330305102
Encrypted:	false
SSDEEP:	96:NNDzkW0zN6ObkEACLPUXmeZPUXme5CtNEzkyYzh6EbkUCH/UXue9/UXue1C07rTb:X7s3NACLMXmeZMXme5CUnQ5fCHcXue94
MD5:	35D91E6268F9002ED9DD8FD4FABA061D
SHA1:	A632D5160EDC16BB82C78DAF8CF3B11598C59D65
SHA-256:	15AA116A694341625C6AAB471C85168F4EF3CEAB2A4725E056232BA62C6D982D
SHA-512:	AB0614F4272B6521A0AC42F9E47C13ECF6626229A08052F0D072EE96BC6F2774F5B2FBF95B9FAE53430016EFF3916CBAE7C7E2A5E7905456AF035345FEC20B5D
Malicious:	false
Preview:	.[2024-02-27 17:39:13.870] [info ] [settings ] [ 1820: 7052] [000000: 0] paths.ini_store configuration is empty, settings ini store folder to asw::instup::GetDataDirectory...[2024-02-27 17:39:14.440] [info ] [ini_access ] [ 1820: 7052] [000000: 0] watch task for C:\Program Files\CCleaner\Setup\config.def started..[2024-02-27 17:39:14.440] [info ] [ini_access ] [ 1820: 7052] [000000: 0] watch task for C:\Program Files\CCleaner\usercfg.ini started..[2024-02-27 17:39:14.456] [info ] [ini_access ] [ 1820: 7052] [000000: 0] watch task termination for C:\Program Files\CCleaner\usercfg.ini requested..[2024-02-27 17:39:14.456] [info ] [ini_access ] [ 1820: 7052] [000000: 0] watch task for C:\Program Files\CCleaner\usercfg.ini gracefully terminated..[2024-02-27 17:39:14.456] [info ] [ini_access ] [ 1820: 7052] [000000: 0] watch task for C:\Program Files\CCleaner\Data\settings.ini started..[2024-02-27 17:39:14.472] [info ] [ini_access ] [ 1820: 7052] [000000: 0] w

C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.541353230083788
Encrypted:	false
SSDEEP:	3:7JWqupL6y3sLy3Eu71/ALTq6mTX8jusLRAp5Crl1W1bP3:Evl6ycO3u/XlU5CrvybP3
MD5:	A6664336C0DE0734850697CECE1CEF4E
SHA1:	EC458E8E9A31672B93641B4AE8BCF54807ED3FC9
SHA-256:	450B3FB19C1B35ECE0771CFB8451520E729672F071343AC3CC15EB806B235C7D
SHA-512:	CBF8E09E2BC307D03389A0931C40F1E108160549A3152DDE93BFC45DE51C36ED90CAF310A51F44F75229173411B05BCAFEF76118A26B0FB236EA3DD4DCCD9355
Malicious:	false
Preview:	..nlsbyh20,1..nlsbyh, Inc..&Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz ....*.Intel Corporation2.Intel 806f88..@.H.P.?X..`..

C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\642aa3dc-ecae-4987-b7a1-5b5e44f3bbaa

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	614
Entropy (8bit):	7.267455372708956
Encrypted:	false
SSDEEP:	12:CUkUpL6mWxExDLMqbjropy5SKn7t4i0MLVsydOdD5xjZClPYdl:CUvImqExDL5Mw77t4DsTdGD5wPYP
MD5:	C8FB2BA4B2F3EE067157147E97808125
SHA1:	27CBA564C2BB954FA70F4A5B72993F5E3800D8AC
SHA-256:	8A84639D594CEB30A72D9E002C343E0698FC52C021CDC3AD32650DDEF1968975
SHA-512:	DEA87CC564F8AD4A959A3FAECF86A4A88BAA723A18CD7D7113521F4416DFBA5750ED387173D2BA4A7B731710B9FBFE3A16631EE830B327641BF10869AB8C4F48
Malicious:	false
Preview:	burgerdata..................................z..O........R...VB...4.5.n...........f...... ..... ..nTW...q..f..1......w..)4............ .....%N.Z.X...f.r...........b....p.....O..>.%..2....lwjg...d.B...H..3..C .Y$Q6._..........<....)...l?.7.E)......../k..zXp...X..\.......{.?.1.i."&U.@.."lX....:.:..\|b.{.T..a.q.8.~...b.9.rQ..:...;<H..%...0.H.pwDD.... .#.....y..)E...x...f..2...-.s....y.......T~...........Mcz..\...?...v.Y..{-..VZ.........X......\|b,.c.....e.=.8xY..R$.D...k.....L..p_.Z .....Mg.T/.... V#.4..v.../....t.l.@....Z.-..>..=.+.....M..;..w..`.W..(\|.CC=h.O.Z8e..?.V..]3...>.$.

C:\Program Files\CCleaner\LOG\event_manager.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Program Files\CCleaner\LOG\su_adapter.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (595), with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.351223166737336
Encrypted:	false
SSDEEP:	24:GLX9iX3obgMZu2J4nU4pKVLUX3KuLXyliX3qKAtDB9/7KV2TLUX3y:GLIX4bJQu4nU4AJUX6uLCwX1qZeVQUXC
MD5:	E42E2D552287AFB88F244CC85FAE4144
SHA1:	6D8C704197BC06BE61D9425C359889CEC41CC37E
SHA-256:	F06D0F2C5C1A85A27FD3B7F6236FA9F55B446975A5A9E88517C6019BEEBB7CDB
SHA-512:	51C299238A98D43607C20E43F422A0709AC7A2AB108BA86C2CDC23CEE3A904E785EE2309B36E66553505250F157E0BF0702C572A1DD570C801524835E01BB15A
Malicious:	false
Preview:	.[2024-02-27 17:44:11.904] [info ] [sw_updater ] [ 1820: 6624] [0D403E: 25] asw::su_adapter::detail::SUAdapterModule::Initialize:{"data":{"customLogDirectory":"C:\\Program Files\\CCleaner\\LOG","dataDirectory":"C:\\Program Files\\CCleaner\\Data\\su_data","disableBugReporting":false,"enableDebugLogging":false,"opswatCdnUrl":"https://download.avira.com/download/opswat-sdk-database/","opswatInvalidateCacheAfterHours":0,"opswatMockupMode":false,"opswatWebRequestTimeoutSeconds":30},"signature":"9A72A4B6-3419-4C56-81AD-866403B280F6","type":"struct asw::su_adapter::data::InitializationParams"}..[2024-02-27 17:44:11.904] [info ] [sw_updater ] [ 1820: 6876] [0D403E: 25] asw::su_adapter::detail::SUAdapterModule::StartScan:{"data":{"exclusions":["tp41","tp308","tp458","tp756","tp848","tp3031","tp3087","tp3103","tp3149","tp3197","tp3326","tp3364","tp3596","tp3648","tp3676","tp3701","tp3716"],"includePatches":false},"signature":"9A72A4B6-3419-4C56-81AD-866403B280F6","type":"struct asw::su_a

C:\Program Files\CCleaner\LOG\su_controller.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	5.063128941448942
Encrypted:	false
SSDEEP:	12:GLX/VNliH2h5gqLX/VNliH2ZLX/VNliH6iIfLeaWQP:GLX9Xh3LX9XZLX9/iIDeaWQP
MD5:	B7A95E2FE3EB32AF9CEB18E4D56C2A22
SHA1:	3A1361622624EDB4D4F690B8E9C916DB70136636
SHA-256:	90E99573B8278ED63FA84AE11D03044482FACC1515A8CB2CBC6486CEEE9301AA
SHA-512:	90C76ED8F46D1A14D5FCF11C29B07035B68FC66AF9E43BFE2603A696A3F8F3B0D3D7A0A0656F70D39D2777A402D218DA7595F3FE10F652BFACF998731A336EA3
Malicious:	false
Preview:	.[2024-02-27 17:44:11.904] [info ] [sw_updater ] [ 1820: 6624] [0D403E: 25] asw::su_controller::detail::SUControllerModule::OnScanStateUpdated..[2024-02-27 17:44:11.904] [info ] [sw_updater ] [ 1820: 6624] [0D403E: 25] asw::su_controller::detail::SUControllerModule::OnDetectionsUpdated..[2024-02-27 17:44:11.904] [info ] [sw_updater ] [ 1820: 6624] [0D403E: 25] asw::su_controller::detail::SUControllerModule::StartScan:S-1-5-21-2246122658-3693405117-2476756634-1003,Nothing,Manual,,nullopt..

C:\Program Files\CCleaner\LOG\su_telemetry.log

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Program Files\CCleaner\Lang\lang-1025.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	248632
Entropy (8bit):	4.239231550099738
Encrypted:	false
SSDEEP:	3072:OejpwJ5WckrG4m4xyOfF3FForEjl34/s2O8sl10sO62nVvxX0n+TOq3MK5zeDxde:fLHEsVtId
MD5:	A01E9186139C271CE3FDDC75E81DD8FD
SHA1:	AAC324DA2F13B641937FE7FAF49F6CB7CD83CCCA
SHA-256:	98BE5CFDC30FA36CBB464F02D3A0B32CE7489C210EE0D7019580D859B49E8BFC
SHA-512:	AD8A2F2CAD8726A670C5FC1C472341ACDE78E6945930CC995E61F77819A496BD1D5EAA08B26F1D9F582F51E0A11757F72F07891E423BBDFB4E72CDB8A4DEB028
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................;R....@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..`p...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1026.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296248
Entropy (8bit):	4.12691518997062
Encrypted:	false
SSDEEP:	1536:4XmZiAYLSKbowy3HxDeUvZtSffDd6v40oD9h9U1UJph4PWC7Bxi:mWPYLFowy3HxyURtmd6yTmUJph4V+
MD5:	305493527FE9893594176CAD462494D0
SHA1:	8053A5BE3DD8A265ADCE7502AEE4E5C6BBE75C51
SHA-256:	8E01C8DA3313682671D76B1184AAE204E08B76B2D0A600B3D46DCB03769A5CC2
SHA-512:	33A861FDD32E0D894CC5A7345AEEFEB5D306ABE0251B76DDCD371416E78F17F1450C2A88748C03C797BBDB78B8AE9FAE07AECF3184AAE260FA02BEC559F5BD1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z......................................................7.....@.......................................... ..`V...........\..8)...........................................................................................rdata..............................@..@.rsrc...`V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...)...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1027.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	298808
Entropy (8bit):	3.640553369045086
Encrypted:	false
SSDEEP:	3072:B3rr3phz4msC0MUmq3nFvQ2iZHzNbUSl1QRPM36qWFnZY2WZDRRqKHpxzp/O:Zb4s0MUmqGNbUSlKqWEDNxzs
MD5:	7F31AADD362899A9B360A2CBF8471F3C
SHA1:	9AA10E84C215D06B06ADD17DF88D25B93F32BF03
SHA-256:	9825E6E50B1FAD4C9D7C020F9E34CFFB46E8478FBD12697DB11A31EC316FE56A
SHA-512:	7F99D14E826205FDC769F8B5443A068A8BF93AEBB9B13520C4A97C816D072ABB5CE360ABE314B20A28507000123E6C089AC676EB1A08E94A0DB01D23F0D58C1A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....d......................................................dz....@.......................................... ...`...........f..8)...........................................................................................rdata..............................@..@.rsrc....`... ...b..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...4...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1028.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117048
Entropy (8bit):	6.452718480765422
Encrypted:	false
SSDEEP:	1536:IXC/b/on4ysGSVTRLdYIMY4JUjAs/0zEwjHh2Eq7WVqxb:WCzYHVIMY4JzlLHHqSy
MD5:	BBA4E5137872602F890842C75D237196
SHA1:	C8FBC18D365D01280A2D73FF6F9848141F5617DB
SHA-256:	FB7059957BA80E7D032864CACB5E9663A82DA8EE77C8437A0BFB9FF4A0F6527C
SHA-512:	4C8A24B94E3E9EC1FDCB3D140ABFCF5E9775BFE4D9FFFF15DB4E109B13580C3927918054F357138F099DDC861CCAA07DF21E4E071E0DB6FA8AB764902FC13593
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................e....@.......................................... ..H...............8)...........................................................................................rdata..............................@..@.rsrc...H.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...m...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1029.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	262456
Entropy (8bit):	3.9739739942191368
Encrypted:	false
SSDEEP:	3072:BuWyV0ws1yxbxqTjEuq+m64l0V13hcIYq80sJ0wonymZq1Mb2gz/a:sJJ413rYb
MD5:	F61CFF30D67B04636A3342DAC21D3677
SHA1:	17C92035F0F8A764E746F3A26DC2DB009D1190D1
SHA-256:	35023FD83DDF4748B92EF1D4E846D832226D0887D297E0F99EA5765DE04DA8DB
SHA-512:	33929E77A85C966E5E49A7B305C7C14B1BF7944C11CDD23399F56088ED573D500B286377A5B8DE791479FFD67629B22B0382D935B4AB14E98727C3DAD052D815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..(...............8)...........................................................................................rdata..............................@..@.rsrc...(.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1030.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258360
Entropy (8bit):	3.6974935928324646
Encrypted:	false
SSDEEP:	3072:SVKMUPjdHlJsCPH02R/CCzuo8JqT1oS748mSAtlFgCIcgSnQEiGZd:u8hlJhPmFpg4iGT
MD5:	C3E5084C32B286FDE2A432212960F5CC
SHA1:	A4196A97A68A3848E424E53073F212EF71C75614
SHA-256:	87AC64757184173C4F161CFB580508D092E92E69AA46DF5DDD2044F9057892CD
SHA-512:	5AE7F6A8803574D44362AB3ECB9D8016EAC4EFFCD89FDEC6E0CE35EF12BC89DFC2637C3102CD1CC707C8CD2C03312788B06D3E1DCC8225411B00E1E1DEBA0430
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1031.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292664
Entropy (8bit):	3.69324721888596
Encrypted:	false
SSDEEP:	3072:adJRKPgjvypvWTChegDQhK7JUfRtR+ga9hI7AlfbamVXu9dIEhpg8XVLZkwwlPaI:8ypvCEFzda9Yhoo
MD5:	2374DE90DF944930CE530DE94FFBE4A1
SHA1:	9F2B4CEAC2E2A91C74712639E6A0EA115F634356
SHA-256:	DEDB7E45B3CA76E4F3DBF57ECF278CDA6DAFA64C79A82EA3F7C1DD3526334FE2
SHA-512:	48F913A605AEA339244B494F49FC90B615C2035FA300F48BADDAAE66A4684B1398329F3102D60C785D285BBF913EB686ECC0973A1DCB6E377276A3141AD2D35F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....L...............................................p......=r....@.......................................... ...H...........N..8)...........................................................................................rdata..............................@..@.rsrc....H... ...J..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1032.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306488
Entropy (8bit):	4.296158643464465
Encrypted:	false
SSDEEP:	3072:fW6kCHTgkU7ZlvMQmOnMGopX6YQ5dWORIqC4adqLDBBlKLSUG8+wi9rvxVJzAkHc:2vM9y6Gyn
MD5:	8EB5BBB05CCDF83AE36DFB88557A3634
SHA1:	6FC0D02390737E3606D50FBBBD1EB4815633EAF2
SHA-256:	7D56E4485B95BD0501532CD14AE2B2D7A4125F08FB6C56B3A5F28223E1D05EF4
SHA-512:	1D809091026947E731C821E1EB012C060524A6F576411421B2F2094278D4389FF35BA2EE0B32BC1F24D769BE733E3D1224442923C8E757423FD77B043E528CB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.................................................................@.......................................... ..(~..............8)...........................................................................................rdata..............................@..@.rsrc...(~... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...Q...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1034.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292152
Entropy (8bit):	3.620389748101341
Encrypted:	false
SSDEEP:	3072:pFSWXaxuncqz57vDc+JqL/wDFyIsDFPxxeiWaC7kkhTrldUuUfHu6KFWhadVTY:zSNxucqo+JqLY4RDFPOivkhQHlhaHs
MD5:	6194DDB4AE7B2E0B4C1F018BFF77C0AD
SHA1:	74DE3757BC56683371EC08683EEFB7F2BE39CE25
SHA-256:	76D82D261927A56FFC8C45572F1AF9E56CE8A4F26DC0F2525E9DF1581C47F3AF
SHA-512:	D854C9F4BF08E90652279407E95D2F011575480122461DCE241FDFE90267B53AA726185CC14BA9056F39B85E5CA2CC12116E26196DD03E05A410150373009C8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....J...............................................p......E.....@.......................................... ..8F...........L..8)...........................................................................................rdata..............................@..@.rsrc...8F... ...H..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1035.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270648
Entropy (8bit):	3.6472847715680423
Encrypted:	false
SSDEEP:	3072:S670AYKzLFQiBRLAEmW6WiM8LHxaMNv0HhZ/m2lLi2/eqLyJ801IEaI88RTr+vUH:ZLFJ8zx/ZxWVxziBZpKY/si
MD5:	609C67F72687CAF46436ED655A0F5B63
SHA1:	EBE584E44675999E1A8B61DBE65FEDC5C8DA60A7
SHA-256:	51C5F5B5DC59887834F5D237E858BCB760E4E9C0826DE857B2E129C322FB7929
SHA-512:	945AA032D911B06E9F8893FC8CC544891A3FC76F4983D93B21CA22F84A265FBE1B895299F0321DADBB05465B31863B8B0F1675B7D0411512ACCAE7D84DB6C528
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ............@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1036.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303928
Entropy (8bit):	3.6404308301986052
Encrypted:	false
SSDEEP:	3072:7gp/XQG0lY0HlRWz9lOM55IemQC7R57J35lgsPJ+OTanfRcrWy6gh0Fu:eUmvLmP5r+Ox
MD5:	6864C8DBBD985EAF10547C739021A298
SHA1:	25320554ED676CFCB61604EC10D3BE7993020560
SHA-256:	227E20F77BD2ED3F27B5BFDCD4A86BE558635B0C5918E1705F12B69CC808302D
SHA-512:	9CD88473E719E958A1A46FA9A92DFBA487275FE04B67F630A8906DD490FEA34AB52889132EF73F68DFA486A314251B282EBEE89F6763270894570D28A58046A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x.......................................................=....@.......................................... ...t...........z..8)...........................................................................................rdata..............................@..@.rsrc....t... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..PH...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1037.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84792
Entropy (8bit):	4.7557618188326725
Encrypted:	false
SSDEEP:	1536:nIbG/Ev7fV/QDGLu7rXc+yF3hN2qx8x07cVxkeR:YBQDGLu7rqF3hNL8x0xeR
MD5:	37C796DE159745FEE5BA01E850FAEBED
SHA1:	64632DD6DF1315B056D3E92DD28B5FCC998103D3
SHA-256:	1FDE83D00A9887F2CC13D6BC43823366C49142A33EFCAA69023A19A27469B7AA
SHA-512:	9E04D002B624815709FA88656AF55F9B545B37EA607EBA8F44B1661922CA32276E82E5B635B2E2200DCEC0E414E372F74BECA368D144CA6A6B8D13B4892DE4C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..... ...............................................@.......s....@.......................................... ..............."..8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1038.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	289080
Entropy (8bit):	3.8281219925120538
Encrypted:	false
SSDEEP:	3072:26AkFjlc69HieVvyQfEJfAXaHaf8p2FjQzrDJK8+jewl8w0i85EK/FMJgMEz+d/g:ugpWyKxqnKKoMC1
MD5:	8BE44BCFC2C19460518B8A29D0DB6936
SHA1:	EACFB7D6F3FAD825A2359F37F56210FD2F36ABE4
SHA-256:	1596D155EADFD874CAF22F137CB4E4731A4CB58E0641E6503E6728C28C18DE63
SHA-512:	92258565FF725AC2B091F6528D5094FBCAB3AF47FE38F88275C9AA2CCD7DFFCE851B66AF27D7F290B435D8003086966BC3DB09F8E7A731258EA0D954085A8E78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....>...............................................`............@.......................................... ...;...........@..8)...........................................................................................rdata..............................@..@.rsrc....;... ...<..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1040.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286008
Entropy (8bit):	3.6142714230784154
Encrypted:	false
SSDEEP:	6144:sgr2dkv5rbJEzkk7VbQgxdUSycePovN11uBIAN22H/G2//WF3jn+lZ5a0aIMjpk4:IAYbOUH
MD5:	4D636C317FFBBA449C712A2B0DBBB537
SHA1:	1E8C4427822BE28EADA46D1569C491902BE6ABBD
SHA-256:	75EB9A07F95B2BA0C71BEB391EBDF4B5A3A945DCA2B2A7B9FCEB69963A826E28
SHA-512:	640CFA911A0E85EAD9260101B741F51C4D425ABF6356A72E98CB54AE1F1E985A7E6A5AC6E0EA9E9768528B58A796469C8B5CACA37F1E6353C9C74CF71342E7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....2...............................................P............@.......................................... .../...........4..8)...........................................................................................rdata..............................@..@.rsrc..../... ...0..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1041.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155960
Entropy (8bit):	5.589951870506423
Encrypted:	false
SSDEEP:	3072:Mmj7f08GAYGz/CJyeD/cQPPYg7Qdwk9kyASAqXSZf8okOqq0Q4WFIUFJG0dvgzGl:rn0uqIB9658okLy3
MD5:	251BA0079D80F800E5B60A3D12D625C4
SHA1:	DAD52B0AFBD138BCFD793C6612B5B85744626142
SHA-256:	6EDB4A7DD1285AE6B4E74692EC35AB56F0F4F975909DBC88F7FADAB64066BBFB
SHA-512:	350CE45BAEB9D0F634F07EFFEA6F59B062037475C6E7E1D472E7A31EFE953CDF4EEAE01F77FFA3A88859B8B8E00D3D41CA6342B4756946F1F1BCAE9BCF12CA51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....6...............................................`......L.....@.......................................... ...3...........8..8)...........................................................................................rdata..............................@..@.rsrc....3... ...4..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1042.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151352
Entropy (8bit):	5.839152066962377
Encrypted:	false
SSDEEP:	3072:NFdIFT8jQ3PPBY0rY9hd//bY4nAMUxHf9exB3gPbz854I:6T8ePP7Y9fY4nAMfj2VI
MD5:	E7B1864BB73C440CF77F49D1596DB018
SHA1:	88E843823D05CA53C131FA48584F9187C1A76A8C
SHA-256:	EFC34E82941FBDEE109327CA62C9AA6763C0BDFAFA415EBB3D9ED1E7829246E9
SHA-512:	EC559D3A3B91E482894CA1BE23456F7750F8214B9E6A1D3BF966C0DA666CB8861D884E7974C16AC292CEFDCAA38EDCFD3AEC9A0F55D93742B18D3D428A529AE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....$...............................................P......8.....@.......................................... ..H ...........&..8)...........................................................................................rdata..............................@..@.rsrc...H ... ..."..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1043.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	288568
Entropy (8bit):	3.630735826932675
Encrypted:	false
SSDEEP:	3072:9t00qKa0cGVl71eOTnhSx+0hdPLWa/zwiJ07kVliIOJE5E6pjCA6YxKxYMe7NnB8:L0sm9SJ
MD5:	110F03D53E06D234264F9A741FD556D0
SHA1:	32654249EC77AAF248EF0950F1D600D05A56F3E2
SHA-256:	AAD89D266C73F86C72CB56E5C7DAA5190F3E4436BFAF10A2D2294F6B7C9B8BCE
SHA-512:	DA4B00F809850D89896BEC1A25B356ADC14DAF34C264EE21D904CC72E342D6934651C257EFEA64D123D050C076CC92FBE657F61A0992DACE0397AC034764D471
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....<...............................................`.......7....@.......................................... ...8...........>..8)...........................................................................................rdata..............................@..@.rsrc....8... ...:..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1044.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260408
Entropy (8bit):	3.678006065256406
Encrypted:	false
SSDEEP:	3072:bKpMYtueTfZOaRLl/TP2BPgfJ9yBIwSk5/apG24OveEfBGtqe4BLKjP2PS1grYeZ:ar/YewrKIq
MD5:	9DB91B3A00EE5CD034A349813A611865
SHA1:	58E361DF02987C14C2AA6203E0D886B5A3044CA9
SHA-256:	D8143DB740C2C923938A5BF3663B5BD79CFF9909A3A7668E8E2C4F06AB39A4AE
SHA-512:	519C12A2005FFD7F161C07DB2B0FD3A764C00ED34059193CE95B8786BA03E6E225740129C8CD37B09F19E139F680C1A207A0D9C1F9D6A3278A6CC69EF4DB7209
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................,....@.......................................... .. ...............8)...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1045.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	293688
Entropy (8bit):	3.880847948239701
Encrypted:	false
SSDEEP:	3072:ILrSQMoXPCfy0a8tfT2aJfuold7GQPp9vi:2mQeTxT3JJ96
MD5:	B6585C8ADC8FC4881BEA4040938A608E
SHA1:	EA4C4030494BECB639216E9E80932C8D13C9EE6D
SHA-256:	309D50B27F40391AD77064BD5E04F61F2B6DA982AB20031A0FC7A6122110F3B6
SHA-512:	1222478492641A7FD018573DAD6D59B4F4A127D43363AB729D43FE2BF34B83B8B722AB53A5992D8049D4F45A8DDBE409FAC056F0CABD605A2726695EA4D8FE0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p............@.......................................... ...L...........R..8)...........................................................................................rdata..............................@..@.rsrc....L... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.. ...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1046.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282936
Entropy (8bit):	3.6658749051211355
Encrypted:	false
SSDEEP:	3072:mQeBXArEsM0CnEJumUv8ggDBLfk2hxvosC4bXm3hoO/miM0vLnY5sWkUSUIx6/2q:/Ys90vLnYK8h
MD5:	497A136C4D367BBA408DFD6BB8824164
SHA1:	A84B074AABDE526815E10D9DE977CD88CBC75450
SHA-256:	E42BD51A78FE8075D0C643B28D6A0C96A4EF749CBCD0D3F29F313EFA9AFB21D0
SHA-512:	A7E797794C685C2A9994350D743FC9D1AEB67F14B88258589F3FB47B566845B7270D1CC9923E39230C4C5DCB453E2EEB051671BD19B713DE406D8D887B9FA06A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....&...............................................P......<f....@.......................................... ...#...........(..8)...........................................................................................rdata..............................@..@.rsrc....#... ...$..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1048.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303928
Entropy (8bit):	3.7709129072481
Encrypted:	false
SSDEEP:	6144:HBL70sRPwC8RsSNskqf0xZWH5cWXONAmyDjbVfeNZIj:tRPw8LQW
MD5:	690EDA8E154E9606C0D04A70628888ED
SHA1:	D67219531CEA245EEE2029982856C2E812B9AC02
SHA-256:	53212F1AB3D71087FC592565C2AA18F26CF16C22F6318B1F2BC6A3B0387A25FD
SHA-512:	A3A80C79B2F962DFE587A6B526BE77B0A7F36EA0177B4313B5181480342F80DD9CD7D39ED83FDC84626BFD50336A620218CE7A5BD0D5A0A7826C4ACD2793DC3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x...........................................................@.......................................... ..Pu...........z..8)...........................................................................................rdata..............................@..@.rsrc...Pu... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...H...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1049.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271672
Entropy (8bit):	4.257460919898505
Encrypted:	false
SSDEEP:	1536:oXIb3Gu57nUkqLBnZSBTjZGjWtaBr74x2:2k3GE7nUkqVZITdG6taBrp
MD5:	B565867F2DE209112F9EC3EA0BD5888E
SHA1:	E8B0EA8EE0A1913D8740702A81C455E6332A31E0
SHA-256:	778E74F69EBF757D7CFDDAB3979B818080917CCC26430DF436FD6F6F8A945767
SHA-512:	9E18A4E31E16481EDBA77D1C6B34B2BF6BDDE6D008DC38225AFC832E702A48F85955067B6FFB10AE338C7BE918BC49B90DE346E0C1EFD9D7DE8AD4F5D61508B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ............@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1050.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283960
Entropy (8bit):	3.749024130586376
Encrypted:	false
SSDEEP:	3072:pgbwUkEwuTAg8LmgkuvBi/NfKlDPh4CK11AFM/jgCXV5wgd:kwUI6gSJCAF
MD5:	79D025DDBBCDEA86B4092235D545F53F
SHA1:	90E6C8DBBF4E3736B487CE1E5E7E1A7A312F5214
SHA-256:	8BDAD2121A3A1F7AE44DE2904D572153C58FAECEDB5C13531861C16586D44A7D
SHA-512:	143FA85BDBE6EA3C687F4F68B828495A2D041646CC892122E7D69C4E8A29625B7B57CD97BD0846BF879A681C8EDB6814BAB548D0AFD9350096D4A6DA89EB0AC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....*...............................................P.......X....@.......................................... ...&...........,..8)...........................................................................................rdata..............................@..@.rsrc....&... ...(..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1051.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268600
Entropy (8bit):	3.9331978809545247
Encrypted:	false
SSDEEP:	3072:HItr1zSE4O4XFtr2LWX0shp3ABenp521oRU6rDv9zETWfxtLswfk2trxqt2h7PAM:6UCN6GDM
MD5:	06659B13BC275A83258C9AE73CF8D0B8
SHA1:	26185C4DFA171E7F224DD23059D9C03F5CA71C3B
SHA-256:	84670061F9C2709EB1F2405E04DB9C095E5B8A67D11C7FF1A66AFD282CC1A3F9
SHA-512:	C2848B49C67FE0EC267759CF52B5701D676FF2D737DFE8D59E373663C220751134168F121EB96272B1A03181B526DBD79C0F29B99C952F79CC8BCE68FE6D050E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1052.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99128
Entropy (8bit):	4.168880650413021
Encrypted:	false
SSDEEP:	768:AvnphI3J0F33dUUFwSdCG8CTzExQmGeapZZ+SQDegeO2NcRxvXWx3Fzkb/5dqbQb:Gn6qRuv+PTg0Pg9evRKrmFqYbXd7lxUj
MD5:	714774A0E56D4B0B664E8D8BA526AF28
SHA1:	F23E1AFFDF0922A6E3E5FA3F2CB7582BF45072B3
SHA-256:	921EED116A7320B0B18239E68911DC867A6CA29569D32CDC2C4003A0158F14D9
SHA-512:	20B59305DA8723A0137A22CA11BDE38ADD86ABA970C39BF360522AE0089958E9F20704D8035882FD840D398DD48411385EA1FA39214F86B7E4688FA51CDD64A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....X............................................................@.......................................... ..hT...........Z..8)...........................................................................................rdata..............................@..@.rsrc...hT... ...V..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...;...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1053.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265528
Entropy (8bit):	3.6983833583699717
Encrypted:	false
SSDEEP:	3072:+NN/puqAv0GWYIuzj9CU1w48dFPn2iaNpQ2O/nsuZs9+UTBl/EEdqJ5OS0qZpXLT:LZvrfViMMLZ5QeP
MD5:	D8751E488F0D070A950D22782654FA08
SHA1:	F698BC11258FEBF11AE9E4D8296D0280EC320F1F
SHA-256:	945B20451F40F18570880F321E33280A579C3A489232DDAB2D9F2A0F2CB0E804
SHA-512:	378C952F4516A3A3C1ABD743E78707FC662072D9F792E349AD94FEC81C09EDA4DD9D88569FCBDB1901C28C0F1AE242A29424E820C2B3446F36D1179E4F45D4BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................_.....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1054.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253240
Entropy (8bit):	4.4100131114157515
Encrypted:	false
SSDEEP:	3072:EkGZVlkS/+Mgdz7D+iBVMSHHCjqxn3weW5x78OCM4b0RamFnaxuFw3O:8odS
MD5:	A4B946192AAEE8C4E29B10AC63D9DF13
SHA1:	7F54E266224407C2F7AE43CA61DD6C86E4A4019B
SHA-256:	E68D8CC1C12F034E9E75EE92990AF56275C3702C8C3489C15A2AE7DBF48C3916
SHA-512:	44F08971AC267CF7537C16FC896325B23469CB082151FCD6F462C4E6FF63C1E4BE2A54558F39191F25D184895B821D34CA2B5B98723D92F94E307CD9768CDF2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................^.....@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1055.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	284984
Entropy (8bit):	3.872100961039669
Encrypted:	false
SSDEEP:	3072:eb2tbSoZXtw+SayJfzLK36reuSPx7aoLRG1UdB1uMmcxj2JuyI4kOienS6moo6HA:NyoxJxrlN6ryL4cfG4coFYUM1uVH3B9v
MD5:	5229EB6774F85C3134E235F93000A1F6
SHA1:	0B55D8C2DF9C554D0C29B747B57DB1ED28F3E805
SHA-256:	600E41222EFFC4E9D33F80849C35C18DED3F7618CB462DF6137E4230DEB92594
SHA-512:	C4E6A1940E11CCE892C858C349F773D335761AE2B9DCE1ABF19075AB6CF2AAFDC16DDCDCE14F43C344D5FA945F9C6B1BB130259D69F771E7A6A6C39EEE98B93F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................P......7m....@.......................................... ..X...........0..8)...........................................................................................rdata..............................@..@.rsrc...X... ...,..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1056.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271672
Entropy (8bit):	4.1812798449992075
Encrypted:	false
SSDEEP:	768:FQ+VPPYtWAzurM3uqudf+E/hhdJt47ZHgt4eNz6Y0zfBiz+J+XjN+QlBAhFwN/eH:FX/hZhS4PSNj5RlgkLth+GvoSp7qxY
MD5:	A8D2F070195A2676A75BCDB77E236B3C
SHA1:	DEF3DFE3C41FF2D0103CC188CDC3E873ADAA378E
SHA-256:	37AA329A1AA780ED68E3D5D5A074FB4898106D4FD5CB38CE500163523B0CC8D1
SHA-512:	9400140EDA418B710DBF022D14BE57A08458FE11E477F71A6B908DDACAC41B3EB1BE00A8800C1223D9B9EB714F05C1EACB1A38E609A42578E6BEF2B9872AC227
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ......h4....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..P....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1057.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274232
Entropy (8bit):	3.639395137336487
Encrypted:	false
SSDEEP:	3072:pAvnsbqLRaB3LPlCkJq5WycwPAfrbC/hDiypbDsalR97gA7e1k3s:fB3blP5r+/h+i5S1k8
MD5:	83329490E6C35E6587237CF7BF6CCEF8
SHA1:	4E1A3679E8110EFA8F5593A0C0A880D293DBCFB6
SHA-256:	C6EA79461B3F498D7000745CEE54E0D8D454DC523958B7217026DC467AD90AB9
SHA-512:	30C1B370080D75C2AF77A0B43BE7CE5B870026AA10A6D8331977C058193870A068225F7D5054080503FBE5C5A5C94747C3CBF2E1E19D88F7145E70F81F8BEF8A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0............@.......................................... ..`...............8)...........................................................................................rdata..............................@..@.rsrc...`.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1058.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276280
Entropy (8bit):	4.279534858355222
Encrypted:	false
SSDEEP:	1536:cXSwhopP25xej01KWA6cIhMEDdQPlYB1fe7rxr:6Swm25xwShTDdq0tex
MD5:	C84F6F53A636BC5F3388E7D8B717B7E5
SHA1:	E4DCE9D306D6D4ED9BCCE926BBF04DB76A596E92
SHA-256:	A111E75E6CE14ED35E3538A67B2BCDD866228625CBB170E475F6D9C322E0AED3
SHA-512:	0DB63B4BD8B768F6D3D4AC6C75613CE7078728D88774906230934CE1FB411AC0B5925BF08635F40447A8457E100D3E5A280B3C80AABAF703AF4A4A8A07033B53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0.......*....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1059.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	269624
Entropy (8bit):	4.283484846724436
Encrypted:	false
SSDEEP:	1536:qXQmt8zGdrZbW+z7cSXItN+EGtmod7+7tKxv:ggEVW+XXKatN+A
MD5:	82602D3F29663A1E9224AC109A0CAB9E
SHA1:	3D6F3B19A0AEA5AD46F0857C90E6B57AF28C49AB
SHA-256:	0BC4E1EA28C0C7B5170FE66083E4D91E03A2A0B95EB9E6262ED0AD1D70185AEA
SHA-512:	3D63BDB25F4AD6B7CCB10BE14E80628AF186F497C6FE8ADE95972809E6865AC140F376B8A1724C217466A3C1FE5962B7A6A466E2F7D0AEE557A9744720228BA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..p...............8)...........................................................................................rdata..............................@..@.rsrc...p.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1060.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287544
Entropy (8bit):	3.735968289363709
Encrypted:	false
SSDEEP:	3072:BUI6yN3B+Db7tT0yRVLX90eNfVyYoD1sFZVpmg4V+JkEKpperPV/4JmZIdiZbCYp:jWBe+
MD5:	C94CFCA62C1F3890CC132B81ECC79D72
SHA1:	34DBCB06438BDA578C288164F1CC20515B951B0C
SHA-256:	5AA12C825E2B73CA702A49087323D1A5F20CE3AC58A04877CD172903CF0E4F1A
SHA-512:	74C49C0702C07DDB6AD1224965FFB738F9FA19C6EE5C46AA8F2687473334D1B6B3E0FED4906D58022C64C25F025E7E6F083712307C8628D234D804A441D70CC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....8...............................................`......3e....@.......................................... ...5...........:..8)...........................................................................................rdata..............................@..@.rsrc....5... ...6..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..0....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1061.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260408
Entropy (8bit):	3.6848176636362475
Encrypted:	false
SSDEEP:	6144:iS6PYBjrXQL4Kfm0lh7+BhJlCO447I+s+:bUC
MD5:	495CEB9835D47D6C341CD49D659F0E88
SHA1:	A3B896058B9E961BDA1C6D2FE3D34CC6CC938D29
SHA-256:	982481F832FF0A87F6EF57C45959247F62F2F9757B069E2AB8BE294E23CEE4CA
SHA-512:	B459A70737F1BB0C2920599359E1217CFDEBCD639D9488E6DE6686C23ACE3858DF601A27DD9050825B2381ACEAA1EDADCB03BE1D0CC43C0A42D1C77CC9F8F6AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................T....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1062.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268600
Entropy (8bit):	3.8838937768448623
Encrypted:	false
SSDEEP:	3072:5TN79qaua3xqfkz3xYe2cWI/Cy1ddAG98kPHeopgE+ZDhFDk2M:PhqjtzI/F1ddAG9zPHeopgE+ZDhFDkr
MD5:	DCB35665250C8265ECF696CB4E6D70F3
SHA1:	55A74BF410BFFB6AD949D22FCAB973833D55E730
SHA-256:	75BBAC26EFBA1B1EB5EEEC6057453F5E52FE754282E0CF333CCF1F81D069F6B0
SHA-512:	DAC791FF5FC16ED179FFF5DC9B17DE5B0EDD76303056AB8801F60CC60FFB2F596D10CBDF1BEF71A9FC9146F3FCAFCA46110B65449BB7995F97E5D3584B4AEC06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..h...............8)...........................................................................................rdata..............................@..@.rsrc...h.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1063.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275256
Entropy (8bit):	3.8453835254793582
Encrypted:	false
SSDEEP:	3072:n2cVFxILT3wHKd4OZchEXSKyb74AwlCTWgVEhm5f6UsAJ2QE09AZytVEaLpglnfX:IIiwHmR
MD5:	4403B8DBF0092943D809ABA994BE5F01
SHA1:	1B0CF2573F04C3D7936BC9C2459C90FE8D39F7C6
SHA-256:	A4E5CDDADE944C272CA762E8275B1D6364569E2AA3FB70DBE54FC45E49A079CF
SHA-512:	32DC21011D9BEDAB58C7934CC45CDDB38603C9C56935E2C08F2EBB3021956E1D150A47A7A67C9D83E75C845B1D2B49582837AB784A8C610CD1D9B30693914564
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0...........@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1065.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270136
Entropy (8bit):	4.133388939090134
Encrypted:	false
SSDEEP:	3072:sA6wg68Y8bfzKuFEgw1gO6isQKjY97MH5kVwohumW1M:H6wggafvEgw1gOVsQKjY97MH5kVNRWi
MD5:	FB85822299AB83F2DDB8901F5B56861D
SHA1:	CD33299EFDA1BA559873E504001B106AFC9C56C1
SHA-256:	030D610D8CCCE6AABA493A3DBFFB37D0BE07799FC43B440F06BCDE1E3A7977BC
SHA-512:	EDCB45C4AF0E81B0A87DB9318D9A7EA062F6EE42516CCC48A3BFEF3423BB67097DBFDDE12F638FA40D6F563F0CE84685DEFB8B7AFA8F4A7A237B5B18EAB57D5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ......8.....@.......................................... ..X...............8)...........................................................................................rdata..............................@..@.rsrc...X.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1066.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280888
Entropy (8bit):	4.221356410788591
Encrypted:	false
SSDEEP:	3072:+7jHQb3OJJv2Sy5boo+hToMMK8b0y8TI2ZZVfaP6A:+S3OGS+K8X8LZzi
MD5:	F3ABB8BC938B065FE7F896E9B7FBFE1B
SHA1:	98FABBD97D1258AEC7C7710D2294DCC7DFFC192A
SHA-256:	6D07CC2ADC1F8574EAE59A2FDD504CBD122DC8A6865AF70B336F781CCEC757BE
SHA-512:	5C9075239DD23D1A71DEF11737DA04AB95C15D461BB371CE6F2845B27C8C39492AC928B249CEF582532298D3F30111E7AF270EE7542D5FDA2276E75115A2972D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L.....e...........!...&.....................................................@...........@.......................................... .. ............ ..8)...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1067.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	4.745844586954647
Encrypted:	false
SSDEEP:	1536:0VRKRwjihIlKVSYMOv2RLT7KooahF6LAIUjmuJ2DispH1aNv73gsmfAsZATeg9eb:mQyXThwi0Yeg9evQ1rmFqYAK
MD5:	AC312ECC20A86B1570F0C1F480B1DDEA
SHA1:	D0036F51BB48EDD9264C1C674D0DE4DE30DCF332
SHA-256:	54D9F6450EC303A70E98B9D050156A4115D0F40BBEF9DC5844EF3E0EE114A19F
SHA-512:	9DBED2E6380543001BA9D4465F88E64599A5A1EAC680429E81DEE964EABC6547DC2D9BEF4B897E76FB408C413D9F280A464E1A8940B6BE07D58308CB9EB26EDD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....R...............................................p.......9....@.......................................... ...O...........T..8)...........................................................................................rdata..............................@..@.rsrc....O... ...P..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...6...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1068.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	4.299701176412258
Encrypted:	false
SSDEEP:	1536:o8OWtBFOFKSvrNse08AsdUMJ8vlKnMTg0Pg9evRKrmFqYWXd7ogxQ:9JBYxselfGvlKn4xPg9evRKrmFqYqW
MD5:	CA3691D66F8C9A7FEA3F12A75701652E
SHA1:	0958582CFDEE403FF9FDBBBA405FC4FAD944111A
SHA-256:	CEFE2149BEB636C6812C056A0356899DEFFB16DA20A714AF540C96BBC71DC3BD
SHA-512:	F2F9562AA5CDD91CE64B77E691203DB2E70C47B5489EFDA3A94724345EC3C7CBAAAFCB4DAB23A8E6836FCF2F83D0737357598B4734140248875CB1B78E8169B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p...........@.......................................... ...M...........R..8)...........................................................................................rdata..............................@..@.rsrc....M... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..P4...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1071.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106296
Entropy (8bit):	4.68566767027544
Encrypted:	false
SSDEEP:	3072:vIfvxxMq132FYhTaWH1zgdevRKrmFqY8t:33WHc1P
MD5:	1B6CD38C17FC9EA6AA6625D20909857D
SHA1:	D5596E9C10674028EBD501A6FDD70208FC2DB323
SHA-256:	118D69CA068AA2B5A4E069ED41FE550BFE6BC5CABE1849F5282C29791999BC8C
SHA-512:	25AA2B34BEAB5D7845254C3D82667C3E986F43F0709255C1970777AB4BDF0B5A2FBCE87EDEC9F2A7F53D0D02E65FA6A60F61C42D1FC11F3165831F8CE8ADA3A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....t......................................................L=....@.......................................... ...p...........v..8)...........................................................................................rdata..............................@..@.rsrc....p... ...r..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...W...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1079.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98616
Entropy (8bit):	4.810510530524856
Encrypted:	false
SSDEEP:	1536:CMim7E6UZ2gL/VgFvSDKBMTg0Pg9evRKrmFqYWXH7Tx8:HUZ2gLdIvSW4xPg9evRKrmFqYsm
MD5:	CD9EEB0CB04965C4B6B7197BB8986264
SHA1:	0AFE0DFAA8F8F8994913E4B73C22279923A47564
SHA-256:	554B1FE4C064BDA724B2627EB8802E74ED3021EBC9466674042DD8BC3F27BF3C
SHA-512:	C05606E615696900088C13216FAED7117B63A3EFE7AB9813E48B9DE8B17D3C254A569A267EE4F7D93BEF6FC7C90053464CE5724894839471527741B4E401C66B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....V............................................................@.......................................... ..(S...........X..8)...........................................................................................rdata..............................@..@.rsrc...(S... ...T..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...9...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1081.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	273208
Entropy (8bit):	4.291819194202965
Encrypted:	false
SSDEEP:	3072:hpENh0qtd0dvkGCYxmdFch+hThkbX+IErKc/Rdr1c7cMKeBzAWTJ3z+bhAqhnVDP:oFvkM1tkk1JWaMt2
MD5:	8F05F7E058834A60EE85C3A3CEC76DC5
SHA1:	907FDA588BE838A4D1220C2A9F192A1A6674BC3A
SHA-256:	71AA6B02E577450D7DE9A689143C468D23DA9E923542FB53ACDCEE3F00796E33
SHA-512:	85D29B26FC176D9F191D9BAAA8716C59580820CB4C05E448D264F53054DEC8090BB536306D59521A9E4A8261DE03C96EFB24CF3FF41CFEB7D9B12DE9DEF17254
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ....... ....@.......................................... ..x...............8)...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1086.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283960
Entropy (8bit):	3.5965805962316364
Encrypted:	false
SSDEEP:	1536:GX7scKGcHdo1546rRkMuQsulA7VkE2hzAj/nyq2UUc6CnmtCGQSQ1cNXpHWdUlqF:sEGj59FkMuQsuE+hYPyq2UnuC2HzW
MD5:	E2773D73C90E55532166B3219125DE85
SHA1:	67800B2C198F7EF316B484C11591E062977BA764
SHA-256:	8249892FDD5847A4485FE21084629F3574F199E262C03B8F7C624C5A03299650
SHA-512:	2DB2ED20B248BD9070B1B2B189784578E46B340A5CCA095251EC738E13D790A54070282048D5B56D4D4F7D18861BF4B8521A40BE4EEDDE011F15435C04016943
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....*...............................................P......{.....@.......................................... ...'...........,..8)...........................................................................................rdata..............................@..@.rsrc....'... ...(..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1087.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95544
Entropy (8bit):	4.734471160751719
Encrypted:	false
SSDEEP:	1536:S8xbxAJ6vrN4mB/jx+dnwSp69vhdFUxtg0Pg9evRKrmFqYl78x0:1cqJIwlvhv4xPg9evRKrmFqYlB
MD5:	E835EBA92F2C5A5CCB4B599EFC038CE0
SHA1:	6D622B26AE391091A79C3BAD873DF02EEE1FE37D
SHA-256:	D20D0074DD914F9DED67D59D469DA588F8B8CB0EC97BB429309556EBEBE8B383
SHA-512:	B7CD59505A0544AE0D404E93BF449F4329880C2D2C66933183440A0543AF48D4ABAAA9BF48593BD78D4630E094158717E54C7A0A83D7B60ABFE18663427D380E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....J...............................................p......*.....@.......................................... ...F...........L..8)...........................................................................................rdata..............................@..@.rsrc....F... ...H..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..P-...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1090.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107320
Entropy (8bit):	4.222433439461034
Encrypted:	false
SSDEEP:	3072:4UxZ5eiAoalbBP+98CddkERRc5ijjsfaWIG0LwB0spaS26NDdNdmVesHAn4qoqIf:oVMMu
MD5:	DB19E2642911FB0C0FAB498EC4794AF6
SHA1:	B7F1F16495ADEAF0D17AB62415050B151ECBFCDD
SHA-256:	7DC3374254237617AB3D9DF45D495FD298FB049A02945B32586051C67BD06607
SHA-512:	0587F8E60D8AB992539C740D3A9790D6C5515D5A091F43EBEC6809A9D4F6BB72FC7013753696905FADDFC8A026F998891EA99C7D0DB87645872D3B9E81333D8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x.......................................................w....@.......................................... ...u...........z..8)...........................................................................................rdata..............................@..@.rsrc....u... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...[...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1092.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95032
Entropy (8bit):	4.844875701190333
Encrypted:	false
SSDEEP:	1536:N2E8pozpgNaKTnEcNS7vO0MTg0Pg9evRKrmFqY+a7Cq4xh9:3826aKTEcNS7vv4xPg9evRKrmFqY5+q4
MD5:	86FBE7947DD03B137A87E46F3447EEF9
SHA1:	114086DA22F07CF18A213B76BCAD93FE024C32FD
SHA-256:	7956802C0200BEE74515B7D3E50A50F717B98A3BE6E01E6C4149B0BB14101B62
SHA-512:	F8C18F8B18E7B8754D05B2692168E7CFF8FD6BCF96361FE0AD7F20508BED14A52B2E20DE14DC17C604B190575BF198D84A48C29C6F67412ADC69A920F9F80224
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....H...............................................p............@.......................................... ..(E...........J..8)...........................................................................................rdata..............................@..@.rsrc...(E... ...F..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...+...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1093.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276792
Entropy (8bit):	4.350978598702097
Encrypted:	false
SSDEEP:	3072:AFO+67kbZVDyYhn1iKN2zA46ErzsCPvC+xMasNu4CyZtljU3:qskbZVDzhnszAUzsIMaOu4CyZtlG
MD5:	443F4E0EC5A2FC289232AB9D434D5A62
SHA1:	2BB59430EB53B80B035385257E038D548BC22627
SHA-256:	622C70221E70D4462B499CA9828645CF3C16344FF923F483FEAC9B5FC89C13C7
SHA-512:	92D15108D550037E861B6EB7ACDEBEC9953787D92E73C9FD53B5ACCD42FB1E08E7BA3D9CB20CB46AF2BFB0FC76168E7A73F9F0A4C8F0CC52B260CC10D6565004
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0....../.....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1102.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99640
Entropy (8bit):	4.728187060232998
Encrypted:	false
SSDEEP:	1536:7Q+vvrNhPw/3mdwJ3vJbMTg0Pg9evRKrmFqYWXX7OxB:dRh4/cGvZ4xPg9evRKrmFqYwW
MD5:	60F2EF22695F5923C98008BD25EA9BFC
SHA1:	977B4EB59997D5090EE7E8E70E6CF0B76CCA83E4
SHA-256:	DEA7F9F2FCAD74408817D91F9F78AFC01557685A254938B5C25A9DCD3CAA678B
SHA-512:	D0FD4EBE8F4BC5D2C07C6E006412BED7E514CAD48935CBB2D333B0605FB59226252483ED90E70D7A8707DB30119AE2A52599B30A694EB2BAFD1F9EF65DEF1F74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z.......................................................J....@.......................................... ...V...........\..8)...........................................................................................rdata..............................@..@.rsrc....V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..`=...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1104.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	4.755458349414788
Encrypted:	false
SSDEEP:	1536:k6WKkcKSdmT/ya7LLuPaCdx4vOw38M1g0Pg9evRKrmFqYWXk7mxM:RWnSAHaH8vAexPg9evRKrmFqY7n
MD5:	E56C416B45EA2B66429DC196A53EACBB
SHA1:	CCD00677A9429764615E8AB37BD7BA1DAFA9B232
SHA-256:	E6A08000CF62EA8434F9C2A117686AE6895B79BF5CC175D6224CA09B9EDC1471
SHA-512:	CAD8ED8492EBFAC87A973BE33D7576212BF0E273C3BD5206EF6745586B5FF72070990A39BB1CA52189199FBE1533853973CAC04B4022797E5B199CED28474D34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....R...............................................p.......o....@.......................................... ..PN...........T..8)...........................................................................................rdata..............................@..@.rsrc...PN... ...P..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...5...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1109.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102200
Entropy (8bit):	4.6898542181777785
Encrypted:	false
SSDEEP:	1536:mNsWvrNxLllQdwx9veMTg0Pg9evRKrmFqYWX77O2xPc:wsI960ve4xPg9evRKrmFqY0bc
MD5:	C636388E2BA87D2A6205F010D629B4C8
SHA1:	B791A6F5CF8A3E70CD0A5FF6548C582769BE698B
SHA-256:	21B972AD516ABC997EC20AA1C0A5C1BFF2270206663CD190E4F26BF615C673C3
SHA-512:	D93B53A165A29671711EC24304058121D3AC0DBBEFC7FCE00F9C6113BC4C60315A0ED520AC7F58FB7396D96DAC2EF11871D521898D5C1F724551E705A69A58BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....d......................................................J.....@.......................................... ...a...........f..8)...........................................................................................rdata..............................@..@.rsrc....a... ...b..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...H...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1110.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	4.149221296446485
Encrypted:	false
SSDEEP:	1536:PtVvrN/KQEDdwd9vJ2q0EZqMTg0Pg9evRKrmFqYWXh70aRGxe:FL/hE5IvCR4xPg9evRKrmFqYSH7
MD5:	B9D7FF3F308E195B8E0F14CA31FAFBCA
SHA1:	2C015D2A607B6798BAB1332E223FD5A17A6E3426
SHA-256:	6524B51513B71BF04CD6BB2130341EE740DC95643EE49FF736E53F1A4CAEFA89
SHA-512:	1C70A5D946F6302DBF4890CB7F92CD8939404BDBEF16457B04B3A4439820215180904A35327A145C53929085C62D382EE668EA16565C8A41D5643EFDC6914B64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p.......$....@.......................................... ...M...........R..8)...........................................................................................rdata..............................@..@.rsrc....M... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..84...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-1155.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113976
Entropy (8bit):	4.053287008578674
Encrypted:	false
SSDEEP:	3072:Gpg4lMseFlQWOc7tEsGGg7gsaVgdevRKrmFqYlygI:YVx1FZ
MD5:	1AEAE50834932E0222B1ED078431A492
SHA1:	724083CFABA2560D30E65B5CB5C2354878C4804B
SHA-256:	4E19D8A8EC60237DA9840D8D6D44B728D7C0DE01CFB0E94E59FE2DED9F92109A
SHA-512:	8871CFCF9146B1041E7E69F0E3676A7E1F4E188CC6882232440754DD2A87D6144B6E127E6471D2977402792852E985F8EF1890EA53083546AB3EB18FDC34F131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...v...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-2052.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113464
Entropy (8bit):	6.4045303506775095
Encrypted:	false
SSDEEP:	3072:f6SwxE9bxYj80EMxsEsZiDF161Fb3KNTbFhYVYm0MBLYy2nAM:Vl1EsZiDF161Fb3KNTbFhYVYm0MBLb2x
MD5:	5D17951AD220C67E35F6CB76F4C30785
SHA1:	37024A9A709D0E15CB591718F73A7D168E827B90
SHA-256:	3C19C586B56E1D2B1965FE4E1379848AFAF164EDAA34F4738C22A59D38E9A09C
SHA-512:	95F376296ADCC67A85B339FD25DE775DFEA21344F7194137BCA9AFB21E27851C9CE4B33CD15D3D38839F609DE9B53E5FAE51807E973772A8620D3B0831BFC447
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(`...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-2070.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286520
Entropy (8bit):	3.649571862125894
Encrypted:	false
SSDEEP:	3072:zqvgWq94audzAC6y2roL6+USZ5xMXvsE+DgDCCyie9uGPaj:RLufNkr
MD5:	C7AF447B1A7D953DB89F2C3902281EAC
SHA1:	4958777511EA2D003E0E79341CD03A3D4F9DC6CE
SHA-256:	DA41F01C131F9C62DB52D7D41965776D8E3CA5EB4E4266E6A23281C5D0008A44
SHA-512:	6EC62FDE3E1909F6C9F572368B6AA105586F3974068E2E7ECAD808599A556B4AEDD399F34341F5A3AC8EDC758B1EB8D66554DE612AA2B738E2816CCC2A75EA7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....4...............................................`......;M....@.......................................... ..h1...........6..8)...........................................................................................rdata..............................@..@.rsrc...h1... ...2..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-2074.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281912
Entropy (8bit):	3.7545288292453285
Encrypted:	false
SSDEEP:	1536:iX2fj4PVUHqRnku573Rozs2bcoYJ55HccR7lENnYFf1o5t3iap82Sveap6EJ5eGp:4HVN5SioYJ5QnYF+5tB8xxPEQnmOyM
MD5:	239CE9A7F5F02C4C00D1CA1452703601
SHA1:	EE29D4A5AF7768BA71E4D23D9933B6D33DAE65E9
SHA-256:	CAB5396B0EC712C673031F175CBEAA869EA91D88139C1F609FE04B04D4C17A33
SHA-512:	3A9B1D5E0C66C7864CD971B7C066FF7FFAF6317F2E66EF0B1C6786AB4C4412BF2F1A77D6233548C5AC7B75D1F8B78FDD1F0B46D6EBF31BEBA4819651DC296BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&....."...............................................@......;.....@.......................................... ...............$..8)...........................................................................................rdata..............................@..@.rsrc........ ... ..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-3098.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99640
Entropy (8bit):	4.703727010685646
Encrypted:	false
SSDEEP:	1536:maTftzNluN4jjDovp+MTg0Pg9evRKrmFqYWX57DxS:JrlISjDovp+4xPg9evRKrmFqYWE
MD5:	3AA49BB2B9A2CB82D45BBAA687802F59
SHA1:	9116A0429241542B22D7433CE89709EFF5BF4ACF
SHA-256:	5FAB3F5F8688515903C55F503FC7A2DF41548F7C5C904DF5A24DC76E6DF2AF26
SHA-512:	00D3378155FADB803B27019E176471E59C2715415BA446216CE0CFA86DC875DF031AF616A498CCAF67FEFF03163F036AE398F87E8801A268413386A0C7E8384F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z............................................................@.......................................... ...V...........\..8)...........................................................................................rdata..............................@..@.rsrc....V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...<...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-5146.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102712
Entropy (8bit):	4.171575155855462
Encrypted:	false
SSDEEP:	1536:0WTdQdr3+167bBBAOe6wCBjviagdevRKrmFqYUS73xS:RBB6HvAOQCJRgdevRKrmFqYPM
MD5:	18E2B274058099603D1A1E3F8B6AF2E4
SHA1:	BE1D1A00A4EEDED76FDF90B5AD95A2E04571AACE
SHA-256:	72F2E3FF23821F654938141ECDF65904E467863045FA250BB7E913532D01D126
SHA-512:	DAB43804508265C41A49AB931F01E1DF7DC8E3B2EB9FEA29D47365B6161B23A46630F1D97376DF5B94B2767F9CF3AB77898507A728C0E38378640299E7EE335E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....f....................................................../j....@.......................................... ...b...........h..8)...........................................................................................rdata..............................@..@.rsrc....b... ...d..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...I...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Lang\lang-9999.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101176
Entropy (8bit):	4.729989733399104
Encrypted:	false
SSDEEP:	1536:kHIbKpE+8vrNGbxN8nIvfS+kMTg0Pg9evRKrmFqYWXK7fxHA:P6SIvbk4xPg9evRKrmFqYtS
MD5:	41A02B9950D0F62FD603F5C07F127FCF
SHA1:	B5778E3C5C5496C23A4A808199D63A53D7F385FB
SHA-256:	A0512B624E6A0512488A3EF49DFE041C0B63AB0F5396240882B08E898C00989F
SHA-512:	80E7335D728FAF26CB365415F55706C0861276BAEFC1E649F0E8F989C65872EA85508C4CE8B41C005AC08A424DEB68A8CCE30B98AEEA82C9B783E1667216C980
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....`............................................................@.......................................... ...\...........b..8)...........................................................................................rdata..............................@..@.rsrc....\... ...^..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...C...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	480648
Entropy (8bit):	6.655759441527599
Encrypted:	false
SSDEEP:	12288:KptzeTYZP443n/q6LQX5uNllmSJIbbEcgSZ5MQUszT:KptzeKP443nCuQKgSJITgybUsf
MD5:	FE6F58FB55D9A93502528C3C9BB13A3F
SHA1:	516275DDDBC9E2F056342201B03A0931D93A6239
SHA-256:	C427BCF6B065EDF06662E0540E3E9A21C07095184E7BB9D05926DC3B79FC3348
SHA-512:	7F45F187D6C3156B89E2DAF0C2BFDC60A59140FF94F8255FA672422ABC43AA1252B0FE0FA0A3EF675F9E71C33B26424597C015DB83DEC7F5E20EE8769C61C619
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........I...I...I...&..[...&....&..^.......J.....z.K...r...^...r...$...r...j...@...P...I...S...............H.....B.H...I.*.H.......H...RichI...........................PE..L....5.[...........!.....8...........R.......P............................................@A............................l........... ..8...........H4..@!...0...H..0W..p....................W.......W..@............P...............................text...:6.......8.................. ..`.rdata.......P.......<..............@..@.data...P9.......&..................@....tls................................@....rsrc...8.... ......................@..@.reloc...H...0...J..................@..B........................................................................................................................................................................................................................

C:\Program Files\CCleaner\Setup\a6ad0008-1852-4a11-a99f-a3ca58c3b06c.ini

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	Generic INItialization configuration [Signature]
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.950846800752146
Encrypted:	false
SSDEEP:	3:YgB4kRzoGJAEuQwGBL/ARRKJArLr4AMVGVWJovmwA4NfeE63sSVS/rJC2zbkVQn:YybOUwGBgRzGwgYmwAqWEdHQ236Qn
MD5:	2AF9F69DF769F876F6E02DA18E966020
SHA1:	5D21312D9BD23A498A294844778C49641A63D5E2
SHA-256:	473D48A44A348F6C547AEFD2C60DD4B9DE0092E1FB94A7611BDD374783EF3B2C
SHA-512:	A4705E5491CF03867FD46E63293181BF761D04FE0CCCB86E373DD567C68D646634F64EF95D5B910D2266468B93BF7CDF6F9ACBF576C6F42A4FF6C3CAA09D2274
Malicious:	false
Preview:	[Patches_dll]..5=http://ccleaner.tools.avcdn.net/tools/ccleaner/update/20180205.dll..[Signature]..s{...,ZQ]~..7..C5.R..+...s- .zy...nn..~.r@.X(.WJ..8t..n..%k.ASWSig2B

C:\Program Files\CCleaner\Setup\a7887a58-7a5c-4d85-8db0-b95adb9d8dee.xml

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.3325861603048565
Encrypted:	false
SSDEEP:	24:2dKAAierZHv4H6hc8AieaBHtH6hUzoAiezSBX9PUUk:cuietwaKjieGNaUieyxnk
MD5:	630C4EE79D3F33EC45DB18933DEFA13A
SHA1:	62ED2F4A1BC61111CE8B083144369E27FC9D4E59
SHA-256:	58EF4236F552A2965B8F61B1AE1FC00354F425B77C7FE0B8D9FC9A3471E891D5
SHA-512:	4AE480AF2DFBED8A7AB76DC53D59999D686E3445289FB7FAC82E5FF2DA7C01A11B4ED54B2D77C028C693F0D145EE3A99512C79185AAE2EF97852B2155F57B489
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<aswmicroupdates version="3">.. <update url="http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate10.cab" mversion="10"/>. .</aswmicroupdates>..<aswmicroupdates version="9">.<condition version_c="(+=)6278" os_c="(+=)6.1">. <condition version_c="(-=)9727">. <update url="http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate029.cab" mversion="29"/>. </condition>.</condition>.<condition version_c="(+=)9825" os_c="(+=)6.1">. <condition version_c="(-=)10897">. <update url="http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate041.cab" mversion="41"/>. </condition>.</condition>.</aswmicroupdates>.ASWSig2A532598D464F3BD831F541059510957410ED88333D7D052C474E1C2AB53BE440B4F73F2125AEF4D40A29770636A74F2B9BBC4D605BAEE1635C390B1C26C9FAF3FASWSig2A

C:\Program Files\CCleaner\Setup\config.def

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.106377316818027
Encrypted:	false
SSDEEP:	3:XvVP2vn:tA
MD5:	05927E894C81EB42C3B4DAE5A5A6C937
SHA1:	7EC0660AAC7C3396599447A49F30BA18E1F0DB49
SHA-256:	09C65B39BC891E12956AB7BB30FAE147EF7C8FA37542B6F040613436B566E7F8
SHA-512:	C06E2788952A3550597F5B539CF8F5CF7A569E33192951BC8CE97D4570BD4BA35ABCE99586F309F3E1CFFE6F1D83AEE98B79C0C26503EF4CD4D1FBFB40E1BA4E
Malicious:	false
Preview:	[common]..DumpReporting=1..

C:\Program Files\CCleaner\gcapi_17090555521820.dll (copy)

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	758272
Entropy (8bit):	6.544177497925195
Encrypted:	false
SSDEEP:	12288:06hpgkDPRqJpEhD5WCcZle6qZ5eR5+nRognE:XpgkD5qEhUZgFxM
MD5:	F17F96322F8741FE86699963A1812897
SHA1:	A8433CAB1DEB9C128C745057A809B42110001F55
SHA-256:	8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
SHA-512:	F10586F650A5D602287E6E7AEEAF688B275F0606E20551A70EA616999579ACDF7EA2F10CEBCFAA817DAE4A2FC9076E7FA5B74D9C4B38878FBF590FFE0E7D81C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Pt.^.........." ................0M.......................................@............`..........................................f.......h..........x........V........... ......\|e.......................c..(.......0............n...............................text............................... ..`.rdata..L...........................@..@.data...D}.......4..................@....pdata...V.......X..................@..@.00cfg..(............r..............@..@.tls.................t..............@..._RDATA...............v..............@..@.rsrc...x............x..............@..@.reloc....... .......~..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\gcapi_17090555793612.dll (copy)

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	758272
Entropy (8bit):	6.544177497925195
Encrypted:	false
SSDEEP:	12288:06hpgkDPRqJpEhD5WCcZle6qZ5eR5+nRognE:XpgkD5qEhUZgFxM
MD5:	F17F96322F8741FE86699963A1812897
SHA1:	A8433CAB1DEB9C128C745057A809B42110001F55
SHA-256:	8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
SHA-512:	F10586F650A5D602287E6E7AEEAF688B275F0606E20551A70EA616999579ACDF7EA2F10CEBCFAA817DAE4A2FC9076E7FA5B74D9C4B38878FBF590FFE0E7D81C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Pt.^.........." ................0M.......................................@............`..........................................f.......h..........x........V........... ......\|e.......................c..(.......0............n...............................text............................... ..`.rdata..L...........................@..@.data...D}.......4..................@....pdata...V.......X..................@..@.00cfg..(............r..............@..@.tls.................t..............@..._RDATA...............v..............@..@.rsrc...x............x..............@..@.reloc....... .......~..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\gcapi_dll.dll

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	758272
Entropy (8bit):	6.544177497925195
Encrypted:	false
SSDEEP:	12288:06hpgkDPRqJpEhD5WCcZle6qZ5eR5+nRognE:XpgkD5qEhUZgFxM
MD5:	F17F96322F8741FE86699963A1812897
SHA1:	A8433CAB1DEB9C128C745057A809B42110001F55
SHA-256:	8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
SHA-512:	F10586F650A5D602287E6E7AEEAF688B275F0606E20551A70EA616999579ACDF7EA2F10CEBCFAA817DAE4A2FC9076E7FA5B74D9C4B38878FBF590FFE0E7D81C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Pt.^.........." ................0M.......................................@............`..........................................f.......h..........x........V........... ......\|e.......................c..(.......0............n...............................text............................... ..`.rdata..L...........................@..@.data...D}.......4..................@....pdata...V.......X..................@..@.00cfg..(............r..............@..@.tls.................t..............@..._RDATA...............v..............@..@.rsrc...x............x..............@..@.reloc....... .......~..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\libwaapi.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1041712
Entropy (8bit):	6.257191154355353
Encrypted:	false
SSDEEP:	24576:h7cZHgutkiO02wtq4wTtKg3zeonxYJq3fP:2vSwtq4wTtKezeoxn3
MD5:	3CCC58D1603B95452743CB86F67F7F8A
SHA1:	6897B4AD545D81C9FE2CF4ECF987093E5CB03489
SHA-256:	86E681D8DFFB560D73CA0D2523E6AEA4CEDD97035A65EB8F1B8D0BC86214D148
SHA-512:	28502F8D832B49FFB624323E725D170F2B1A3756C1A4D5F29172B603BF451CD55FCAD94673FB56CC7E6767246F854A15BF09A35A513AC1D96A9AF2B0D2178834
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..n...n...n...z...d...z...{...z......U...f......l...U.......U...K...z...b.......k...n..........g.......o.....$.o...n.L.o.......o...Richn...........PE..d.....0e.........." .....<...\|......0[.......................................0............`A.........................................q......\r...............`...\|......0)......P...`y..p...................hz..(....y...............P...............................text....;.......<.................. ..`.rdata.......P.......@..............@..@.data...4r.......R..................@....pdata...\|...`...~..................@..@.tls................................@....gehcont............................@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................

C:\Program Files\CCleaner\libwaheap.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103216
Entropy (8bit):	6.18754181483796
Encrypted:	false
SSDEEP:	3072:IA8EMdY59enGtW/zc7fKJP5MbA5kVq1bpa:X64iGtAz0fUXFw
MD5:	B1114307AC17601B7070A5E45B35D7A2
SHA1:	378A15C5CB3006C5B9B253F549183E1E47D04A49
SHA-256:	3591FABFBC4AD6DE7FA9D5325CF7163C43FB73D82AFD12C4D6DE03B739FD1F3E
SHA-512:	1CE1CE32C9CA10960A7668BC564906C690AFFE11ECE0057989709C5044835CE3AC3DA833996BB8436AE48FC3B0BEC3B272EF27ADAAF711863778DFE67850FAFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;..PZ.PZ.PZ.D1.TZ.D1..[Z.D1...Z.k..WZ.k...DZ.k...@Z.D1.SZ.PZ..Z.....QZ....QZ.....QZ.PZe.QZ....QZ.RichPZ.................PE..d.....0e.........." ................@.....................................................`A.........................................Q..L....R..(....................j..0)...........C..p............................C..................8............................text............................... ..`.rdata..............................@..@.data........`.......@..............@....pdata...............J..............@..@.gehcont.............X..............@..@.rsrc................Z..............@..@.reloc...............b..............@..B........................................................................................................................................................................................

C:\Program Files\CCleaner\libwalocal.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1837360
Entropy (8bit):	6.413534928713407
Encrypted:	false
SSDEEP:	24576:CJ/lT2ZCfpeVmJCavQUfBa+Zgrb1tONaCWt+Dh+SnZneQIBNw9E8UQhSCIB/k79:K/lT2Z+pJC4ZzFbZeTNw9RUQ8C8C
MD5:	562DE4B9DBB51BEC9361B832B5EFBFF7
SHA1:	5B512F449914D4DEB4D1E4FA4D467946068AF1C1
SHA-256:	C3C99B98F69FBDC9654DC368EF699314F88158AA190DF9BF950010E6DF242754
SHA-512:	AAB5EB532C44B47E1F184301389662F7786C938E6821DBAC105C8180728D31348B613863868EF96F4EE413C3E3EB54B00D5047E055139657A16295A3A97421F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$................................a.....W6...............................................................f.........Rich...........................PE..d...s.0e.........." .........V...... X.......................................P............`A................................................4/...............0..p.......0)... ...%..`...p............................................................................text............................... ..`.rdata..............................@..@.data............n...r..............@....pdata..p....0......................@..@.gehcont............................@..@.rsrc...............................@..@.reloc...%... ...&..................@..B................................................................................................................................................

C:\Program Files\CCleaner\libwaresource.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4515120
Entropy (8bit):	7.999933786393098
Encrypted:	true
SSDEEP:	98304:5UjpsPy56I+DB78mG55bG4efxY3JJxoFCrOXuzgxYLZPOhr:5UeDt78mg5bG4eYJKXZxYlPOp
MD5:	E7C2840726F82903369B546F5A0C1648
SHA1:	F9111B72995D50A03FB884441FFB14831D6051E7
SHA-256:	E8E0417E309B4C0B30DF01007F3DB403E0B49447D376E05B0035B0BBAD21C238
SHA-512:	1ECCD80ED67A5432FC0DD54C3D16EAEBAE96775533DFD348C75F783C452C5DDBD4EF10671FB68A15F73116860BA44AA53739E059B30B63D81174C84944999010
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.............Us~.............Us......Rich............PE..L.....0e...........!..........D...............................................D.....&.E...@.......................................... ..`.D...........D.0)..............p............................................................................rdata..............................@..@.rsrc...`.D.. ....D.................@..@......0e........*...p...p.........0e..........................0e........T.................0e....................RSDS..=.i.B.=.4..E.....libwaresource.pdb.......................GCTL....p....rdata..p........rdata$zzzdbg.... .......rsrc$01.....#..0.D..rsrc$02........................................................................................................................................................................................................................................

C:\Program Files\CCleaner\libwautils.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3462448
Entropy (8bit):	6.255819621486704
Encrypted:	false
SSDEEP:	49152:2L/8FvBwoS3yivd9sly6q4wTRWUJql/iTPoNnt0lv356AFUtfV:+CCO/UJSE1v3568UX
MD5:	7F85A76EB93F63BBE75352A7F212D848
SHA1:	D007D0871C357E0CDA036AD227C3A2F4D8A6B88A
SHA-256:	CFE4D9C799C377609309AABDE6DE25F956333D68A76413E56AE3D5F4524D1ED4
SHA-512:	2A9B0733A03751EA2571114BB8BBB9A4336B9681A5EB4886EEC4ABD55171DDDC92D1C8430395B9D12C01CBCBF83A9D8A4B457C07EA00467B96D08E49154E40F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........!..r..r..r...s..r...s).r...s..rtEar..r..s..r..s..r...s..r...s..r..s..r}..s..r...s..r..r..r-..s..r}..s..rx..s..r}..s..rx.Yr..r..1r..r}..s..rRich..r........................PE..d.....0e.........." ......!..................................................P9.....~.4...`A........................................ .0.L...lw2.......9.......7..9....4.0)... 9..'....).p.....................).(...`.#.............. !.@...@.0.@....................text.....!.......!................. ..`.rdata...~... !.......!.............@..@.data.........2.......2.............@....pdata...9....7..:...<3.............@..@.didat..0.....8......v4.............@....tls....a.....8......x4.............@....gehcont$.....9......z4.............@..@.rsrc.........9......\|4.............@..@.reloc...'... 9..(....4.............@..B................................................

C:\Program Files\CCleaner\libwavmodapi.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3948848
Entropy (8bit):	6.430243612285626
Encrypted:	false
SSDEEP:	98304:rouzdB3nWhNs/mMbPk/68nf1Vw2cKoFHheyG:rlzdB3nWhNs/mIPk/68nf1Vw2cKoxgyG
MD5:	FA4883EF89BABDA6C2E986C464B613BE
SHA1:	81B1A8103920E3CBC336CE22AD4E0C7FA1540681
SHA-256:	CFE0101AB49439B75FF1E13DF05ECAC59A54A329B6CB830480C3635A2EB531F3
SHA-512:	17DC2C6F2FAF23FCF78F8CF285453C4EC7F0576B8F32395FECB9D1D39F1321C2B67DE67916CEF6DBE62DF9E676CE5A1345A41D0C5B45A4B118C12EE06C8D8A10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........&.o.Gf<.Gf<.Gf<.,b=.Gf<.,e=.Gf<.,c=VGf<.(.<.Gf<J3b=.Gf<J3e=.Gf<.,`=.Gf<J3c=.Gf<..g=.Gf<P2b=.Gf<.,g=.Gf<.Gg<bFf<H3c=.Gf<H3f=.Gf<H3.<.Gf<.G.<.Gf<H3d=.Gf<Rich.Gf<........................PE..d.....0e.........." ......1.........`.).......................................<......j<...`A........................................ .9.......9.@....`<.......;..:....<.0)...p<......+6.T....................-6.(...@,6.8............01.`............................text.....1.......1................. ..`.rdata..V&...01..(....1.............@..@.data...T....`:..l...F:.............@....pdata...:....;..<....:.............@..@_RDATA.......P<.......;.............@..@.rsrc........`<.......;.............@..@.reloc.......p<.. ....;.............@..B................................................................................................................................................

C:\Program Files\CCleaner\uninst.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	4555928
Entropy (8bit):	7.996503184154882
Encrypted:	true
SSDEEP:	98304:178Cs5WqIh07z+zwOm8/YArunsQLRyFDZQek7PS3moxX28Y:1w7JIh07z+oXA6nsCYllCPS3LJ
MD5:	14267E477BCF2808014011DF4A456226
SHA1:	14C5782C182385C844D793F8A3449A937645BA79
SHA-256:	CDD69A0BC8B59E23D97EBFD0ABEB18FF2D3F87D14C52546C288956AAFE4BDCEC
SHA-512:	7CB5A750295FB53513136A5535E27EAE6A3A6A7E99C87BD683736B4AF96724215F746237B79E29B6F708D60D1DBED04FA1D2AACB7510BC367CBADBE5ECC4652B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h.......@..@6............@..........................`A......rF...@...........................................@..............,E..W...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...xc..........................@....ndata....9..............................rsrc.........@.....................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\wa_3rd_party_host_64.exe

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2779440
Entropy (8bit):	6.389169487998044
Encrypted:	false
SSDEEP:	49152:jiRFAlEU3fKB58D+3l68ZjrqMq1/DByEW5k:jiRuL3fa8P1/NJ
MD5:	9E5E2D7147F01E5E92A31B092F57FC95
SHA1:	91885377A370ED1136C1D22349030806842D5E4D
SHA-256:	A36AC245BC037D63D3359166174A1C1854AC0DDF580E02EAAAA4A1EB0AB40685
SHA-512:	562996CD6273ACE2FAD48EBBEFFDE4F4E6FFB3D2D557999BAA0E6302B561F30EFCE4E96EF460DF5EF650E3CB47D0E74C7245C77FBF70913C2857C9D7529AF913
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......).p.m...m...m...y...a...y.........o.......n...V...d...V...E...V......y...o...y...{...y...\|...m...I......~.......?.......l.......l...m...l.......l...Richm...........................PE..d.....0e.........."..........L.......[.........@....................................Y+...`...........................................'.X.....'......p.\?....(..^...@.0).....h(....#.p.....................#.(....!.......................'.@....................text...,........................... ..`.rdata..b...........................@..@.data.........'.......'.............@....pdata...^....(..`...p(.............@..@.didat.. ....@.......).............@....tls.........P.......).............@....gehcont$....`.......).............@..@.rsrc...\?...p..@....).............@..@.reloc..h(..........*.............@..B................................................................

C:\ProgramData\AVG\Icarus\Logs\sfx.log

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1326), with CRLF line terminators
Category:	dropped
Size (bytes):	10769
Entropy (8bit):	5.471992901212597
Encrypted:	false
SSDEEP:	192:rOX6HCfndgPpMJHb/XPkn5BGKyQr7GrAvrdl3rrrkrd:EgC1gPpMJHbvPEGKyQr7GrAvrXrrrkrd
MD5:	389E09B9232FB7F065236C0C755D194A
SHA1:	94107AA624892646192167CEA16A1A781FFE490A
SHA-256:	27D819F67CA5D5D1E1CB17D6DE77E1CFE23E0620B208775792F0A871C0F2797C
SHA-512:	4CDC5DFA390F617CB8CF90976492CF4F8BF51385D5CD60520D5D72C77B8853759982D51175A04D9918B333BD847809676F165A172D283B0C32F30DA84E48ECF0
Malicious:	false
Preview:	.[2024-02-27 17:39:23.183] [info ] [isfx ] [ 6312: 6252] [B828DB: 199] * Starting SFX (24.1.6758.0), System(Windows 10 (10.0.19045) x64) *..[2024-02-27 17:39:23.183] [info ] [isfx ] [ 6312: 6252] [B828DB: 200] launched by:'6248-C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe'..[2024-02-27 17:39:23.551] [debug ] [isfx ] [ 6312: 6260] [B8059A: 61] Sending report data: ({"record":[{"event":{"type":25,"subtype":1,"request_id":"d21e873a-74e8-44c4-8372-f934a1ecf807","time":1709060730979},"setup":{"common":{"operation":"install","session_id":"a08dcfa1-7b47-48ad-af19-cdaa4e470b06","stage":"sfx-start","title":""},"product":{"name":"sfx"},"config":{"main_products":[{"product":"avg-av","channel":""}],"sfx_ver":"24.1.6758.0","trigger":"6248-C:\\Users\\user\\AppData\\Local\\Temp\\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\\Microstub.exe","cmdline":"C:\\Windows\\Temp\\asw.d2a83021bf4cad31\\avg_antivirus_free_online_setup

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.ccleaner.com/ccleaner>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.550468962332913
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4YiyZhJArynQPKd4ovn:HRYFVm/r4Y9A+Qydlvn
MD5:	E874843904A42397C1A78C267F1A85E7
SHA1:	56D970E6F25001089700706F484366C32FD7B644
SHA-256:	D037CA0BE3BB7853C2A7A540AF9E60A99C349210FBDAE5618825766B18C6C06D
SHA-512:	8C244BFCFB0596F222AD4F62CA6BDDBA179250411F107B8E89D404496D489301B909CE905A0266D97E4E2FF1F412860A2DFCB9E7562006B5A147AA78F764851C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.ccleaner.com/ccleaner..IconFile=..IconIndex=0..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Feb 5 16:18:54 2024, mtime=Tue Feb 27 16:38:29 2024, atime=Mon Feb 5 16:18:54 2024, length=45018016, window=hide
Category:	dropped
Size (bytes):	881
Entropy (8bit):	4.492498458165165
Encrypted:	false
SSDEEP:	12:8mYh20YXyyi1h9OmudpF4yYCqXBzl6o4pOjAjO4RkbdpzCbdpNspWcmV:8mCyi5ud+CqxzlipyAXwddGdTspZm
MD5:	3C2677F45E5C647FB454DA8A5CC7A0D2
SHA1:	D61B2F48C0EE43C72D0F333C70CDDC58D9D0959D
SHA-256:	3F26C34456EC89FA3AEE01DAC4B2F04C6FDE459118795D9FF10EBDCD4FEB82DF
SHA-512:	47B7AF8083BB1C872C214E10B2488865E6B3F7DF8A7AD77E3EF270512C85F85DD5457D734D901876E9AAF36DF80A17A9F186ADF074FB23200438305E0E84DB79
Malicious:	false
Preview:	L..................F.... ......dWX...l..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r.....................F...C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.`.......X.......571345...........hT..CrF.f4... .eL......./....%..hT..CrF.f4... .eL......./....%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\Public\Desktop\CCleaner.lnk

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Feb 5 16:18:54 2024, mtime=Tue Feb 27 16:38:25 2024, atime=Mon Feb 5 16:18:54 2024, length=45018016, window=hide
Category:	dropped
Size (bytes):	863
Entropy (8bit):	4.516456905645636
Encrypted:	false
SSDEEP:	12:8m8h20YXyyi1h9OmudpF4yYCqXBzl6o4pOjAjOAbdpzCbdpNspWcmV:8m+yi5ud+CqxzlipyAFddGdTspZm
MD5:	6AC7016A2FCB9031E7F63D1CF0E3C544
SHA1:	380F9C65DC56071D185FAC876633DD256B2A9149
SHA-256:	6865501FADE2B2D7DAC73EBDE970EB08028CE5290B4794EA54D1AD965B615B52
SHA-512:	1D57F937FC9088D330D26A4C7F2F45FB21FD53947CF1BEEB9F34CE3E549BA5BC48EF2DA029DDDE85384439661E9826D3E72AB7474D5368216EAF35C22EB4F427
Malicious:	false
Preview:	L..................F.... ......dWX..YN..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r.....................F...C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe........\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.`.......X.......571345...........hT..CrF.f4... .eL......./....%..hT..CrF.f4... .eL......./....%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000002.dbtmp

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.374413240586206
Encrypted:	false
SSDEEP:	12:7lWaZ0kwjSFsnEtMESVNsxU/t6Rzz5xXdFBOstZ2OUwPtsBbt:RWaZ0kwuGEtFSVO2tEXdF9tH0bt
MD5:	3A2304971DE1C3C2386AE53EA688BC60
SHA1:	7548D99666441945D2868FA59E677359299D6F15
SHA-256:	1BD33BDD15082961223F38A70FC1ED16754E8AE0EE32D476581EF7E73CD86BC1
SHA-512:	AE80909D54F7477313150F3F42F072754248D0F22E762011D56336CC75A6267172EDC901DAB2258D124FA379746F8FA3BEFEF8366A47EC2F0F0056724DACFDBB
Malicious:	true
Preview:	.%.META:https://www.ccleaner.com......................VERSION........1.,+_https://www.ccleaner.com.._cc_trSrc.........{"value":"007_z8b","expiry":1709062724229}...hjLocalStorageTest.........*.adal_out_queue_adalyserTracker_get.........[].:.com.adobe.reactor.core.visitorTracking.pagesViewed.........1B..sessionCount.........1...lastExternalReferrer.........empty/..Time.........1709055527147..%i_adsId.........ccc2390f-36d5-4081-bead-9ed05ac00137...modernizr.................Mr.Q..............`.....................Bf1........................................W...$uG.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000002

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.13481327242705
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVF3NFluEx74illWDSLYiyZblk3OrSLYiyZdE:oO7F31Zx74clWOLYs3OGLYnE
MD5:	B671CA091041BAF9011A07C9C67D7B2D
SHA1:	BBE006F33A25FF6D9B8821556C6A60329665E8B6
SHA-256:	CDEDC4A74F6AC01A44661DD56BFCDACAF705CE733342608180E2B93EA8D35626
SHA-512:	38C82314C2EBE6ACFAA7332492A9130468AEDEB0FEB43637D3DAAB592B3C3FB809A9894140F0428EAF36C42B895FAD1B779B0DA1665267A527AA3D771D0C7BA9
Malicious:	false
Preview:	V........leveldb.BytewiseComparatorS..`...............%META:https://www.ccleaner.com........,_https://www.ccleaner.com..modernizr........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000002.dbtmp

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.465801297462397
Encrypted:	false
SSDEEP:	3:tR4M73fRKsAWZmwv29M73fRKd9JAR1V879M73fRKd9JAR1WFv:r7MsXZmw+K7MdrA7VeK7MdrA7g
MD5:	32CA83448E64A6F15DCE706F0DC7B11D
SHA1:	FDFBE4952FC3BAFD4E6A866B39322730C7F493D7
SHA-256:	0E42B7733967E85D6C83E9268F59857369EB0F2434519EDD80CFFB1ED9E73541
SHA-512:	1D05CD8FFD74B0BC910DBE42D4D2C492984056C09E9662207491BC116CDE0022C47B0373EE836752D4CAC4287C73F2283CDF24153424568AF7AAE48390389F52
Malicious:	false
Preview:	2024/02/27-18:45:45.000336 5d0 Recovering log #3.2024/02/27-18:45:45.000352 5d0 Delete type=0 #3.2024/02/27-18:45:45.000352 5d0 Delete type=3 #1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000002

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.988758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVKceul:oO7Deul
MD5:	64486E4C658733375B5B98EB7DCA49FF
SHA1:	FCAE1102348CBAB75E16C45901C9EE9974A87BC3
SHA-256:	D420B162415FF7ED4B23DA14CEE4FFC3E89B288951AB5EFE8965266367D6B370
SHA-512:	A216F7A9508C011889B6859F377D7E4BA6A3DBA794A04206C759D7A41910B73C87BF62DB0AD71054D33AD3375D7DB005521C9851E3EE8F32F6388A586F78A3BF
Malicious:	false
Preview:	V........leveldb.BytewiseComparator\.j............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Roboto-Medium-v1[1].ttf

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Med
Category:	dropped
Size (bytes):	168644
Entropy (8bit):	6.50869331396147
Encrypted:	false
SSDEEP:	3072:wqmtn5wkex8r6Qym7KCkygAKuXylCC9ptSUXl8j/6afWRCgqdhASD/80/:n25wklN7T3QtSUXz7XfST80/
MD5:	68EA4734CF86BD544650AEE05137D7BB
SHA1:	3C6A09FCC6A454924C81AF7DFF94FC6D399ED79B
SHA-256:	9D0D55A303BFD13B79A87721F65185E93F235E2D77FE398B2DCA67AC519915F5
SHA-512:	5D55A41B845F3A3AE9B08CEE5258348DFD83DAC5F0A0E48159CD85C141C614A02F8F474FA683D2BFBC451D49DD3B749820662D403B2E3FD3F16A242EACA64115
Malicious:	false
Preview:	........... GDEF.B.........bGPOS...i......e.GSUBz..w..}4....OS/2.....<...`cmap..Qm........cvt 1..K...H...\fpgm..$....8....gasp............glyf/......,...<hdmxd.t.........head...r......6hhea...........$hmtx..M........8loca..n........maxp.>.....h... name>.mR........post.m.d...t... prep...).......S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\app_cc_pro_trialkey[1]

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.8035088547976788
Encrypted:	false
SSDEEP:	3:xoSrzIObn:xhjbn
MD5:	4ACA4C7925AEEE3811270ADC068F1D94
SHA1:	9B5F502C4F8FD9DDC7C3DC46C60E8295A5FD46CE
SHA-256:	07D064338089968431DCC1FE0E7731E9234B2E34CE5D41E86EA39E856779041C
SHA-512:	159D5FB689CF6AD99F8DC4BD62262552530AD57B273E54BEBC451D8CAB2F46206C56C898E8FB84AC4FEAC377B40F1E2CACE6DCD680BA515633B8C9F6AE860EC5
Malicious:	false
Preview:	CJ9T-J7CU-SPNV-GWMB-WBEC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\icon-blue-dot-v1[1].png

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PNG image data, 5 x 5, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.038549544620154
Encrypted:	false
SSDEEP:	3:yionv//thPlgqTAly42/uDlhlp8Lts7CX9/ixdkwubKQNneHhnxxEWY86x/aNwP2:6v/lhP+qTAs/6TsR/gkbFeBn3EWY8618
MD5:	348D7FC7AD2283B358B96195A633B62E
SHA1:	572F8ECCA37039815DC9AF00F19E48A8B6F756BA
SHA-256:	7DE129B5BEBF3860770D42665E76458967DD7E1C6D6E8E23E5178BE16D28F665
SHA-512:	E96D3642C1402C31F3CF15D8BD3C3DB7693A1A4348DE38B625BC40E31CD21450AB4BA55E77753675164689ECBAC5E538B4161E37C3AD47721925E6FE92D02D75
Malicious:	false
Preview:	.PNG........IHDR..............o&.....pHYs.................sRGB.........gAMA......a....UIDATx.U....0........!#.BF`.6b.JZF.:D.'..Q...3..Z^u...@L\|...;..Q.S..m(.C....e 7..LHd.....[5Q9.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\10[1].json

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:YVXK+W9:Y9K+W9
MD5:	8FBB197A46BFBC0877ECDE22EE21B582
SHA1:	598480CDC624A167BA58F96B0F79FC9C85DC193D
SHA-256:	A92C5B1252BD5AFBC6BA9E5783FCFF146188FF715DEE96CFE5F437AE7A125CB3
SHA-512:	0AF8A3610A164852A653CBA039AEEB77EA037B2684A66CA52029A87E3E8028896CFC37D48B302519D1C909D0619669448F88F3F44D128DF35167F495894CAB1A
Malicious:	false
Preview:	{"processed": true}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Roboto-Bold-v1[1].ttf

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.001150; 2014Roboto
Category:	dropped
Size (bytes):	162464
Entropy (8bit):	6.524438741684788
Encrypted:	false
SSDEEP:	3072:x6X+/XYXXXXXXP9kPbVQdSZr/OkS98QSADOy9w4zb4VB22knj+1NmLVhygfTZluN:x+yZQMOJZDboVB22k5zTW+w
MD5:	D329CC8B34667F114A95422AAAD1B063
SHA1:	0A1793926E2EE724CF2FF3FC7ADC745348659F82
SHA-256:	EF2AB0E402D5CB9DE893E263A2C44E57F57FEC3974B0D981BFE84DEC3DAE83A1
SHA-512:	34B78978F62FD447C60654E4BE36877EB95AE9B7F616CA59858D2251C47825EEEBEAFD04D317D1E36D4C0FA9122A94D0140A81B2EE69FB08A3237EAC4279BCFC
Malicious:	false
Preview:	........... GDEF.5.5.......DGPOSZ.61...<..Y\|GSUB.2....b.....OS/2..........`cmap@&Hr...\|....cvt .N$.../....BfpgmS.W...-D....gasp............glyf.u./..9....vhdmxWHS7........head.......,...6hhea.&.....d...$hmtxT...........loca....../.....maxp........... name7.c....(....post.m.d....... prep.6~.../..............F>._.<...................N..0.....s.................l.......0.5...............................N.................................3.......3.....f..................P.!....!....GOOG. .........f.... ........:... . .....d.................-.\|...@...@...\..._.@.G.K.?...\|...(.....^.9...#...n.S.~......._.......F...@...7...i...d...=..._...V.B.}...9...6.....".x...-.).K.b.......<.V.3.......b...s.^.....U...x.(.....U.............V.).....T.......E...(.D.t.;.....#...........I.9.x.`...9.....,.......4.J.D...o.,.B...B.S.H.......E.z.h...m.....F.o...~...o.{.i...B...o...B...o...8.....z.h...................J...0.......".0.j.B.....c...c...Q...........\...].F.V.......M.i.~.F.V.......~.L.Y...7...0...e.......K

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\info[1].json

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	4.957495515140646
Encrypted:	false
SSDEEP:	6:YMMLUg0Ps7XK4d+2pHMAaNmXHNA8R3b5AW+1ChmzUM29fNxpDrCJInHEEL1nHIK:Yk1I6++2pHMAaNmTR3h+imQM29fx3Kbu
MD5:	89C2B4BFAF6122A6A4433AF3F22DE848
SHA1:	1B5468B42B1C83375AE12501EC66932854FE6FBD
SHA-256:	2AE83E6E9F0117BA098875F00338B5B4BE73D28B0CEBA5FD577E64EF9614F4B2
SHA-512:	D4D49D6DACC336D979FF90990744FE7CDF1EEC7CDDE78CDAD591422E6BB80C4C7478D8C6F6F9A4973D67CCBE26A5EB60C414B9A1FA3FE31F2EB320619BE9F8B0
Malicious:	false
Preview:	{"ip":"89.149.18.20","continent":"North America","continentCode":"NA","country":"US","countryName":"United States","subdivisions":["DC"],"city":"Washington","timezone":"America/New_York","latitude":38.894,"longitude":-77.0365,"isp":"iNES GROUP","asnNumber":212238,"asnOrganization":"Datacamp Limited","organization":"Datacamp","postalCode":"20068"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Roboto-Regular-v1[1].ttf

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.001101; 2014Roboto-Regular
Category:	dropped
Size (bytes):	162876
Entropy (8bit):	6.532050095534921
Encrypted:	false
SSDEEP:	3072:jgWSNgHPoqWL1MMeFchiZ414XtvlbjybHp/rGazzxla34cS2FXzyuDAbM5hDWH3b:jrsHYt56Nklyuk8WMoBiul
MD5:	AC3F799D5BBAF5196FAB15AB8DE8431C
SHA1:	CB0CB91A31F43293BD7042DDAB945CE161C29D3D
SHA-256:	F0E5A21BF5C95E4C1BCE2BE98A3656EBCC6D42A21F41C4E3EBF69DD815702E54
SHA-512:	A8B7F0F8759FCE064B8576429A59A0B18BFC7A6AA3B140AF43EC665FFAAD2A1CB27A2BD745435113894EC5D607A3EA706F92C19CA5A233D87F464362DD6063CB
Malicious:	false
Preview:	........... GDEF.W.Y.......DGPOSJr....0..R$GSUB.....dT....OS/2...........`cmap@.Iv...\|....cvt $A..../....Lfpgmg.\...-D....gasp............glyf.....9....6hdmx78..........head.F.....,...6hhea.......d...$hmtx..........loca..g...0(....maxp........... name5ScY...(....post.m.d....... prept...../..............*Y._.<...................N......0.s.................l.....I...J.0.............................T.................................3.......3.....f..................P.!....!....GOOG.@.........f.... ........:... . .....d...........................w.~.n...i...e.e.g.......&.r.....N.....5.%.....L...~.s.~...~.].~.^.~.5.~...~...~.M.~.p.~.d.......)...H.d.........K./.j.8.......5.w.?.......l...s.z.....-...j.5.....N.............v.......m.......P...1.0.........=...9.......V.....H.(.....X.@.....y.9.Z.m.}...0.\..._.=.]...<.}.`.h.......................j.....[.}....._..... ._.....i.....!...+...).......X...@.........q.......`.i...[...i...........Z.X.f.I.[.......f.n...J.Z...x.....F.a...B...>...{.......C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\ZZ1FDLIH.txt

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	Generic INItialization configuration [Common]
Category:	dropped
Size (bytes):	958
Entropy (8bit):	5.469021841392672
Encrypted:	false
SSDEEP:	24:yUWbwlrFWxMrSqeJVpgUKm8sF2P6TFBCWtSk:yxbweCheJrgUFFY6xBTtSk
MD5:	A876444A2DF516BFB38416F4BEA74C98
SHA1:	78CCF2480189FF4282E9C0E0E5DF7EA7F92BF505
SHA-256:	35F954BADBC479C8A0FD657036AC27282CEB06F8B7B65A5118B9109245C6DAC8
SHA-512:	43D8E971A6BC54726D8AA4200D695068FFF4197B38CAFF214084842E2F963A684EDF84B931DC490D22A1B2EF89377CF3211D71B040F13F0FA430952B0CE9BE49
Malicious:	false
Preview:	[Encrypt]..ABTestingNames=HealthCheckNF..CCPOC=DISABLED..DTNP=1200..DUNP=900..[Common]..AlphaIntegration=1..AlphaMigration=1..AU2=1..DriverScanInterval=7..DriverUpdater=1..DriverUpdaterVersion=1..DumpReporting=1..DUSkipOnboarding=0..HCSkipAdvanced=0..HealthCheck=1..HealthCheckIpm=1..HealthCheckNF=0..HealthCheckVersion=1..NotificationCentre=0..OPSWATSoftwareUpdater=1..OPSWATSoftwareUpdaterHC=1..PC=0..PE=1..PENP=27..PerformanceOptimizerVersion=1..POSkipOnboarding=0..PrivacyPolicyDate=2022-07-14..QuickCleanIpm=1..REU=90..ShowOffers3rdParty=1..SoftwareUpdater=1..SoftwareUpdaterIpm=1..SPERDI=8..SRDI=8..SUExclusions=tp41,tp308,tp458,tp756,tp848,tp3031,tp3087,tp3103,tp3149,tp3197,tp3326,tp3364,tp3596,tp3648,tp3676,tp3701,tp3716..Survey-Uninstall=true..TrialOnboarding=1..WelcomeScreen=0..[Signature]..Signature=ASWSig2A7520AA1B33A1F74F0DEDF68C4356529FB06D1F1C15C22C0EF6C6567CCB78B1197A603413B9CC7474AF9D69ACD0C87D202FA10D3B1473753DF8461D5DE57AB0DCASWSig2A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\img-add-world-class-protection-free-v2[1].png

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PNG image data, 271 x 237, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28396
Entropy (8bit):	7.969963962681381
Encrypted:	false
SSDEEP:	384:ZgDz90j7Tdr6rDpwhF7gKzOzqpLiWH9sthCslzM/53A2Gwmfybxuv3cdQm2q:WDz9m7BEpwhaz2LpH9stve3AHdixde5q
MD5:	61848357E62E9A77A2F84D465A9DD5A0
SHA1:	8F2E89483AEE1F0017A152E2C1BE852FA4BE5F17
SHA-256:	B836AF8D67B199C3DD89C5B4FD03D70678C2D1BC48B56B44228B28FC66144ADF
SHA-512:	93459B2B8600B2F7EDE6AF7740B94B0BEDCE2C2095AF0A905A68D3A73792C51F2BB7F7609DA343573277318521CE022365FAAB2429578F429E8498BFF9A97DC7
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a...n.IDATx....]Wy'......MQ.%7Y....q(....C..I ,...HvY..d...@.....1.p.."Y].Q....).......w.fF#yL.Oz....s..;_;..888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888.=.888.j..G>.<V(,...Y...072.X.......u....g....).y88..\|.C.j......CC........`S<.\.L...K..B!_76:..\|.<.X,..y....M-..s..;..~....<.#.......~wm}}}.....?.x\|\|.yp.....#..\_..6$......y.0........9..E...<..8 .@,....(.H.,h.U.V....~..0.....?=6o.\y.UW.<..S...MkGF.........:...\|>.....R..H...9......7.A.T.T.Ps`.$...@B..M.L. .H....;.q\N..b..d9..8...+H..p..n..n....nYs/.C.......6.5y.k.>......J..%...V.,...e.._UQQ.t83...;~........D..;&.....3B.x...O$.H.(....C.P!.I.)...p. ......Fr.r.7%"..6..PDm..cx...f`.X..S8.px..5..%.\...'.OVV&.UWW....YZ(....L2W(....ZR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Roboto-Light-v1[1].ttf

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	TrueType Font data, 17 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto LightRegularVersion 2.001151; 2014Roboto-L
Category:	dropped
Size (bytes):	162420
Entropy (8bit):	6.5451429747376
Encrypted:	false
SSDEEP:	3072:LX9E5gPCzd+xMOknOhTwLMkaZVn4rEm0n2TCqtUD5Mq6rrdUIDP+Nk/XXLBH:JEa2Mx17TwL67n2Tttu5Mq6vNmyXXLBH
MD5:	7B5FB88F12BEC8143F00E21BC3222124
SHA1:	2E3148D213B15328EBEBBA14E828FB3BF79634EE
SHA-256:	E7EA653DDEC2D2A74D0DCBFF099C009CC7469EC323A50C89A2915CE44CA4C0B4
SHA-512:	266D424E8BDB4128472618CE6AFB18BA7A5D2924548706864104B1FB74BDB3C9F0FB1BD8D8E1B0C7241FB54E3BBB42D35BB180EFD7378B2BCF3C352A0F694DAE
Malicious:	false
Preview:	............GPOS.......4..Q.GSUBL.(...a....hOS/2.C.........`cmap@&Hr...l....cvt ..).../....Rfpgms.....-4....gasp.......(....glyf...T..9....thdmx!...........head.3.........6hhea...k...T...$hmtx...*........loca..,.../.....maxp...\...x... name<.n....8....post.m.d....... prep..m3..................n._.<...................N.. .....s.................l.....7. .E...............................Y...............r.......q.,.......3.......3.....f..................P.!....!....GOOG.@.........f.... ........:... . .....d.....................L.....U.o.s...m...l.\.w.......!.e.....K...<.J.1.....-...o.x.o...o.i.o.b.o.C.o...o...o.M.o.j.o.e.......<...M.m...%.\|...T.N.q.........2...=...........x.......!...g.G.....7...........j.}.....j.y.......X...4.B.......,.=...7.......Z.....'.0.....T.M.t...I.g.I.d.o.....^.r.l.".Z...?.p.l.d.......................e...{.Z.o...v.l.......e.....e.....&...?...0... ...W...D.........z.......[.w...]...m...,.......f.q...e.k.......{.].\|.j.f.j.j.....=.T...L...G.@.\|.t.....S.......b...~....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\tick-red-v1[1].png

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PNG image data, 13 x 9, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	6.318611843815597
Encrypted:	false
SSDEEP:	24:GB1hBWwjx82lY2T3hzVzFyJ3VYkG0tRbjztxLQ:cONn2tzaJ3ZDtBRxLQ
MD5:	5E4E4C8616BA386A1ACFC0567CC30C03
SHA1:	64B7075305F742E51E41AAB77DE8D82D95CBC65F
SHA-256:	1B331904C9D4ACB414CDB9804E79ED9156E01176B9B2C583ACD5FCBDE347E523
SHA-512:	F6BFB6F1A2687A4FAAE623A6AEECB2AE8A00AC3B1E5EE9399BC74E53F0B8C44518B4AB19BDAF4045BEAD89141A15BA3F72D83CB11620598E587F28AF62994811
Malicious:	false
Preview:	.PNG........IHDR..............z.j....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmpMM:InstanceID="xmp.iid:194AFA7DDFAA11EAAE25CA514F5E537F" xmpMM:DocumentID="xmp.did:194AFA7EDFAA11EAAE25CA514F5E537F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:194AFA7BDFAA11EAAE25CA514F5E537F" stRef:documentID="xmp.did:194AFA7CDFAA11EAAE25CA514F5E537F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Q.d.....IDATx....P...9.bqe`...d0.........a.`..&8A.Z..,.E...w.L.P..~..{..]...qU......exf.....'t%.#@.G.B..4q..M...

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.39693352084198963
Encrypted:	false
SSDEEP:	12:s6s6WHVYeVHWHVYeVPlq6s6WHVYeVHWHVYeVPl:dzW1YeVHW1YeVRzW1YeVHW1YeV
MD5:	40010550F1F1B4DF9A59627F72A2BEB8
SHA1:	E50D97ECF2AEBBDF045D6E47ACEDD3EF0642FE9F
SHA-256:	966D4862AD91FA6CCBDB035F02CC63A4F98670B7074F93469A75CAC33782D703
SHA-512:	EB7BDD7F7B38AFA5D134F919C910BF94E89CA5E5CE5735A0D74973F32AC70FA2BC058B1A9FB7FC7D8488D88C2F4B2599BB07E91B41ADE82F2DBD0FB245268263
Malicious:	false
Preview:	.5............b........?*+...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\............................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.................................................................................................................................................................................................................,...@.......~.........5w...................................................b.............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	3.4595132965663495
Encrypted:	false
SSDEEP:	3072:nCgdcMNBH0DfAE5bwL4Iq+5RJmOvnsYSYE8pJ51bggFRn1tu:NdcMNBHgHw8Iq+5RJmOtp/FRn
MD5:	40924F97F53AA37339DA4BDE9AE2E7CD
SHA1:	BB450599D09469C3361B44E20772F0613C9CEB9C
SHA-256:	10DB11013F9D43EE81402C4A97F0AEE7488E1C4F4C2B308BF3C384FD200B2E68
SHA-512:	A7160CB3642BF16D7E85F52787E9C1B20F42933A916CE0C7D4E346C3DBB0F47B2CA8159C45D93E49E93EC57B2941B8D95E0FC994CEDA865807CE08FA7A12E3F6
Malicious:	false
Preview:	..!..................\|.......{..........<......?+...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\............................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.............................................................................................................................................................................................................0u.............................................".................Q.#......... ..Y&......a.......h.#.....6.!......{..+...{..................C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t..........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9a430172, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	18874368
Entropy (8bit):	1.2743995211135974
Encrypted:	false
SSDEEP:	12288:KdOGIAVRZEa1m73bAllCSPawKVoxuZJMGDN/xpWHq6LTbkB4WLgoxMb84yHibgoq:KMQRAzZMKrHuWSTtHmT
MD5:	6364BA1546B0ED9EFD5A5F0E41DA29D9
SHA1:	94B6D6472FCAEDC6DD42D74E503BD57227DFA585
SHA-256:	4D6C098A8DEFC0D2244EAD6B9493E7324318632A0F022AF214DC0FD87E17139C
SHA-512:	3655FD4E96C1398C942D300693CD67DFADA8CBF84FCAFC1832BE1382E9BCEECD9B613B88EF028F67EDE0F02635885DF3D0FDB6F998FDEC78733A0B4545BEC213
Malicious:	false
Preview:	.C.r... ........+.......{..+...{......................6.`......-...\|)..-...\|..h.c............................?+...{..............................................................................................f...........eJ......n........................................................................................................... ............\|..............................................................................................................................................................................................;2...\|/.................................4+Yo.-...\|.F.................Xx{.-...\|...........................#......h.c.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.14322916256715862
Encrypted:	false
SSDEEP:	6:ENqv0kwt5cJ04tfyUGbNkAaadugblDkqIHN/i3/:EvkQ5cpTel8HNa3/
MD5:	4F8516238DBDE209CF8260A513AF54B8
SHA1:	A491CD4BD4D027339DA5DEC781A5CDD22C09516D
SHA-256:	0C47885283D747DB1E8523223AA7BD17E88AA144BBEB922ED1F471F13D9D0D24
SHA-512:	9233A5902AB9D96D927A290F59FF29525089BC5E6FB439A5361BE9C323DC6AE0BB889BA06AB44667B5EB2F8C4614EF78CA7EA43F58950309A3FDD6F04829E3A1
Malicious:	false
Preview:	<.......................................*+...{...-...\|...-...\|)..........-...\|)..-...\|)..Z.5.-...\|)L.................Xx{.-...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	3.8750276267517423
Encrypted:	false
SSDEEP:	24:V98uCFCpXOPtYLlXsdIEfot0mbxqJzHDWW1bf2l7pcqwd0svQU2hCMtUn:V98uFXxRXug/xAHD51SlVcquaWMKn
MD5:	50312EA469D1384C08ACEB168ABF2144
SHA1:	680704644233756437D21597FC653C31FD7662D4
SHA-256:	869C992934C3BCF7359A41388F787B138CE484758165A0BB567AA1A27FA3CD34
SHA-512:	0CA1DFBE7E0E7092DDB1FDC301D48F02C2D5A475D4E67C86DA67EC60834D7EEF3AF948924CA19CAF605583E4751236C6114E508971679FE993FE17F4A5E4836F
Malicious:	false
Preview:	A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.J.D.E.E.C.u.s.8.E.K.7.9.c.X.w.p.Q.3.Q.d.g.Q.A.A.A.A.C.A.A.A.A.A.A.A.Q.Z.g.A.A.A.A.E.A.A.C.A.A.A.A.C.L.f.N.J.Z.m.4.R.4.N.Q.m.+.+.R.d.W.8.K.Y.W.+.d.F.G.l.V.P.g.5.i.c.c.v.i.2.b.r.x.A.T.G.g.A.A.A.A.A.O.g.A.A.A.A.A.I.A.A.C.A.A.A.A.D.W.0.g.B.J.K.D.K.f.g.4./.E.A.B.V.1.y.+.Q.N.E.S.D.n.J./.F.D.+.G.5.m.C.5.r.K.h.z.b.U.E.f.A.A.A.A.C.C.x.t.D.u.t.3.x.a.k.P.T.e.n.v.c.6.f.4.z.L.S.6.w.2.i.o.a.D.b.W.C.S.K.F.Z.l.+.z.w.l.o.s.D.9.8.w.t.P.q.1.Z.x.e.F.m.y.f.t./.w.R.Q.h.r.o.I.f.9.j.I.6.Y.V.X.y.4.X.3.0.j.c.Q.D.C.+.o.x.e.B.5.e.F.u.I.S.g.m.3.r.G.e.0.j.u.s.P.k.b.r.w.W.2.1.A.T.J.A.+.8.g.J.m.N.l.B.E.p.O.w.t.Z./.K.W.+.1.e.2.o.J.z.p.K.h.L.p.N.5.R.I.B.U.h.9.9.R.0.9.d.U.u.f.1.K.j.T.u.X.X.N.C.I.q.Z.B.m.L.p.K.P.g.5.a.C.v.b.6.R.2.U.u.A.b.A.5.o.A.0.+.G.s.h.t.B.N.o.f.1.t.+.l.8.6.X.L.V.L.s.c.o.V.v.R.Q.K.r.T.o./.+.6.y.k.e.0.I.t.9.e.s.W./.p.N.Z.B.w.u.9.Z.f.7.+.o.7./.G.R.U.o.K.a.5.K.W.j.T.H.8.d.r.K.z.V.Y.M.E.E.x.c.o.A.a.t.n.B.x.2.6.E.k./.4.N.e.o.7.2.+.d.V.k.B.z.

C:\Users\user\AppData\Local\Temp\CheckUpdate.log

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	2.8201597655573916
Encrypted:	false
SSDEEP:	3:oUgOMKplylX+3Rl/T:oURMKLylAD/T
MD5:	29F7AAA9B9941EA6E142E80594912EC5
SHA1:	915DC60E5AF7709417D54C26AB9BE8171884A7FD
SHA-256:	2EDFC745C1178202078F86C84D1ED70721D43A741A049DCB83BDE9D34BD29E10
SHA-512:	AFB110B30D6AD88789E3FD309E21E290B730C3BC5678C1487C9CF6003617E0769D0F1A42CAECBECB9D60C465B1A436DE64D0B1D7832B8FEA869DA00254F124AE
Malicious:	false
Preview:	3.C.1.6.B.2.3.C.8.8.6.1.3.1.0.4.6.9.2.5.A.0.0.3.2.D.B.1.A.6.7.7.

C:\Users\user\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	2.892263848208277
Encrypted:	false
SSDEEP:	3:QlnHadWql73ElUwYS5yUalWlKl:QlHuWeYUHS5yUaMA
MD5:	BFF7494A6F35A9DE8E92801CB910B1DD
SHA1:	1B24E1535A8150BCFACE82E4CE99BD444AAEA506
SHA-256:	6D9C78C9BA79C76B8C0BB3AFE9E6AD9CA7511A47DAA839CB238307DF05F51680
SHA-512:	8D4E131545EE25CEE658EB2543744827D820151FA15CF325B2D2E1D38EA3F017D91A4463ED5A7C7B2CCF4CCD3170F52966AC9AA65CD1C32FF437AE96D491D783
Malicious:	false
Preview:	9.5.a.8.6.c.f.9.-.8.0.3.4.-.4.b.d.2.-.8.4.9.5.-.7.9.5.c.1.1.1.0.5.3.9.6.

C:\Users\user\AppData\Local\Temp\asw442b2ae2908e6878.tmp

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Preview:	GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Temp\asw66fe2d0570e0925a.tmp

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Preview:	GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Temp\asweab9e63d78b24d48.tmp

Download File

Process:	C:\Program Files\CCleaner\CCUpdate.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Preview:	GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ButtonEvent.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.070048832652426
Encrypted:	false
SSDEEP:	48:a7sTTDi+BjvqYR4gYFmsHFpXq65lZ9W5wOXnhLk4nOvlWxG5PZKuB:ri+BjSXgY8sHFE6TzWXzncsGSm
MD5:	C24568A3B0D7C8D7761E684EB77252B5
SHA1:	66DB7F147CBC2309D8D78FDCE54660041ACBC60D
SHA-256:	E2DA6D8B73B5954D58BAA89A949AACECE0527DFB940CA130AC6D3FD992D0909D
SHA-512:	5D43E4C838FD7F4C6A4AB6CC6D63E0F81D765D9CA33D9278D082C4F75F9416907DF10B003E10EDC1B5EF39535F722D8DBFAB114775AC67DA7F9390DCC2B4B443
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................Q..............A.......i.......Y.......X......._.....Rich....................PE..L....*.M...........!......................... ...............................`............@..........................!......\ ..<....@.......................P....................................................... ..4............................text...:........................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc........@......................@..@.reloc..2....P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\INetC.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.321814815133819
Encrypted:	false
SSDEEP:	384:l4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO:lG8sUAUnt88CFJDhmajMA
MD5:	7760DAF1B6A7F13F06B25B5A09137CA1
SHA1:	CC5A98EA3AA582DE5428C819731E1FAECCFCF33A
SHA-256:	5233110ED8E95A4A1042F57D9B2DC72BC253E8CB5282437637A51E4E9FCB9079
SHA-512:	D038BEA292FFA2F2F44C85305350645D504BE5C45A9D1B30DB6D9708BFAC27E2FF1E41A76C844D9231D465F31D502A5313DFDED6309326D6DFBE30E51A76FDB5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........G.G.G.G.^.%...C.....F.(.C.(.D.G...A..F...F....F.RichG.........................PE..L...7M.N...........!.....,...8......A;.......@.......................................................................I..l....A..x....p...............................................................................@...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data........P.......<..............@....rsrc........p.......P..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.3422620069068625
Encrypted:	false
SSDEEP:	48:qKDBQE7F4aBr1wH8l9QIXTZShMmj3jkCTbGr7X:5WkFZruHSXTH6jkCnGr7X
MD5:	2F69AFA9D17A5245EC9B5BB03D56F63C
SHA1:	E0A133222136B3D4783E965513A690C23826AEC9
SHA-256:	E54989D2B83E7282D0BEC56B098635146AAB5D5A283F1F89486816851EF885A0
SHA-512:	BFD4AF50E41EBC56E30355C722C2A55540A5BBDDB68F1522EF7AABFE4F5F2A20E87FA9677EE3CDB3C0BF5BD3988B89D1224D32C9F23342A16E46C542D8DC0926
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L...!.Oa...........!................~........ ...............................P............@.........................@"......l ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...h....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\a\asdk.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1098648
Entropy (8bit):	6.667490399491581
Encrypted:	false
SSDEEP:	12288:U/TjOExADWCIvLhqBHp0ZdGXSfScVggggMu7QNb+a/aoV4Vax1gIzKLORnf68LjN:KqExXWfCPggggMuOZaoVyaxoLOY83
MD5:	E3F60A2CF6B1D155F5F7D17615907013
SHA1:	8191871854DCBCC4FE34218040215581B0FCCF43
SHA-256:	74FCD2367FB1D9C0084547EBAF1C6DB081946453A5D0A2D668D83D3C489A60A9
SHA-512:	20A57A1D2CE3D081958B4B3B48F1C902039F26DD28ABCAC94FAD6F20E8E5D630BBFD2365EB7200F7C8D676C593CB3DC465A406E8536ABDF63BD7EF76BB86DF2B
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........cH.............l.........................................................................K....................i...v...i......i............i......Rich...................PE..L...Z.hc...........!.....:..........p........P......................................'9....@A............................H............0..p...........H...P)...@..H.......................................@............P...............................text...Z9.......:.................. ..`.rdata.......P.......>..............@..@.data... .... ......................@....rsrc...p....0......................@..@.reloc..H....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\g\gcapi_dll.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356864
Entropy (8bit):	6.662745889899097
Encrypted:	false
SSDEEP:	6144:O3RIclFikwwYUP5SvL8z6uNMw4n8kUddV6F8Q4cfRUWj/aNTcES:O36SwwviL8VgnaddV6F8Q4cZBzES
MD5:	2973AF8515EFFD0A3BFC7A43B03B3FCC
SHA1:	4209CDED0CAAC7C5CB07BCB29F1EE0DC5AC211EE
SHA-256:	D0E4581210A22135CE5DEB47D9DF4D636A94B3813E0649AAB84822C9F08AF2A0
SHA-512:	B6F9653142EC00B2E0A5045F0F2C7BA5DBBDA8EF39EDF14C80A24ECAB3C41F081EB466994AAF0879AC96B201BA5C02D478275710E4D08B3DEBC739063D177F7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..e7.67.67.6q.x65.6._m65.6.c^66.6:.x6..6:.F6..6:.y6..6J.\|6..6._v6,.67.6..6J.x6..6J.E66.6:.B66.67..66.6J.G66.6Rich7.6................PE..L.....5W.........."!.....J...X...............`............................................@.........................0#.......$...................................-...c..................................@............`......t"..@....................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data....L...@......."..............@....tls.................<..............@....rsrc................>..............@..@.reloc...-...........D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\modern-header.bmp

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 24, image size 25764, resolution 3780 x 3780 px/m, cbSize 25818, bits offset 54
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	1.1555809525391862
Encrypted:	false
SSDEEP:	48:Anwo+LwPEEEfWtnriL0Wklls3yXyxATVQ89GHTsbAiveyUTe/ES33/zTXNpF:Va8E904nz9y+8zskivDLn/vR
MD5:	079CB79B69190FFB3A584A7344E34197
SHA1:	35A450167CD54BEAF5D50BD85E00858A6684C724
SHA-256:	AB3DEA92A333E89F41BB310D5B5D5A52B80D2AEDF78B0516F2B1A6A9AF69B222
SHA-512:	CBCD40BB163BC51DF0E42A2CE3565848734B8FD6065592CB90270182B7473ECBA71D0623505CA2C5654C9D65E16394AC55919D4018BBEFE0CB72489579593E18
Malicious:	false
Preview:	BM.d......6...(.......9............d....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154488, resolution 3780 x 3780 px/m, cbSize 154542, bits offset 54
Category:	dropped
Size (bytes):	154542
Entropy (8bit):	1.8895357436613915
Encrypted:	false
SSDEEP:	768:lyd0OiQa2gwsuT5fZpd1AEtgTiVV0U1ho410uR3W:lydd1nrHtTZG
MD5:	8BD95FBD159E00B9823FE8D60CCF9B50
SHA1:	C55E1A485062EFCAE2AC4D4AA43172A0D8DC9413
SHA-256:	6EF238FAFC028BA028EACBFF28BCC670CD7213DF9318F99F619AC3E2988D16F3
SHA-512:	1BBF9D41D3180CFDDB99E300142B619DDBC225A099A43E8755AECB44000A4248A7606D04BBEA3C1E65143FC488C40D30FCF9BDD418174BD821247B932977F86F
Malicious:	false
Preview:	BM.[......6...(.......:...........x[....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.158136237602734
Encrypted:	false
SSDEEP:	96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5:	6C3F8C94D0727894D706940A8A980543
SHA1:	0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
SHA-256:	56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
SHA-512:	2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.703695912299512
Encrypted:	false
SSDEEP:	48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5:	F0438A894F3A7E01A4AAE8D1B5DD0289
SHA1:	B058E3FCFB7B550041DA16BF10D8837024C38BF6
SHA-256:	30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
SHA-512:	F91FCEA19CBDDF8086AFFCB63FE599DC2B36351FC81AC144F58A80A524043DDEAA3943F36C86EBAE45DD82E8FAF622EA7B7C9B776E74C54B93DF2963CFE66CC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n}f.L...I...P...@..K...@..H...@..H...RichI...........................PE..L...\..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..d............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\ServiceUninstaller.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	509424
Entropy (8bit):	6.731421785316144
Encrypted:	false
SSDEEP:	12288:Iuxv89zhwE04WSrOzqCxHoRNR4DdjuJjQn6nPOy:ZJ5SrOzqCZxDdjuVe6nPn
MD5:	3053907A25371C3ED0C5447D9862B594
SHA1:	F39F0363886BB06CB1C427DB983BD6DA44C01194
SHA-256:	0B78D56ACEEFB4FF259660BD55BBB497CE29A5D60206B5D19D05E1442829E495
SHA-512:	226530658B3E1530F93285962E6B97D61F54039C1BBFCBC5EC27E9BA1489864AECD2D5B58577C8A9D7B25595A03AA35EE97CC7E33E026A89CBF5D470AA65C3E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.v#...p...p...p:..q#..p:..q...p:..q6..p\|..q>..p\|..q9..p\|..qg..p:..q)..p'..p,..p...p...px..q'..px..q/..px..p/..p..p/..px..q/..pRich...p........PE..L..."-.b...........!................................................................Yy....@A.........................+.......,..P.......h................)......DB......T...............................@............................................text...:........................... ..`.rdata.............................@..@.data....6...@...(...*..............@....rsrc...h............R..............@..@.reloc..DB.......D...X..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\p\pfBL.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14003512
Entropy (8bit):	6.799154495107574
Encrypted:	false
SSDEEP:	196608:KRtbkNE85eApKhoi9I1fJ3AJY1C/qjiXcMtQ7u3p:KST8ApKhoi+1fJ3AJY1CAi3wuZ
MD5:	519E14F6D5032B956E5268546CF74DD5
SHA1:	56E3DBE14BB4083CA1F87FA0D48A200D77C46AF1
SHA-256:	0822E27A2ACFC872EA903A27985FAFD3EB510319ECCA688F44E7E3C8A00F8B75
SHA-512:	1871C1CE46D0A2F653E576FC966A5E62CF4DBD307FC8DF01DAF916BF46A16A9EB2010B47FA53BA943B1D42878990E141AA7DF31E8A3CB188B61DC3A9B4BBF9A7
Malicious:	false
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........xH.s+H.s+H.s+..v..s+..v@.s+N%.+C.s+N%wZ.s+N%pT.s+N%v'.s+..pR.s+..wm.s+..vx.s+..wI.s+..vI.s+..rK.s+..wD.s+..w=.s+A..+J.s+H.s+k.s+..v`.s+..r~.s+H.r+.s+"%z.s+"%sI.s+"%.+I.s+H..+J.s+"%qI.s+RichH.s+................PE..L......e...........!...&.&....B.....P.......@............................................@A..................................D.......................8)..........a..T...................@b.......a..@............@..H............................text....%.......&.................. ..`.rdata.....@......*..............@..@.data...0.......:.................@....rsrc...............................@..@.reloc.............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\pfUI.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18826040
Entropy (8bit):	6.7224278095646675
Encrypted:	false
SSDEEP:	393216:JfPPWcnpg8cVvnxRAKnwLwE+o0oyZyvKn:hWcn6XRApsZyvy
MD5:	474BD358596374984E3400AD59E386D8
SHA1:	7C22719B6D2634ECAEF25A84C6514256EED9D310
SHA-256:	079ADDB8F44F4DF2EB2F214351FC955B6FBDB931E4B22A0541153E5A80C3FD0E
SHA-512:	490B82820E3F3D8E937794A16C63F841D6716A1676405F0B524B9F83830E9EEF27878E2FE40B29BB74FA7FCE680782D683E52B00959EB9984A2531602B2CE9BB
Malicious:	false
Preview:	MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$...........W...W...W...............G...Q._.Z...Q...E...Q...K...Q...$.......L.......}.....f.......V.......V.......m.......T.......\.......T.....[......."...^.1.U...W...A...W...t...........=.......=...V...=.].V...W.5.T...=...V...RichW...........PE..L....e...........!...&.\..........`i.......p................................@...........@A.........................,......,..........................8)....5......a..T....................b.......`..@............p...............................text....[.......\.................. ..`.rdata....3..p....3..`..............@..@.data.....0......2...f..............@....rsrc..............................@..@.reloc........5......6..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\CC_Logo_40x96.png

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PNG image data, 40 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	7.919668479594029
Encrypted:	false
SSDEEP:	48:w7qkcM5Xno7pkNijRBH9wcByGcu892wLdpPHWSSoF5WSy1a1Q+ZcHFtGmD:GeM5XoeuFzvuP5xs2OTGy
MD5:	D32B0460183056D3056D6DB89C992B88
SHA1:	79823E151B3438AB8D273A6B4A3D56A9571379B4
SHA-256:	B013039E32D2F8E54CFEBDBFDABC25F21AA0BBE9EF26A2A5319A20024961E9A7
SHA-512:	3AD36F9D4015F2D3D5BC15EAC221A0ECEF3FCB1EF4C3C87B97B3413A66FAA445869E054F7252CC233CD2BF8F1AA75CB3351D2C70C8121F4850B3DB29951BC817
Malicious:	false
Preview:	.PNG........IHDR...(...%.....0`......sRGB.........IDATX..Xil\..=o..3....1.q"b.,.HS.R...J.EE.Z.K.R...Z...."~..?U.PK.....KH..(aQ.g..N....>o.....8..8f..;.-w9.\|.}Z.....dN>.7..W,.wl@.a4.a.."..F8....E.\....<......B...f[0....pu..f ....`v^.h.F4..Pc..3..e0.p.r/..ox.f. ...N .a....%....).6-....<.S...Z...).......\|....3.L..w._..,.0b1 ..f..F4.....f.... ..>..:..#..+.V,.....h.......0~ ............q.3):...#_...x/......p.WF+.w@.T.Qy.......BO'.zj'......Qj..+3o...?Dxb.."\...U.$.......`.E.)...i8.X..Yc<...6.L.......).Ri....8..]L.r'..".$....d...."L...o....Lc[$...\.3.l.v.V.l.d........ZU ...<q...z.a...+PuV(Z..[..F.z..../E')r..E.5...lN=..9....(.~.G~.....z...<M.;].7.@.$7,.E}d.8..6b49.UF...)X.K@.......V .....f........2.......8.G.&.r....y..&...t..;#.X.W......5...l.z.G.:+Wc.7....pQ+v.%d.{.aM#..k.H...W.....(^[..'.^.p.u.I.p.B...F=..T..FguO..g.....?.1Z.w../.0=.....4.l^....;..5..............*.u7~...e..jv...#........f..f ..z(......X.......dP....#.w'....?D}2.

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\CC_logo_72x66.png

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PNG image data, 72 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7486
Entropy (8bit):	7.964739649140705
Encrypted:	false
SSDEEP:	192:SCVcCARPBHZUeIIPY6ZGH5AESYAsMTwtDhAMq:SlRJ5UeII7wEBJTwSL
MD5:	A736159759A56C29575E49CB2A51F2B3
SHA1:	B1594BBCA4358886D25C3A1BC662D87C913318CB
SHA-256:	58E75DE1789C90333DAAF93176194D2A3D64F2EECDF57A4B9384A229E81F874F
SHA-512:	4DA523A36375B37FA7BC4B4CCF7C93E1DF7B2DA15152EDF7D419927AA1BB271EF8BA27FE734D2F623FCC02B47319E75333DF014BED01EB466E0CD9EC4111EF53
Malicious:	false
Preview:	.PNG........IHDR...H...B......v.!....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\..\U.>.........N.... .;.Yd..DP.ap..q@d..qp\>..AEP6..E.(.a...hX...Y:K..N.....9wyU.p...q:y]...........5...s..3..[.....FC.D....8-.!(.......E.v....d_....,H6........kXf.i.S)12......P...G<....p(...~......]...=.......>yR.T.T..[.5.0M...&%`.&bB.......o....8.@..}.....+.^..+..(..?v......?.@..b\|...klJ~..y..p.q.....p..(>.?0,0 .Fp!..l.<8...........S.(?.d._......{....}.k.........'5..W..g&S.aY...X...gk.....,I...>...M....e.....<......4B6E@.$. ..`y>.....cE..-=..~.cdd....c...N^S..?.J.-..."m."@.>..S4/.H....(..j=.>.8.F6v.t..7...5.. .Z..2.).i...x. X.@.........f.X...u......y.../...cs..h.6M.1a...1.%D\).....R..Sp"...X.t"...ws..^..x3~.....8Q...... .d.>...M....u..8v.=?..:........x.A..$.;....6@....A..U&....L4..4...V........M.L..!..c.T. .UG.r...~.c.cP.X.M......^2..@......6'.O.YD..M.V........4.19..\|",@....w.U...,.g.a.".....2.I..&..QM.(f.8.8^\|\.<...mL..3....8t.....=.t..I{y.c.#A....M...

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\Montserrat-Regular.otf

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	45360
Entropy (8bit):	6.905288287751393
Encrypted:	false
SSDEEP:	768:AhyKKD3ss27ucoAXMH1GyOisclJ1V815wWnmCufcrElJgLDKja5nCwY9ldrij:IKD3ss26fA8H5OisqCufweJWmDwYzcj
MD5:	27E50FFD6A14CBC8221C9DBD3B5208DC
SHA1:	713C997CE002A4D8762C2DCC405213061233E4BC
SHA-256:	40FC1142200A5C1C18F80B6915257083C528C7F7FD2B00A552AEEBC42898D428
SHA-512:	0A602F88CFBA906B41719943465EDB09917C447D746BFED5C9CE9C75D077F6AED2F8146697ACD74557359F1AE267CA2A8E3A2CA40FB1633BDE8E6114261ABD90
Malicious:	false
Preview:	OTTO.......@CFF c\.}........GDEF.S.0...h...(GPOSU.?....`....GSUB3.'.........OS/2h......0...`cmap5.p........@head..t*.......6hhea.A.9.......$hmtxD%:.........maxp.zP....(....name............post...2....... .........p._.<...........>......>.....e.....................>.........e.................z..P..z.....6.........X...K...X...^.2.?............................UKWN.@. ............ .............. .......>.........;.............;...........E...........L...........;.........H.i...................................................................................}.........v.........................!.........:./.......................i.........$..........."..........."...........2.?.........2.?......... .q.........4..Copyright . 2014 by Julieta Ulanovsky. All rights reserved.MontserratRegular1.000;UKWN;Montserrat-RegularVersion 1.000;PS 002.000;hotconv 1.0.70;makeotf.lib2.5.58329 DEVELOPMENTMontserrat-RegularJulieta Ulanovskyhttp://www.zkysky.com.ar/This Font Software is licensed under the SIL

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\PF_computer.png

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PNG image data, 679 x 176, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	89461
Entropy (8bit):	7.994111178657751
Encrypted:	true
SSDEEP:	1536:jU6vVsf6Z/r1EJ8yIfDnA2RBjY85YGmr/OOykkT/Ee+liGIQbTZpVa1bUyYgUSF3:jU8GfwhI8Zr/R5B5YfbOfp76liGD9pV0
MD5:	7F4F45C9393A0664D9D0725A2FF42C6B
SHA1:	B7B30EB534E6DC69E8E293443C157134569E8CE7
SHA-256:	DBD8B6FDB66604A0A5E8EFE269FBFA598E4A94DC146006036409D905209DA42B
SHA-512:	0C27F9CE615CBFF3E17FD772CE3929AB4419D7432D96223B7EEC1BA70953F2AC993404B954020247B52D7F7499212D44EB6F85DA2E2676773CAFE1CE89B390F9
Malicious:	false
Preview:	.PNG........IHDR...............PY....IDATx..k.-[V.W.9.j......~Cw.41..D...<d.l..E....K1A..r"......X..VL....C^.......8....W....{.9{..9....m.....n..g.Z...s....?.........y.....?....3/.\|..._.}..y...gyVd16iY.i,.r.}]....bN3........{..-..,.?.o......U.m[.e].m.^...u.cU..4.eY...E....\...z[.L.K...YQ.K.].X...}.....~'..l.f..ee..e.E.....u...,3......)M.....,.E.w-...X..\{...vZ....V...so.6..aO[.......J....Z.E....\...Z.YK..y...YU...u.x...Uo..).gJml..T.OEQU...n[.A.E..>o....K..a...2-.).Z..s..~K...i.,f...!...m[...aJ{./..%-......OZ..!g.!.sJUU......%..\|}^....j.M.4z.4.r....u].$....ZvnQ.U%Y...'.^}BG..V.7.c.....T"......3._..6q..P...U...H}_.p..Im..^......i.8l...B......B.m..R.3.[.Ul....^$.3l...L..._.7..N.B-.+...].I?.-.uF.<..hv_..%..j$v.b.l.:K8.....,....\...'.U..Gp..Z....jI$.M`..7.....M..I.j.}...A......\|].%....\.l..m.0..z@.We.'nu.....]...h.U.>..$.mQ..i...MI..Q.V.A.]/\|>.t..\o.._..b....7.<...K....o.....r.f..ND_..Rq..Y.r(y...T...5Ls...qYfN...i.^a

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1025.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	248632
Entropy (8bit):	4.239231550099738
Encrypted:	false
SSDEEP:	3072:OejpwJ5WckrG4m4xyOfF3FForEjl34/s2O8sl10sO62nVvxX0n+TOq3MK5zeDxde:fLHEsVtId
MD5:	A01E9186139C271CE3FDDC75E81DD8FD
SHA1:	AAC324DA2F13B641937FE7FAF49F6CB7CD83CCCA
SHA-256:	98BE5CFDC30FA36CBB464F02D3A0B32CE7489C210EE0D7019580D859B49E8BFC
SHA-512:	AD8A2F2CAD8726A670C5FC1C472341ACDE78E6945930CC995E61F77819A496BD1D5EAA08B26F1D9F582F51E0A11757F72F07891E423BBDFB4E72CDB8A4DEB028
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................;R....@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..`p...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1026.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296248
Entropy (8bit):	4.12691518997062
Encrypted:	false
SSDEEP:	1536:4XmZiAYLSKbowy3HxDeUvZtSffDd6v40oD9h9U1UJph4PWC7Bxi:mWPYLFowy3HxyURtmd6yTmUJph4V+
MD5:	305493527FE9893594176CAD462494D0
SHA1:	8053A5BE3DD8A265ADCE7502AEE4E5C6BBE75C51
SHA-256:	8E01C8DA3313682671D76B1184AAE204E08B76B2D0A600B3D46DCB03769A5CC2
SHA-512:	33A861FDD32E0D894CC5A7345AEEFEB5D306ABE0251B76DDCD371416E78F17F1450C2A88748C03C797BBDB78B8AE9FAE07AECF3184AAE260FA02BEC559F5BD1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z......................................................7.....@.......................................... ..`V...........\..8)...........................................................................................rdata..............................@..@.rsrc...`V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...)...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1027.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	298808
Entropy (8bit):	3.640553369045086
Encrypted:	false
SSDEEP:	3072:B3rr3phz4msC0MUmq3nFvQ2iZHzNbUSl1QRPM36qWFnZY2WZDRRqKHpxzp/O:Zb4s0MUmqGNbUSlKqWEDNxzs
MD5:	7F31AADD362899A9B360A2CBF8471F3C
SHA1:	9AA10E84C215D06B06ADD17DF88D25B93F32BF03
SHA-256:	9825E6E50B1FAD4C9D7C020F9E34CFFB46E8478FBD12697DB11A31EC316FE56A
SHA-512:	7F99D14E826205FDC769F8B5443A068A8BF93AEBB9B13520C4A97C816D072ABB5CE360ABE314B20A28507000123E6C089AC676EB1A08E94A0DB01D23F0D58C1A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....d......................................................dz....@.......................................... ...`...........f..8)...........................................................................................rdata..............................@..@.rsrc....`... ...b..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...4...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1028.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117048
Entropy (8bit):	6.452718480765422
Encrypted:	false
SSDEEP:	1536:IXC/b/on4ysGSVTRLdYIMY4JUjAs/0zEwjHh2Eq7WVqxb:WCzYHVIMY4JzlLHHqSy
MD5:	BBA4E5137872602F890842C75D237196
SHA1:	C8FBC18D365D01280A2D73FF6F9848141F5617DB
SHA-256:	FB7059957BA80E7D032864CACB5E9663A82DA8EE77C8437A0BFB9FF4A0F6527C
SHA-512:	4C8A24B94E3E9EC1FDCB3D140ABFCF5E9775BFE4D9FFFF15DB4E109B13580C3927918054F357138F099DDC861CCAA07DF21E4E071E0DB6FA8AB764902FC13593
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................e....@.......................................... ..H...............8)...........................................................................................rdata..............................@..@.rsrc...H.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...m...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1029.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	262456
Entropy (8bit):	3.9739739942191368
Encrypted:	false
SSDEEP:	3072:BuWyV0ws1yxbxqTjEuq+m64l0V13hcIYq80sJ0wonymZq1Mb2gz/a:sJJ413rYb
MD5:	F61CFF30D67B04636A3342DAC21D3677
SHA1:	17C92035F0F8A764E746F3A26DC2DB009D1190D1
SHA-256:	35023FD83DDF4748B92EF1D4E846D832226D0887D297E0F99EA5765DE04DA8DB
SHA-512:	33929E77A85C966E5E49A7B305C7C14B1BF7944C11CDD23399F56088ED573D500B286377A5B8DE791479FFD67629B22B0382D935B4AB14E98727C3DAD052D815
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..(...............8)...........................................................................................rdata..............................@..@.rsrc...(.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1030.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258360
Entropy (8bit):	3.6974935928324646
Encrypted:	false
SSDEEP:	3072:SVKMUPjdHlJsCPH02R/CCzuo8JqT1oS748mSAtlFgCIcgSnQEiGZd:u8hlJhPmFpg4iGT
MD5:	C3E5084C32B286FDE2A432212960F5CC
SHA1:	A4196A97A68A3848E424E53073F212EF71C75614
SHA-256:	87AC64757184173C4F161CFB580508D092E92E69AA46DF5DDD2044F9057892CD
SHA-512:	5AE7F6A8803574D44362AB3ECB9D8016EAC4EFFCD89FDEC6E0CE35EF12BC89DFC2637C3102CD1CC707C8CD2C03312788B06D3E1DCC8225411B00E1E1DEBA0430
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1031.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292664
Entropy (8bit):	3.69324721888596
Encrypted:	false
SSDEEP:	3072:adJRKPgjvypvWTChegDQhK7JUfRtR+ga9hI7AlfbamVXu9dIEhpg8XVLZkwwlPaI:8ypvCEFzda9Yhoo
MD5:	2374DE90DF944930CE530DE94FFBE4A1
SHA1:	9F2B4CEAC2E2A91C74712639E6A0EA115F634356
SHA-256:	DEDB7E45B3CA76E4F3DBF57ECF278CDA6DAFA64C79A82EA3F7C1DD3526334FE2
SHA-512:	48F913A605AEA339244B494F49FC90B615C2035FA300F48BADDAAE66A4684B1398329F3102D60C785D285BBF913EB686ECC0973A1DCB6E377276A3141AD2D35F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....L...............................................p......=r....@.......................................... ...H...........N..8)...........................................................................................rdata..............................@..@.rsrc....H... ...J..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1032.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306488
Entropy (8bit):	4.296158643464465
Encrypted:	false
SSDEEP:	3072:fW6kCHTgkU7ZlvMQmOnMGopX6YQ5dWORIqC4adqLDBBlKLSUG8+wi9rvxVJzAkHc:2vM9y6Gyn
MD5:	8EB5BBB05CCDF83AE36DFB88557A3634
SHA1:	6FC0D02390737E3606D50FBBBD1EB4815633EAF2
SHA-256:	7D56E4485B95BD0501532CD14AE2B2D7A4125F08FB6C56B3A5F28223E1D05EF4
SHA-512:	1D809091026947E731C821E1EB012C060524A6F576411421B2F2094278D4389FF35BA2EE0B32BC1F24D769BE733E3D1224442923C8E757423FD77B043E528CB7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.................................................................@.......................................... ..(~..............8)...........................................................................................rdata..............................@..@.rsrc...(~... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...Q...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1034.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292152
Entropy (8bit):	3.620389748101341
Encrypted:	false
SSDEEP:	3072:pFSWXaxuncqz57vDc+JqL/wDFyIsDFPxxeiWaC7kkhTrldUuUfHu6KFWhadVTY:zSNxucqo+JqLY4RDFPOivkhQHlhaHs
MD5:	6194DDB4AE7B2E0B4C1F018BFF77C0AD
SHA1:	74DE3757BC56683371EC08683EEFB7F2BE39CE25
SHA-256:	76D82D261927A56FFC8C45572F1AF9E56CE8A4F26DC0F2525E9DF1581C47F3AF
SHA-512:	D854C9F4BF08E90652279407E95D2F011575480122461DCE241FDFE90267B53AA726185CC14BA9056F39B85E5CA2CC12116E26196DD03E05A410150373009C8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....J...............................................p......E.....@.......................................... ..8F...........L..8)...........................................................................................rdata..............................@..@.rsrc...8F... ...H..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1035.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270648
Entropy (8bit):	3.6472847715680423
Encrypted:	false
SSDEEP:	3072:S670AYKzLFQiBRLAEmW6WiM8LHxaMNv0HhZ/m2lLi2/eqLyJ801IEaI88RTr+vUH:ZLFJ8zx/ZxWVxziBZpKY/si
MD5:	609C67F72687CAF46436ED655A0F5B63
SHA1:	EBE584E44675999E1A8B61DBE65FEDC5C8DA60A7
SHA-256:	51C5F5B5DC59887834F5D237E858BCB760E4E9C0826DE857B2E129C322FB7929
SHA-512:	945AA032D911B06E9F8893FC8CC544891A3FC76F4983D93B21CA22F84A265FBE1B895299F0321DADBB05465B31863B8B0F1675B7D0411512ACCAE7D84DB6C528
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ............@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1036.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303928
Entropy (8bit):	3.6404308301986052
Encrypted:	false
SSDEEP:	3072:7gp/XQG0lY0HlRWz9lOM55IemQC7R57J35lgsPJ+OTanfRcrWy6gh0Fu:eUmvLmP5r+Ox
MD5:	6864C8DBBD985EAF10547C739021A298
SHA1:	25320554ED676CFCB61604EC10D3BE7993020560
SHA-256:	227E20F77BD2ED3F27B5BFDCD4A86BE558635B0C5918E1705F12B69CC808302D
SHA-512:	9CD88473E719E958A1A46FA9A92DFBA487275FE04B67F630A8906DD490FEA34AB52889132EF73F68DFA486A314251B282EBEE89F6763270894570D28A58046A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x.......................................................=....@.......................................... ...t...........z..8)...........................................................................................rdata..............................@..@.rsrc....t... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..PH...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1037.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84792
Entropy (8bit):	4.7557618188326725
Encrypted:	false
SSDEEP:	1536:nIbG/Ev7fV/QDGLu7rXc+yF3hN2qx8x07cVxkeR:YBQDGLu7rqF3hNL8x0xeR
MD5:	37C796DE159745FEE5BA01E850FAEBED
SHA1:	64632DD6DF1315B056D3E92DD28B5FCC998103D3
SHA-256:	1FDE83D00A9887F2CC13D6BC43823366C49142A33EFCAA69023A19A27469B7AA
SHA-512:	9E04D002B624815709FA88656AF55F9B545B37EA607EBA8F44B1661922CA32276E82E5B635B2E2200DCEC0E414E372F74BECA368D144CA6A6B8D13B4892DE4C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..... ...............................................@.......s....@.......................................... ..............."..8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1038.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	289080
Entropy (8bit):	3.8281219925120538
Encrypted:	false
SSDEEP:	3072:26AkFjlc69HieVvyQfEJfAXaHaf8p2FjQzrDJK8+jewl8w0i85EK/FMJgMEz+d/g:ugpWyKxqnKKoMC1
MD5:	8BE44BCFC2C19460518B8A29D0DB6936
SHA1:	EACFB7D6F3FAD825A2359F37F56210FD2F36ABE4
SHA-256:	1596D155EADFD874CAF22F137CB4E4731A4CB58E0641E6503E6728C28C18DE63
SHA-512:	92258565FF725AC2B091F6528D5094FBCAB3AF47FE38F88275C9AA2CCD7DFFCE851B66AF27D7F290B435D8003086966BC3DB09F8E7A731258EA0D954085A8E78
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....>...............................................`............@.......................................... ...;...........@..8)...........................................................................................rdata..............................@..@.rsrc....;... ...<..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1040.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286008
Entropy (8bit):	3.6142714230784154
Encrypted:	false
SSDEEP:	6144:sgr2dkv5rbJEzkk7VbQgxdUSycePovN11uBIAN22H/G2//WF3jn+lZ5a0aIMjpk4:IAYbOUH
MD5:	4D636C317FFBBA449C712A2B0DBBB537
SHA1:	1E8C4427822BE28EADA46D1569C491902BE6ABBD
SHA-256:	75EB9A07F95B2BA0C71BEB391EBDF4B5A3A945DCA2B2A7B9FCEB69963A826E28
SHA-512:	640CFA911A0E85EAD9260101B741F51C4D425ABF6356A72E98CB54AE1F1E985A7E6A5AC6E0EA9E9768528B58A796469C8B5CACA37F1E6353C9C74CF71342E7FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....2...............................................P............@.......................................... .../...........4..8)...........................................................................................rdata..............................@..@.rsrc..../... ...0..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1041.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155960
Entropy (8bit):	5.589951870506423
Encrypted:	false
SSDEEP:	3072:Mmj7f08GAYGz/CJyeD/cQPPYg7Qdwk9kyASAqXSZf8okOqq0Q4WFIUFJG0dvgzGl:rn0uqIB9658okLy3
MD5:	251BA0079D80F800E5B60A3D12D625C4
SHA1:	DAD52B0AFBD138BCFD793C6612B5B85744626142
SHA-256:	6EDB4A7DD1285AE6B4E74692EC35AB56F0F4F975909DBC88F7FADAB64066BBFB
SHA-512:	350CE45BAEB9D0F634F07EFFEA6F59B062037475C6E7E1D472E7A31EFE953CDF4EEAE01F77FFA3A88859B8B8E00D3D41CA6342B4756946F1F1BCAE9BCF12CA51
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....6...............................................`......L.....@.......................................... ...3...........8..8)...........................................................................................rdata..............................@..@.rsrc....3... ...4..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1042.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151352
Entropy (8bit):	5.839152066962377
Encrypted:	false
SSDEEP:	3072:NFdIFT8jQ3PPBY0rY9hd//bY4nAMUxHf9exB3gPbz854I:6T8ePP7Y9fY4nAMfj2VI
MD5:	E7B1864BB73C440CF77F49D1596DB018
SHA1:	88E843823D05CA53C131FA48584F9187C1A76A8C
SHA-256:	EFC34E82941FBDEE109327CA62C9AA6763C0BDFAFA415EBB3D9ED1E7829246E9
SHA-512:	EC559D3A3B91E482894CA1BE23456F7750F8214B9E6A1D3BF966C0DA666CB8861D884E7974C16AC292CEFDCAA38EDCFD3AEC9A0F55D93742B18D3D428A529AE7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....$...............................................P......8.....@.......................................... ..H ...........&..8)...........................................................................................rdata..............................@..@.rsrc...H ... ..."..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1043.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	288568
Entropy (8bit):	3.630735826932675
Encrypted:	false
SSDEEP:	3072:9t00qKa0cGVl71eOTnhSx+0hdPLWa/zwiJ07kVliIOJE5E6pjCA6YxKxYMe7NnB8:L0sm9SJ
MD5:	110F03D53E06D234264F9A741FD556D0
SHA1:	32654249EC77AAF248EF0950F1D600D05A56F3E2
SHA-256:	AAD89D266C73F86C72CB56E5C7DAA5190F3E4436BFAF10A2D2294F6B7C9B8BCE
SHA-512:	DA4B00F809850D89896BEC1A25B356ADC14DAF34C264EE21D904CC72E342D6934651C257EFEA64D123D050C076CC92FBE657F61A0992DACE0397AC034764D471
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....<...............................................`.......7....@.......................................... ...8...........>..8)...........................................................................................rdata..............................@..@.rsrc....8... ...:..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1044.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260408
Entropy (8bit):	3.678006065256406
Encrypted:	false
SSDEEP:	3072:bKpMYtueTfZOaRLl/TP2BPgfJ9yBIwSk5/apG24OveEfBGtqe4BLKjP2PS1grYeZ:ar/YewrKIq
MD5:	9DB91B3A00EE5CD034A349813A611865
SHA1:	58E361DF02987C14C2AA6203E0D886B5A3044CA9
SHA-256:	D8143DB740C2C923938A5BF3663B5BD79CFF9909A3A7668E8E2C4F06AB39A4AE
SHA-512:	519C12A2005FFD7F161C07DB2B0FD3A764C00ED34059193CE95B8786BA03E6E225740129C8CD37B09F19E139F680C1A207A0D9C1F9D6A3278A6CC69EF4DB7209
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................,....@.......................................... .. ...............8)...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1045.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	293688
Entropy (8bit):	3.880847948239701
Encrypted:	false
SSDEEP:	3072:ILrSQMoXPCfy0a8tfT2aJfuold7GQPp9vi:2mQeTxT3JJ96
MD5:	B6585C8ADC8FC4881BEA4040938A608E
SHA1:	EA4C4030494BECB639216E9E80932C8D13C9EE6D
SHA-256:	309D50B27F40391AD77064BD5E04F61F2B6DA982AB20031A0FC7A6122110F3B6
SHA-512:	1222478492641A7FD018573DAD6D59B4F4A127D43363AB729D43FE2BF34B83B8B722AB53A5992D8049D4F45A8DDBE409FAC056F0CABD605A2726695EA4D8FE0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p............@.......................................... ...L...........R..8)...........................................................................................rdata..............................@..@.rsrc....L... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.. ...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1046.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282936
Entropy (8bit):	3.6658749051211355
Encrypted:	false
SSDEEP:	3072:mQeBXArEsM0CnEJumUv8ggDBLfk2hxvosC4bXm3hoO/miM0vLnY5sWkUSUIx6/2q:/Ys90vLnYK8h
MD5:	497A136C4D367BBA408DFD6BB8824164
SHA1:	A84B074AABDE526815E10D9DE977CD88CBC75450
SHA-256:	E42BD51A78FE8075D0C643B28D6A0C96A4EF749CBCD0D3F29F313EFA9AFB21D0
SHA-512:	A7E797794C685C2A9994350D743FC9D1AEB67F14B88258589F3FB47B566845B7270D1CC9923E39230C4C5DCB453E2EEB051671BD19B713DE406D8D887B9FA06A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....&...............................................P......<f....@.......................................... ...#...........(..8)...........................................................................................rdata..............................@..@.rsrc....#... ...$..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1048.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303928
Entropy (8bit):	3.7709129072481
Encrypted:	false
SSDEEP:	6144:HBL70sRPwC8RsSNskqf0xZWH5cWXONAmyDjbVfeNZIj:tRPw8LQW
MD5:	690EDA8E154E9606C0D04A70628888ED
SHA1:	D67219531CEA245EEE2029982856C2E812B9AC02
SHA-256:	53212F1AB3D71087FC592565C2AA18F26CF16C22F6318B1F2BC6A3B0387A25FD
SHA-512:	A3A80C79B2F962DFE587A6B526BE77B0A7F36EA0177B4313B5181480342F80DD9CD7D39ED83FDC84626BFD50336A620218CE7A5BD0D5A0A7826C4ACD2793DC3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x...........................................................@.......................................... ..Pu...........z..8)...........................................................................................rdata..............................@..@.rsrc...Pu... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL...H...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1049.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271672
Entropy (8bit):	4.257460919898505
Encrypted:	false
SSDEEP:	1536:oXIb3Gu57nUkqLBnZSBTjZGjWtaBr74x2:2k3GE7nUkqVZITdG6taBrp
MD5:	B565867F2DE209112F9EC3EA0BD5888E
SHA1:	E8B0EA8EE0A1913D8740702A81C455E6332A31E0
SHA-256:	778E74F69EBF757D7CFDDAB3979B818080917CCC26430DF436FD6F6F8A945767
SHA-512:	9E18A4E31E16481EDBA77D1C6B34B2BF6BDDE6D008DC38225AFC832E702A48F85955067B6FFB10AE338C7BE918BC49B90DE346E0C1EFD9D7DE8AD4F5D61508B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ............@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1050.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283960
Entropy (8bit):	3.749024130586376
Encrypted:	false
SSDEEP:	3072:pgbwUkEwuTAg8LmgkuvBi/NfKlDPh4CK11AFM/jgCXV5wgd:kwUI6gSJCAF
MD5:	79D025DDBBCDEA86B4092235D545F53F
SHA1:	90E6C8DBBF4E3736B487CE1E5E7E1A7A312F5214
SHA-256:	8BDAD2121A3A1F7AE44DE2904D572153C58FAECEDB5C13531861C16586D44A7D
SHA-512:	143FA85BDBE6EA3C687F4F68B828495A2D041646CC892122E7D69C4E8A29625B7B57CD97BD0846BF879A681C8EDB6814BAB548D0AFD9350096D4A6DA89EB0AC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....*...............................................P.......X....@.......................................... ...&...........,..8)...........................................................................................rdata..............................@..@.rsrc....&... ...(..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1051.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268600
Entropy (8bit):	3.9331978809545247
Encrypted:	false
SSDEEP:	3072:HItr1zSE4O4XFtr2LWX0shp3ABenp521oRU6rDv9zETWfxtLswfk2trxqt2h7PAM:6UCN6GDM
MD5:	06659B13BC275A83258C9AE73CF8D0B8
SHA1:	26185C4DFA171E7F224DD23059D9C03F5CA71C3B
SHA-256:	84670061F9C2709EB1F2405E04DB9C095E5B8A67D11C7FF1A66AFD282CC1A3F9
SHA-512:	C2848B49C67FE0EC267759CF52B5701D676FF2D737DFE8D59E373663C220751134168F121EB96272B1A03181B526DBD79C0F29B99C952F79CC8BCE68FE6D050E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1052.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99128
Entropy (8bit):	4.168880650413021
Encrypted:	false
SSDEEP:	768:AvnphI3J0F33dUUFwSdCG8CTzExQmGeapZZ+SQDegeO2NcRxvXWx3Fzkb/5dqbQb:Gn6qRuv+PTg0Pg9evRKrmFqYbXd7lxUj
MD5:	714774A0E56D4B0B664E8D8BA526AF28
SHA1:	F23E1AFFDF0922A6E3E5FA3F2CB7582BF45072B3
SHA-256:	921EED116A7320B0B18239E68911DC867A6CA29569D32CDC2C4003A0158F14D9
SHA-512:	20B59305DA8723A0137A22CA11BDE38ADD86ABA970C39BF360522AE0089958E9F20704D8035882FD840D398DD48411385EA1FA39214F86B7E4688FA51CDD64A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....X............................................................@.......................................... ..hT...........Z..8)...........................................................................................rdata..............................@..@.rsrc...hT... ...V..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...;...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1053.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265528
Entropy (8bit):	3.6983833583699717
Encrypted:	false
SSDEEP:	3072:+NN/puqAv0GWYIuzj9CU1w48dFPn2iaNpQ2O/nsuZs9+UTBl/EEdqJ5OS0qZpXLT:LZvrfViMMLZ5QeP
MD5:	D8751E488F0D070A950D22782654FA08
SHA1:	F698BC11258FEBF11AE9E4D8296D0280EC320F1F
SHA-256:	945B20451F40F18570880F321E33280A579C3A489232DDAB2D9F2A0F2CB0E804
SHA-512:	378C952F4516A3A3C1ABD743E78707FC662072D9F792E349AD94FEC81C09EDA4DD9D88569FCBDB1901C28C0F1AE242A29424E820C2B3446F36D1179E4F45D4BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................_.....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1054.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253240
Entropy (8bit):	4.4100131114157515
Encrypted:	false
SSDEEP:	3072:EkGZVlkS/+Mgdz7D+iBVMSHHCjqxn3weW5x78OCM4b0RamFnaxuFw3O:8odS
MD5:	A4B946192AAEE8C4E29B10AC63D9DF13
SHA1:	7F54E266224407C2F7AE43CA61DD6C86E4A4019B
SHA-256:	E68D8CC1C12F034E9E75EE92990AF56275C3702C8C3489C15A2AE7DBF48C3916
SHA-512:	44F08971AC267CF7537C16FC896325B23469CB082151FCD6F462C4E6FF63C1E4BE2A54558F39191F25D184895B821D34CA2B5B98723D92F94E307CD9768CDF2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&............................................................^.....@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..x....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1055.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	284984
Entropy (8bit):	3.872100961039669
Encrypted:	false
SSDEEP:	3072:eb2tbSoZXtw+SayJfzLK36reuSPx7aoLRG1UdB1uMmcxj2JuyI4kOienS6moo6HA:NyoxJxrlN6ryL4cfG4coFYUM1uVH3B9v
MD5:	5229EB6774F85C3134E235F93000A1F6
SHA1:	0B55D8C2DF9C554D0C29B747B57DB1ED28F3E805
SHA-256:	600E41222EFFC4E9D33F80849C35C18DED3F7618CB462DF6137E4230DEB92594
SHA-512:	C4E6A1940E11CCE892C858C349F773D335761AE2B9DCE1ABF19075AB6CF2AAFDC16DDCDCE14F43C344D5FA945F9C6B1BB130259D69F771E7A6A6C39EEE98B93F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................P......7m....@.......................................... ..X...........0..8)...........................................................................................rdata..............................@..@.rsrc...X... ...,..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1056.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271672
Entropy (8bit):	4.1812798449992075
Encrypted:	false
SSDEEP:	768:FQ+VPPYtWAzurM3uqudf+E/hhdJt47ZHgt4eNz6Y0zfBiz+J+XjN+QlBAhFwN/eH:FX/hZhS4PSNj5RlgkLth+GvoSp7qxY
MD5:	A8D2F070195A2676A75BCDB77E236B3C
SHA1:	DEF3DFE3C41FF2D0103CC188CDC3E873ADAA378E
SHA-256:	37AA329A1AA780ED68E3D5D5A074FB4898106D4FD5CB38CE500163523B0CC8D1
SHA-512:	9400140EDA418B710DBF022D14BE57A08458FE11E477F71A6B908DDACAC41B3EB1BE00A8800C1223D9B9EB714F05C1EACB1A38E609A42578E6BEF2B9872AC227
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ......h4....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..P....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1057.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274232
Entropy (8bit):	3.639395137336487
Encrypted:	false
SSDEEP:	3072:pAvnsbqLRaB3LPlCkJq5WycwPAfrbC/hDiypbDsalR97gA7e1k3s:fB3blP5r+/h+i5S1k8
MD5:	83329490E6C35E6587237CF7BF6CCEF8
SHA1:	4E1A3679E8110EFA8F5593A0C0A880D293DBCFB6
SHA-256:	C6EA79461B3F498D7000745CEE54E0D8D454DC523958B7217026DC467AD90AB9
SHA-512:	30C1B370080D75C2AF77A0B43BE7CE5B870026AA10A6D8331977C058193870A068225F7D5054080503FBE5C5A5C94747C3CBF2E1E19D88F7145E70F81F8BEF8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0............@.......................................... ..`...............8)...........................................................................................rdata..............................@..@.rsrc...`.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1058.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276280
Entropy (8bit):	4.279534858355222
Encrypted:	false
SSDEEP:	1536:cXSwhopP25xej01KWA6cIhMEDdQPlYB1fe7rxr:6Swm25xwShTDdq0tex
MD5:	C84F6F53A636BC5F3388E7D8B717B7E5
SHA1:	E4DCE9D306D6D4ED9BCCE926BBF04DB76A596E92
SHA-256:	A111E75E6CE14ED35E3538A67B2BCDD866228625CBB170E475F6D9C322E0AED3
SHA-512:	0DB63B4BD8B768F6D3D4AC6C75613CE7078728D88774906230934CE1FB411AC0B5925BF08635F40447A8457E100D3E5A280B3C80AABAF703AF4A4A8A07033B53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0.......*....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1059.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	269624
Entropy (8bit):	4.283484846724436
Encrypted:	false
SSDEEP:	1536:qXQmt8zGdrZbW+z7cSXItN+EGtmod7+7tKxv:ggEVW+XXKatN+A
MD5:	82602D3F29663A1E9224AC109A0CAB9E
SHA1:	3D6F3B19A0AEA5AD46F0857C90E6B57AF28C49AB
SHA-256:	0BC4E1EA28C0C7B5170FE66083E4D91E03A2A0B95EB9E6262ED0AD1D70185AEA
SHA-512:	3D63BDB25F4AD6B7CCB10BE14E80628AF186F497C6FE8ADE95972809E6865AC140F376B8A1724C217466A3C1FE5962B7A6A466E2F7D0AEE557A9744720228BA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..p...............8)...........................................................................................rdata..............................@..@.rsrc...p.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1060.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287544
Entropy (8bit):	3.735968289363709
Encrypted:	false
SSDEEP:	3072:BUI6yN3B+Db7tT0yRVLX90eNfVyYoD1sFZVpmg4V+JkEKpperPV/4JmZIdiZbCYp:jWBe+
MD5:	C94CFCA62C1F3890CC132B81ECC79D72
SHA1:	34DBCB06438BDA578C288164F1CC20515B951B0C
SHA-256:	5AA12C825E2B73CA702A49087323D1A5F20CE3AC58A04877CD172903CF0E4F1A
SHA-512:	74C49C0702C07DDB6AD1224965FFB738F9FA19C6EE5C46AA8F2687473334D1B6B3E0FED4906D58022C64C25F025E7E6F083712307C8628D234D804A441D70CC3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....8...............................................`......3e....@.......................................... ...5...........:..8)...........................................................................................rdata..............................@..@.rsrc....5... ...6..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..0....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1061.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260408
Entropy (8bit):	3.6848176636362475
Encrypted:	false
SSDEEP:	6144:iS6PYBjrXQL4Kfm0lh7+BhJlCO447I+s+:bUC
MD5:	495CEB9835D47D6C341CD49D659F0E88
SHA1:	A3B896058B9E961BDA1C6D2FE3D34CC6CC938D29
SHA-256:	982481F832FF0A87F6EF57C45959247F62F2F9757B069E2AB8BE294E23CEE4CA
SHA-512:	B459A70737F1BB0C2920599359E1217CFDEBCD639D9488E6DE6686C23ACE3858DF601A27DD9050825B2381ACEAA1EDADCB03BE1D0CC43C0A42D1C77CC9F8F6AE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.............................................................T....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1062.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268600
Entropy (8bit):	3.8838937768448623
Encrypted:	false
SSDEEP:	3072:5TN79qaua3xqfkz3xYe2cWI/Cy1ddAG98kPHeopgE+ZDhFDk2M:PhqjtzI/F1ddAG9zPHeopgE+ZDhFDkr
MD5:	DCB35665250C8265ECF696CB4E6D70F3
SHA1:	55A74BF410BFFB6AD949D22FCAB973833D55E730
SHA-256:	75BBAC26EFBA1B1EB5EEEC6057453F5E52FE754282E0CF333CCF1F81D069F6B0
SHA-512:	DAC791FF5FC16ED179FFF5DC9B17DE5B0EDD76303056AB8801F60CC60FFB2F596D10CBDF1BEF71A9FC9146F3FCAFCA46110B65449BB7995F97E5D3584B4AEC06
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..h...............8)...........................................................................................rdata..............................@..@.rsrc...h.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1063.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275256
Entropy (8bit):	3.8453835254793582
Encrypted:	false
SSDEEP:	3072:n2cVFxILT3wHKd4OZchEXSKyb74AwlCTWgVEhm5f6UsAJ2QE09AZytVEaLpglnfX:IIiwHmR
MD5:	4403B8DBF0092943D809ABA994BE5F01
SHA1:	1B0CF2573F04C3D7936BC9C2459C90FE8D39F7C6
SHA-256:	A4E5CDDADE944C272CA762E8275B1D6364569E2AA3FB70DBE54FC45E49A079CF
SHA-512:	32DC21011D9BEDAB58C7934CC45CDDB38603C9C56935E2C08F2EBB3021956E1D150A47A7A67C9D83E75C845B1D2B49582837AB784A8C610CD1D9B30693914564
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0...........@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1065.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270136
Entropy (8bit):	4.133388939090134
Encrypted:	false
SSDEEP:	3072:sA6wg68Y8bfzKuFEgw1gO6isQKjY97MH5kVwohumW1M:H6wggafvEgw1gOVsQKjY97MH5kVNRWi
MD5:	FB85822299AB83F2DDB8901F5B56861D
SHA1:	CD33299EFDA1BA559873E504001B106AFC9C56C1
SHA-256:	030D610D8CCCE6AABA493A3DBFFB37D0BE07799FC43B440F06BCDE1E3A7977BC
SHA-512:	EDCB45C4AF0E81B0A87DB9318D9A7EA062F6EE42516CCC48A3BFEF3423BB67097DBFDDE12F638FA40D6F563F0CE84685DEFB8B7AFA8F4A7A237B5B18EAB57D5F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ......8.....@.......................................... ..X...............8)...........................................................................................rdata..............................@..@.rsrc...X.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1066.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280888
Entropy (8bit):	4.221356410788591
Encrypted:	false
SSDEEP:	3072:+7jHQb3OJJv2Sy5boo+hToMMK8b0y8TI2ZZVfaP6A:+S3OGS+K8X8LZzi
MD5:	F3ABB8BC938B065FE7F896E9B7FBFE1B
SHA1:	98FABBD97D1258AEC7C7710D2294DCC7DFFC192A
SHA-256:	6D07CC2ADC1F8574EAE59A2FDD504CBD122DC8A6865AF70B336F781CCEC757BE
SHA-512:	5C9075239DD23D1A71DEF11737DA04AB95C15D461BB371CE6F2845B27C8C39492AC928B249CEF582532298D3F30111E7AF270EE7542D5FDA2276E75115A2972D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L.....e...........!...&.....................................................@...........@.......................................... .. ............ ..8)...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1067.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	4.745844586954647
Encrypted:	false
SSDEEP:	1536:0VRKRwjihIlKVSYMOv2RLT7KooahF6LAIUjmuJ2DispH1aNv73gsmfAsZATeg9eb:mQyXThwi0Yeg9evQ1rmFqYAK
MD5:	AC312ECC20A86B1570F0C1F480B1DDEA
SHA1:	D0036F51BB48EDD9264C1C674D0DE4DE30DCF332
SHA-256:	54D9F6450EC303A70E98B9D050156A4115D0F40BBEF9DC5844EF3E0EE114A19F
SHA-512:	9DBED2E6380543001BA9D4465F88E64599A5A1EAC680429E81DEE964EABC6547DC2D9BEF4B897E76FB408C413D9F280A464E1A8940B6BE07D58308CB9EB26EDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....R...............................................p.......9....@.......................................... ...O...........T..8)...........................................................................................rdata..............................@..@.rsrc....O... ...P..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...6...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1068.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	4.299701176412258
Encrypted:	false
SSDEEP:	1536:o8OWtBFOFKSvrNse08AsdUMJ8vlKnMTg0Pg9evRKrmFqYWXd7ogxQ:9JBYxselfGvlKn4xPg9evRKrmFqYqW
MD5:	CA3691D66F8C9A7FEA3F12A75701652E
SHA1:	0958582CFDEE403FF9FDBBBA405FC4FAD944111A
SHA-256:	CEFE2149BEB636C6812C056A0356899DEFFB16DA20A714AF540C96BBC71DC3BD
SHA-512:	F2F9562AA5CDD91CE64B77E691203DB2E70C47B5489EFDA3A94724345EC3C7CBAAAFCB4DAB23A8E6836FCF2F83D0737357598B4734140248875CB1B78E8169B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p...........@.......................................... ...M...........R..8)...........................................................................................rdata..............................@..@.rsrc....M... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..P4...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1071.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106296
Entropy (8bit):	4.68566767027544
Encrypted:	false
SSDEEP:	3072:vIfvxxMq132FYhTaWH1zgdevRKrmFqY8t:33WHc1P
MD5:	1B6CD38C17FC9EA6AA6625D20909857D
SHA1:	D5596E9C10674028EBD501A6FDD70208FC2DB323
SHA-256:	118D69CA068AA2B5A4E069ED41FE550BFE6BC5CABE1849F5282C29791999BC8C
SHA-512:	25AA2B34BEAB5D7845254C3D82667C3E986F43F0709255C1970777AB4BDF0B5A2FBCE87EDEC9F2A7F53D0D02E65FA6A60F61C42D1FC11F3165831F8CE8ADA3A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....t......................................................L=....@.......................................... ...p...........v..8)...........................................................................................rdata..............................@..@.rsrc....p... ...r..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...W...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1079.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98616
Entropy (8bit):	4.810510530524856
Encrypted:	false
SSDEEP:	1536:CMim7E6UZ2gL/VgFvSDKBMTg0Pg9evRKrmFqYWXH7Tx8:HUZ2gLdIvSW4xPg9evRKrmFqYsm
MD5:	CD9EEB0CB04965C4B6B7197BB8986264
SHA1:	0AFE0DFAA8F8F8994913E4B73C22279923A47564
SHA-256:	554B1FE4C064BDA724B2627EB8802E74ED3021EBC9466674042DD8BC3F27BF3C
SHA-512:	C05606E615696900088C13216FAED7117B63A3EFE7AB9813E48B9DE8B17D3C254A569A267EE4F7D93BEF6FC7C90053464CE5724894839471527741B4E401C66B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....V............................................................@.......................................... ..(S...........X..8)...........................................................................................rdata..............................@..@.rsrc...(S... ...T..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...9...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1081.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	273208
Entropy (8bit):	4.291819194202965
Encrypted:	false
SSDEEP:	3072:hpENh0qtd0dvkGCYxmdFch+hThkbX+IErKc/Rdr1c7cMKeBzAWTJ3z+bhAqhnVDP:oFvkM1tkk1JWaMt2
MD5:	8F05F7E058834A60EE85C3A3CEC76DC5
SHA1:	907FDA588BE838A4D1220C2A9F192A1A6674BC3A
SHA-256:	71AA6B02E577450D7DE9A689143C468D23DA9E923542FB53ACDCEE3F00796E33
SHA-512:	85D29B26FC176D9F191D9BAAA8716C59580820CB4C05E448D264F53054DEC8090BB536306D59521A9E4A8261DE03C96EFB24CF3FF41CFEB7D9B12DE9DEF17254
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................... ....... ....@.......................................... ..x...............8)...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1086.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283960
Entropy (8bit):	3.5965805962316364
Encrypted:	false
SSDEEP:	1536:GX7scKGcHdo1546rRkMuQsulA7VkE2hzAj/nyq2UUc6CnmtCGQSQ1cNXpHWdUlqF:sEGj59FkMuQsuE+hYPyq2UnuC2HzW
MD5:	E2773D73C90E55532166B3219125DE85
SHA1:	67800B2C198F7EF316B484C11591E062977BA764
SHA-256:	8249892FDD5847A4485FE21084629F3574F199E262C03B8F7C624C5A03299650
SHA-512:	2DB2ED20B248BD9070B1B2B189784578E46B340A5CCA095251EC738E13D790A54070282048D5B56D4D4F7D18861BF4B8521A40BE4EEDDE011F15435C04016943
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....*...............................................P......{.....@.......................................... ...'...........,..8)...........................................................................................rdata..............................@..@.rsrc....'... ...(..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1087.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95544
Entropy (8bit):	4.734471160751719
Encrypted:	false
SSDEEP:	1536:S8xbxAJ6vrN4mB/jx+dnwSp69vhdFUxtg0Pg9evRKrmFqYl78x0:1cqJIwlvhv4xPg9evRKrmFqYlB
MD5:	E835EBA92F2C5A5CCB4B599EFC038CE0
SHA1:	6D622B26AE391091A79C3BAD873DF02EEE1FE37D
SHA-256:	D20D0074DD914F9DED67D59D469DA588F8B8CB0EC97BB429309556EBEBE8B383
SHA-512:	B7CD59505A0544AE0D404E93BF449F4329880C2D2C66933183440A0543AF48D4ABAAA9BF48593BD78D4630E094158717E54C7A0A83D7B60ABFE18663427D380E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....J...............................................p......*.....@.......................................... ...F...........L..8)...........................................................................................rdata..............................@..@.rsrc....F... ...H..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..P-...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1090.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107320
Entropy (8bit):	4.222433439461034
Encrypted:	false
SSDEEP:	3072:4UxZ5eiAoalbBP+98CddkERRc5ijjsfaWIG0LwB0spaS26NDdNdmVesHAn4qoqIf:oVMMu
MD5:	DB19E2642911FB0C0FAB498EC4794AF6
SHA1:	B7F1F16495ADEAF0D17AB62415050B151ECBFCDD
SHA-256:	7DC3374254237617AB3D9DF45D495FD298FB049A02945B32586051C67BD06607
SHA-512:	0587F8E60D8AB992539C740D3A9790D6C5515D5A091F43EBEC6809A9D4F6BB72FC7013753696905FADDFC8A026F998891EA99C7D0DB87645872D3B9E81333D8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....x.......................................................w....@.......................................... ...u...........z..8)...........................................................................................rdata..............................@..@.rsrc....u... ...v..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...[...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1092.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95032
Entropy (8bit):	4.844875701190333
Encrypted:	false
SSDEEP:	1536:N2E8pozpgNaKTnEcNS7vO0MTg0Pg9evRKrmFqY+a7Cq4xh9:3826aKTEcNS7vv4xPg9evRKrmFqY5+q4
MD5:	86FBE7947DD03B137A87E46F3447EEF9
SHA1:	114086DA22F07CF18A213B76BCAD93FE024C32FD
SHA-256:	7956802C0200BEE74515B7D3E50A50F717B98A3BE6E01E6C4149B0BB14101B62
SHA-512:	F8C18F8B18E7B8754D05B2692168E7CFF8FD6BCF96361FE0AD7F20508BED14A52B2E20DE14DC17C604B190575BF198D84A48C29C6F67412ADC69A920F9F80224
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....H...............................................p............@.......................................... ..(E...........J..8)...........................................................................................rdata..............................@..@.rsrc...(E... ...F..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...+...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1093.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276792
Entropy (8bit):	4.350978598702097
Encrypted:	false
SSDEEP:	3072:AFO+67kbZVDyYhn1iKN2zA46ErzsCPvC+xMasNu4CyZtljU3:qskbZVDzhnszAUzsIMaOu4CyZtlG
MD5:	443F4E0EC5A2FC289232AB9D434D5A62
SHA1:	2BB59430EB53B80B035385257E038D548BC22627
SHA-256:	622C70221E70D4462B499CA9828645CF3C16344FF923F483FEAC9B5FC89C13C7
SHA-512:	92D15108D550037E861B6EB7ACDEBEC9953787D92E73C9FD53B5ACCD42FB1E08E7BA3D9CB20CB46AF2BFB0FC76168E7A73F9F0A4C8F0CC52B260CC10D6565004
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....................................................0....../.....@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1102.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99640
Entropy (8bit):	4.728187060232998
Encrypted:	false
SSDEEP:	1536:7Q+vvrNhPw/3mdwJ3vJbMTg0Pg9evRKrmFqYWXX7OxB:dRh4/cGvZ4xPg9evRKrmFqYwW
MD5:	60F2EF22695F5923C98008BD25EA9BFC
SHA1:	977B4EB59997D5090EE7E8E70E6CF0B76CCA83E4
SHA-256:	DEA7F9F2FCAD74408817D91F9F78AFC01557685A254938B5C25A9DCD3CAA678B
SHA-512:	D0FD4EBE8F4BC5D2C07C6E006412BED7E514CAD48935CBB2D333B0605FB59226252483ED90E70D7A8707DB30119AE2A52599B30A694EB2BAFD1F9EF65DEF1F74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z.......................................................J....@.......................................... ...V...........\..8)...........................................................................................rdata..............................@..@.rsrc....V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..`=...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1104.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	4.755458349414788
Encrypted:	false
SSDEEP:	1536:k6WKkcKSdmT/ya7LLuPaCdx4vOw38M1g0Pg9evRKrmFqYWXk7mxM:RWnSAHaH8vAexPg9evRKrmFqY7n
MD5:	E56C416B45EA2B66429DC196A53EACBB
SHA1:	CCD00677A9429764615E8AB37BD7BA1DAFA9B232
SHA-256:	E6A08000CF62EA8434F9C2A117686AE6895B79BF5CC175D6224CA09B9EDC1471
SHA-512:	CAD8ED8492EBFAC87A973BE33D7576212BF0E273C3BD5206EF6745586B5FF72070990A39BB1CA52189199FBE1533853973CAC04B4022797E5B199CED28474D34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....R...............................................p.......o....@.......................................... ..PN...........T..8)...........................................................................................rdata..............................@..@.rsrc...PN... ...P..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...5...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1109.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102200
Entropy (8bit):	4.6898542181777785
Encrypted:	false
SSDEEP:	1536:mNsWvrNxLllQdwx9veMTg0Pg9evRKrmFqYWX77O2xPc:wsI960ve4xPg9evRKrmFqY0bc
MD5:	C636388E2BA87D2A6205F010D629B4C8
SHA1:	B791A6F5CF8A3E70CD0A5FF6548C582769BE698B
SHA-256:	21B972AD516ABC997EC20AA1C0A5C1BFF2270206663CD190E4F26BF615C673C3
SHA-512:	D93B53A165A29671711EC24304058121D3AC0DBBEFC7FCE00F9C6113BC4C60315A0ED520AC7F58FB7396D96DAC2EF11871D521898D5C1F724551E705A69A58BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....d......................................................J.....@.......................................... ...a...........f..8)...........................................................................................rdata..............................@..@.rsrc....a... ...b..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...H...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1110.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	4.149221296446485
Encrypted:	false
SSDEEP:	1536:PtVvrN/KQEDdwd9vJ2q0EZqMTg0Pg9evRKrmFqYWXh70aRGxe:FL/hE5IvCR4xPg9evRKrmFqYSH7
MD5:	B9D7FF3F308E195B8E0F14CA31FAFBCA
SHA1:	2C015D2A607B6798BAB1332E223FD5A17A6E3426
SHA-256:	6524B51513B71BF04CD6BB2130341EE740DC95643EE49FF736E53F1A4CAEFA89
SHA-512:	1C70A5D946F6302DBF4890CB7F92CD8939404BDBEF16457B04B3A4439820215180904A35327A145C53929085C62D382EE668EA16565C8A41D5643EFDC6914B64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....P...............................................p.......$....@.......................................... ...M...........R..8)...........................................................................................rdata..............................@..@.rsrc....M... ...N..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9..84...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-1155.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113976
Entropy (8bit):	4.053287008578674
Encrypted:	false
SSDEEP:	3072:Gpg4lMseFlQWOc7tEsGGg7gsaVgdevRKrmFqYlygI:YVx1FZ
MD5:	1AEAE50834932E0222B1ED078431A492
SHA1:	724083CFABA2560D30E65B5CB5C2354878C4804B
SHA-256:	4E19D8A8EC60237DA9840D8D6D44B728D7C0DE01CFB0E94E59FE2DED9F92109A
SHA-512:	8871CFCF9146B1041E7E69F0E3676A7E1F4E188CC6882232440754DD2A87D6144B6E127E6471D2977402792852E985F8EF1890EA53083546AB3EB18FDC34F131
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... .................8)...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...v...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2052.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113464
Entropy (8bit):	6.4045303506775095
Encrypted:	false
SSDEEP:	3072:f6SwxE9bxYj80EMxsEsZiDF161Fb3KNTbFhYVYm0MBLYy2nAM:Vl1EsZiDF161Fb3KNTbFhYVYm0MBLb2x
MD5:	5D17951AD220C67E35F6CB76F4C30785
SHA1:	37024A9A709D0E15CB591718F73A7D168E827B90
SHA-256:	3C19C586B56E1D2B1965FE4E1379848AFAF164EDAA34F4738C22A59D38E9A09C
SHA-512:	95F376296ADCC67A85B339FD25DE775DFEA21344F7194137BCA9AFB21E27851C9CE4B33CD15D3D38839F609DE9B53E5FAE51807E973772A8620D3B0831BFC447
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&..................................................................@.......................................... ..................8)...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..(`...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2070.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286520
Entropy (8bit):	3.649571862125894
Encrypted:	false
SSDEEP:	3072:zqvgWq94audzAC6y2roL6+USZ5xMXvsE+DgDCCyie9uGPaj:RLufNkr
MD5:	C7AF447B1A7D953DB89F2C3902281EAC
SHA1:	4958777511EA2D003E0E79341CD03A3D4F9DC6CE
SHA-256:	DA41F01C131F9C62DB52D7D41965776D8E3CA5EB4E4266E6A23281C5D0008A44
SHA-512:	6EC62FDE3E1909F6C9F572368B6AA105586F3974068E2E7ECAD808599A556B4AEDD399F34341F5A3AC8EDC758B1EB8D66554DE612AA2B738E2816CCC2A75EA7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....4...............................................`......;M....@.......................................... ..h1...........6..8)...........................................................................................rdata..............................@..@.rsrc...h1... ...2..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-2074.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281912
Entropy (8bit):	3.7545288292453285
Encrypted:	false
SSDEEP:	1536:iX2fj4PVUHqRnku573Rozs2bcoYJ55HccR7lENnYFf1o5t3iap82Sveap6EJ5eGp:4HVN5SioYJ5QnYF+5tB8xxPEQnmOyM
MD5:	239CE9A7F5F02C4C00D1CA1452703601
SHA1:	EE29D4A5AF7768BA71E4D23D9933B6D33DAE65E9
SHA-256:	CAB5396B0EC712C673031F175CBEAA869EA91D88139C1F609FE04B04D4C17A33
SHA-512:	3A9B1D5E0C66C7864CD971B7C066FF7FFAF6317F2E66EF0B1C6786AB4C4412BF2F1A77D6233548C5AC7B75D1F8B78FDD1F0B46D6EBF31BEBA4819651DC296BE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&....."...............................................@......;.....@.......................................... ...............$..8)...........................................................................................rdata..............................@..@.rsrc........ ... ..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..p,...rsrc$01....pL..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-3098.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99640
Entropy (8bit):	4.703727010685646
Encrypted:	false
SSDEEP:	1536:maTftzNluN4jjDovp+MTg0Pg9evRKrmFqYWX57DxS:JrlISjDovp+4xPg9evRKrmFqYWE
MD5:	3AA49BB2B9A2CB82D45BBAA687802F59
SHA1:	9116A0429241542B22D7433CE89709EFF5BF4ACF
SHA-256:	5FAB3F5F8688515903C55F503FC7A2DF41548F7C5C904DF5A24DC76E6DF2AF26
SHA-512:	00D3378155FADB803B27019E176471E59C2715415BA446216CE0CFA86DC875DF031AF616A498CCAF67FEFF03163F036AE398F87E8801A268413386A0C7E8384F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....Z............................................................@.......................................... ...V...........\..8)...........................................................................................rdata..............................@..@.rsrc....V... ...X..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...<...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-5146.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102712
Entropy (8bit):	4.171575155855462
Encrypted:	false
SSDEEP:	1536:0WTdQdr3+167bBBAOe6wCBjviagdevRKrmFqYUS73xS:RBB6HvAOQCJRgdevRKrmFqYPM
MD5:	18E2B274058099603D1A1E3F8B6AF2E4
SHA1:	BE1D1A00A4EEDED76FDF90B5AD95A2E04571AACE
SHA-256:	72F2E3FF23821F654938141ECDF65904E467863045FA250BB7E913532D01D126
SHA-512:	DAB43804508265C41A49AB931F01E1DF7DC8E3B2EB9FEA29D47365B6161B23A46630F1D97376DF5B94B2767F9CF3AB77898507A728C0E38378640299E7EE335E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....f....................................................../j....@.......................................... ...b...........h..8)...........................................................................................rdata..............................@..@.rsrc....b... ...d..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...I...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjDF41.tmp\ui\res\lang-9999.dll

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101176
Entropy (8bit):	4.729989733399104
Encrypted:	false
SSDEEP:	1536:kHIbKpE+8vrNGbxN8nIvfS+kMTg0Pg9evRKrmFqYWXK7fxHA:P6SIvbk4xPg9evRKrmFqYtS
MD5:	41A02B9950D0F62FD603F5C07F127FCF
SHA1:	B5778E3C5C5496C23A4A808199D63A53D7F385FB
SHA-256:	A0512B624E6A0512488A3EF49DFE041C0B63AB0F5396240882B08E898C00989F
SHA-512:	80E7335D728FAF26CB365415F55706C0861276BAEFC1E649F0E8F989C65872EA85508C4CE8B41C005AC08A424DEB68A8CCE30B98AEEA82C9B783E1667216C980
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9....~..9...9...9.......9..Rich.9..........PE..L......e...........!...&.....`............................................................@.......................................... ...\...........b..8)...........................................................................................rdata..............................@..@.rsrc....\... ...^..................@..@.......e........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ..P....rsrc$01....P9...C...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsoDF11.tmp

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	data
Category:	dropped
Size (bytes):	223070838
Entropy (8bit):	6.895236228530489
Encrypted:	false
SSDEEP:	3145728:uq85Iaz8f260yR4FkFXTzEApw7nzMVSpzqoQqH/8SjbetqP4JyrlY:u3cfB6FkFXXAl9/Zj2PyrG
MD5:	59CF2416D85E3C87E6CE32938943B4FB
SHA1:	D65AB4D7D5C490104D78B37EFBD577CA27597E15
SHA-256:	DDFE4DB0D15890794D5443D35AC28282BF544B83B8EF98D6437EE421DD3B2BF6
SHA-512:	C5D8E4AE89C8DC34F12AFE6CEF194A91B1EB78425472D69FBFFFDF06138E8AF5CBADC0D27C4F34274CB9F3C0423FCC1A01438C976DCEFE6887AFE340D6211AA5
Malicious:	false
Preview:	........,................B... ..0.......r...<...j...........................]...........................b.......4...............................................................................................................................................................................................j...............................................................................................................................................................................................t$..........j...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	234936
Entropy (8bit):	6.579614226060056
Encrypted:	false
SSDEEP:	3072:S2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhhAK0KC:S0KgGwHqwOOELha+sm2D2+UhngNmK4w
MD5:	0CCDF8EDAF3A0FB11856FEE1690E2957
SHA1:	ECCB8847CA5B42E9EA85B3EB96141899D47856E8
SHA-256:	A90757A87FFA192188C71D2AAEB7CC2D7758E7BAAEE7E1344D33A6C257884F10
SHA-512:	C18FEFAD4033ADA7C8D1C2947B718C89D446881D9730E10FA9189584687762818E0823F069FD4B4673DB62CFA2F12DAEBAAFCE14CF71AE804169D9E553792FC3
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L....m6d.........."..........\...... ........0....@.................................n.....@........................................................Hl..p)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\387LN76X6B3SQ67F5D0O.temp

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	modified
Size (bytes):	8595
Entropy (8bit):	3.133720811077656
Encrypted:	false
SSDEEP:	48:Ji5ud57ORbd2G5pqVi5ud57ORxxd2G8pi5ud57ORBd2GW/6i5ud57ORL0d2GGK/N:JsTHgsTgsT46sT0sTI
MD5:	41BC14C95F43D17FAB629BED1D942201
SHA1:	114634137883DB694897EEE6D2954E60B8FC4E7A
SHA-256:	77DFDE8D42411F538C9E3D2078F0609B78B853127A71D0B71AF1557350D5F434
SHA-512:	D92C0124A9C78754A0A88DA19AA82BD56970F93C5AC000AD449CCD38C0AE6C1D336DA86365CA2D4D8ADDED08BDE2132FFFF020438189B147D636D2AED1835CDE
Malicious:	false
Preview:	...................................FL..................F.@.. ......dWX...4..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r......................!..C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe..../.A.U.T.O.J.L.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e.........%ProgramFiles%\CCleaner\CCleaner64.exe..............................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.C.l.e.a.n.e.r.\.C.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VLTUNUDH29F0SCQA65GY.temp

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	8595
Entropy (8bit):	3.133151589096717
Encrypted:	false
SSDEEP:	48:Ei5udTORbd2G5pqsi5udTORxxd2G8Yi5udTORBd2GWo6i5udTORL0d2GGKCi5udN:EsdHxsdhsd/6sdRsdI
MD5:	27CD6E77394AC47C504481A4B9E7B2A7
SHA1:	F19DFDF773535B593121E7C0460E83D1A7840A30
SHA-256:	B71399782D7BC21B1A16A273DB0E5759367509DB861FC5140B86E71C33B44F36
SHA-512:	B25107A71C1EE44A1CFC4D66870F5C0ABD621003771AC09AC4EE8CF27C4838CEFD68F4F14820946932E9FF8FA1D90B8350BA78A967272B6F8A2FCA392CB0504F
Malicious:	false
Preview:	...................................FL..................F.@.. ......dWX...v..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r.........................C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe..../.A.U.T.O.J.L.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e.........%ProgramFiles%\CCleaner\CCleaner64.exe..............................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.C.l.e.a.n.e.r.\.C.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	8595
Entropy (8bit):	3.133151589096717
Encrypted:	false
SSDEEP:	48:Ei5udTORbd2G5pqsi5udTORxxd2G8Yi5udTORBd2GWo6i5udTORL0d2GGKCi5udN:EsdHxsdhsd/6sdRsdI
MD5:	27CD6E77394AC47C504481A4B9E7B2A7
SHA1:	F19DFDF773535B593121E7C0460E83D1A7840A30
SHA-256:	B71399782D7BC21B1A16A273DB0E5759367509DB861FC5140B86E71C33B44F36
SHA-512:	B25107A71C1EE44A1CFC4D66870F5C0ABD621003771AC09AC4EE8CF27C4838CEFD68F4F14820946932E9FF8FA1D90B8350BA78A967272B6F8A2FCA392CB0504F
Malicious:	false
Preview:	...................................FL..................F.@.. ......dWX...v..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r.........................C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe..../.A.U.T.O.J.L.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e.........%ProgramFiles%\CCleaner\CCleaner64.exe..............................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.C.l.e.a.n.e.r.\.C.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms~RF564812.TMP (copy)

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	8595
Entropy (8bit):	3.133151589096717
Encrypted:	false
SSDEEP:	48:Ei5udTORbd2G5pqsi5udTORxxd2G8Yi5udTORBd2GWo6i5udTORL0d2GGKCi5udN:EsdHxsdhsd/6sdRsdI
MD5:	27CD6E77394AC47C504481A4B9E7B2A7
SHA1:	F19DFDF773535B593121E7C0460E83D1A7840A30
SHA-256:	B71399782D7BC21B1A16A273DB0E5759367509DB861FC5140B86E71C33B44F36
SHA-512:	B25107A71C1EE44A1CFC4D66870F5C0ABD621003771AC09AC4EE8CF27C4838CEFD68F4F14820946932E9FF8FA1D90B8350BA78A967272B6F8A2FCA392CB0504F
Malicious:	false
Preview:	...................................FL..................F.@.. ......dWX...v..i.....dWX..............................P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....[X...CCleaner..B......[X.[X.....r.........................C.C.l.e.a.n.e.r.....j.2....EX[. .CCLEAN~1.EXE..N......EX[.[X...............................C.C.l.e.a.n.e.r.6.4...e.x.e.......W...............-.......V...........a..;.....C:\Program Files\CCleaner\CCleaner64.exe..../.A.U.T.O.J.L.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.6.4...e.x.e.........%ProgramFiles%\CCleaner\CCleaner64.exe..............................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.C.l.e.a.n.e.r.\.C.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 16:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9905994508617595
Encrypted:	false
SSDEEP:	48:8soi5ud+T77AuJHYidAKZdA1JehwiZUklqehoxy+3:8sosDEHzy
MD5:	BC9B2499460BA102ECDE6B25682C6CB5
SHA1:	32B1CCB749DD71A31886879364A688F5A0D945F3
SHA-256:	A51995070A07E5641F1BBD03B7D3BE68E9A56F6D4986B808D272D067E0F83DAF
SHA-512:	C7F128520A53D3AFA76318BC0FEFA974B3286E56B6E0680DCCB15332BBDD9886451FDC7CEC3A9DC73C3A436CA3A44941FF52606F4C9FB03388387A0902F0D8FF
Malicious:	false
Preview:	L..................F.@.. ...$+.,....E.N.i......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V[X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 16:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.005977195877815
Encrypted:	false
SSDEEP:	48:8Soi5ud+T77AuJHYidAKZdA10eh/iZUkAQkqehZxy+2:8SosDE99QCy
MD5:	5BAAB8D4D44C8533A1D1F8C21B911254
SHA1:	ADA0D2EF4B5EE50D1522441F7DE3BBDB59654ABE
SHA-256:	00A41F9669005A3F2B1DAFD9907588EA559EFC68CEDBB86248AF51A77F440C0D
SHA-512:	C40C94A6A4CB1D4B0E7911B6072EA54A1E00D085904091BDA8943BF450DA9A7A94841497BE8F78C0EBB1B16EF41E319B569A9D4FED9D1BAED1C353573666CF2B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....7.=.i......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V[X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.016384032756069
Encrypted:	false
SSDEEP:	48:8eoi5ud+T77AjHYidAKZdA14tIeh7sFiZUkmgqeh7sXxy+BX:8eosDEcn3y
MD5:	572B97586D72C5EEDD01ADB7F09137E1
SHA1:	E2FBE759AE3CEF94E1181D99C579E837901C23D3
SHA-256:	8B61CA228D486CE3716D7F2F8F268C2BC8FCA1E53AC115FDFCD53EBF1A78EB60
SHA-512:	796927DFBC6F320ED611FD868D0A98CC622EC2F693DD2DBE871FE55688D6C25B125FD6CC4EEA6292880C2CC3874CE7C02DCFD133334E2A9A7CE46A351B69C1D0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 16:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.005688451409726
Encrypted:	false
SSDEEP:	48:8Koi5ud+T77AuJHYidAKZdA1behDiZUkwqehdxy+R:8KosDEOpy
MD5:	0DB210492C372E364310DA6287696707
SHA1:	2E414AD519CA937F3DCC7C2333AAD37C38FB4178
SHA-256:	39661E7F1144B749B94F093A21734C4C81BD67C515AC45C8E7D1D6A5932120F1
SHA-512:	70394F0BEA79770B14EE6FA981FA90E6CE6C85884A05409398B89D2C07CD2A5FC40030A20CCC09FC2574EF1F83A8F2198F7551A72A0187D81263A128E807693E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......4.i......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V[X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 16:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.994045456769461
Encrypted:	false
SSDEEP:	48:8noi5ud+T77AuJHYidAKZdA1VehBiZUk1W1qehTxy+C:8nosDEe9ly
MD5:	F6908331D251EA2A92DE161A78C1F1E2
SHA1:	196DD2283B9097161AF26806D2C9AA45D86DA8F9
SHA-256:	9E4AAC5AC8C726C8FB9208C4DAF79C972F78E0D21D8158DA58A6951EB23CDB10
SHA-512:	59AAFF8AA054ACEF0BEDBA8AB7E39F92B1CE56C17453373F081F2788AC4571707531AB64DB5A45DD5C9A8F4F9E861D85FFF9699AD2F48A56BD5148158C94D586
Malicious:	false
Preview:	L..................F.@.. ...$+.,......F.i......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V[X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 16:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.004833843637352
Encrypted:	false
SSDEEP:	48:8loi5ud+T77AuJHYidAKZdA1duT6ehOuTbbiZUk5OjqehOuTblxy+yT+:8losDE8TTTbxWOvTb3y7T
MD5:	582BC74FF9214CBF99E1EF9608C89E5B
SHA1:	2324F299252A956C803CEDEBEA2DAF101E327B2D
SHA-256:	3EE10761544DF7A2EF1CD8463ED670AE7B5792CDF3BFCD3B1AD2F4689D1954E7
SHA-512:	862924BB6CDBDD55F4CB9925D002861359F912EEAA78546A37CE4BF2CD519C2DCE58980B0549808199AA8E77670551E3D4BA5001A72C2015E0D7081FF877B87B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....\(.i......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....[X...PROGRA~1..t......O.I[X.....B...............J.....r...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V[X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V[X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V[X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\ccsetup621.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\CCleanerCrashReporting.job

Download File

Process:	C:\Program Files\CCleaner\CCleaner64.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	3.620590178944818
Encrypted:	false
SSDEEP:	12:V4kkbdpzANtf9HoUGmubdpkIS2Byubdpk0L46a8zUmLZBsD0rEwKV7Z5:VUddatdoFmqd2lWyqd60L46/UmL/sDuh
MD5:	5FFC2C92E68E291EFB6EB782E98DD3AD
SHA1:	289F40658329AC43E301002DFF9E00C7FA853687
SHA-256:	A80D0D7F2332AC15CB378B087514A4A006CA6E3F020E429EC87A9FDC03CDD186
SHA-512:	9CB176C53B3F95A975D3769C8008BD1364F67AB13BEC81F8294245E009CE798F3633928D7B8D697749596F469351DE2774C21B5B7A5F2214EB7D9A46B8EEA61F
Malicious:	false
Preview:	.....#lXw..D.mIw....F.h.....<... .....s.......... ....................0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.C.C.l.e.a.n.e.r.B.u.g.R.e.p.o.r.t...e.x.e.....-.-.p.r.o.d.u.c.t. .9.0. .-.-.s.e.n.d. .d.u.m.p.s.\|.r.e.p.o.r.t. .-.-.p.a.t.h. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.\.L.O.G.". .-.-.p.r.o.g.r.a.m.p.a.t.h. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.C.l.e.a.n.e.r.". .-.-.g.u.i.d. .".5.b.6.b.b.5.b.a.-.f.c.1.d.-.4.8.5.b.-.9.a.3.2.-.6.2.e.4.c.f.d.c.2.8.b.6.". .-.-.v.e.r.s.i.o.n. .".6...2.1...1.0.9.1.8.". .-.-.s.i.l.e.n.t.......P.i.r.i.f.o.r.m. .S.o.f.t.w.a.r.e. .L.t.d...................0.................&.............................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\29b6baa8-44bb-4c69-82d7-2bd385baf8a7

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 15296
Category:	dropped
Size (bytes):	9554
Entropy (8bit):	7.978212224227758
Encrypted:	false
SSDEEP:	192:XtD3rRDZGQpNWF43rm4mXPtGiseGZEnSSE+Ul8:XtD3rRQN23C4iAilzx
MD5:	F942A876DC88976DCCBAF177F0CDA67D
SHA1:	A4AFE055690CCE021A0B8F3A6CB0B1CC9CF3C415
SHA-256:	8BF55F36DCAD8DF422EA0DFC8DD7EFCD7E1C4E2B64371F20C0CDEF9A04390840
SHA-512:	385449260564B9C7582A2BC5D072DD77B20C1CDDFFD136FC4FA840247A3D0E9B8C0D7274BAEE85066E041E3A04ADBDACECDA1F031CC633A3DB5D1EBCD49489E8
Malicious:	false
Preview:	]..@..;.......&..p.........../D.\|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;....L.c.Jc..k_....P....u....E.~.Y.......0....\.x.Q.........$YmPd..JQ....@.;d......e..a4w^./QJ^..........)G9.p...a.K...Y........w!q_l......A....P+.E..z.u.Z..=.`...t.....'.q.A.Z..v..-....M.!.fM.........V\..h..6;\|.......5.}E6;i....O...@.O!......_..1.=l}....{3...._.....^J...,Fq;.=..5..8..D.....A.`...'....q......l..].,......zY.)T..$q...X.U..O.:y..LCy....%K.8.^.o.......D.O.v .Z.[d.........Xm.[. ......sQ.&y.."......\.P5..K.....g.%M.{].0..h:..B.D.+.zZ.!...[.w..q..a.......8 ..+.O..jV].....n......^...Inud..z..sk.Ai.......p.....".....>..............u...P.)5..2....=.....D.s?......S.d....4..V'.[t...A....!....z..U.ghH. .`....W....fu.t#UN/.6...v...:65>.Z..g.....Y:1._......1......a.r..=.5..S!pR%T.&...t..A...*...../....4.]......bY.P..M&.j......T.v.x.~.$....A&1o .`.............a...l.,p1}K. .Y....;..<......aT.2..<z]..D.HL.B...i]&..0.a.cO.r..$...p...).3..9.Bh..Y.<..h

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\3214a7f0-c39b-4a2f-97b2-65d8a838766c

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1219000
Category:	dropped
Size (bytes):	468305
Entropy (8bit):	7.999578864199125
Encrypted:	true
SSDEEP:	12288:w2vvW+XCs8AguCAez8PL736Yi2UCWD6jcYeJMuqRTTF4e:wlan8AegLipDscYWMuylH
MD5:	49F55E7659813E6A9D67E3275A7B3913
SHA1:	1E6D348B49CB47441549BDE84E8570B7F4F64A3E
SHA-256:	3E7C66C70B501EC5DB1D68FD10C5A0BD6B3E4ED598138D73E660EB3EA36D55A5
SHA-512:	6316880AE942B5D1330C5E1CD43BA182B906F70FD4EB085E90E0AB40F73F2B53B3534BA6AB05C7202C2DF5B936AB7BE5B540141064E49157CCD68C881A5D5D08
Malicious:	false
Preview:	]..@..........&..p.........../D.\|..'.J.mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X..../.F....\.Y...#...:.Qw...z8......d....&....=M9..).(V=./..'F.l{.K6..{+..p.....sx.<...so.i.c..pmy.....Yqz..f..G.6....MB..6.u..P.T~.,n}.1.y...q.aI.. .<6k....M......N..27........3..........v.GC...)..7....flku......+~.L\|0t.:.7......rvr..[......e4e..X.....6.P..eV....lk.B.rM.w...0.C.[.i#RR.V`.g.......q].......>.V...q..F....B+.._C.Zs./D......"x.} n.z...z..y[.b.d.s!........PZ..BC...KDP.#.iC..c..f.......w.[.a^......Qj.5)..o...x/.\|.......r..B...Z.... ..Ji..;.o...@QC+...y....U.f...=>....~.g....T4@>y.)a..h..n...@..@%..l.Q\|g...v..+.~.7I.;l....@.....z...P0..;W.j...y..\<C.$^.{n&.x1../.IY..AA.nuKwr9~.S.P...!...".h.`..1...x.......Lbi...z..$../.x......[..O.QU..k....C..... RB.Op.AmtH....2.w9W..%[1...pa.^...m'\A/...q....]..(...J9...o"..k.......i!&.p.O...,........m...Y.}\|b...V....2...&.....>...@....%.Y.E.\[...s....\|..X.."...@T..B...hf8O....} .ns4..sO:.......h...

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\b01d62c3-3b14-462a-a42f-c9c8d942fbc1

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 11713984
Category:	dropped
Size (bytes):	3783920
Entropy (8bit):	7.999950633352773
Encrypted:	true
SSDEEP:	49152:lKBpC3aLdlAQZeLks1YafwM3fLLim3KKrFtWn4sJCZkQrexPd3XmUUzmqpyc35:lCo3eP7ZeLV1Y+PLLiGVC/UAxPB2ic35
MD5:	2F8997B9B36B5A72DD004D191D9CDFB3
SHA1:	745E01E69134CD00A3ABDD7BBB618DFD395291F1
SHA-256:	141C30995040B6487619E7F75B0BDD556BAF31A53D626FA41FF3E5DC5F291AE3
SHA-512:	98302987CFD4C43A0DAB24FF28DFCAE1A05464E85A1CDCFF40E0B55536A370CFE6ED3FEEFB507D9FC55FEBB9637190FA5568A2BA3456FAD0D6F953C63D0962EE
Malicious:	false
Preview:	].............&..p.........../D.\|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..S.....:..r.H....=.Tc.!..:.5......\.......a...Ov..o.+.....q.E..7.b..{..(.\J.g.4.......&L.!.._aD...r...g.1xS...M..+{>.7s.M..'^...@..o.@z...;....C.f.aC...w..9.X.S.-.)..%......H."..m..;..JD...'...\^.I...R.0ze.... ...q.......YO..+.......\.....&f.?..IH..aJgs..y........os..'..-.Lu...N'.{.....S...1%.'..q&,.f..,...8..3...H.#.j......?...ih...4.....6.Rv* .?4P.,h.....Y.d.".-+.N....M..../fR...E@S.N.9..\|.VfV.?.RD!,C.]..T.w2"..b^a...[.x.N5I}.x...-m..A-...R#a.u..~...Mc..\.@..._A.*OWV=.<.d....V.k+wct&.=.[..t...E.f...l.K.f.e.#JJOp!.O.\.......V8..2.e:....H.......\p>.>.......Q.].'....e,C.)..._Cv.@.O.......BV.....A...s.H..F..H\..~.....Zm$....8.....+O.G...Y .K......I...g.c%..I..w..H..w:.C+.7.......]B....9.31.^..&...G..l....R\'.d0ST5.ft!..[C..(..}.BK..}..'',$..W.d5r$...{.....n.(.{.t.lV(.Q.b5y.p%~.=..........pS.}.52..UWR..<e..<......(..J..+.....z.....gR.%..C.O]=...Mi.4.8.Tp

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\b1b1a7af-36bf-481d-9e5d-35b24a3930fd

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 4976056
Category:	dropped
Size (bytes):	1449365
Entropy (8bit):	7.9998648923054265
Encrypted:	true
SSDEEP:	24576:sKMeZiqI72ZS7UWNux3GrAU8nV8izMQNoZgrOg8SX+w7xcqykeHY8iz+VK106U9:zCWZlmuxrUgvWZgrOg8P0reHwqVVz9
MD5:	7854B330C1303CF4C7B3A5AEE0D38309
SHA1:	BF7AFE5A13031A004B87D688BDE82594796BC54A
SHA-256:	A53EE3108E9CA2D1C784582F4453BB50ECFCB4AED6BB0C1254D65DC015E213BB
SHA-512:	62C4E7EC39B5CE8C625AE4F6A9C87E2ACC354FC71257D369AEBAC9BE38A9E1B28330A30C23242BC8EA203322C5585087231866BB0D1714427DC79D83AD524DE9
Malicious:	false
Preview:	]..@...K......&..p.........../D.\|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV....d..........DY.~...82.\|`.!.$............=......L.....m....~.W....I.l...h...))MI.....oV?0e7A'..&.u..~.G.4>.1.........{...A......+.O.Ay..mT..H.....D...3w..'.Rv.!.G...a..2bn.....d?7..lL.....8+.......g...z....G.u.pP.i....F......bg..~R.M.....iJ..g.......XR.T.i..p...[..5.s8N8d.%.y\|.A...."..9....h........l<.?........O.Ii..:.~\|W..gu@..UA..@Z..X;.D...e3..`...J...L.......r.......@R...DF.c....L^......v'..))..P7..L=.wz.t_.S....BZ..5..l...3.T..i..h.J....X...X..g...\"t.m......N\|CP......:.N..z.T:E...DuG.._.=.....q.,y....bd...........Aj.:.......(i#,(...KWY}pa..u;_k,..r/..'.6..X...&*.....A./...=..'..x..>.7..#.BW..U...M....\9.l...a.~.f.0..t......>s..r7.'....&.}.s3A...3...cU%aO..(.M.m.KZ.;...d...:...u...>^....E....C...-..9 ~.).....'.q..%.5Ir.....KKDPt....$.[..Vp.1...?....,..l~f..S..2f..{Ri+...'.]q..s.st......s>.q.i'..\.>.2/y...Ta.k....F.t7....7..a.@.......... ..XV.0

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\b9ed29ad-cabf-4a7f-aaa5-9846ec3c7d1b

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 7741888
Category:	dropped
Size (bytes):	2316444
Entropy (8bit):	7.999913551751568
Encrypted:	true
SSDEEP:	49152:aGwybsARpsKCbPvNEtEaGP08WyAmYB7ZSYwCm7agxByAmXmd:3wyb/2xvNEt5aX0EYwxeYnmk
MD5:	369418AA119D47A24F675DA5F0D2044E
SHA1:	F3D9410EB5E8D8BF59359F165B01661832C96770
SHA-256:	A7359B918EE60E52885033933864D2A242C7F376688A4C53DAE38618676624CA
SHA-512:	5AF08F13FF6B156D7B94E9407C172AC4F841D73C955DE78F7258E632D52734B7795141AB3D1988CF596858E36E00B07097AB520CE920332A98BE5A97DF725EA9
Malicious:	false
Preview:	]..@..!v......&..p.........../D.\|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.p ....m.N.g...%.7.6$....)1..u.Xs..3)....(....S.5c.............bIx....._.....5S...[G..&.P ..........aE..$9....,...s.n...(.<....U...E....{?..3F.N24....[.#9.j..J..^Yfu.V1.y,x}.g.60.."..m.._...?.K.....X=..Y`.=..e.LD./.K^.)>..[.j.'..~..Q>.a.u...vL....!.ll.^.1..M.%..f.q...v{..H..3R.6l..c.>....".Hv...6....[...-....lLY.,1.\.......2....9...g.,.e....?....)..9....T.6.#...}2.+R.._.2N>...g..(...t.....0t.clBY.t..s.g....8.....o.N.H.E...&...{.k......8.3}..G3..'UA.+.,..e...[nO9...{.P.....B.....m...u..,.7V.....!64.).......5..[..3..61....E..~0Ddjz$V8.o...(.M4.9....H.%B...u.....3.....~.......?.L.$$...)....<.G.V....`\ .R...... ..h.i...`..%}...{...y../...\F...&S........v..c.=.xMN...@+7)......\%.....7.[.D...1.c-....9..0e./Y..9.)...!T..-I.@..*.R..D..=.D...1.Hq..5...e..B>~..\..T...i.2...9......K.'.....-GO..c...NL...}.......0.#'...8... .:>.W....,...N.B...]......3

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\bug_report.exe

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4976056
Entropy (8bit):	6.516956127831372
Encrypted:	false
SSDEEP:	49152:gMLbH1ldDq/NPNKnB8MM6M9Pq5DIsHCtY1Mc1pftdhHFPySCg9Vc9AOJnPA3n8SU:IKnaOssHCtc1dtZyqeK8GdOjxX1
MD5:	2A76C72BCB596078E6F92994A7E9EA50
SHA1:	E90451F942411F37F3D3A17A5E147AAD6B9CD004
SHA-256:	1A4A052EA94389A6A223FEAD10CE85A6B05D0B4EE00EB71A1E924D6F977CA415
SHA-512:	0419CF9904BC12E2C896B858C1BF31B32521356F25CD06105504DF934B8BDC81CF928A0802A5128C729657CB290BDDADB32075A9EC8479E02246348F429B74A6
Malicious:	false
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.........xa...2...2...2L..3C..2...2...2...3...2F..3...2...3..2...3...2L..3...2...2...2...3...2...3;..2...2...2...3...2]..3...2L..3...2L..3...2...2..2...3..2...3...2...2...2...2...2...3...2Rich...2........PE..d...!k.e.........."....&..2..........S.........@..............................L.......K...`..........................................tA.....xuA.,.... L.P.....I..V..H.K.p)...0L..i...p:......................r:.(....n:.@.............2.h............................text.....2.......2................. ..`.rdata........2.......2.............@..@.data... .....A..d....A.............@....pdata...V....I..X....H.............@..@_RDATA........L......PK.............@..@.rsrc...P.... L......RK.............@..@.reloc...i...0L..j...ZK.............@..B................................................................................................................................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\dae22d3a-a897-44b5-ae1a-c0bc33552ba3

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1304557
Category:	modified
Size (bytes):	141615
Entropy (8bit):	7.998589575017388
Encrypted:	true
SSDEEP:	3072:HUi8cyVdVCBpR/fj9zrJU02TNY5WfxSshGh33vrbYR16vY7UiVd74:HhCdVCBf/fhR2Ti5WrM33jbYR16vYI5
MD5:	42A80B62777BCC65FBFCB5E94BF5442A
SHA1:	F91603F3A2FE6B9EEE56682C2D912D8AF5990013
SHA-256:	0E6183C3CD718147196417012B99482B5FA666FFAC60346DF51209AA6F36536A
SHA-512:	5D2EBD692619E01D399E63E4AC6CCBA98F7563E888FC1D6DC03A24BA653B3753A7334E548AADDBA4B4FE5F585A21DA42071BDF6374DA347358040381A9D7592B
Malicious:	false
Preview:	]..@................f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%.../.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjCd..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.@a{....\|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V.....`.U#...\.8.T....C.K.H..#UD.?..#..;..#......P.!...(.QS..v*...>..T.....T...65.vX{l..8.G..E......A.....+.Q...G.<..!k.....f."._...&.t...Dm....wZ.-..W..uX.zb.....Ru..h..F0f..=..:..0...

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\dump_process.exe

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1219000
Entropy (8bit):	6.593936301896839
Encrypted:	false
SSDEEP:	24576:L2Xv41fIyhwLm96xe1uJMhFVzTrDJcI3o4h0lhSMXlAomJkdV4KM:qw1fI0wLmExdMhFVzHD2KKoJIV4
MD5:	20F4F6E440ADE9ED5F2FE71F729564C5
SHA1:	262038FAF8A2D497604F4AA41E2843A60AED7B5C
SHA-256:	2EB0017643BFBAB0BF8CD1A9C2CE04786EB22936A3F9189DFC6094B412A04322
SHA-512:	646C93A7E3FB60A4ECC9F54A7A8DD3CF7EFD61BBC0885D5E398250CD39D88D2711CCD2C6DCAE1A2DC0BD995E0A3875BF78030BCF4F35F8C5BED7A8F879AA4E0D
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........i.;..oh..oh..ohMzli..ohMzji(.ohMzki..oh...h..oh..ki..oh..li..ohG\|ji..oh..ji..oh.p.h..oh..oh..ohMzni..oh..nh..oh.fi..oh.oi..oh.h..oh...h..oh.mi..ohRich..oh........PE..d....j.e.........."....&.......................@....................................s\....`.............................................................`Y......,...Hp..p)......................................(....J..@............0..........@....................text...L........................... ..`.rdata..x....0......................@..@.data........0...^..................@....pdata..,............v..............@..@.didat..P....`......................@..._RDATA.......p......................@..@.rsrc...`Y.......Z..................@..@.reloc...............Z..............@..B........................................................................................................................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus.exe

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7741888
Entropy (8bit):	6.4616109352927795
Encrypted:	false
SSDEEP:	98304:oHALSTpZRk092CuujkPcPgdxo7fyGBoBoPE/+Y9y:cA2TpZRk09NuuIHo7qGiBs7Ys
MD5:	296B5F218A5D9EE481D1EBC0CAB61E75
SHA1:	00BE392DCF9EB3C9F2A3A6067A149ABD365D9B7A
SHA-256:	402BEE920C7D5E30D2CE1880DDEFE15E2F8EE3C080B853AB3422E7668CC99A93
SHA-512:	573AAA53CED8F6415A15C9130F90F2ECCDCF9672B6EA80B48B6883940D2D4ADF92A2F938D3B4DC9924AA813E68D2225DCA5BCFBADF7AD43AEB0466A8FEABF9D5
Malicious:	false
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$............................0......................................T......T.........^.......f............................................"..........2.....Z..........Rich...................PE..d...Bk.e.........."....&..Q...%......Q,........@..............................w......v...`.........................................`.g.....D.g......pu.......r..5..H.u.x)....v.......].......................].(...0SU.@............@Q......g......................text...l,Q.......Q................. ..`.rdata..B....@Q......2Q.............@..@.data...@.....h..N....g.............@....pdata...5....r..6...4q.............@..@.didat..p....Pu......jt.............@..._RDATA.......`u......lt.............@..@.rsrc........pu......nt.............@..@.reloc........v......pu.............@..B........................................................................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_mod.dll

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15296
Entropy (8bit):	6.946350765988101
Encrypted:	false
SSDEEP:	192:wOh5ta//bOy0bVvIYiYF8AzI77cfwRzAA5K+o/y2sE9jBF0NyxaqEvYJ:wOlgFuVvIYiifwGAM+o/8E9VF0Nys9v0
MD5:	37D0FDA7996C070D77B1806424B32F05
SHA1:	8341DE725361364E451C27EC22821A7177D8EA1E
SHA-256:	EB749CED744CA8961E40AF75A5870FBC551390D8EF3653989B90554AF2D98ACE
SHA-512:	3B1625C8463AFF2667C5D1B71C44AFDF8AC3D7E65B2CAA94A9F70FEDB8606488AEDDE26E4F293DAE4B8795A6154B5EFA5A795F9103E6FC2852615189C408979E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................*........Rich..................PE..L....j.e...........!...&..................... ...............................P............@E........................ !..\....#..<....0..............H...x)...@..(.... ............................................... .. ............................text...U........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\icarus_ui.exe

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11713984
Entropy (8bit):	6.577117425355902
Encrypted:	false
SSDEEP:	98304:Ucnxf9DbQW7vaPPEggfYlui9p8P2qYlJ/J5pdBArrqNg/:UcnHQiaUggfYki9GP2ZvBWrqNg/
MD5:	DA59F693DED0BAB67E4170B6D3CE6D2B
SHA1:	ECD787042D10A70083B5EED5AC4DE34FECE2C17F
SHA-256:	B80F083EF189B1A7244FC60935B646E90E91FCE9446FAA29712D8A9804ADBCAC
SHA-512:	A6F21998FE2879C6F61EBE28A650C18162A6C1CD8DFF1BA6AA5F0CB1C7C177D06ECA0193959A05CD0CBDF7FF0D668D67EAED490D26A83D0FCF069990E1376985
Malicious:	false
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........,eb_M.1_M.1_M.1.?.0.M.1Y..1VM.1Y..0KM.1Y..0.M.1Y..0KM.1.?.0@M.1.?.0.M.1.1.0.M.1.1.0.M.1V5.1]M.1_M.1XM.1.8.0\M.1.8.0^M.1.#.0]M.1.#.0OM.1.?.0hM.1_M.1.N.15..0.M.15..0^M.15..1^M.1_M.1]M.15..0^M.1Rich_M.1........PE..d...[k.e.........."....&..~...^......t.........@.............................P......dh....`.......................................................................H...x)......4...`...........................(... ...@............0~..............................text.....~.......~................. ..`.rdata....#..0~...#.."~.............@..@.data....54..P.......<..............@....pdata..............................@..@_RDATA.............................@..@.rsrc..............................@..@.reloc..4..........................@..B........................................................................................................................

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\product-def.xml

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1304557
Entropy (8bit):	5.395721766011499
Encrypted:	false
SSDEEP:	6144:Fe4pzSPXIq9eRaTMEsp6GM1okosnDWB9bL8p0J+QQHXMvOAG:Fe4pzSGaTMvp6bokosnDWB9U65QcvOAG
MD5:	5456E7B8CBA4F6EED4FA25A63FC54EA5
SHA1:	DA0FB298F1822D3054D3F07094362AB589506EFC
SHA-256:	66F2B4E30DCE65515E1E1744CD73894D45C37F53806A7B22E926968D4D40A5F3
SHA-512:	EE8321EE8061A4DD931D8684256DE9F4BAC78E072FF9E46086A9F708C39D1442D32FC30C9EBFF7771308895C7D1B59E885A73B0E63BC89DE238FC5BDA5A7CF33
Malicious:	false
Preview:	<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

C:\Windows\Temp\asw-11751dfa-19bb-4492-8fea-96989cb91b43\common\product-info.xml

Download File

Process:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9648
Entropy (8bit):	5.275410805526245
Encrypted:	false
SSDEEP:	192:piFGQFxGmNJ6YIaf831SiHUzEoHXV1Frpl8FlL7ebj2MbaRzOWWQzsL:papgmNAYjdTNVm3e3TQnWmK
MD5:	0516D4B421CC67E45E3917A740D8A3B7
SHA1:	BB71ECE9912F1316EFE6197BDDA669E03286CEFA
SHA-256:	7D96900D97C199FB9676E0D1E5FCD02348F5412C396DE453A2F2FA7810663E45
SHA-512:	9848110257C008A74B755F4B8CC1289D6E271131E5101B920B6F4AFCB00ABA2356E0415E20F61271233EF5E5BCE971950F9897397B33BFCA2BB63D9947DD72DF
Malicious:	false
Preview:	<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>24.1.8821.1479</version>..<build-time>1706808750</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>411247a91c7c90c7b46c96bdef5526e421290b2a1cfebf8f90d8061a94dc0b19</sha-256>....<timestamp>1706808695</timestamp>....<size>6873528</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>402bee920c7d5e30d2ce1880ddefe15e2f8ee3c080b853ab3422e7668cc99a93</sha-256>....<timestamp>1706808696</timestamp>....<size>7741888</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<name

C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1553920
Entropy (8bit):	6.797198726421779
Encrypted:	false
SSDEEP:	24576:/Z7T2RItIgooooEwI/uAnlDUFm3eukrWeh0lhSMXlsgRl24e4OH4RyXs:/Z7CRIPooooEwITlDUo3ercRlfe40Cy8
MD5:	62D68511172418FBE4A8C75E1BE49913
SHA1:	1E9B32FD746FE770733B2AA24C36AB5F25FE79E2
SHA-256:	F5B11E63A2713030C83E033AD0E12099D7104E8B9E582E0A30BB409A03D9D912
SHA-512:	FC36A8E972330419D4941928BEDF9A715390284FB569451E5829C780230BA20EF6506F71058D49FA11D9E972BB9EB592EC5A8C053C23A568033F816F8EEDA52D
Malicious:	true
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......]=.J.\...\...\.......\.......\....h..\......\......\.....~\.......\...2...\...$...\..O)...\...\...\.......\.......\...\...]..s...\..s...\..s.j..\...\...\..s...\..Rich.\..................PE..L....j.e...............&.f........................@..................................:....@.............................................r..............x)......\....&......................@'..........@...................4}.......................text....e.......f.................. ..`.rdata...............j..............@..@.data...H...........................@....didat..T....p.......,..............@....rsrc....r.......t..................@..@.reloc..\...........................@..B................................................................................................................................................................................................

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2998
Entropy (8bit):	4.189711652602748
Encrypted:	false
SSDEEP:	48:B82lNUshFh5tRJHnZgG78YqA9vUrpvMpfapJa4PE1vMtwD3wAjFH8mS6GphIw7pt:flNUsh75tRJHVhB9sWpypJbE10uD31Bg
MD5:	2E9B9AC8BE368C1EFCC51965C74BE43B
SHA1:	DDE87F63ECBAEB97C5708CED6FFD0E7DE5A806C0
SHA-256:	49B9B4996D1FF0A8E3DE643A0C623255BF631F298F2799B949C29DE93926EE7A
SHA-512:	FFC56944E751D82233F3ED504EB42A44544CB4E58969E8AC3ABD76D96C0607282FEE0E52F13AED8902B05330E0C82E74BA8592FF2BDCBF0188BE8898EFB2C741
Malicious:	false
URL:	https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg
Preview:	<svg width="136" height="16" xmlns="http://www.w3.org/2000/svg"><g fill="none"><path d="M79.039 7.346c0 1.784-.449 3.186-1.346 4.206-.897 1.021-2.152 1.532-3.767 1.532-1.641 0-2.905-.505-3.791-1.513-.887-1.008-1.335-2.422-1.346-4.24 0-1.815.449-3.221 1.346-4.22.897-1 2.165-1.498 3.805-1.496 1.6 0 2.85.507 3.748 1.523.899 1.015 1.35 2.418 1.351 4.208zm-8.88 0c0 1.51.32 2.654.963 3.434.642.78 1.577 1.17 2.804 1.168 1.234 0 2.166-.388 2.796-1.165.63-.777.945-1.923.947-3.437 0-1.498-.314-2.634-.942-3.41-.627-.774-1.557-1.163-2.787-1.164-1.235 0-2.173.39-2.815 1.17-.642.78-.964 1.915-.964 3.404h-.002zm16.891 5.587V7.535c0-.68-.155-1.188-.466-1.523-.31-.336-.795-.504-1.455-.504-.874 0-1.514.236-1.922.708-.407.472-.61 1.251-.61 2.339v4.378h-1.265V4.575h1.028l.204 1.143h.062a2.583 2.583 0 011.076-.955 3.541 3.541 0 011.564-.339c1.006 0 1.763.242 2.271.727.508.484.762 1.26.762 2.327v5.455H87.05zm7.392.151c-1.234 0-2.208-.376-2.922-1.128-.714-.752-1.073-1.796-1.077-3.132 0-1.346.332-2.415.996-3.

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6552
Entropy (8bit):	4.710790111908242
Encrypted:	false
SSDEEP:	96:f7OMRKY4Udy7YI6khfWqsFRx4U85uH3I6khfWUdcdGnRlKQ/4UdyUOjI6khfp:SIKiylhfPsLN4hfdcERYSy+hfp
MD5:	C4CBEC34CED00EFC322A019813DE6A32
SHA1:	FF0E3351E520F7E4C471EBDBAF607367988D8F30
SHA-256:	7CFA698EC64018DFA12B1AF46DE8533A331B325DAB2D5949774226526ED4C235
SHA-512:	0DB53D2B2A272ADBFF8FADC5E8019106E161AE72F42898F3D81116D2409609703360F9E9DEECC8BADDD09180A4F317C6C7B826758EBD3C964F8E706EAE02CC5D
Malicious:	false
Preview:	{.. "posts": [.. {.. "id": "5972295e-d753-41bd-a5c6-6f83d5afbffc",.. "title": "How to check what version of Windows you have ",.. "url": "/knowledge/how-to-check-what-version-of-windows-you-have",.. "listing_image": "https://cdn-production.ccleaner.com/site/qoron0kq/how-to-check-windows-version-thumb.jpg",.. "detail_image": "https://cdn-production.ccleaner.com/site/yugpuylu/how-to-check-windows-version-detail.jpg",.. "display_date": "29th January 2024",.. "categories": [.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "home-computing",.. "name": "Home Computing",.. "url": "/knowledge?c=home-computing".. },.. {.. "id": "security-and-productivity",.. "name": "Security & Productivity",.. "url": "/knowledge?c=security-and-productivity".. }.. ],.. "content": "<p>Learn how to

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 86, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.715508418119475
Encrypted:	false
SSDEEP:	24:YjkaKv4/vdmjWI9ZFUPLHA3gruIjze8oboSm6eeeeZD:Gkwvd+WI1UPL9j3ZvyD
MD5:	AE7F706F4454CEEF6AE8D73188BA81FE
SHA1:	16A920DB1F5DE137BCF9E3FBAA2A7485DC911A97
SHA-256:	8EE70E831154CC4ACD33403CF518D7282BF5E8237A9FCC077BC5505ABC8D18B5
SHA-512:	0342F1DF08AF3ACD6085BED84724F07150423EE763197EEEBECD23D07DC2CA4C013D6F28176CA3948B06FCBB3B3CE77115CCD507B8575EC3D07D8E259506563F
Malicious:	false
Preview:	.PNG........IHDR...X...V.............sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..{lSU.....sk...l........#d...S........h..3B....._&3....w..A..&..D\|ln.M.F.m.n.....{...s..........{....{...>.r.......C...0....C...0....C...0....C...0....C...0....C...0....C......>....j..\...a==.1.....h.Z.^..Z.0.5aP4.!...X..0,..T.....H0......^....s...3....;.....r...\+.B..5....6]&}...-.0..'.k2...2.f....}.<h.p..t[.,..N..VCz.d^H...n..lV.,2..8.v....E....X.DR.../...T.S..x..X.^.?l<.ct.G....r..g.F3D....v]..w..........\|..J.r..}.{B3w..p.h4CL$...W....opW..M...I..G......N<.....f...i.s...J.f...v/Y..S.....3.~.'.`W...d...du.b,..,.Yh.;Go....y..).s.2.fLj.W~K.....&.t.....]HP3.....zo.8.77...k\.g..D..}!..C.g.~.c....0@....0...A6E..(/..;.L.9d..GT.....]..Smew.....,.v..nZ'K...n.!...ZFV.8..f.`2...<w...M0y..!..{c.f...j....w6.!.1s..47\|9.M..r..cP.z<......<.`.~.......wF4.....c.R.LB....@...G..G.l..`.=...$\"w....#.+:'S7.Ra.....5..'.=M$....(..`..x}X{y.Z.m..*....V!.g.....N...>..v.X

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	34309
Entropy (8bit):	5.422720535320716
Encrypted:	false
SSDEEP:	768:PiIIM/AWdbcMCw5Kqjjm4KtPcM573A43FiB:qIIM3
MD5:	4E366F0730E102A255702D887624FAE9
SHA1:	1BEADFCE262FADED780561100DD303120510CB33
SHA-256:	091673724313FCD527B724C0ECCF5A13CC63BDE03C44E802F3EE739EFFA683CE
SHA-512:	09AEC072F96D4FD888744F27CB659105C9DEABC963AA8EEE14425174BF376F44446EE9481DDAC8E228027CEA011D5665343C459133BCB480DEF9D59E8FFCE586
Malicious:	false
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700\|Roboto:300,400,500,600,700\|Marck+Script\|Rock+Salt\|Oswald:200"
Preview:	/* cyrillic /.@font-face {. font-family: 'Marck Script';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/marckscript/v20/nwpTtK2oNgBA3Or78gapdwuyzCg_WMM.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ latin-ext /.@font-face {. font-family: 'Marck Script';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/marckscript/v20/nwpTtK2oNgBA3Or78gapdwuyxig_WMM.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Marck Script';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/marckscript/v20/nwpTtK2oNgBA3Or78gapdwuyyCg_.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+21

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21099)
Category:	downloaded
Size (bytes):	21100
Entropy (8bit):	5.307475695141851
Encrypted:	false
SSDEEP:	384:TRFZ2wWtdbD5ABwXwLrekrff8eTr+xITxMcvn9LuJPvV/:T8wAD5ABwXw+krfflyxUx3n96/
MD5:	F18B357811C039616EB24F0BAA46360E
SHA1:	7EF528148C7FA2DF751BAA512F8EA24C84A7C19A
SHA-256:	5BE2DFA172D505ACB197760B55C4731347CC239A7A046013C251948BB8214DBC
SHA-512:	F9498E8904AB5F3BD1D4FF6506007ACCE1E0A0EC989E3CAB9801CB5A3020A0BC3504260B0A97BC90B4EA1F07E66D58916070C5EC0CDCEA23D36BA17FC5277284
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(m=g=g\|\|{})[m.Days=1]="Days",m[m.Weeks=7]="Weeks",m[m.Months=30]="Months",m[m.Years=365]="Years",(m=i=i\|\|{}).Name="OTGPPConsent",m[m.ChunkSize=4e3]="ChunkSize

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	25320
Entropy (8bit):	5.859135725488595
Encrypted:	false
SSDEEP:	768:vSzVKa08CXq92rqhgDji5A1jWHdTmqJi0o:vSz0Ef92rqhQjqyyHdet
MD5:	8AF764F8DE1FEAA90054ECB9DDBED251
SHA1:	5BD24065B0D4BCFF007CD1C9DEF1EF2FC39465AF
SHA-256:	99FECA634A96A742C1FB62B5D574720933E9164D9D1BA3C617F22CA87F58FA94
SHA-512:	2E9769CE9FB6714380BEB585B267A42F23483B0B40524DF364FAE425AD24938770C132DDEC668DD65E9597675625F6A0DCA9CD0830F48D91B4184618B89F23E4
Malicious:	false
Preview:	<svg width="125" height="36" viewBox="0 0 125 36" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="39.2628" height="35.8833" fill="url(#pattern0)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M49.9807 25.517C49.0129 25.517 48.1206 25.3365 47.3037 24.9754C46.4867 24.6143 45.7798 24.121 45.1828 23.4956C44.5858 22.8701 44.1176 22.1318 43.7783 21.2807C43.439 20.4295 43.2693 19.5204 43.2693 18.5531V18.5145C43.2693 17.5472 43.4358 16.6413 43.7689 15.7966C44.1019 14.9519 44.5701 14.2104 45.1734 13.572C45.7766 12.9337 46.493 12.4307 47.3225 12.0632C48.152 11.6957 49.0695 11.5119 50.075 11.5119C50.6782 11.5119 51.2281 11.5635 51.7245 11.6666C52.221 11.7698 52.6766 11.9149 53.0913 12.1019C53.5061 12.2889 53.8894 12.5113 54.2413 12.7693C54.5932 13.0272 54.9263 13.3109 55.2405 13.6204L53.7511 15.3807C53.2233 14.8778 52.664 14.4715 52.0733 14.162C51.4826 13.8525 50.8102 13.6978 50.0561 13.6978C49.4277 13.6978 48.8464 13.8235 48.3123 14.07

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4076
Entropy (8bit):	4.874084213279633
Encrypted:	false
SSDEEP:	96:OyIo40wsYOHpCZpdGKZa6Ayr1vRYUjojVjzZtOT:iXbepCZpA6vrxRYkQdC
MD5:	E2705BDDA7AA3D40B7BE72F664D6910F
SHA1:	0E2FD7D89624833322201868927580D56A462EF3
SHA-256:	E7E055F17B2520F44F8CDE27178E542EA8A4964765198FB1D8DA5D9659604333
SHA-512:	5A79BE1CE7087B0B44DF37F18C641250D37E2A50EDF60E27187DE17CF30F27ADBD7731A10B7F823EEC58CD99B0EFAA3E03360AEBFC375473D4278114CD40472E
Malicious:	false
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.36.0","OptanonDataJSON":"831b8ee0-e952-49a5-af6b-01382c722774","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"88869503-73ab-4afa-8651-1bc86c0ca4db","Name":"Global (GDPR)","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","br","sc","bs","sd","bt","bv","sg","sh","bw","by","sj","bz","sl","sn","so","ca","sr","cc","ss","cd","st","sv","cf","cg","ch","sx","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","tf","cu","cv","tg","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","va"

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (64709), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	280367
Entropy (8bit):	5.400629705305917
Encrypted:	false
SSDEEP:	3072:vs5yDt+KI+99jlx8Ux82h1L2q/Bzgnczbr+N:vfW2hcurzbr+N
MD5:	7697C1D92AC0CFD7EE595507F01C05C7
SHA1:	CCBD8E9DD43C2F56005FF6CDE9EAD28B1E7EF334
SHA-256:	4BAFD701FF7E62993F9665F89F17BF9EA1D76609B0BADF54A78432AD942BDD68
SHA-512:	F58EA57B0CC8A1EAF1106D9249FF5EF5FD35D85CBD5BFAAD7BC9DAAB958B4888286F4C5F2E94D90AC6221FA9B0D91A0598A2087B29B394A0B8B7635E85CD0B9F
Malicious:	false
URL:	https://mstatic.ccleaner.com/api/mhubc.js
Preview:	(function(apiUrl){..window.mhubc={ads:[],push:function(u){window.mhubc.queue.push(u)},queue:window.mhubc&&window.mhubc instanceof Array?window.mhubc:[]};var util={define:function(u,o,t){window.setTimeout((function(){var e=util.modules[u]=function(){},i=o.map((function(u){switch(u){case"require":return util.require;case"exports":return e;case"./generated/mhub_pb":return util.proto.CrossMasters.MHubCloud.Protobuf;case"google-protobuf":return util.jspb;default:if(util.modules.hasOwnProperty(u))return util.modules[u];throw"Not supported dependency "+u}}));t.apply(null,i)}),1)},modules:{},exports:function(){},require:function(){},main:function(u){var o=u(util.define,util.exports,window.mhubc);util.jspb=o.jspb,util.proto=o.proto,util.apiUrl=apiUrl},jspb:void 0,proto:void 0};...util.main(function(define, exports, mhubc){..var $jscomp=$jscomp\|\|{};$jscomp.scope={},$jscomp.findInternal=function(e,t,o){e instanceof String&&(e=String(e));for(var r=e.length,s=0;s<r;s++){var n=e[s];if(t.call(o,n,s,e

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 47136, version 1.0
Category:	downloaded
Size (bytes):	47136
Entropy (8bit):	7.99615068864472
Encrypted:	true
SSDEEP:	768:/mKiHVeRlbsF/1p6cYAagXYe2eUEBJu2Sz12n7PS/NwlY2jOh/QOaReZ5QBdN5TA:/mjHmqNp6cYJe2u6z12njS1E6BQOa1TA
MD5:	A47C3355AAE82555F7CA3C38E8A4C1D6
SHA1:	C57E17BD233D69F67EC6EDE882E7932CDC02D56D
SHA-256:	6B0DAB5300943D98F4F20DE9D48A49E0186441F6FB8B5E95A9635A30C0B60E72
SHA-512:	3F448E5625EFDC95929CA2A504C17C4814FC8ED2A83B232F07B2E1A50F421D894C34F4CE5C699C42ED6F615C3EF9A141C98B740E14EA6923CA4E64A4FA7D3B77
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2
Preview:	wOF2....... ......................................s..z...?HVAR.H.`?STAT.$'....+...\|.../V.....<.....T.0..$.6.$..$. ..~......[q.qB.c.A.IUY?.v.'...s;(y..w...."A}.]...?5...I.iAA....?....,.H...h.s...U.zi..CRk..6^[.c.....r...a...!.....U,.."......).skT.c..N.:.M../i.:]?._...n..%h..?..L.x..LI...h../\|.yn..M...ni..~[./.7..8y......-F..v....C.Ju....'..o.....\e....DQ.e/.D.L%.dm."0n...T.k......1..........ANOzfT.m7)59..Q.-'=Q.R2<m......p.y.....;... .....TD..dV`...s...MY.3.T....(ZJ....T..LT.D.....`s....7.~.......a.V...1.,D.l..._e..6.....QV1....M....R.g....W...@..Vlmj.$mn..00.g.p....b....%.....^.v...........3..Z........E...F(..a.&.!.y..Q.C...u.../}.a&F...Fm...GB-......%.....w..I..6..B.$.L2Qb.]gs>........Kp'.y8.u......f%.:&...T..l.fmJ...,..]u.8.n..)i..H.b....,...2.^...M5..Y..R.}."\|.c,.ur8M._.lY......X].zw.@.x. ......B=..6.0t."Y..Z...C.;?=8W...@.a..S.].4 ...&..Y..R. p..zV..3[..R-g`.c..@<....r'Ep$...9..$.>.u..... ..k..P..#Ch..D..O'D<.BQ3.../;.`..\|......Y{...._.8...}$..m.L...W

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18187), with no line terminators
Category:	downloaded
Size (bytes):	18187
Entropy (8bit):	5.347759003709589
Encrypted:	false
SSDEEP:	384:s40C/Y3uOOpp9W89rzOv4m8Avx2kjEhNgyyuek:VjOOp281UsAlErPyud
MD5:	5C6ED25DCE803FD84288922B8928409E
SHA1:	3CCC10546AE12F160BACAC1E9E422AF091EA4A41
SHA-256:	480B06B23E574B4BF386FDE1A91145A4171F97AEB5EE800E4BE1850F29B1AD91
SHA-512:	FE9265D2E6EA4ACB7E0A87E08BEDFAF48BCBAD62BB7A86E73F9AE21C8437AF3334D2A9733C6BC47A12BBF54F97EC79271CB5300F90231614F407599D1B4C05E5
Malicious:	false
URL:	https://s.yimg.com/wi/ytc.js
Preview:	!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=0)}([function(e,t,n){"use strict";function r(){if("undefined"==typeof TextEncoder){window.Tex

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1032
Entropy (8bit):	4.719529036809842
Encrypted:	false
SSDEEP:	24:2P0jB4VuZ2TGXRygBmRGYv5uHBskfUX070VOAapq:JhXIg0MYvbkfU9aY
MD5:	E558429843BDF48BD1D712AEE1776DB0
SHA1:	CAD0D48A416E1D9D7B7F600FD9E3C8FFC5FC7122
SHA-256:	D158DE3A01C90355DDD3AE6E1D56EF2D7AE35F962146D4399A706337A332E797
SHA-512:	418E3F66C0B12F9290673702F11142A737F065B595AFFF905A4143AC494BDE1AA77FC8C7FBEE9B5D4000BFE06E0FA52DF64D187A37F98103187BE5FCA91306A3
Malicious:	false
URL:	https://www.ccleaner.com/dist/js/legacy/unsupportedBrowserRedirect.js?v=1.0.95
Preview:	(function() {.. "use strict";.. CCleaner.UnsupportedBrowserRedirectModule = function(options) {.. var _redirect, _sniff, _buildUrl, init;.. _redirect = function() {.. window.location.replace(_buildUrl(options.redirectTargetPage));.. };.. _sniff = function(params) {.. if (CCleaner.sniffer.browser.name === "ie") {.. _redirect();.. }.. };.. _buildUrl = function(page) {.. var currentPath = encodeURIComponent(window.location.pathname);.. var locale = document.documentElement.getAttribute("data-culture").toLowerCase();.. page = page + "?ref=" + currentPath;.. page = locale === "en-us" ? page : "/" + locale + page;.. return page;.. };.. init = function() {.. _sniff();.. };.. return {.. init: init.. };.. };..})();....var unsupportedBrowserRedirectModule = new CCleaner.UnsupportedBrowserRedirectModule({.. redirectTargetPage : "/unsupported-browser",.. lowestSupportedIE : 11..});....unsuppor

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11231)
Category:	downloaded
Size (bytes):	21866
Entropy (8bit):	4.993825454722558
Encrypted:	false
SSDEEP:	384:HRc7fQV8C0NGoFQlC2MGAVsqlXaivSYBQY2YpuMc:u9+N
MD5:	FF0B470FEA1863B7594730B1E74199AD
SHA1:	5EC5122D9CE4D25069017D202728F9A887B7DBD4
SHA-256:	74C39B5EC5A61C19FF20D81C0418FABD61D6DEB6AC0C967DA28761D6B895FF7D
SHA-512:	8D8292C31D6D34E1AECD7AAE68DE2AC6921A7807165BD71AC3FD11284A272C33B6C9ABDBCD29E5203436A2C64A69C9ECB1BF7F629A698F970F2085DFEE4F77C0
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/6.36.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.493473304203662
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8Ha2yOE9HjH2ZmjuJGlyRHfHyI:x2pHDMnEljHMB5yI
MD5:	4A7E157A6DF07A8F848E13647A1F50BD
SHA1:	95E2715124461E84FB01E75A2157917697670D6D
SHA-256:	E45C44615E141491E0540FEC7B7A8BE281D4E63E22D71E9F28F8295497C7FB51
SHA-512:	667B25AD6400C94F4E53A2A1664FBAEFE33E9ED236E3434095F83D53AD072B66D97535523F7761EFA9DBF8D8A2618ACC91886748255712E78094C6C3DBE64397
Malicious:	false
Preview:	jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1300), with no line terminators
Category:	downloaded
Size (bytes):	1300
Entropy (8bit):	5.795356006132744
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAjZJlN96+KVCLTLv138EgFB5vtTGJTlWtZ1v8IgsLqo40RWUnYN:VKEciJKonR3evtTA871v8IhLrwUnG
MD5:	A113F0D92F4AF8BD00C0AA10ECA58618
SHA1:	E4A4435A820BC28FBA302C56128096A09927B557
SHA-256:	D2F800F202791D0994D3CD929449E5FADC6E7F744AECF48C49D6458C042BA42F
SHA-512:	C6AA93DE7A370A68EA21CBD64B1311F9B1A0ABF02BF0F70BBE00B0CFE6B99610C162CDF21E44E1822399BE20F3C088BBB646AE0ABB01EDA209B52C2F3770BDB8
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js?onload=ccleaner_recaptcha_onloadCallback&render=explicit
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('explicit');(cfg['onload']=cfg['onload']\|\|[]).push('ccleaner_recaptcha_onloadCallback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js';po.crossOr

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21272, version 1.0
Category:	downloaded
Size (bytes):	21272
Entropy (8bit):	7.990496092568165
Encrypted:	true
SSDEEP:	384:4guNBPivS+fxUejsjwQn7cP+D3UASv5mj/TKv+kzy5DKO4SMEYyrgPydm/NBWRvr:4ggiLf5u7cP+DEASRmbTWyISHYykZkRj
MD5:	7CE899B19A6212898DDC18A1CF52FD23
SHA1:	F6668C418C5B68C9B671AFA7A91166BC1D2CBEEF
SHA-256:	131C390D2291ABC752740F06581A01BAF1774279764AD0D3C08F45C5A33C4772
SHA-512:	7571EEB9B10837E29E0F70F92F77B63F5CF1CB2CFF6BB308DBE951700209B1C2972C4265C7C8494E084F18B0632FE1FD77E577E9FED15EB79526DAAD5DAC9EEA
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2
Preview:	wOF2......S........<..R...........................c..N...?HVAR.U.`?STAT.$'..t+...\|.../V....t.Z..N.0...6.$.... ..~..h.......pg..z....>....y..D..7.....l......S...&E.u6.OJ.....s.6..!4.n%'.a.F..!.:u..B..%.<...w....8gb&r....'....H...B-.eZ..?+.I.``..4.`,I..XE.Y....~F..a_Z......a.R..K,.J....>.^J..0..g.C%.................;.....@.j..m...L.1..9..\).].........K........(........z...E.g...:...n..r.....A}...W............s-&F......`N.DKZTI....zQ...\.....E...........% :..J.....t,.M.C^1....L.R.;]7.q...a.d..K......u.d,.."...m}.&.V...nD...5w.AEq.APh.0...u...o.........'eaX.I..IT...."..`.BaCl.l...N..PM..0x....+.".P.!...Mmo.....0_..#..BB.g..U.....L.R{.....tU"?$.....7...Xd....s...........-....{./.......3..J.~.\...1.I.%X(..'....u....9.e..% .u@..y.RR.I].;}..[.\|.p.d8...`G^..N:{.1}....._..1....U.j.1.,....3H.. .v.<...........\|h........b3.{r..>v......4.)....Q~.... ......C.C.7........R...z...sg..:.?.}.f...........@6..X.p..3kG.n. T.%WmQ.`S_.h..X3#9.k...

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	166890
Entropy (8bit):	5.213025329783762
Encrypted:	false
SSDEEP:	1536:O1hCqYgEHNbG2EiaEdh/P0KfYXt/zBKc/58k8k0C0Au+YQ62GAg7B:qhCqKNne/zBwk8k2+sL7B
MD5:	B467EC42DDFC1378494A9423DC37E9BC
SHA1:	3E0EB9647B30D596AC78BCFF045A55F23C0253A1
SHA-256:	C11B9C3C2E5DE7D52D5799DDD904E086AFC383FA63B7EBCBB8E4300AED294691
SHA-512:	4793C8BFD51FCB4DB7D54083D645B78A16DB44ED7267E45F5A79001414DDF1BB98900EB52929CF0EBD88A8451A996214721AAC43D2FFD94DBCC980C7A3A97348
Malicious:	false
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccloseButtonType":"Icon","pccontinueWithoutAcceptText":"Continue without Accepting","cctId":"831b8ee0-e952-49a5-af6b-01382c722774","MainText":"Privacy preference center","MainInfoText":"By clicking \"Accept All\" you allow cookies that improve your experience on our site, help us analyze site performance and usage, and enable us to show relevant marketing content. You can manage cookie settings below. By clicking .Confirm Selection. you agree with the current settings. See","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","AboutLink":"https://www.ccleaner.com/about/cookies-policy","HideToolbarCookieList":true,"ActiveText":"Active","AlwaysActiveText":"Always Active","AlertNoticeText":"By clicking \"OK\" you allow cookies that improve your e

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7630)
Category:	downloaded
Size (bytes):	8994
Entropy (8bit):	5.340999628674685
Encrypted:	false
SSDEEP:	192:lxbnMSH54wHePVClsCtUx4lfPAfoewL5E8fI9+VpB5LP:lxbnMbseaUxQzEwDB5T
MD5:	405F8EB9DDAD21DEB58BB2FF5B5DD427
SHA1:	2D2730484D94C2DE5987CC4ED11122234DE19D0F
SHA-256:	585C661712282FF2A030C07E7A34C8B6F8400050B54906F5ABBA2C62AC50959F
SHA-512:	047D692E4AF246DED183C663D0EA2194B431B7F29E68A48845C8181340D4FE35E6F835057E6AF4BEC482743B5A376E17BD0168D894AD6E824E28F5DABFD42E09
Malicious:	false
URL:	https://static.hotjar.com/c/hotjar-857043.js?sv=6
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":857043,"rec_value":1.0,"state_change_listen_mode":"automatic_with_fragments","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":false,"suppress_location":false,"user_attributes_enabled":false,"legal_name":"CCleaner Official Site","privacy_policy_url":"https://www.ccleaner.com/about/privacy-policy","deferred_page_contents":[],"record_targeting_rules":[{"component":"url","match_operation":"exact","pattern":"https://www.ccleaner.com/business/ccleaner-cloud/signup","negate":false}],"feedback_widgets":[],"heatmaps":[],"polls":[],"integrations":{"optimizely":{"tag_recordings":false},"abtasty":{"tag_recordings":false},"kissmetrics":{"send_user_id":false},"mixpanel":{"send_events":false},"unbounce":{"tag_recordings":false},"hubspot":{"enabled"

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:	384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 88, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	972
Entropy (8bit):	7.598081682207088
Encrypted:	false
SSDEEP:	24:j3T0He44LI9+Vx/S5KF4fI9csyvTUelLBuTk5fcekr4Ml7:Lg+4484b/So4fI9VslBI/Rr4Ml7
MD5:	4B95F1FF1304B8D6EE6124308535E427
SHA1:	B9BDAB5A5FDAC2AF15B00A91294979F711A98BE1
SHA-256:	DBDEBE8A278551BD60D8A1C1322DA181B59D79ADDC168ED1C496B5D0EEEA9B7F
SHA-512:	121CEDDC1D3BCFB46BDBEA2E17CAAD43F9A23F674F2FE41800A6DBA5C24F17801F9C47E547F9327C035DE23584EED9C2CCAA9FBA03AD27D92BB014A45DBDFA6E
Malicious:	false
Preview:	.PNG........IHDR...X...X........c....sRGB.........gAMA......a.....pHYs..........o.d...aIDATx^..]HSa...9.R'.G.j..-...^..J./.J........./..6...H..."aAzQ.4...b.........0....q.....(.<;...9..4....$....Q...@!.B.......(.P...@!.B.......(.P...@!.B.......(.p.......#.6..=..].8&6n!......l.....7mO]......rdgT.F...O.nN.b.0n!...E.`6.96a"0n!.2.0Rqd.0....#....$8$.n!>..c....8...z..b....-}.)...D.....b X..u...s....!%%9?...u......Ux.?T.mk.u......x.Rd..X..a\|f...t.....E.7n!n..}.t.&.r..N....J..eK.(.W%..n.S...D.B......UN....n...`.!......N.........;....EO*..+0FY>[..u..TuQ....P(.Q,5.....I.V......,.9.=.~.P^`..W.%&........s.._.....(.......J....H.5...D.$#&...b5..&j?.<......)p...b>...;.b......Z.5..w...;Jk..?k...8..^h`..X!..n{.9.IXc.......}[20.L...aO]..LVx...oQd.Z0.L.....Eb...C.L".[.=.............."..0.L.......16.;.{a..fb.,......E....!.lm.........[C...5.B..[.......sD.....@[.hE..+.>...W..(.P...@!.B.......(.P...@!.B.......(.P...@!.$./.X.;..L....IEND.B`.

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 55 x 55, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	142
Entropy (8bit):	5.351616840670792
Encrypted:	false
SSDEEP:	3:yionv//thPliItAkxd7IwJNMbL5PkJkkkkkkkxvjOMtWr5DElbp:6v/lhP/WQMwbMbL5cYvjOMtselbp
MD5:	D1323B2D9208F4937CFBCC2C85F9C8EF
SHA1:	3D9C4B34ABEF3F7935548C1D5FFF7A50CF82A7B2
SHA-256:	48DF23086CE9629F42E690CFCCA07138E8BFB0002068DCE489CF2D0938C2D5A1
SHA-512:	4C0DC3F8A47AD77376B0A13C393A30CE1A224174723CA73FFE18EA5A9233785F1274B7549D9A09AE7A62EFC575F81821E6AD5CFBEE4096A654CBB6F75CAC94B3
Malicious:	false
URL:	https://s1.pir.fm/pf/btn-hamburger-grey.png
Preview:	.PNG........IHDR...7...7........F...UIDATx^..Q..0.C...VOL.$.kR...^.................%.:.....I......I......................g.r{........IEND.B`.

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32722)
Category:	downloaded
Size (bytes):	183855
Entropy (8bit):	5.363791695112582
Encrypted:	false
SSDEEP:	3072:AUFmv+O36udPFS8uniMUpkiPXxV8IgbsHb:AUF9O36ud9S8uniMUppxVPp
MD5:	4127BF21F36841D6A71A564BC85FCAC8
SHA1:	07D4955CEEA5AC5C4C4D2CCE946B72ED6343D963
SHA-256:	D5772F4CDA097985BD5E32C43F721975D9F9C231B576F745A94D2BCE3BE4336E
SHA-512:	97DCEFE2E02731E16253E2ED92E8701CA2312991C6A08A3B3858581B602B463360E149F23DCE2D778AC503147A8D8A4F877941A450ACEEE34FA1EA1360CEE93F
Malicious:	false
URL:	https://assets.adobedtm.com/b29989a14bed/fb232d48b52a/launch-6a58c8f8d4cd.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/b29989a14bed/fb232d48b52a/launch-6a58c8f8d4cd.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-01-16T21:27:20Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"EN8348818414d3457da014cac8b02fade1",stage:"production"},dataElements:{"Dynamic Adobe Library URL - HTTPS":{modulePath:"core/src/lib/dataElements/customCode.js",settings:{source:function(){return previewurl="https://www.nortonlifelock.com/content/dam/norton-adobe-analytics/test/s_code_norton_min_preview.js",produrl="https://www.nortonlifelock.com/content/dam/norton-adobe-analytics/prod/s_code_norton_min.js",void 0!==_satellite&&void 0!==_satellite.environment&&"production"!=_satellite.environment.stage?previewurl:produrl}}},site_subsection:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_sub_section"}},site_language:{moduleP

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, datetime=2023:09:14 14:39:52], baseline, precision 8, 1560x590, components 3
Category:	downloaded
Size (bytes):	100691
Entropy (8bit):	7.918200234690059
Encrypted:	false
SSDEEP:	3072:ZjDVbXCR/h5wWQGy3r3qF0urUjYje2VP2Ff:hJqtQx7qF0qUcjFP0
MD5:	49681CCDAFD35D56F0DC166B41CF8FB2
SHA1:	1F8157DD8B5A78236480340B8EF8E4F223D90264
SHA-256:	4F106F4739AFE6B4DEF291950A7EBD12C2F5AA8D78ED6151CB2157400CB5B674
SHA-512:	EFC22FAAF4F253D7C0157F8B6C835AFC2EB53B303991527B27D5AC1C4F07F181075B75AF0C8206F394C1E14DAC4DCFCBC621B88200781BB0A184A2B93571FCFE
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/qoron0kq/how-to-check-windows-version-thumb.jpg
Preview:	......JFIF.....H.H......Exif..MM.*.................J...........R.(...........2.........Z.i.........n.......H.......H....2023:09:14 14:39:52....................................N.........Ahttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.5.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmp:ModifyDate="2023-09-14T14:39:52+02:00" xmp:MetadataDate="2023-09-14T14:39:52+02:00"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="produced" stEvt:softwareAgent="Affinity Photo 1.10.5" stEvt:when="2023-09-14T14:39:52+02:00"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.399253351432876
Encrypted:	false
SSDEEP:	24:5vIB4DtXbcS6HOWQaMyaMkDBtrVwWLNdRsZwwosmYN:5vIB6FbEIaMyaxDBDwQ2ZwDsfN
MD5:	AFC4701847AA2F501BC26F82449BB588
SHA1:	270595D75AC6B5A784F48A3CD1C286ED63A607A9
SHA-256:	1158212FFE32C3FAE6CAD215307BDE10A52FE54A460413E8209D316E908AD725
SHA-512:	591A3F9A8F46C7328454BF347AF0CA95E9B5B23EA04658E3B8A94DC9D5416F9C7E974B18B38D0DF42A7A12DA69E6619A151A65ABCB153AEB7E759AD95952D09A
Malicious:	false
Preview:	.PNG........IHDR.......0.......r.....sRGB........DeXIfMM........i...................................................0....XI.c....IDATx..\]N.@....!!.F.).g.....\|..r..).F!........a.....twg...3..7.o.....x<...h..q;.c..r%........z..+f...5......V/q....x...,.U.....c=.....A.q...b...b....`..(..ic.3..38....g..........}{...~.......R.........+.az}O...W.....%.......d...W..a1..'.9.Qz...2,.@.y..d2.._m6..{w}...u...W......I.e.".....A...,e........N.e.......6..5.. ...8F.....bu.X.>........f.(..&{.........rN.\.C..Qy.W.e..HV.......)...XlcP.OV.`....\|#H5...U......7.A...U.q...:.>..sb.O.'.......... I......uq.c...2.......e.I(@.....Y...L.....hYrT....2.$..J0l.$..Zj9..P.....s.T.^.2"%[.e.g...DV.L.rS~le.W.[.#.KV.2k.P.3.u.....B.]...V-... ..y.9....\.......k ..Zk.P..........d0([.e.g...DV.L.xS~le.W.[.#.KV...fN.P.....yg.~.Pl.'...k.n.:......f.y:.`..I(.M......=B.....L0v....a'.>..T#W..?j..........IEND.B`.

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 3840x472, components 3
Category:	dropped
Size (bytes):	64194
Entropy (8bit):	7.334922169141684
Encrypted:	false
SSDEEP:	1536:sJTM7iJhc8obQDpTlphFGQs1AxugePH6ha:shMYhclsDV7G/1VL
MD5:	F412765C87DA4B4C13FC1D58EC42FBF2
SHA1:	5BB256F4F3A78AB21BB641EF9A1EA68B3294EDD0
SHA-256:	8085D479C4ED1F7A7F270957DFE6D533BAB1226FD26E7E8200819E720E473384
SHA-512:	FBB50528E4CADF755B1928E64478504D7B52817E988B5CBBABBF4B515A61163E6FD712D8A1181E2088B8683FD2DCD1D0A288C6DE3D7B0E9D375979D1DAF45BC9
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:D764B5CD809311EA9010A262A2C780AD" xmpMM:DocumentID="xmp.did:D764B5CE809311EA9010A262A2C780AD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D764B5CB809311EA9010A262A2C780AD" stRef:documentID="xmp.did:D764B5CC809311EA9010A262A2C780AD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............8a..9...im....................................................................................................

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	7.970911206497318
Encrypted:	false
SSDEEP:	192:+ScSIZDTZRxQ9NLsvtijyzm0hpVlOQ9Us+FREuK4IXj3:hsTZrQ/svtUyq0hJwbREJ4G3
MD5:	A26307C26A07659BB8E6B567A4A4C1F6
SHA1:	2308915C005D02B142EE2171C2EC35DDC5413426
SHA-256:	CB0AA53B9E3F8951E27AD9CCA537C03CF2A78012AA79CAE560CFB4A45F33FC42
SHA-512:	9E06CC60C76A626C7613FDE3A276300AB671A344777D698DFD984B09D6A4A200116A3C307AFB299E8819B90E099F3183B46441C96A9F1310F1F800CB231220EE
Malicious:	false
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a....{IDATx..\...U........t'...B .,..I .....!....""..\|22....TFE..q.pd.EF.....2"..F..I.;...w..j.9w.[.N.s..].j......V..]....R.y.{...6..f.0.e..}.z.....T:...d.Y...n..N.W. .^VVv&..D.D..._i......49V.P.sW^y.f..bA..........G.........-(I&.J...4..T..KPR.......R[..K..\..1..A.i0..H......7.~...........V...[.........Rx.....i.'.J.\.@H...;.R.0@.ee .#.JQVZ&...U.rM"...Y......0.L..V.^......d2........C.[A.."M...H.z...9[f<_o.K<.U..I......NK.m.....T.t.....xBx..mp.....y+6n..T...@.. %[.(......z....".W.@.......B....qzZ.. .1::.tz.CC.0W..p....l.;}_...0...s.p`..L.....8q...X.. .>.b....m....a0..kr."^..B.....<#.9T.?.bC>..x+.p.....V.c@@lv.A..O.W..t.......J..+*p....$..fU.m.C.+..s.EH....p..."6.....51.3.5.hH....p.%.....p...j..U..y.cW.X....Nev.n.u.B.D<B(.aE.P.g...x.......M8.P..s..I..........=.....b."..4hh.k......{...0.....:..~.9H..`........<Fb.9\...;v;g.5\...uE..#....0.p..zHq4.1.(OR.!.......W..fU....

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42573)
Category:	downloaded
Size (bytes):	361280
Entropy (8bit):	5.560221406327953
Encrypted:	false
SSDEEP:	6144:7AzTs2gYPk6yZ410F7/J0gIq4aT2lSEUH8I4:+Ts2hbyqSs
MD5:	6FAB4AF2F401996F2F1F4F91BC22B092
SHA1:	5C7C13BEC61AC17D7900AB821E894A56B2A2D809
SHA-256:	5C551DE46B44AE6E0D844FC93505C7DC54110A20E9D7129854F5AB30E96CD7A0
SHA-512:	FEE4C64C2FD013131F85A84A8153E126EEF2902E1FA3F5A49045E93EF02A1A8E81BD6244EBF47E3F86907A89200BB0592D4D02DF219F8FC32CFBDC995AA37766
Malicious:	false
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-KFXRTR
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"258",. . "macros":[{"function":"__e"},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__jsm","vtp_javascript":["template","(function(){var d=\"UA-69441-2\";return function(b){var c=b.get(\"sendHitTask\");b.set(\"sendHitTask\",function(a){var e=a.get(\"hitPayload\"),f=new RegExp(a.get(\"trackingId\"),\"gi\");c(a);a.set(\"hitPayload\",e.replace(f,d),!0);c(a)})}})();"]},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cartLocale"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"pageName"},{"function":"__v","vtp_dataLayerV

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2066
Entropy (8bit):	4.669613400366005
Encrypted:	false
SSDEEP:	48:6zxcS8z87YASeOCNFUffCF6SBZoBmVgbRYRhdrOh8:GxhM87BSYDUfUR0Khdrs8
MD5:	79059363FE2E3B9261A274B809BCF175
SHA1:	F2B9756CEB97D8E510C8244F46F7338A840F34B4
SHA-256:	D67519701A6730486CA33DB5FAAEF03ACD180871130A4426DFAA1FC88CBAFD3C
SHA-512:	24FCB22BDC388BF8B750E6DB5778606158F2DE233B193CAA61A2C328CE24D197075928D54F68CF8809FDDFA92CA05A32D00234DE31251ADC9A1EFCF20C723728
Malicious:	false
URL:	https://www.ccleaner.com/en-us/api/knowledge/labels?guid=1b822ab0-17c0-4d49-88b6-24186f4dd904
Preview:	{.. "advertisement-image": "https://cdn-production.ccleaner.com/site/mumonrut/ccleaner-v2-ad-new.png",.. "advertisement-link": "/ccleaner/download/standard",.. "advertisement-image-alt": "Download",.. "article__related-title": "Related Articles",.. "category--all-text": "All",.. "category--aria-label": "Show category",.. "back-to-top": "Back to top",.. "load-more": "Load more",.. "load-more-button-text": "Load more",.. "load-more-loading-text": "Loading...",.. "main-heading": "Knowledge Center",.. "most-popular-posts": "Most popular",.. "read-more": "Read more",.. "search__no-results": "No results found for",.. "search__placeholder": "Search the knowledge center...",.. "search__reset-title": "Reset",.. "search__searching-for": "Searching for",.. "socials-heading": "Follow us on:",.. "socials--share-facebook": "Share on Facebook",.. "socials--share-linkedin": "Share on Linkedin",.. "socials--share-twitter": "Share on Twitter",.. "newsletter-heading--wide": "Subscri

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	46
Entropy (8bit):	4.544876086303667
Encrypted:	false
SSDEEP:	3:YVMCT+dVgjjQIdROMrfW9:Yn+QjsI3OCw
MD5:	5DF7DEE99A3FF0EF853B4C1A7E8A6F34
SHA1:	6CD1DFCB0C120C014D10E91D9946CC32AD68E41B
SHA-256:	A42766AC88CC70E52CFA0DF72AEE3EA8D736FCB913DA08DBA998D749631B840C
SHA-512:	9B2FB00C9DF77B4CBD096FC4AEEE651F0EF4554BAC19469891C6026161A09F98D6D4E814590D8A9FD87DF455D0AB0E7E82045AB99CC2D9B582C5497E3C42FABC
Malicious:	false
URL:	https://s.yimg.com/wi/config/10180940.json
Preview:	{"pixelId":10180940,"use1stPartyCookies":true}

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5955)
Category:	downloaded
Size (bytes):	271916
Entropy (8bit):	5.569766844933762
Encrypted:	false
SSDEEP:	3072:cK4lg1qsHEoSquZ2Ike8Zh+9TvQgFB8+vm4aTdY/mksnwjg8QjI/inOwosai1:x4iYqk2IRcgE+vm4aT2eksJ8QjI/inOm
MD5:	C246B674D5C9AE477B85AAE54EC265CD
SHA1:	40E870D073906A0D773C25D6BF64CBDB7D366270
SHA-256:	0C3FCB05295F5C0DB22E6D40ECDAD9CE9FA739A6EB7676C462FD08856AD09B63
SHA-512:	791C181970288F6E40BD68CC911F9F7C8D363D4541648E3C3585EAD19330EC26364C7D009AFB9C346C6569908BA270FD98DD99FC5608C03FDCD6BB67BAF52DC5
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-YG64G9XX0R&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":14,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_email

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33615)
Category:	downloaded
Size (bytes):	33616
Entropy (8bit):	5.413721726762077
Encrypted:	false
SSDEEP:	768:EbuqqwM9iRD91mDdP/6Lf9nafTAVZxp1Z7s:EbuTiRB1m2a8VZxpro
MD5:	FA0660A8882E303688049086E6201CBE
SHA1:	163A8A8481E067A40D4FFC0815F92684B45BD3AB
SHA-256:	240530CD560BF994EBC14EABF67AA7B0413487CACC7AE1D1E29306243D87672B
SHA-512:	7370B394B4F0360238498C7E9F31F582B45BB67A19E6CB811DF1D07D63FC31E6B1142E85F2445E5C1807A9BC0930346B1025F377695DA84321484267DB54CAB0
Malicious:	false
URL:	https://c5.adalyser.com/adalyser.js?cid=ccleaner
Preview:	var adalyserModules=trackerCore;adalyserModules.AdalyserTracker=function(e,r){var t=window;mutState={outQueues:[],bufferFlushers:[],expireDateTime:null,hasLoaded:false,registeredOnLoadHandlers:[]};function n(){var e;adalyserModules.helpers.forEach(mutState.bufferFlushers,function(e){e()});if(mutState.expireDateTime){do{e=new Date;if(adalyserModules.helpers.filter(mutState.outQueues,function(e){return e.length>0}).length===0){break}}while(e.getTime()<mutState.expireDateTime)}}t.AdalyserTracker={};adalyserModules.helpers.addEventListener(t,"beforeunload",n,false);return new adalyserModules.InQueueManager(e,mutState,r)};adalyserModules.InQueueManager=function(e,r,t){var n;function a(){if(adalyserModules.isBot(navigator.userAgent)){return}for(var e=0;e<arguments.length;e+=1){var r=arguments[e];var t=Array.prototype.shift.call(r);if(typeof t=="function"){t.apply(r);continue}if(t==="create"){o(r[0]);continue}n[t].apply(n[t],r)}}function o(e){e=e\|\|{};if(!n){n=new adalyserModules.Tracker(t,r,e

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46592)
Category:	downloaded
Size (bytes):	46595
Entropy (8bit):	5.462333879097584
Encrypted:	false
SSDEEP:	768:T/oEqoKVLCyLvUkTUtFDWUwcEk4jvIlAvheFECCAUEVDRpz/BIj0Iv8NCxr5:YDRM3tFi7vFkFI/q5ij0IICx9
MD5:	678ED857D1CC65EB0C8142398908C806
SHA1:	2734943700DCD3269C51B45ED636F41CF81935FD
SHA-256:	DEC888202913F9630B63196880EA2E96210C59DF2905E55154FE88432C1B0E3D
SHA-512:	3A9E4F4C671BE909D97D2DF0E2F4C502188FBECD304E9AD454FAF46BE686D17BE27E056315CE90CA1B66BBC198B039371A12B633A6DDF29A2CC68D51C8F6BC6A
Malicious:	false
URL:	https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Preview:	!function(){"use strict";function t(t,n,e){return n in t?Object.defineProperty(t,n,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[n]=e,t}var n,e,r,o,i={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONAL"},a="GUEST",u="MEMBER",c=0,l=1,f=2,s=(t(n={},a,"li_gc"),t(n,u,"li_mc"),n),d=function Xe(){var t=arguments.length>0&&arguments[0]!==undefined?arguments[0]:null,n=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,e=arguments.length>2&&arguments[2]!==undefined?arguments[2]:null,r=arguments.length>3&&arguments[3]!==undefined?arguments[3]:null;for(var o in function(t,n){if(!(t instanceof n))throw new TypeError("Cannot call a class as a function")}(this,Xe),t=t\|\|{},this.consentAvailable=!1,this.issuedAt=n,this.userMode=e,this.optedInConsentMap={},i)t[o]=t[o]\|\|c,t[o]!==c&&(this.consentAvailable=!0),this.optedInConsentMap[o]=t[o]===l\|\|t[o]===c&&r===l},p=(e=[i.ADVERTISING,i.ANALYTICS_AND_RESEARCH,i.FUNCTIONAL],r=[c,l,f,c],o=new R

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
Category:	downloaded
Size (bytes):	15860
Entropy (8bit):	7.988022700476719
Encrypted:	false
SSDEEP:	384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
MD5:	E9F5AAF547F165386CD313B995DDDD8E
SHA1:	ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
SHA-256:	F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
SHA-512:	2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........W.......S...hT,.l..'.9.;[@..._.L..\|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2\|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'\|Z........a....^.b...o.>...g........f../w'....Ja.o(

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	1381557
Entropy (8bit):	5.587513081251701
Encrypted:	false
SSDEEP:	24576:ZQfmGjL/HVjhOk1KdFDfvDbpY63AewOA2c2MvF8nkcSYy0i4HZU7s6wqECoOBDe+:afmGjL/HVjhOk1KdFDfvDbpY63AewOA7
MD5:	96B0ED3D3DAD15678D2739513928B0CB
SHA1:	D666CFEA8B2A220A9DEF010C88D070E00F2193E5
SHA-256:	F15B33831F18731695518A0AC0F3AABB8E000E25BC9D76D6E02E8A4053CE727D
SHA-512:	949D9607B68C9EDDEC80B31C4C3C00EA2A0E04C23F6BC591842E14EA886084391829EB7B2E983F16BBBBDBF0C375DEF95979B9D4C0297B6EA18C832D276BCD8D
Malicious:	false
URL:	https://www.ccleaner.com/dist/uiv1/apiary-legacy-native.css?v=1.0.95
Preview:	@charset "UTF-8";@import"https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700\|Roboto:300,400,500,600,700\|Marck+Script\|Rock+Salt\|Oswald:200";.color--primary{color:#627f15!important}.color--primary-alt{color:#536c12!important}.color--secondary{color:#0e6fbe!important}.color--secondary-alt{color:#0c5ea2!important}.color--secondary-alt--light{color:#0e6fbe!important}.color--mid{color:#676767!important}.color--mid-dark{color:#46515d!important}.color--midplus{color:#75716c!important}.color--midminus{color:#454545!important}.color--red{color:#d23d3d!important}.color--gray{color:#6d6d6d!important}.color--gray-light{color:#bcbcbc!important}.color--white{color:#fff!important}.color--off-white{color:#f7f7f7!important}.color--text{color:#382e23!important}.color--darker{color:#383d40!important}.color--darkest{color:#111!important}.color--cyber-blue{color:#6ee2e9!important}.color--flame-pea{color:#e15244!important}.color--dark-text{color:#363636!important}.color--yellow{color:#ffd200!im

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 3840x472, components 3
Category:	downloaded
Size (bytes):	64194
Entropy (8bit):	7.334922169141684
Encrypted:	false
SSDEEP:	1536:sJTM7iJhc8obQDpTlphFGQs1AxugePH6ha:shMYhclsDV7G/1VL
MD5:	F412765C87DA4B4C13FC1D58EC42FBF2
SHA1:	5BB256F4F3A78AB21BB641EF9A1EA68B3294EDD0
SHA-256:	8085D479C4ED1F7A7F270957DFE6D533BAB1226FD26E7E8200819E720E473384
SHA-512:	FBB50528E4CADF755B1928E64478504D7B52817E988B5CBBABBF4B515A61163E6FD712D8A1181E2088B8683FD2DCD1D0A288C6DE3D7B0E9D375979D1DAF45BC9
Malicious:	false
URL:	https://s1.pir.fm/pf/blog/knowledge-center-header-image.jpg
Preview:	......Exif..II*.................Ducky.......<...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:D764B5CD809311EA9010A262A2C780AD" xmpMM:DocumentID="xmp.did:D764B5CE809311EA9010A262A2C780AD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D764B5CB809311EA9010A262A2C780AD" stRef:documentID="xmp.did:D764B5CC809311EA9010A262A2C780AD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............8a..9...im....................................................................................................

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	541725
Entropy (8bit):	5.235860247228786
Encrypted:	false
SSDEEP:	3072:1WZQvWOJm8JjIg657J9V7s8zk18E4hF8MY:1WmqJ9V7vzk154hKMY
MD5:	10775F84F522EB270CB11F3914A711EF
SHA1:	2FF8A0E8FC4D1250501FB0F51CE098BD94ED690F
SHA-256:	D3A62F9F540342284B4FA0352DA601A081D052D98032F93F782BDF5DDD41A34A
SHA-512:	5F2B38C69DED6423B2FA8D88803C36CE89BE83BE1B014386C8D0AE7C02823D60842461CDD077DBF79ACFD2CF19DD4E5011257C50234F02AB078785A27BF1E76E
Malicious:	false
URL:	https://www.ccleaner.com/dist/uiv1/apiary-legacy-vue.css?v=1.0.95
Preview:	.color--primary[data-v-71a27d86]{color:#627f15!important}.color--primary-alt[data-v-71a27d86]{color:#536c12!important}.color--secondary[data-v-71a27d86]{color:#0e6fbe!important}.color--secondary-alt[data-v-71a27d86]{color:#0c5ea2!important}.color--secondary-alt--light[data-v-71a27d86]{color:#0e6fbe!important}.color--mid[data-v-71a27d86]{color:#676767!important}.color--mid-dark[data-v-71a27d86]{color:#46515d!important}.color--midplus[data-v-71a27d86]{color:#75716c!important}.color--midminus[data-v-71a27d86]{color:#454545!important}.color--red[data-v-71a27d86]{color:#d23d3d!important}.color--gray[data-v-71a27d86]{color:#6d6d6d!important}.color--gray-light[data-v-71a27d86]{color:#bcbcbc!important}.color--white[data-v-71a27d86]{color:#fff!important}.color--off-white[data-v-71a27d86]{color:#f7f7f7!important}.color--text[data-v-71a27d86]{color:#382e23!important}.color--darker[data-v-71a27d86]{color:#383d40!important}.color--darkest[data-v-71a27d86]{color:#111!important}.color--cyber-blue[dat

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	4.2430101595548555
Encrypted:	false
SSDEEP:	3:KQCZAK+uP:K9GruP
MD5:	75C843C7B717E7B722777907475C67A3
SHA1:	983D1C9A05B315288039B9D4694CE3B402259240
SHA-256:	1D348F9F803C95305F63DEF9D75FD50E79E54A375E1A4A888EDBBEA366845580
SHA-512:	41F58C029586198B0F5E7AB6D2CC1EDEB113184F82C8ADFFC81F0E229FF5CE44CC9AABB8BDA82F923984A3CFE5E42C68EF2F4620FF94AE0B1809B03B9A6FD37F
Malicious:	false
URL:	https://tr.outbrain.com/cachedClickId?marketerId=001ac0827d67b7b38319c9517e7fa2f4cc
Preview:	obApi.setCachedClickId("NoClickId")

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8007
Entropy (8bit):	7.964007524235252
Encrypted:	false
SSDEEP:	192:+S4c9h8xu5xR6Pk9Y7wu6UUuDYWfebxWxivvN+cHZ/kbrBITCeDAYV+bH9:hQx4xR6Pk9Y7wu6U288L58xUTWd
MD5:	736D03DCC8B73579022004524E4261E8
SHA1:	0D009FFF81FA1590FE9EBA29FBFDD64A2F83D226
SHA-256:	395F457D20154F7FD6F0886480D492D3F614B21B631649912152F974A723CA49
SHA-512:	772DDF161E51A4B0ECA107E57D8E8A800D7EC570061EB1300624095AC6FA2DB38CE90ACF9A2EB94D006D5C1132D800C5D33484A5AC987092755D848ABC2578E6
Malicious:	false
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a.....IDATx..\|y.].y..[{o...%...@..HbWX......<......\|&Nb.....s..0...L<.......=.o8..6.F .%..PK.V.z.~.o....^...H.$....[....5........f/..;t]KuP?6Gp..y........PV.7.....uQg....+),. <...C.../.._^...g.P.....(..g......X,..=..u..]..]t.+.1...T..........A...1....W..D...!....]E.4....DQ...<..@.....?\|.]\|.... .8.11X..X...*2.vt...s..a..b...s..0B..1...,..8s...h.@.}.s...t..At}..<........Z.Z#D=...<E.......kp..CC.....m'.2..D]s.....Q..4g...Lp\`........... ..@}.,..i.@u.(......%.:.S#R........e..P.!..%...\..G.8..=f..........JD.DM........N... 0.DJp.........4..F..t...[...>8....ShPo...$..BMZ..05^.Q.. ....{>8..2.F:j.1..C....[K.e..z.a......t...\|.....W....W..9S........%.e.....q..S..>........+.aZt\|.B.j..dY.e..~C...(.E... ....2..j......'.v.Q......0..;`.?sO...L.g....!B..g...zt....=.B.U..6..>[\..%N...5...@.m..."...$C..u..]..x&....z..z...R....../+...9YO..t...~.M..Q.B.~.(.)..U\..%....)3nx\..........o.".E

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	910
Entropy (8bit):	7.399253351432876
Encrypted:	false
SSDEEP:	24:5vIB4DtXbcS6HOWQaMyaMkDBtrVwWLNdRsZwwosmYN:5vIB6FbEIaMyaxDBDwQ2ZwDsfN
MD5:	AFC4701847AA2F501BC26F82449BB588
SHA1:	270595D75AC6B5A784F48A3CD1C286ED63A607A9
SHA-256:	1158212FFE32C3FAE6CAD215307BDE10A52FE54A460413E8209D316E908AD725
SHA-512:	591A3F9A8F46C7328454BF347AF0CA95E9B5B23EA04658E3B8A94DC9D5416F9C7E974B18B38D0DF42A7A12DA69E6619A151A65ABCB153AEB7E759AD95952D09A
Malicious:	false
URL:	https://s1.pir.fm/pf/blog/post-icon.png
Preview:	.PNG........IHDR.......0.......r.....sRGB........DeXIfMM........i...................................................0....XI.c....IDATx..\]N.@....!!.F.).g.....\|..r..).F!........a.....twg...3..7.o.....x<...h..q;.c..r%........z..+f...5......V/q....x...,.U.....c=.....A.q...b...b....`..(..ic.3..38....g..........}{...~.......R.........+.az}O...W.....%.......d...W..a1..'.9.Qz...2,.@.y..d2.._m6..{w}...u...W......I.e.".....A...,e........N.e.......6..5.. ...8F.....bu.X.>........f.(..&{.........rN.\.C..Qy.W.e..HV.......)...XlcP.OV.`....\|#H5...U......7.A...U.q...:.>..sb.O.'.......... I......uq.c...2.......e.I(@.....Y...L.....hYrT....2.$..J0l.$..Zj9..P.....s.T.^.2"%[.e.g...DV.L.rS~le.W.[.#.KV.2k.P.3.u.....B.]...V-... ..y.9....\.......k ..Zk.P..........d0([.e.g...DV.L.xS~le.W.[.#.KV...fN.P.....yg.~.Pl.'...k.n.:......f.y:.`..I(.M......=B.....L0v....a'.>..T#W..?j..........IEND.B`.

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x132, components 3
Category:	dropped
Size (bytes):	9878
Entropy (8bit):	7.9403680892771185
Encrypted:	false
SSDEEP:	192:Q6PcNYBV4lgfBo9LAuRU8hT7ut5lmgAVABpYvhKzzAS:Q6PWYLLfOLAui8hXHGDVIS
MD5:	7895CB1F002CBE6FEFE3535878A3D9C3
SHA1:	9BEC6812D6B968CF4BBCE4CCDE8F0A969DE6BE74
SHA-256:	B8F3F81E29101C6A7EAB759A4A681298F3DDA8A99CB2459B32C40EE658E0D720
SHA-512:	7D176C21C83AC715C7BCAE0C16CC4989834F0C1CC1FED02FF2FF88B937282D27957129FFF9ED1CA66971985A2870716A68071DA2CF83522545D9657404705849
Malicious:	false
Preview:	......Exif..II.................Ducky.......U......Adobe.d.................................................................................................................................................................................................................................................!..1...AQ".a2#.q.....B3$.Rb.....r.C.%E).......................!1...AQ.".aq.2.B#......3C$.............?..s.ZMi..8.....&Q.COm...m_D..`.d2.T.R..l..<..)s(e..Q.N."X....n.KvaAM.R.<.p..9Q.Q.U(..[...'.'....a..C..8.IY.NV\!.c...AI&.#.~..K...'!..~.O$.Y.MVA"?.....YY.......%z..K...G.....4E...HH.t...V...m(:..1...A.]..E......?...@.S.......p.&...YC....]2....d...u...s.#.O!.ct;.W.......I.1...*Q.q....6E....2.09...Q..y....S.......$]e{..iuv.s..G(.<yVD.......ci3.\.HW.B.........P.;.5)..@.B>e..q;N_ .-.e.c.%&.9TCkXB...CiY?.t.........+....V...Vfg[.S. ..2.......f)Y.+..4vV./.BcTT...8..V.'5.Ci+...Rc..!!`...G..8.8b.'..x?.m;Lu2.d..\+J.$....i......u..Y,...t.c(...6E........!.A.}V.n...........

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x38, components 3
Category:	dropped
Size (bytes):	6488
Entropy (8bit):	7.851768898963181
Encrypted:	false
SSDEEP:	96:l2flVpsXS/jAGMe/Qa41Y4O/tssnfdJvYvDoHdl4mG8JD97L3LKQszcYwdBx:MCXCjn3QRWiv0n7zWwrdBx
MD5:	21F472010B9CDD8C4F035FE0DC10D3E4
SHA1:	17D1E45849A5FD40F3722E3ACADDE9BFF1D61C96
SHA-256:	B669C1B37255A5C966BDDD14DADF96D97AEFACB148AF4680172DA4D097E93D40
SHA-512:	7BF4289370620B2B8164A5D48D0AFCC7DCE5B5610AAD8EBAFE00A9CB40AB96374418541C1E43D9FC5225115CD0FB4E12BC5F1AE77C46EAEB4AB3E1E7C41F13E1
Malicious:	false
Preview:	......Exif..II*.................Ducky.......d.....1http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:43816D83D11A11E7A7B4C512885C8C2E" xmpMM:DocumentID="xmp.did:43816D84D11A11E7A7B4C512885C8C2E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:43816D81D11A11E7A7B4C512885C8C2E" stRef:documentID="xmp.did:43816D82D11A11E7A7B4C512885C8C2E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................................................................................................

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	4.379103488639966
Encrypted:	false
SSDEEP:	24:QEV5kybXk5EkXk1XkdQwSDQKXkTXksXk3XkzKvD:4yQ0qdto6YvEED
MD5:	EE48EA4B1F40513BC68866678E40FCCE
SHA1:	32155C91E2BD9FC8473FB92BDEA14B3073268113
SHA-256:	19FD78ACBD8904531A11791C4FE3537E51A8D5585F05E60858C806CCF8A61DC2
SHA-512:	D7EAEFCCC749B71087B87F16691D62D7E7483A383A6068678AC2ACE3091E5D3B6B648F4550B82347DD13847BE4D534434BE5C80E6D560DA4BCA412AF9ECB3D6F
Malicious:	false
Preview:	{.. "posts": [],.. "categories": [.. {.. "id": "office-tech",.. "name": "Office Tech",.. "url": "/knowledge?c=office-tech".. },.. {.. "id": "home-computing",.. "name": "Home Computing",.. "url": "/knowledge?c=home-computing".. },.. {.. "id": "in-the-news",.. "name": "In the News",.. "url": "/knowledge?c=in-the-news".. },.. {.. "id": "security-and-productivity",.. "name": "Security & Productivity",.. "url": "/knowledge?c=security-and-productivity".. },.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "cloud",.. "name": "CCleaner Cloud",.. "url": "/knowledge?c=cloud".. },.. {.. "id": "ccleanerbrowser",.. "name": "CCleaner Browser",.. "url": "/knowledge?c=ccleanerbrowser".. },.. {.. "id": "release-announcement",.. "name": "Release Announcements",.. "url": "/knowledge?c=release-a

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	166890
Entropy (8bit):	5.213025329783762
Encrypted:	false
SSDEEP:	1536:O1hCqYgEHNbG2EiaEdh/P0KfYXt/zBKc/58k8k0C0Au+YQ62GAg7B:qhCqKNne/zBwk8k2+sL7B
MD5:	B467EC42DDFC1378494A9423DC37E9BC
SHA1:	3E0EB9647B30D596AC78BCFF045A55F23C0253A1
SHA-256:	C11B9C3C2E5DE7D52D5799DDD904E086AFC383FA63B7EBCBB8E4300AED294691
SHA-512:	4793C8BFD51FCB4DB7D54083D645B78A16DB44ED7267E45F5A79001414DDF1BB98900EB52929CF0EBD88A8451A996214721AAC43D2FFD94DBCC980C7A3A97348
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccloseButtonType":"Icon","pccontinueWithoutAcceptText":"Continue without Accepting","cctId":"831b8ee0-e952-49a5-af6b-01382c722774","MainText":"Privacy preference center","MainInfoText":"By clicking \"Accept All\" you allow cookies that improve your experience on our site, help us analyze site performance and usage, and enable us to show relevant marketing content. You can manage cookie settings below. By clicking .Confirm Selection. you agree with the current settings. See","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","AboutLink":"https://www.ccleaner.com/about/cookies-policy","HideToolbarCookieList":true,"ActiveText":"Active","AlwaysActiveText":"Always Active","AlertNoticeText":"By clicking \"OK\" you allow cookies that improve your e

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46137), with no line terminators
Category:	downloaded
Size (bytes):	46138
Entropy (8bit):	5.305013525068926
Encrypted:	false
SSDEEP:	768:OaOFhhRXR2ahpjfRys3LzQRo4TYYyDMOWPKQ:OaOFnRNDRtzQy4IfWiQ
MD5:	C1733EDB23701B926864754FC516435C
SHA1:	C899A598EA340D01D79E378C092A45B558E2D2BB
SHA-256:	45396B8359112C614D4AAB3FCB716DEAABC47E477078F675D7BF69F5791C8F53
SHA-512:	80A85AC3684EF1003C0311E9842F9FC5E81B08C41BBA53CDB3D88F20B74E82EEE3637114A328A31ACB743E3F55E583E4045F4B5C944B747FF5F9D7E671195531
Malicious:	false
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	9507
Entropy (8bit):	5.3592270038592424
Encrypted:	false
SSDEEP:	192:ebkfPUyAQgtNBIWguxw68uCItctpwfTh3fYwuoOE5YBTi+1POyj/0Pp5b5LfvEf0:PSN9cO51r
MD5:	4D67D7FCE83E8D073C84E4D5B5936E71
SHA1:	E02711957EA1C637BE41485526C65E4B56C55FD3
SHA-256:	1DA25CF82F065474AADCE40A8C7369F6DF48E1847CB95C21BD9083488EFF7390
SHA-512:	1E9D7565BEF92D1C2DA126245D6392176D29A4BE7F1B4623FB367B4C345AA5381EB9022ECD3317CC946B48E2AF89073C80EDCEE0FC121073C88643B191D8E4D0
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/6.36.0/assets/otCenterRounded.json
Preview:	. {. "name": "otCenterRounded",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZXRydXN0LXBvbGljeS10ZXh0Ij48ZGl2IGNsYXNzPSJvdC1zZGstcm93Ij48ZGl2IGlkPSJvbmV0cnVzdC1ncm91cC1jb250YWluZXIiIGNsYXNzPSJvdC1zZGstdHdlbHZlIG90LXNkay1jb2x1bW5zIj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3kiPjxkaXYgY2xhc3M9ImJhbm5lci1oZWFkZXIiPjxkaXYgY2xhc3M9ImJhbm5lcl9sb2dvIj48L2Rpdj48L2Rpdj48aDIgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgaWQ9ImJhbm5lci1vcHRpb25zIj48ZGl2IGNsYXNzPSJiYW5uZXItb3B0aW9uIj48YnV0dG9uIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIiBjbGFzcz0iYmFubmVyLW9wdGlvbi1pbnB1dCI+PHNwYW4gY2xhc3M9ImJhb

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6285), with CRLF line terminators
Category:	downloaded
Size (bytes):	6590
Entropy (8bit):	5.2266865354230285
Encrypted:	false
SSDEEP:	96:a0AJpmJgNJdmJgJ/f8mCmym+PwS06oFCZjXsG37wI/6c2uix4zX+KIrAV2CbD0yO:a0AZqPZYqq4fInCb+MjgkkWc
MD5:	7A3283EB65168F6B890F1FBFB52799C0
SHA1:	C8F3BFBC04475BD9035020FE2BB0F0FF242F18D3
SHA-256:	81994C69BCAC3BB1212FB0EF5034B1D4F1B429265750022AC28A846BF13A6D89
SHA-512:	3839797127482AF02DB3D0FAE720232E17C6A1114470CFFF88CA64CAA913230856A64B09277885B846B1ABCCD6D903B3887D9260CD386D127670FEB47C7144B6
Malicious:	false
URL:	https://www.ccleaner.com/dist/js/legacy/sniffer.js?v=1.0.95
Preview:	/!.. Sniffer is a clientside browser/engine/os/device detection tool.. * v. 3.3.0 \| https://github.com/wilddeer/Sniffer.. * Copyright Oleg Korsunsky \| http://wd.dizaina.net/.. .. MIT License.. */..var Sniffer=function(i){"use strict";var f={browser:{fullName:"",name:"",version:"",majorVersion:null,minorVersion:null,patchVersion:null,engine:""},os:{fullName:"",name:"",version:"",versionName:"",versionAltNames:[],majorVersion:null,minorVersion:null,patchVersion:null},features:{bw:!1,mobile:!1,tv:!1,proxy:!1}},u={browser:[{test:["SailfishBrowser"],browser:{fullName:"Sailfish Browser",name:"sailfishbrowser",engine:"gecko",$version:{search:"SailfishBrowser/"}},features:{mobile:!0}},{test:["Edge/"],browser:{fullName:"Edge",name:"edge",engine:"edgehtml",$version:{search:"Edge/"}}},{test:["MSIE"],browser:{fullName:"Internet Explorer",name:"ie",engine:"trident",$version:{search:"MSIE "}}},{test:["Trident"],browser:{fullName:"Internet Explorer",name:"ie",engine:"trident",$version:{search:"

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1560x590, components 3
Category:	downloaded
Size (bytes):	92067
Entropy (8bit):	7.817112492608626
Encrypted:	false
SSDEEP:	1536:9PcO0QriP/4JFJ6+Kh5r+sO6CpRkLhmvF6MehSJESAaSxMPssk:YQrK+FJ6+KhthOvXjF6nhSQLUssk
MD5:	6455EAC0D7B6FB17D419FC734538A9CF
SHA1:	711AC0FC93CCD476516682AF42D16929C8652DFC
SHA-256:	ADF0769B8D66670AC87E65DD2C6DF6C0A2A33EB58A39903FB9BA49ACD4A5C87E
SHA-512:	B7DB88858729F111C3753A340CA5C657C1D2DD53F135FCC636AD4B21CF5E4C3C448E5CEB5AFEC45C2A06DD26AEB20CE7325798FC8E30389E43C91BC0C343B897
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/ysco1rxm/release-announce-blog-1560x590.jpg
Preview:	......JFIF.....d.d......Ducky.......K......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d" xmpMM:DocumentID="xmp.did:6C20C9FA3BCF11EC8D2FE7DCF3B86EFC" xmpMM:InstanceID="xmp.iid:6C20C9F93BCF11EC8D2FE7DCF3B86EFC" xmp:CreatorTool="Adobe Photoshop 23.0 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d" stRef:documentID="xmp.did:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16552)
Category:	downloaded
Size (bytes):	21059
Entropy (8bit):	5.4206512466590056
Encrypted:	false
SSDEEP:	384:f9raZLAavtqrtVa6IJJoNRnWjUg/UQ63KiG3nXUnHVh:1raZLAStqrtVVIJJoNgjUg/ye3E1h
MD5:	63C3184C909BC7998BD23DD5BB0F77B3
SHA1:	3EF36E419274135B4ADC487BBFEFB10F0569C9C6
SHA-256:	26448EFE01D31EF2F622C08599388578EFFC22441ED1C77F2D7B9D69BE9BD117
SHA-512:	4144E19495049B59362189B72B046B4955B90DB9EA89DDC1BE3437A7A451E458A1D2EFE1A20A15F80E3A11C139A0C960B0288C4328CA76FFF6569305E3F42FC8
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/831b8ee0-e952-49a5-af6b-01382c722774/OtAutoBlock.js
Preview:	!function(){function n(d){var g=[],a=[],f=function(c){for(var b={},e=0;e<z.length;e++){var h=z[e];if(h.Tag===c){b=h;break}var k=(r=h.Tag,t=x=l=void 0,l=-1!==(t=r).indexOf("http:")?t.replace("http:",""):t.replace("https:",""),-1!==(x=l.indexOf("?"))?l.replace(l.substring(x),""):l);if(c&&(-1!==c.indexOf(k)\|\|-1!==h.Tag.indexOf(c))){b=h;break}}var r,l,x,t;return b}(d);return f.CategoryId&&(g=f.CategoryId),f.Vendor&&(a=f.Vendor.split(":")),!f.Tag&&D&&(a=g=function(c){var b=[],e=function(h){var k=document.createElement("a");.k.href=h;h=k.hostname.split(".");return-1!==h.indexOf("www")\|\|2<h.length?h.slice(1).join("."):k.hostname}(c);y.some(function(h){return h===e})&&(b=["C0004"]);return b}(d)),{categoryIds:g,vsCatIds:a}}function A(d){return!d\|\|!d.length\|\|(d&&window.OptanonActiveGroups?d.every(function(g){return-1!==window.OptanonActiveGroups.indexOf(","+g+",")}):void 0)}function m(d,g){void 0===g&&(g=null);var a=window,f=a.OneTrust&&a.OneTrust.IsVendorServiceEnabled;a=f&&a.OneTrust.IsVendorS

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 86, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	1344
Entropy (8bit):	7.715508418119475
Encrypted:	false
SSDEEP:	24:YjkaKv4/vdmjWI9ZFUPLHA3gruIjze8oboSm6eeeeZD:Gkwvd+WI1UPL9j3ZvyD
MD5:	AE7F706F4454CEEF6AE8D73188BA81FE
SHA1:	16A920DB1F5DE137BCF9E3FBAA2A7485DC911A97
SHA-256:	8EE70E831154CC4ACD33403CF518D7282BF5E8237A9FCC077BC5505ABC8D18B5
SHA-512:	0342F1DF08AF3ACD6085BED84724F07150423EE763197EEEBECD23D07DC2CA4C013D6F28176CA3948B06FCBB3B3CE77115CCD507B8575EC3D07D8E259506563F
Malicious:	false
URL:	https://s1.pir.fm/pf/blog/twitter.png
Preview:	.PNG........IHDR...X...V.............sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..{lSU.....sk...l........#d...S........h..3B....._&3....w..A..&..D\|ln.M.F.m.n.....{...s..........{....{...>.r.......C...0....C...0....C...0....C...0....C...0....C...0....C......>....j..\...a==.1.....h.Z.^..Z.0.5aP4.!...X..0,..T.....H0......^....s...3....;.....r...\+.B..5....6]&}...-.0..'.k2...2.f....}.<h.p..t[.,..N..VCz.d^H...n..lV.,2..8.v....E....X.DR.../...T.S..x..X.^.?l<.ct.G....r..g.F3D....v]..w..........\|..J.r..}.{B3w..p.h4CL$...W....opW..M...I..G......N<.....f...i.s...J.f...v/Y..S.....3.~.'.`W...d...du.b,..,.Yh.;Go....y..).s.2.fLj.W~K.....&.t.....]HP3.....zo.8.77...k\.g..D..}!..C.g.~.c....0@....0...A6E..(/..;.L.9d..GT.....]..Smew.....,.v..nZ'K...n.!...ZFV.8..f.`2...<w...M0y..!..{c.f...j....w6.!.1s..47\|9.M..r..cP.z<......<.`.~.......wF4.....c.R.LB....@...G..G.l..`.=...$\"w....#.+:'S7.Ra.....5..'.=M$....(..`..x}X{y.Z.m..*....V!.g.....N...>..v.X

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, datetime=2023:09:14 14:42:07], baseline, precision 8, 1560x590, components 3
Category:	dropped
Size (bytes):	189654
Entropy (8bit):	7.956839893692659
Encrypted:	false
SSDEEP:	3072:xKLwM6aotF1LJ4adVuduLvf4L8E4Zzm84hMUD9UPBxRXifULwBxWsNKdStz2:ILwMlotl48VZLvgrHBUPVXKwUxeQq
MD5:	7463C42374B647EE3C53DE7DA25B575B
SHA1:	83987881FCFF3352FE07A1F6FB7C1B60E4879002
SHA-256:	7EF8BBD2F5B6BAA1EBAF5F66CC6D0B05D1D56BF74E4C85C028FBC584347CEDDB
SHA-512:	76113539EC0B45865A0DE5F4216E3888F48DB49A7586A1865BD12B62435A20DC12E26000C98DA712649FE7393743644C564C50C63E8190E5F3E64A6D7391AFEA
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM.*.................J...........R.(...........2.........Z.i.........n.......H.......H....2023:09:14 14:42:07....................................N.........Ahttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.5.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmp:ModifyDate="2023-09-14T14:42:07+02:00" xmp:MetadataDate="2023-09-14T14:42:07+02:00"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="produced" stEvt:softwareAgent="Affinity Photo 1.10.5" stEvt:when="2023-09-14T14:42:07+02:00"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7910
Entropy (8bit):	7.970911206497318
Encrypted:	false
SSDEEP:	192:+ScSIZDTZRxQ9NLsvtijyzm0hpVlOQ9Us+FREuK4IXj3:hsTZrQ/svtUyq0hJwbREJ4G3
MD5:	A26307C26A07659BB8E6B567A4A4C1F6
SHA1:	2308915C005D02B142EE2171C2EC35DDC5413426
SHA-256:	CB0AA53B9E3F8951E27AD9CCA537C03CF2A78012AA79CAE560CFB4A45F33FC42
SHA-512:	9E06CC60C76A626C7613FDE3A276300AB671A344777D698DFD984B09D6A4A200116A3C307AFB299E8819B90E099F3183B46441C96A9F1310F1F800CB231220EE
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/1kwnnzj5/sticky-cart-ccleaner-premium.png
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a....{IDATx..\...U........t'...B .,..I .....!....""..\|22....TFE..q.pd.EF.....2"..F..I.;...w..j.9w.[.N.s..].j......V..]....R.y.{...6..f.0.e..}.z.....T:...d.Y...n..N.W. .^VVv&..D.D..._i......49V.P.sW^y.f..bA..........G.........-(I&.J...4..T..KPR.......R[..K..\..1..A.i0..H......7.~...........V...[.........Rx.....i.'.J.\.@H...;.R.0@.ee .#.JQVZ&...U.rM"...Y......0.L..V.^......d2........C.[A.."M...H.z...9[f<_o.K<.U..I......NK.m.....T.t.....xBx..mp.....y+6n..T...@.. %[.(......z....".W.@.......B....qzZ.. .1::.tz.CC.0W..p....l.;}_...0...s.p`..L.....8q...X.. .>.b....m....a0..kr."^..B.....<#.9T.?.bC>..x+.p.....V.c@@lv.A..O.W..t.......J..+*p....$..fU.m.C.+..s.EH....p..."6.....51.3.5.hH....p.%.....p...j..U..y.cW.X....Nev.n.u.B.D<B(.aE.P.g...x.......M8.P..s..I..........=.....b."..4hh.k......{...0.....:..~.9H..`........<Fb.9\...;v;g.5\...uE..#....0.p..zHq4.1.(OR.!.......W..fU....

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	4.286554923851383
Encrypted:	false
SSDEEP:	24:t4C3AuXMe0N8nIT4N9eNwXsbN/DUxKMxmADUkjxd87ijKVdE:L0OIT4DeNwXsdDKnx7Z8CKVG
MD5:	9A73A94C1F4F2E530DD32250653E7B6E
SHA1:	D6D90C5DA9F194E6BEF9770FA93EAC6DCA84FED0
SHA-256:	A348985C7B282B773C2CDD47685D896DFC25E2663EDDC23591A45329482E8CCC
SHA-512:	8EC050F08E0DE2181D22E17D30A18EFEB2041152694F8028BE890787C18C2AB0CEA22105B55E699EC286F54F80D0C108A795D22030F5BAB61A591825CDF3FCCA
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M12.962 13.373c-.3.46-.629.86-.986 1.2-.358.34-.773.51-1.246.51s-.865-.082-1.177-.246c-.31-.165-.732-.247-1.263-.247-.53 0-.957.082-1.28.247a2.8 2.8 0 0 1-1.142.28c-.484 0-.917-.181-1.297-.543a6.853 6.853 0 0 1-1.021-1.235c-.67-.921-1.142-2.045-1.419-3.373-.277-1.327-.115-2.561.485-3.702A4.048 4.048 0 0 1 3.93 4.997a3.304 3.304 0 0 1 1.73-.478c.485.022.935.121 1.35.297.415.175.773.274 1.073.296.3-.022.698-.137 1.194-.346a3.832 3.832 0 0 1 1.643-.28c.254 0 .646.083 1.177.247.53.165 1.026.543 1.488 1.136-.093.022-.364.252-.813.69-.45.44-.71 1.098-.779 1.976.092 1.053.427 1.793 1.003 2.221.577.428.912.642 1.004.642-.023.044-.115.258-.277.642-.161.384-.415.828-.761 1.333ZM8.653 1.72a2.73 2.73 0 0 1 .859-.776c.339-.195.664-.304.974-.327.04.437-.005.856-.13 1.258a4.26 4.26 0 0 1-.51 1.087c-.213.322-.485.58-.815.776a1.74 1.74 0 0 1-1.018.258 3.05 3.05 0 0 1 .145-1.258c.136-.4

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4076
Entropy (8bit):	4.874084213279633
Encrypted:	false
SSDEEP:	96:OyIo40wsYOHpCZpdGKZa6Ayr1vRYUjojVjzZtOT:iXbepCZpA6vrxRYkQdC
MD5:	E2705BDDA7AA3D40B7BE72F664D6910F
SHA1:	0E2FD7D89624833322201868927580D56A462EF3
SHA-256:	E7E055F17B2520F44F8CDE27178E542EA8A4964765198FB1D8DA5D9659604333
SHA-512:	5A79BE1CE7087B0B44DF37F18C641250D37E2A50EDF60E27187DE17CF30F27ADBD7731A10B7F823EEC58CD99B0EFAA3E03360AEBFC375473D4278114CD40472E
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.36.0","OptanonDataJSON":"831b8ee0-e952-49a5-af6b-01382c722774","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"88869503-73ab-4afa-8651-1bc86c0ca4db","Name":"Global (GDPR)","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","br","sc","bs","sd","bt","bv","sg","sh","bw","by","sj","bz","sl","sn","so","ca","sr","cc","ss","cd","st","sv","cf","cg","ch","sx","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","tf","cu","cv","tg","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","va"

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:	768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6841
Entropy (8bit):	5.416734184657188
Encrypted:	false
SSDEEP:	96:oglR8YEMdtqUaHHTE3R5Z/iaHHTE3RWJqlaHHTE3RDvN5hHaHHTE3Rw0naHHTE33:ogrTy8Z//TJFmv9eNpAcnqoMZrwVhvA
MD5:	37A6C1EFC76C59C01BAA12D75ACFA138
SHA1:	E0913A055850F712DE4B3739BEDB10C4F4A701D3
SHA-256:	061A7BA3BDB3274591F9C38693FF437949D5EE7E2CAE56EB4153F50010EF2B47
SHA-512:	2EF75ED51FE86477A4F1E2238EAD122388ADB13B976A04EEB880174C4C0F8BE58AD6372D6F47337E517B01BABF415FFC16AF4A9E5B7C9D08EC57B0387F1A64FC
Malicious:	false
URL:	https://www.ccleaner.com/en-us/api/knowledge/article?guid=1b822ab0-17c0-4d49-88b6-24186f4dd904
Preview:	{.. "id": "1b822ab0-17c0-4d49-88b6-24186f4dd904",.. "title": "CCleaner v6.21.10918",.. "url": "/knowledge/ccleaner-v6-21-10918",.. "listing_image": "https://cdn-production.ccleaner.com/site/ysco1rxm/release-announce-blog-1560x590.jpg",.. "detail_image": "https://cdn-production.ccleaner.com/site/ysco1rxm/release-announce-blog-1560x590.jpg",.. "display_date": "14th February 2024",.. "categories": [.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "release-announcement",.. "name": "Release Announcements",.. "url": "/knowledge?c=release-announcement".. }.. ],.. "content": "<p><span class=\"NormalTextRun SCXW59212899 BCX0\">With CCleaner v6.21, we.re introducing a new version of Software Updater, which supports more programs than ever. We.ve also expanded Driver Updater.s database, Performance Optimizer now supports Windows Store apps, and cookie cleaning is refined in Chromium browsers.<

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.2449495025834745
Encrypted:	false
SSDEEP:	24:t4C3AuXM9X85jNU8VYbirKp1UH8VkKUH8ceO+ld2zLfI3UufE:Y85HVbKL+8EHpeO+lIzk3U5
MD5:	D52B88BAD39F249E017B4CD4163FE16D
SHA1:	FC68751B7183A2B4894D74254FA9187CD6097368
SHA-256:	8BD92DC59083E637FA86BFEF195C727BD7418F21DD69A211480DEEA3FE165CC0
SHA-512:	2C922EDCC7ED8E18093C506D0D2415BA620B101BCC829886D305E5D4F7586FABBE9783DFC708B9B0B5ADBB2B85564DF7C6338D0BF1CC8BCF24B51BCDE438A81F
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M9.25 3.117a.29.29 0 0 1 .179.069.228.228 0 0 1 .069.18.244.244 0 0 1-.085.181.226.226 0 0 1-.179.07.196.196 0 0 1-.165-.084.228.228 0 0 1-.07-.18.18.18 0 0 1 .071-.167.261.261 0 0 1 .18-.07Zm-2.82.07c.05.05.076.122.069.194a.198.198 0 0 1-.083.166.227.227 0 0 1-.18.07.197.197 0 0 1-.166-.084.229.229 0 0 1-.07-.18.224.224 0 0 1 .084-.181.296.296 0 0 1 .166-.055c.066.002.13.026.18.07Zm5.069 1.93h-7.5a3.608 3.608 0 0 1 1.11-2.514c.227-.205.472-.39.732-.552L5.084.895a.194.194 0 0 1 .049-.253.196.196 0 0 1 .252.05s.76 1.158.76 1.182a3.888 3.888 0 0 1 1.617-.352 3.582 3.582 0 0 1 1.641.377C9.4 1.872 10.16.694 10.16.694a.196.196 0 0 1 .253-.05c.077.06.099.167.05.251L9.706 2.05c.258.154.496.34.707.553A3.642 3.642 0 0 1 11.5 5.117Zm-8.749.5a.75.75 0 0 0-.75.75v4a.75.75 0 0 0 1.5 0v-4a.75.75 0 0 0-.75-.75Zm9.25.75a.75.75 0 0 1 1.5 0v4a.75.75 0 0 1-1.5 0v-4Zm-.501-.75h-7.5v3.24c0

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1560x590, components 3
Category:	dropped
Size (bytes):	92067
Entropy (8bit):	7.817112492608626
Encrypted:	false
SSDEEP:	1536:9PcO0QriP/4JFJ6+Kh5r+sO6CpRkLhmvF6MehSJESAaSxMPssk:YQrK+FJ6+KhthOvXjF6nhSQLUssk
MD5:	6455EAC0D7B6FB17D419FC734538A9CF
SHA1:	711AC0FC93CCD476516682AF42D16929C8652DFC
SHA-256:	ADF0769B8D66670AC87E65DD2C6DF6C0A2A33EB58A39903FB9BA49ACD4A5C87E
SHA-512:	B7DB88858729F111C3753A340CA5C657C1D2DD53F135FCC636AD4B21CF5E4C3C448E5CEB5AFEC45C2A06DD26AEB20CE7325798FC8E30389E43C91BC0C343B897
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......K......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d" xmpMM:DocumentID="xmp.did:6C20C9FA3BCF11EC8D2FE7DCF3B86EFC" xmpMM:InstanceID="xmp.iid:6C20C9F93BCF11EC8D2FE7DCF3B86EFC" xmp:CreatorTool="Adobe Photoshop 23.0 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d" stRef:documentID="xmp.did:ed6f4275-5c61-4f7b-a239-ec3bfcf74b3d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3476), with no line terminators
Category:	downloaded
Size (bytes):	3476
Entropy (8bit):	5.447951338726859
Encrypted:	false
SSDEEP:	96:Q30xql/8fq6MVZEb8n2updxnr0cW4Nv60TE:QkQ4q6WT2up7PW4Y
MD5:	D33DE465D4E251E151999A8FF0EDAA82
SHA1:	B2F7FECF2C0660C7D414E71902032EA3D944EAB7
SHA-256:	19D3672960BFF6BC8AE3EB220B6897AC2AC929A464CE1B060AF77400D9A56267
SHA-512:	0D88C5EC5758B9CA893002E7ACEEFF7D2692764138D8D98E4D378D7E62A9A8C559A5B59D3FB4B2EC49B4A360C44B485A34A6B270AB90DB4084B1934B2B4534BD
Malicious:	false
URL:	https://dev.visualwebsiteoptimizer.com/j.php?a=176159&u=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&r=0.19947545942317246
Preview:	try{(function(){var aC=window._vwo_code;if(aC){window._vwo_j_e=window._vwo_j_e\|\|0;if(window._vwo_j_e==1){window._vwo_mt="dupCode";clearTimeout(window._vwo_settings_timer);if(window.VWO&&window.VWO._&&window.VWO._.bIE){window._vwo_code.finish()}return}if(window._vwo_j_e==-1){window._vwo_j_e=1}}window._vwo_mt="live"; var localPreviewObject = {}; var previewKey = "_vis_preview_176159"; var wL = window.location; try {localPreviewObject[previewKey] = window.localStorage.getItem(previewKey); JSON.parse(localPreviewObject[previewKey])} catch (e) {localPreviewObject[previewKey] = ""}; try{window._vwo_tm="";var getMode=function(e){var n;if(window.name.indexOf(e)>-1){n=window.name}else{n = wL.search.match("_vwo_m=([^&]*)");n=n&&n[1]}return n&&JSON.parse(decodeURIComponent(n))};var ccMode = getMode("_vwo_cc");if(window.name.indexOf("_vis_heatmap")>-1\|\|window.name.indexOf("_vis_editor")>-1\|\|ccMode\|\|window.name.indexOf("_vis_preview")>-1){try{ if (window.name && JSON.parse(window.name)) { window._v

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
URL:	https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=176159&d=ccleaner.com&u=D7AC5573972C60564976E18E332F56DDF&h=e9c9db551c738e08dbc441ee457e4a33&t=true
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	310
Entropy (8bit):	5.060343257111954
Encrypted:	false
SSDEEP:	6:tI9mc4slzc3AuXMtfpTHXZLhUb+IK0E2zQdjdW0d8IPrHo5E:t4C3AuXM3THX1i6Pn98Iro5E
MD5:	54E65CE79D9B0B4FBF4E6932FB8F56FE
SHA1:	90EEC9CE63ECE1EB4AE22661B85C5B8F62157432
SHA-256:	823BF46FABE1829714E7FB1E180653112BB906C4651E5DADEC65839C142574C3
SHA-512:	D98A6786E725A66C5A7718F94888E9136314861C27B0C2F485BC38E80CB6ACCF247FD32F65959E67F8C0943AFE8FCD8E3ABB2B7B2FAC9F1CD8102E6F8D38CD16
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M6.378 7.576H.971V3.294l5.407-.855v5.137ZM15.03 7.576H7.458V2.277l7.57-1.19v6.49ZM6.378 8.658H.971v4.283l5.407.854V8.658ZM15.03 8.658H7.458v5.299l7.57 1.19v-6.49Z" clip-rule="evenodd"/></svg>

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.189711652602748
Encrypted:	false
SSDEEP:	48:B82lNUshFh5tRJHnZgG78YqA9vUrpvMpfapJa4PE1vMtwD3wAjFH8mS6GphIw7pt:flNUsh75tRJHVhB9sWpypJbE10uD31Bg
MD5:	2E9B9AC8BE368C1EFCC51965C74BE43B
SHA1:	DDE87F63ECBAEB97C5708CED6FFD0E7DE5A806C0
SHA-256:	49B9B4996D1FF0A8E3DE643A0C623255BF631F298F2799B949C29DE93926EE7A
SHA-512:	FFC56944E751D82233F3ED504EB42A44544CB4E58969E8AC3ABD76D96C0607282FEE0E52F13AED8902B05330E0C82E74BA8592FF2BDCBF0188BE8898EFB2C741
Malicious:	false
Preview:	<svg width="136" height="16" xmlns="http://www.w3.org/2000/svg"><g fill="none"><path d="M79.039 7.346c0 1.784-.449 3.186-1.346 4.206-.897 1.021-2.152 1.532-3.767 1.532-1.641 0-2.905-.505-3.791-1.513-.887-1.008-1.335-2.422-1.346-4.24 0-1.815.449-3.221 1.346-4.22.897-1 2.165-1.498 3.805-1.496 1.6 0 2.85.507 3.748 1.523.899 1.015 1.35 2.418 1.351 4.208zm-8.88 0c0 1.51.32 2.654.963 3.434.642.78 1.577 1.17 2.804 1.168 1.234 0 2.166-.388 2.796-1.165.63-.777.945-1.923.947-3.437 0-1.498-.314-2.634-.942-3.41-.627-.774-1.557-1.163-2.787-1.164-1.235 0-2.173.39-2.815 1.17-.642.78-.964 1.915-.964 3.404h-.002zm16.891 5.587V7.535c0-.68-.155-1.188-.466-1.523-.31-.336-.795-.504-1.455-.504-.874 0-1.514.236-1.922.708-.407.472-.61 1.251-.61 2.339v4.378h-1.265V4.575h1.028l.204 1.143h.062a2.583 2.583 0 011.076-.955 3.541 3.541 0 011.564-.339c1.006 0 1.763.242 2.271.727.508.484.762 1.26.762 2.327v5.455H87.05zm7.392.151c-1.234 0-2.208-.376-2.922-1.128-.714-.752-1.073-1.796-1.077-3.132 0-1.346.332-2.415.996-3.

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	310
Entropy (8bit):	5.060343257111954
Encrypted:	false
SSDEEP:	6:tI9mc4slzc3AuXMtfpTHXZLhUb+IK0E2zQdjdW0d8IPrHo5E:t4C3AuXM3THX1i6Pn98Iro5E
MD5:	54E65CE79D9B0B4FBF4E6932FB8F56FE
SHA1:	90EEC9CE63ECE1EB4AE22661B85C5B8F62157432
SHA-256:	823BF46FABE1829714E7FB1E180653112BB906C4651E5DADEC65839C142574C3
SHA-512:	D98A6786E725A66C5A7718F94888E9136314861C27B0C2F485BC38E80CB6ACCF247FD32F65959E67F8C0943AFE8FCD8E3ABB2B7B2FAC9F1CD8102E6F8D38CD16
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/p44dgy15/logo-windows-light-gray-xs.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M6.378 7.576H.971V3.294l5.407-.855v5.137ZM15.03 7.576H7.458V2.277l7.57-1.19v6.49ZM6.378 8.658H.971v4.283l5.407.854V8.658ZM15.03 8.658H7.458v5.299l7.57 1.19v-6.49Z" clip-rule="evenodd"/></svg>

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39014)
Category:	downloaded
Size (bytes):	39367
Entropy (8bit):	5.452591923910293
Encrypted:	false
SSDEEP:	768:xjRRqRH4ahLCk8agRR/xoCLMuriCRQTAqCCV84jgcZ:Zwj7JA/xeR8qCM84jgu
MD5:	454CCCDF284DBE3804C88F4794BB6520
SHA1:	CEF272F3FBF9146EF55A41526B3CE360AB2862F4
SHA-256:	FBDBB8D3062DC8976D063895F056704E513D0E34B755CB93E976253E1D2EBD17
SHA-512:	50764265C5BC2C974FB65914945EF982F9D275E6D58FB3CB528995D1D6D227BF48310C3F8B8DE4ED658B96A4B380F3C56419DAD403E5FA4AB4FA3D89F366E478
Malicious:	false
URL:	https://www.mczbf.com/tags/563151391133/tag.js
Preview:	var CJApi;!function(){"use strict";var e={885:function(e,t){var n=this&&this.__assign\|\|function(){return n=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},n.apply(this,arguments)};Object.defineProperty(t,"__esModule",{value:!0}),t.config=void 0;var r={policyApiUrl:"https://www.sjwoe.com/policy"},o=function(){try{return r}catch(e){return r}}();t.config=n(n({},o),{version:"d8f116245"})},375:function(e,t,n){Object.defineProperty(t,"__esModule",{value:!0}),t.consentForAdvertiser=void 0;var r,o=n(232),i=n(569),a=n(357),c="cjConsent";function s(e){var t=function(e){return"Y"==e};if(new RegExp("\\d+\\\|[YN]\\\|[YN0]\\\|[YN]\\\|\\d+").test(e)){var n=e.split("\|");return{version:n[0],isInGdprZone:t(n[1]),dtmConsent:n[2],isInterimPeriod:t(n[3]),loyaltyExpiration:n[4]}}}function u(e){return atob(decodeURIComponent(e))}function l(e){return encodeURI(btoa((n=function(e){return e?"Y":"N"},"".c

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, datetime=2023:09:14 14:39:52], baseline, precision 8, 1560x590, components 3
Category:	dropped
Size (bytes):	100691
Entropy (8bit):	7.918200234690059
Encrypted:	false
SSDEEP:	3072:ZjDVbXCR/h5wWQGy3r3qF0urUjYje2VP2Ff:hJqtQx7qF0qUcjFP0
MD5:	49681CCDAFD35D56F0DC166B41CF8FB2
SHA1:	1F8157DD8B5A78236480340B8EF8E4F223D90264
SHA-256:	4F106F4739AFE6B4DEF291950A7EBD12C2F5AA8D78ED6151CB2157400CB5B674
SHA-512:	EFC22FAAF4F253D7C0157F8B6C835AFC2EB53B303991527B27D5AC1C4F07F181075B75AF0C8206F394C1E14DAC4DCFCBC621B88200781BB0A184A2B93571FCFE
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM.*.................J...........R.(...........2.........Z.i.........n.......H.......H....2023:09:14 14:39:52....................................N.........Ahttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.5.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmp:ModifyDate="2023-09-14T14:39:52+02:00" xmp:MetadataDate="2023-09-14T14:39:52+02:00"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="produced" stEvt:softwareAgent="Affinity Photo 1.10.5" stEvt:when="2023-09-14T14:39:52+02:00"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	553
Entropy (8bit):	5.562776427382384
Encrypted:	false
SSDEEP:	12:ZHJYYqd/FqCHmdjCBJiFa61kwSEGMdGubBcXhtzor:8Yqd/FqHUJiFa61WMPcRtEr
MD5:	43D189065B48EA6EBA546BB31DD91950
SHA1:	022D35F8810E4AD1DC4B566683644380090DFE41
SHA-256:	FA968E1D96E32BE3B7E907F7439C552126A0B396B769407F0D43AA12CC981FDC
SHA-512:	C0EA6FDD50CF14BF6A73339A069C6789B1F90FD6B66762313457E5381DB1D2B10B419A096CAA9F394C176B86679383EEB7D774E2D0FE574BA7F64DC15C7C4C99
Malicious:	false
URL:	https://www.ccleaner.com/en-us/api/site/settings
Preview:	{.. "business": {.. "enabled": true,.. "endpoint": "/api/site/business",.. "cookieExpiry": 90.. },.. "contentTimeout": 350,.. "referrals": {.. "rpList": "Ww0KICAgIHsNCiAgICAgICAgImZyaWVuZGx5TmFtZSI6ICJDb21taXNzaW9uIEp1bmN0aW9uIiwNCiAgICAgICAgImFiYnIiOiAiY2oiLA0KICAgICAgICAiSUQiOiAiQ2djT0F3b0RCdzAiLA0KICAgICAgICAicXVlcnlTdHJpbmdQYXJhbWV0ZXJOYW1lIjogInNvdXJjZSIsDQogICAgICAgICJwYXNzdGhyb3VnaFFTIjogImNqZXZlbnQiLA0KICAgICAgICAiY29va2llRXhwaXJ5IjogNDUsDQogICAgICAgICJ4U291cmNlVmFsdWUiOiA5MDENCiAgICB9DQpd".. },.. "platform": "windows"..}

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2066
Entropy (8bit):	4.669613400366005
Encrypted:	false
SSDEEP:	48:6zxcS8z87YASeOCNFUffCF6SBZoBmVgbRYRhdrOh8:GxhM87BSYDUfUR0Khdrs8
MD5:	79059363FE2E3B9261A274B809BCF175
SHA1:	F2B9756CEB97D8E510C8244F46F7338A840F34B4
SHA-256:	D67519701A6730486CA33DB5FAAEF03ACD180871130A4426DFAA1FC88CBAFD3C
SHA-512:	24FCB22BDC388BF8B750E6DB5778606158F2DE233B193CAA61A2C328CE24D197075928D54F68CF8809FDDFA92CA05A32D00234DE31251ADC9A1EFCF20C723728
Malicious:	false
Preview:	{.. "advertisement-image": "https://cdn-production.ccleaner.com/site/mumonrut/ccleaner-v2-ad-new.png",.. "advertisement-link": "/ccleaner/download/standard",.. "advertisement-image-alt": "Download",.. "article__related-title": "Related Articles",.. "category--all-text": "All",.. "category--aria-label": "Show category",.. "back-to-top": "Back to top",.. "load-more": "Load more",.. "load-more-button-text": "Load more",.. "load-more-loading-text": "Loading...",.. "main-heading": "Knowledge Center",.. "most-popular-posts": "Most popular",.. "read-more": "Read more",.. "search__no-results": "No results found for",.. "search__placeholder": "Search the knowledge center...",.. "search__reset-title": "Reset",.. "search__searching-for": "Searching for",.. "socials-heading": "Follow us on:",.. "socials--share-facebook": "Share on Facebook",.. "socials--share-linkedin": "Share on Linkedin",.. "socials--share-twitter": "Share on Twitter",.. "newsletter-heading--wide": "Subscri

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32067)
Category:	downloaded
Size (bytes):	81498
Entropy (8bit):	5.419516878705438
Encrypted:	false
SSDEEP:	1536:MZVMbRJN4CoVUTM2ua1OM7CfsGmIZQx5pgLo+oNbH:MaJMYOMuLZQ2LOr
MD5:	A06719DB9D1EF730D55A917FBA5C529D
SHA1:	C9F0C3FFED5225AF8270D096DB66CE6A885CC372
SHA-256:	0919C44FF88E6C03D3C0E89B7EFA6934005D1418103052036E6322A3EDFCBA5D
SHA-512:	67D21371E946DBA17ECB8FC7666466D6F7AFE2E3CF648E2F90362D7CC6B64BAA28229EBB42F20C9C182F8AB4C344A195FA0DF8B9B33931DB0A76209025ACA83F
Malicious:	false
URL:	https://www.nortonlifelock.com/content/dam/norton-adobe-analytics/prod/s_code_norton_min.js
Preview:	/! Norton - v1.0.2 - 2024-02-06 /function s_doPlugins(a){var b=a.linkURL;if(void 0!==typeof a.linkType&&"d"==a.linkType&&"string"==typeof b){a.events="event1";var c=b.split("/"),d=c[c.length-1],e=d.substr(d.lastIndexOf(".")+1).toLowerCase();a.eVar1="D=c33",a.prop33=b,a.prop46=e,a.prop47="download",a.prop48=d,a.eVar49="D=c48",a.linkTrackVars="events,prop2,prop33,prop41,prop46,prop47,prop48,prop49,prop59,eVar1,eVar18,eVar27,eVar41,eVar48,eVar49,eVar59",a.linkTrackEvents="event1"}else void 0!==typeof a.linkType&&"e"==a.linkType&&(a.linkTrackVars="None",a.linkTrackEvents="None");a.eVar47="s_code_norton "+s_code_file_modified_date,a.prop21=a.getQueryParam("inid"),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"inid")&&(a.prop21=nortonAnalytics.inid),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"store_inid")&&(a.prop21=nortonAnalytics.store_inid),a.eVar21="D=c21",a.prop35="D=pageName",a.prop21&&(a.prop35="> "+a.prop21+" "+a.pageName),a.prop22=a.getQueryParam("om_em_cid"),a.prop

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25771), with no line terminators
Category:	downloaded
Size (bytes):	25771
Entropy (8bit):	5.420876085083537
Encrypted:	false
SSDEEP:	384:1vsFf7+nkKo0lyOdG310BOcLeh7sHy4aYIx01Lb5tV6Ua2Mp/XOwQK70oPgFNDCZ:1G+nkKhV6UYZNmynbmgJ
MD5:	3DFEC5817F6E0595CD1AAA12EDD8807B
SHA1:	F0405B20EA0943D60D64C73BBB5CE8321901BDC9
SHA-256:	13E8E4759BA2D94687C897BCB1CE30A40BD520ED2AA3E3A010B2458EEA0886C7
SHA-512:	C7DD41CACFBF503A66069EAB9D47C8F61CDF3ABF2D3A0A698851DC88A63044195248F96594BEB0C8C1184ECD4941A03CD106DFDAC97E8B1A6697556A5D3F6F34
Malicious:	false
URL:	https://amplify.outbrain.com/cp/obtp.js
Preview:	(()=>{"use strict";var e={865:(e,t)=>{var n,r;t.__esModule=!0,t.LOG_TYPES=t.CONTENT_TYPE=t.Zone=t.GDPR_PURPOSE_CONSENTS=t.HAS_CONSENT_EVENT=t.VERSION=void 0,t.VERSION="2.0.5",t.HAS_CONSENT_EVENT="has_concent_event",t.GDPR_PURPOSE_CONSENTS=[1,3,4],(r=t.Zone\|\|(t.Zone={})).Default="all",r.EuZone1="euZone1",r.EuZone2="euZone2",(t.CONTENT_TYPE\|\|(t.CONTENT_TYPE={})).Product="product",(n=t.LOG_TYPES\|\|(t.LOG_TYPES={})).Log="log",n.Warning="warning",n.Info="info",n.Error="error"},920:(e,t,n)=>{t.__esModule=!0;var r=n(865);t.default={zone:r.Zone.Default}},778:(e,t)=>{t.__esModule=!0,t.SEND_BEACON_SUPPORT=t.VERSION_NAME=t.API_NAME=t.GDPR_CALL_ID=t.GDPR_VENDOR_NAME=t.GDPR_VENDOR_ID=t.DOMAIN_URL_PARAMETER_NAME=t.NO_CLICK_ID_COOKIE_NAME=t.VARIATIONS_COOKIE_NAME=t.CLICK_ID_COOKIE_NAME=t.CLICK_ID_URL_PARAM=t.CLICK_ID_PIXEL_URL_PARAM=t.PAGE_VIEW_NAME=t.BASE_URL=void 0,t.BASE_URL="//tr.outbrain.com",t.PAGE_VIEW_NAME="PAGE_VIEW",t.CLICK_ID_PIXEL_URL_PARAM="ob_click_id",t.CLICK_ID_URL_PARAM="dicbo",t.CLIC

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1051
Entropy (8bit):	4.286554923851383
Encrypted:	false
SSDEEP:	24:t4C3AuXMe0N8nIT4N9eNwXsbN/DUxKMxmADUkjxd87ijKVdE:L0OIT4DeNwXsdDKnx7Z8CKVG
MD5:	9A73A94C1F4F2E530DD32250653E7B6E
SHA1:	D6D90C5DA9F194E6BEF9770FA93EAC6DCA84FED0
SHA-256:	A348985C7B282B773C2CDD47685D896DFC25E2663EDDC23591A45329482E8CCC
SHA-512:	8EC050F08E0DE2181D22E17D30A18EFEB2041152694F8028BE890787C18C2AB0CEA22105B55E699EC286F54F80D0C108A795D22030F5BAB61A591825CDF3FCCA
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/5xfpxle5/logo-apple-light-gray-xs.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M12.962 13.373c-.3.46-.629.86-.986 1.2-.358.34-.773.51-1.246.51s-.865-.082-1.177-.246c-.31-.165-.732-.247-1.263-.247-.53 0-.957.082-1.28.247a2.8 2.8 0 0 1-1.142.28c-.484 0-.917-.181-1.297-.543a6.853 6.853 0 0 1-1.021-1.235c-.67-.921-1.142-2.045-1.419-3.373-.277-1.327-.115-2.561.485-3.702A4.048 4.048 0 0 1 3.93 4.997a3.304 3.304 0 0 1 1.73-.478c.485.022.935.121 1.35.297.415.175.773.274 1.073.296.3-.022.698-.137 1.194-.346a3.832 3.832 0 0 1 1.643-.28c.254 0 .646.083 1.177.247.53.165 1.026.543 1.488 1.136-.093.022-.364.252-.813.69-.45.44-.71 1.098-.779 1.976.092 1.053.427 1.793 1.003 2.221.577.428.912.642 1.004.642-.023.044-.115.258-.277.642-.161.384-.415.828-.761 1.333ZM8.653 1.72a2.73 2.73 0 0 1 .859-.776c.339-.195.664-.304.974-.327.04.437-.005.856-.13 1.258a4.26 4.26 0 0 1-.51 1.087c-.213.322-.485.58-.815.776a1.74 1.74 0 0 1-1.018.258 3.05 3.05 0 0 1 .145-1.258c.136-.4

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7948
Entropy (8bit):	7.968102529108477
Encrypted:	false
SSDEEP:	192:+SrA67oWTbzAw53o7FbiGNtN3hzLe4LsfGEdeLeq0QS:hrA0zTYw5i7Nxe9fGEdgeqnS
MD5:	7E6798C8A2D14A57D8C0DB47929CD87A
SHA1:	ED1DBD5DD9EF14888B4FDC61C041172A019457E2
SHA-256:	D5BFF63909130BB81DB1176AD4F8B9167F4681A075C88FCE621621E196D51E7E
SHA-512:	E11F3F9E70F724EEA1AA66DC2B1E84F5BBCB7B0D25D28A67D602088E0FC0E96A9612AD9583D18909479FC0D9B4269C1FD6B348592FC9937B2C76C0FFDCDF3A53
Malicious:	false
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a.....IDATx..\..\U......;Kg#d..Y .@....T..#qdF..a...GG.Fq.......,z...G..Q.....P.....Y!Ig..twz......~_U5../............]....\|...dr5.W..h.....s.....2.F.0.+....F..X...#YX..B.t:}.. .>..N.....(.j@...J...7.x.or. .~.....7..7........\|.<.C2......Rf...0.?.2.W.t.s.P..X...Xq..R......t..(.7]....5..#C...@...u..WJ..m..q./N@.h...."..48q...h%.Zb...9.X..K.m.......(.... ....0P.`..0....P,.WC...Jw$b.p .f...?G...!.B;5.h&@b.$y.p....r....M..T.h..... .4...,&.K@0/..........v...7..T.q.8..&...5...Hp!d@B+.......2-...+...YX...0..1.9...O_E1..U....Y.....@=/......8..l......L.Gp%i+@Kh......;.......h.$...e..7..L....V.&....p.1..b..S........J@..x'. j..+@..!..B...ke./......1.U.O._...)..!..+....8..0..j..F....s...,..^....?........[.%....O.'\.2.....4o.....s..lC.......P..G-.......^...\.=..;........m.j7.....J].E`*..!...........L.J..:.p.M%....jM......`q 2-..><.{........z...............36....j.@S....}Z...}...

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.7733829146247215
Encrypted:	false
SSDEEP:	3:H+uZj5zAoiEnkcOzciC0U:euZHnEbU
MD5:	A38E5C406C6225F2C792D2F7E1459696
SHA1:	ABD69D8EE3DD0B2E920E68BA5FE6EC12C3D59564
SHA-256:	421239E617B7693DF88D703D3D0993E8471B3C9C108A16F468B220D5EDE7A510
SHA-512:	B9DA4ADB0F68B3AE3307C9D20E4B02F41F32DF8A4DB5DA7E9B45DEC2DEF29685A62E4E03700EF4C9596C10CABEA5B1ED3BBDA5C3DE99BE8D76AD499FCA9ACD06
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAl7EsNtZYPFCxIFDZFhlU4SHgmEJAjRszrNfRIFDZRU-s8SBQ2DqFs9EgUNVTtNxg==?alt=proto
Preview:	CgkKBw2RYZVOGgAKIwoHDZRU+s8aAAoLDYOoWz0aBAgJGAEKCw1VO03GGgQICRgB

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64347)
Category:	downloaded
Size (bytes):	219515
Entropy (8bit):	5.455302043125117
Encrypted:	false
SSDEEP:	3072:9K4F6tZfFFncVuh90bteuvQ+AMPpgArl0xYu5G5nYt9:9KQGZtOK90bvQQGArHu5G5nYz
MD5:	C9893A1B94F50E820983FC282F989A10
SHA1:	8E9832465171164D449B1D78803D98CC2AAFE732
SHA-256:	0E04153B5F73BFA7866948F2A9870593D69BFDE14E77A1A06AF5F567096E5A09
SHA-512:	ECF5439801ACB395BD9E162C387EC286D84E8EED59687DD9B2E90C6443420EFACDBDE56A3ECB0AE4B818F3C11180A37992F7C738AB87021BCF2DE77C5458A65B
Malicious:	false
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	123729
Entropy (8bit):	5.265922715765138
Encrypted:	false
SSDEEP:	1536:/BHi77oJ1xEPg2FuN/couhglkqKg8/Ev01L3Inhxrmc9NyB+01b50:/BwUwPxA/pETqx6Es1LInfrmc9+h9O
MD5:	8FDEF0C1E8850D0C97DDA608F0BF891C
SHA1:	3A35526C86D5ECA2CC1CA5BFE47D4F00A7F0EF30
SHA-256:	0830994C5C05693539A9D8BCD3649A3B5F2AAC58A9845D16F495BD53C5811F80
SHA-512:	E8120C3B85C8E7FEC25589A98F0C00A54B77840717B842B7E9AC78B6B3CEE180C57F7471BC2A30A3AC97E7BF8878432E1A39F9F15FF5DED436C7EA1DD5EC2310
Malicious:	false
URL:	https://www.ccleaner.com/scripts/vendor/vue.global.prod.min-3.2.21.js?v=1.0.95
Preview:	var Vue=function(o){"use strict";function e(e,t){const n=Object.create(null),o=e.split(",");for(let e=0;e<o.length;e++)n[o[e]]=!0;return t?e=>!!n[e.toLowerCase()]:e=>!!n[e]}const n=e("Infinity,undefined,NaN,isFinite,isNaN,parseFloat,parseInt,decodeURI,decodeURIComponent,encodeURI,encodeURIComponent,Math,Number,Date,Array,Object,Boolean,String,RegExp,Map,Set,JSON,Intl,BigInt"),d=e("itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly");function h(e){return!!e\|\|""===e}function l(t){if(J(t)){const r={};for(let e=0;e<t.length;e++){var n=t[e],o=($(n)?s:l)(n);if(o)for(const t in o)r[t]=o[t]}return r}return $(t)\|\|Z(t)?t:void 0}const t=/;(?![^(]*\))/g,r=/:(.+)/;function s(e){const n={};return e.split(t).forEach(e=>{if(e){const t=e.split(r);1<t.length&&(n[t[0].trim()]=t[1].trim())}}),n}function c(t){let n="";if($(t))n=t;else if(J(t))for(let e=0;e<t.length;e++){var o=c(t[e]);o&&(n+=o+" ")}else if(Z(t))for(const e in t)t[e]&&(n+=e+" ");return n.trim()}const i=e("html,body,b

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45850)
Category:	downloaded
Size (bytes):	521072
Entropy (8bit):	5.369200579015766
Encrypted:	false
SSDEEP:	6144:8Ne0KB/4vvkqOddSthrPLXoAfZ8fOiplrIaNkPND:8N+mvsnkhDHfiplrBs
MD5:	C2B256D621248D83AE65EB0ABF415721
SHA1:	2D453A5EE34C1FEDD229AF910D80AF09933E73C6
SHA-256:	CB46CDCBDE0687FB44FAE21D8ED264421F3CE7B93F39575F58CD2C4102C4A553
SHA-512:	ACA533EFC91F64E38239B5C62037B2CE9E4DF1DAFA393D503D84FDEBBE7C91DED91B6D2AAA38511FA49AF8EA4B95ACB2F0F60F76A5D324FEF1DD6C2CF646B3F2
Malicious:	false
URL:	https://www.ccleaner.com/dist/uiv1/apiary-legacy-native.iife.js?v=1.0.95
Preview:	var __defProp=Object.defineProperty,__publicField=(e,t,i)=>(((e,t,i)=>{t in e?__defProp(e,t,{enumerable:!0,configurable:!0,writable:!0,value:i}):e[t]=i})(e,"symbol"!=typeof t?t+"":t,i),i);!function(e){var t="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function i(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var n,r,s,o,a,l={exports:{}};n=l,r="undefined"==typeof window?t:window,o=function(e){if("object"!=typeof e.document)throw new Error("Cookies.js requires a `window` with a `document` object");var t=function(e,i,n){return 1===arguments.length?t.get(e):t.set(e,i,n)};return t._document=e.document,t._cacheKeyPrefix="cookey.",t._maxExpireDate=new Date("Fri, 31 Dec 9999 23:59:59 UTC"),t.defaults={path:"/",secure:!1},t.get=function(e){t._cachedDocumentCookie!==t._document.cookie&&t._renewCache();var i=t._cache[t._cacheKeyPrefix+e];return i===s?s:decode

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, datetime=2023:09:14 14:42:07], baseline, precision 8, 1560x590, components 3
Category:	downloaded
Size (bytes):	189654
Entropy (8bit):	7.956839893692659
Encrypted:	false
SSDEEP:	3072:xKLwM6aotF1LJ4adVuduLvf4L8E4Zzm84hMUD9UPBxRXifULwBxWsNKdStz2:ILwMlotl48VZLvgrHBUPVXKwUxeQq
MD5:	7463C42374B647EE3C53DE7DA25B575B
SHA1:	83987881FCFF3352FE07A1F6FB7C1B60E4879002
SHA-256:	7EF8BBD2F5B6BAA1EBAF5F66CC6D0B05D1D56BF74E4C85C028FBC584347CEDDB
SHA-512:	76113539EC0B45865A0DE5F4216E3888F48DB49A7586A1865BD12B62435A20DC12E26000C98DA712649FE7393743644C564C50C63E8190E5F3E64A6D7391AFEA
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/obshxfhv/how-to-start-windows-in-safe-mode-thumb.jpg
Preview:	......JFIF.....H.H......Exif..MM.*.................J...........R.(...........2.........Z.i.........n.......H.......H....2023:09:14 14:42:07....................................N.........Ahttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.5.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmp:ModifyDate="2023-09-14T14:42:07+02:00" xmp:MetadataDate="2023-09-14T14:42:07+02:00"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="produced" stEvt:softwareAgent="Affinity Photo 1.10.5" stEvt:when="2023-09-14T14:42:07+02:00"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4150)
Category:	downloaded
Size (bytes):	69025
Entropy (8bit):	5.380172304849613
Encrypted:	false
SSDEEP:	1536:RJeURT76HXz6nHM9rEqJ1JJnTZ02LKVlEy7Ejk:R5T7OXens9rZdtj8ltZ
MD5:	9563F4819868C8F17EF9BD73ACF8273F
SHA1:	67891EF4BB3469DAA8F0AC39D55B96D9600A1215
SHA-256:	8C2281D0338AF704260CDE453E3A70E8C3FD028E71EECD1861439054D4BEE310
SHA-512:	1B5836DB64612F233A223983A95D7493735547DDDA03F690AD1034D341A76B9DEDE5A9B0CB4C5A139C896E3B4292AD85C84F4C152C488AC24274FEF1C146A5B9
Malicious:	false
URL:	https://connect.facebook.net/signals/config/2679475345708101?v=2.9.147&r=stable&domain=www.ccleaner.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x38, components 3
Category:	downloaded
Size (bytes):	6488
Entropy (8bit):	7.851768898963181
Encrypted:	false
SSDEEP:	96:l2flVpsXS/jAGMe/Qa41Y4O/tssnfdJvYvDoHdl4mG8JD97L3LKQszcYwdBx:MCXCjn3QRWiv0n7zWwrdBx
MD5:	21F472010B9CDD8C4F035FE0DC10D3E4
SHA1:	17D1E45849A5FD40F3722E3ACADDE9BFF1D61C96
SHA-256:	B669C1B37255A5C966BDDD14DADF96D97AEFACB148AF4680172DA4D097E93D40
SHA-512:	7BF4289370620B2B8164A5D48D0AFCC7DCE5B5610AAD8EBAFE00A9CB40AB96374418541C1E43D9FC5225115CD0FB4E12BC5F1AE77C46EAEB4AB3E1E7C41F13E1
Malicious:	false
URL:	https://s1.pir.fm/pf/logos--DA8LAgMPCAQ/ccleaner-logo--small.jpg
Preview:	......Exif..II*.................Ducky.......d.....1http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:43816D83D11A11E7A7B4C512885C8C2E" xmpMM:DocumentID="xmp.did:43816D84D11A11E7A7B4C512885C8C2E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:43816D81D11A11E7A7B4C512885C8C2E" stRef:documentID="xmp.did:43816D82D11A11E7A7B4C512885C8C2E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................................................................................................

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (59815)
Category:	downloaded
Size (bytes):	585908
Entropy (8bit):	5.3682748848533866
Encrypted:	false
SSDEEP:	6144:C2xaBG9dwDyOZma1KEr1sskmeRbizSIOvbddi0sottmOlMGVKf+WOgYYUYY32b2Q:CfBudwDQgQBVKffV2Q
MD5:	29ADDD1129BBB469259F48CB8821AFD9
SHA1:	5F8F1C1A0BEA33705B94F19ABAEECBBF9D4B3F7C
SHA-256:	393F8D0309C85E66DD5BA55EEA9FF8F1DEBCBB5011415FBD4DFAC2287661BB23
SHA-512:	49C2F1706A41B9A79E5C74C184301E6BFF36C86B1F54C75C6F318C64247538FB8E2E904D3268C1B65C4B61C0B1F3A540C80B4E49617A647CA6D0C54A2FA5D337
Malicious:	false
URL:	https://www.ccleaner.com/dist/uiv1/apiary-legacy-vue.iife.js?v=1.0.95
Preview:	var __defProp=Object.defineProperty,__publicField=(e,t,n)=>(((e,t,n)=>{t in e?__defProp(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n})(e,"symbol"!=typeof t?t+"":t,n),n);!function(e){const t={"data-behavior":"vue-component","data-componentname":"knowledge-cta",class:"text-center mb--md"},n=["href"],r={class:"cta"},a=["src","alt"];const o=(e,t)=>{const n=e.__vccOpts\|\|e;for(const[r,a]of t)n[r]=a;return n},i=o({name:"knowledge-cta",data:function(){return{}},computed:{content:function(){return this.$store.state.localisedContent}}},[["render",function(o,i,s,l,c,u){return e.openBlock(),e.createElementBlock("div",t,[e.createElementVNode("a",{role:"link",href:o.content["advertisement-link"]},[e.createElementVNode("div",r,[o.content["advertisement-image"]?(e.openBlock(),e.createElementBlock("img",{key:0,src:o.content["advertisement-image"],alt:o.content["advertisement-image-alt"],"data-qa-id":"knowledge__banner--advert"},null,8,a)):e.createCommentVNode("",!0)])],8,n)])}],["__s

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60295
Entropy (8bit):	5.474502986194847
Encrypted:	false
SSDEEP:	768:5sbcBWhomYYifa6pWClzuz6c18CQ3HoQqhF:5cqv7duz6c18CQXSF
MD5:	307C87905FA5D5B11953ED7F67950381
SHA1:	F900B3F5518887B44E6C565AF7F6D7CCE853DDC0
SHA-256:	B74420758DE35D9E305C4BE91525ACE39BC3961B99841AB0624834B863B7CD01
SHA-512:	E0A40C1756D9E8371B3B6AF6C4FC3814874DF7D871B0894E0E9823FD7E65CDE723E627F4C4D5CD545987768E47CE820B1DE1F360352BEF52D54488853EAD2C04
Malicious:	false
Preview:	. {. "name": "otPcCenter",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImFsZXJ0ZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvdC1wYy1kZXNjIj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGNsYXNzPSJvdC1wYy1oZWFkZXIiPjwhLS0gTG9nbyBUYWcgLS0+PGRpdiBjbGFzcz0ib3QtcGMtbG9nbyIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDb21wYW55IExvZ28iPjwvZGl2PjxidXR0b24gaWQ9ImNsb3NlLXBjLWJ0bi1oYW5kbGVyIiBjbGFzcz0ib3QtY2xvc2UtaWNvbiIgYXJpYS1sYWJlbD0iQ2xvc2UiPjwvYnV0dG9uPjwvZGl2PjwhLS0gQ2xvc2UgQnV0dG9uIC0tPjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BbGxvdyBhbGw8L2J1dHRvbj48c2VjdGlvbiBjbGFzcz0ib3Qtc2RrLXJvdyBvdC1jYXQtZ3JwIj48aDMgaWQ9Im90LWNhdGVnb3J5LXRpdGxlIj5NYW5hZ2UgQ29va2llIFByZWZlcmVuY2VzPC9oMz48ZGl2IGNsYXNzPSJvdC1wbGktaGRyIj48c3BhbiBjbGFzcz0ib3QtbGktdGl0bGUiPkNvbnNlbn

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
Category:	downloaded
Size (bytes):	15920
Entropy (8bit):	7.987786667472439
Encrypted:	false
SSDEEP:	384:sShqOXQlaSchOwK0uFvRqq3xR/xb5OY3aU/lHS9WE2YeK1os:sShJKaScJK0uFvRvxb5OY3aU/lHkmK
MD5:	3A44E06EB954B96AA043227F3534189D
SHA1:	23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
SHA-256:	B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
SHA-512:	FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......\|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.5..?.o.\|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..7.....<\|..i...{...R.M+[..\|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11231)
Category:	dropped
Size (bytes):	21866
Entropy (8bit):	4.993825454722558
Encrypted:	false
SSDEEP:	384:HRc7fQV8C0NGoFQlC2MGAVsqlXaivSYBQY2YpuMc:u9+N
MD5:	FF0B470FEA1863B7594730B1E74199AD
SHA1:	5EC5122D9CE4D25069017D202728F9A887B7DBD4
SHA-256:	74C39B5EC5A61C19FF20D81C0418FABD61D6DEB6AC0C967DA28761D6B895FF7D
SHA-512:	8D8292C31D6D34E1AECD7AAE68DE2AC6921A7807165BD71AC3FD11284A272C33B6C9ABDBCD29E5203436A2C64A69C9ECB1BF7F629A698F970F2085DFEE4F77C0
Malicious:	false
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 26736, version 1.0
Category:	downloaded
Size (bytes):	26736
Entropy (8bit):	7.992700056590475
Encrypted:	true
SSDEEP:	768:ykLQ/7ViopV5bgtwNdULiYmlMIabSd98eM:vc4of5KwjaYGSdK
MD5:	8404CFED82D322C1BE8E149FD9F40EB8
SHA1:	3E3657246DB3B889E68D520904AC294A230DB56D
SHA-256:	8F76526E440538EC1300AA89F671ACD1B746925833F7160F6C0E29443008F97F
SHA-512:	47EA700F6173773136F46BBE61563C1A7CC7314B6BE85286BE064C273927F48CC57FAD00331549316B29EC42F89BACEB5ACF456D918842F6AA54927555BCE7DB
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2
Preview:	wOF2......hp..........g...........................@..<..X?HVAR.a.`?STAT.$'..."+...\|.../V....(.%....0....6.$..6. ..~..R......pgO0..@...z.-..V....-..ed .8.... .....2F......o.lJ.U...Qax4.NyU8.+T..~r<.....Ew..)..-.......t.<.C.N.9!.z.a.S..du}2:..."..QW8.x.........-.....]p.z $../....~.M.....A[.b......i..7Mj#..dCe...m.5{..G..l...f....H....xd...#...!..~..N......s......RL........G.8Z......@....8g..4i#.$m..T......m...33v..3....U.z.^..........U..DF...pac.......j."..M....m3...7'..b.B..Eb.f$f...M_..- J..@.+0.j...\|........H,".B.......7...(.:V.D#...4...!........?U.RW...3\|..S...X.... ..=.^".K.,.h\.\.=6.I/ti.F.'..x.LW... ...C.....Lq..,.tq.W....?...`.P.....(...X........j.Z.h..`.......6..L.7_u.g.+...nn.....)J.H. :E75.......f..l=...k./....?.6...h...Au.E7.....[-$...........R`5..}3..?...z.H...B\.kVA.2T.,...2..}.Z...`...7..s.J@...... `n.`..,H....T....]j('P....Hnf3..h6.n...mQm7sg..y...CJ;3 ..H....~.)..).C.\|.E.?.Y..#H.@..H.Aa..)....O..(..*.u.._-....V_.....\..w.A

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.141565412858599
Encrypted:	false
SSDEEP:	3:RFeBBbBjjHxBAe2FYDxW8:jetdBv2Fp8
MD5:	DE3701EECB9340AE075E05B04BB05A6B
SHA1:	1262474193BC31E859367DF01C4B2B26214A375C
SHA-256:	F475C34186022BA531EBC8BBA97FC10DF7E4C3EA854F314A18AB0644C851620D
SHA-512:	4CCE11ABF10DF2640900C923B0CAC9AE1B80890F52701D5B57AB937C4752E91AEA392ED9439EE24357A6F88AC6F0F79B160A9C080F5670220C29C81B5148C69E
Malicious:	false
URL:	https://s7.addthis.com/js/300/addthis_widget.js
Preview:	// AddThis services have been deprecated as of 5/31/23.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1205
Entropy (8bit):	4.2449495025834745
Encrypted:	false
SSDEEP:	24:t4C3AuXM9X85jNU8VYbirKp1UH8VkKUH8ceO+ld2zLfI3UufE:Y85HVbKL+8EHpeO+lIzk3U5
MD5:	D52B88BAD39F249E017B4CD4163FE16D
SHA1:	FC68751B7183A2B4894D74254FA9187CD6097368
SHA-256:	8BD92DC59083E637FA86BFEF195C727BD7418F21DD69A211480DEEA3FE165CC0
SHA-512:	2C922EDCC7ED8E18093C506D0D2415BA620B101BCC829886D305E5D4F7586FABBE9783DFC708B9B0B5ADBB2B85564DF7C6338D0BF1CC8BCF24B51BCDE438A81F
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/0d2h3li0/logo-android-light-gray-xs.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="17" fill="none"><path fill="#C9C9C9" fill-rule="evenodd" d="M9.25 3.117a.29.29 0 0 1 .179.069.228.228 0 0 1 .069.18.244.244 0 0 1-.085.181.226.226 0 0 1-.179.07.196.196 0 0 1-.165-.084.228.228 0 0 1-.07-.18.18.18 0 0 1 .071-.167.261.261 0 0 1 .18-.07Zm-2.82.07c.05.05.076.122.069.194a.198.198 0 0 1-.083.166.227.227 0 0 1-.18.07.197.197 0 0 1-.166-.084.229.229 0 0 1-.07-.18.224.224 0 0 1 .084-.181.296.296 0 0 1 .166-.055c.066.002.13.026.18.07Zm5.069 1.93h-7.5a3.608 3.608 0 0 1 1.11-2.514c.227-.205.472-.39.732-.552L5.084.895a.194.194 0 0 1 .049-.253.196.196 0 0 1 .252.05s.76 1.158.76 1.182a3.888 3.888 0 0 1 1.617-.352 3.582 3.582 0 0 1 1.641.377C9.4 1.872 10.16.694 10.16.694a.196.196 0 0 1 .253-.05c.077.06.099.167.05.251L9.706 2.05c.258.154.496.34.707.553A3.642 3.642 0 0 1 11.5 5.117Zm-8.749.5a.75.75 0 0 0-.75.75v4a.75.75 0 0 0 1.5 0v-4a.75.75 0 0 0-.75-.75Zm9.25.75a.75.75 0 0 1 1.5 0v4a.75.75 0 0 1-1.5 0v-4Zm-.501-.75h-7.5v3.24c0

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6552
Entropy (8bit):	4.710790111908242
Encrypted:	false
SSDEEP:	96:f7OMRKY4Udy7YI6khfWqsFRx4U85uH3I6khfWUdcdGnRlKQ/4UdyUOjI6khfp:SIKiylhfPsLN4hfdcERYSy+hfp
MD5:	C4CBEC34CED00EFC322A019813DE6A32
SHA1:	FF0E3351E520F7E4C471EBDBAF607367988D8F30
SHA-256:	7CFA698EC64018DFA12B1AF46DE8533A331B325DAB2D5949774226526ED4C235
SHA-512:	0DB53D2B2A272ADBFF8FADC5E8019106E161AE72F42898F3D81116D2409609703360F9E9DEECC8BADDD09180A4F317C6C7B826758EBD3C964F8E706EAE02CC5D
Malicious:	false
URL:	https://www.ccleaner.com/en-us/api/knowledge/related-articles?guid=1b822ab0-17c0-4d49-88b6-24186f4dd904
Preview:	{.. "posts": [.. {.. "id": "5972295e-d753-41bd-a5c6-6f83d5afbffc",.. "title": "How to check what version of Windows you have ",.. "url": "/knowledge/how-to-check-what-version-of-windows-you-have",.. "listing_image": "https://cdn-production.ccleaner.com/site/qoron0kq/how-to-check-windows-version-thumb.jpg",.. "detail_image": "https://cdn-production.ccleaner.com/site/yugpuylu/how-to-check-windows-version-detail.jpg",.. "display_date": "29th January 2024",.. "categories": [.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "home-computing",.. "name": "Home Computing",.. "url": "/knowledge?c=home-computing".. },.. {.. "id": "security-and-productivity",.. "name": "Security & Productivity",.. "url": "/knowledge?c=security-and-productivity".. }.. ],.. "content": "<p>Learn how to

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x132, components 3
Category:	downloaded
Size (bytes):	9878
Entropy (8bit):	7.9403680892771185
Encrypted:	false
SSDEEP:	192:Q6PcNYBV4lgfBo9LAuRU8hT7ut5lmgAVABpYvhKzzAS:Q6PWYLLfOLAui8hXHGDVIS
MD5:	7895CB1F002CBE6FEFE3535878A3D9C3
SHA1:	9BEC6812D6B968CF4BBCE4CCDE8F0A969DE6BE74
SHA-256:	B8F3F81E29101C6A7EAB759A4A681298F3DDA8A99CB2459B32C40EE658E0D720
SHA-512:	7D176C21C83AC715C7BCAE0C16CC4989834F0C1CC1FED02FF2FF88B937282D27957129FFF9ED1CA66971985A2870716A68071DA2CF83522545D9657404705849
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/cafopxlb/blog-author-alex.jpg
Preview:	......Exif..II.................Ducky.......U......Adobe.d.................................................................................................................................................................................................................................................!..1...AQ".a2#.q.....B3$.Rb.....r.C.%E).......................!1...AQ.".aq.2.B#......3C$.............?..s.ZMi..8.....&Q.COm...m_D..`.d2.T.R..l..<..)s(e..Q.N."X....n.KvaAM.R.<.p..9Q.Q.U(..[...'.'....a..C..8.IY.NV\!.c...AI&.#.~..K...'!..~.O$.Y.MVA"?.....YY.......%z..K...G.....4E...HH.t...V...m(:..1...A.]..E......?...@.S.......p.&...YC....]2....d...u...s.#.O!.ct;.W.......I.1...*Q.q....6E....2.09...Q..y....S.......$]e{..iuv.s..G(.<yVD.......ci3.\.HW.B.........P.;.5)..@.B>e..q;N_ .-.e.c.%&.9TCkXB...CiY?.t.........+....V...Vfg[.S. ..2.......f)Y.+..4vV./.BcTT...8..V.'5.Ci+...Rc..!!`...G..8.8b.'..x?.m;Lu2.d..\+J.$....i......u..Y,...t.c(...6E........!.A.}V.n...........

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:HAOfaY:gOfaY
MD5:	4C8A26E14EDABDD7D6BFBF1472AFC853
SHA1:	F268C3DB54608F753ED9320CB2411B00A40C8D65
SHA-256:	B9224CA870B658AB694ECED1FBB07A971FCE7D0C990E50046929E9968BAF435C
SHA-512:	820B85A739953E8A71E89FEB45BBFB01E2D2F8977D30B0AB11BED28A7CA2B0365595AA7074A3A9780C8DE95E0C8DE839B5C390519F5238E8435F44736CDD497F
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlcgVaXlVaJtRIFDaWTNiQ=?alt=proto
Preview:	CgkKBw2lkzYkGgA=

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1076), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	55225
Entropy (8bit):	4.136073193606977
Encrypted:	false
SSDEEP:	384:F6FkKYbPm6gAYQaC7/9rJL0LnYa/G27IDKNBey5ZO/IPwLb/2cs0Y5vNcbuGAdJo:IFGbP/guJL0zPp7IDg9wjY933J9ysK
MD5:	225D99B4A31E83E0F9659893DB8A2ABC
SHA1:	0DC661D0C606EF3FB0EE2783D80A22AD7A057A8D
SHA-256:	D687DEDF364222B56FB8CD9ABD68CA8FD29088EA9E87244A4E4B04299211C767
SHA-512:	0021AB740E1E97061F3030C7E19BF95B48D49B50A20C534164BC98FE67ABEAB4200D9F8424B05D4607BF45126086B5CBDF54020081A170FF1B1D3C044F5B0E21
Malicious:	false
URL:	https://www.ccleaner.com/knowledge/ccleaner-v6-21-10918?cv=v6-21-10918
Preview:	<!DOCTYPE html>..<html lang="en" class="no-js lang--en lang--en-us" data-id="6872" data-guid="1b822ab0-17c0-4d49-88b6-24186f4dd904" data-culture="en-us">...<head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#">.. <title>CCleaner v6.21.10918</title>..<meta name="description" content="With CCleaner v6.21, we.re introducing a new version of Software Updater, which supports more programs than ever. We.ve also expanded Driver Updater.s database, Performance Optimizer now supports Windows Store apps, and cookie cleaning is refined in Chromium browsers. " />..<meta name="keywords" content="" />..<meta charset="utf-8">..<meta http-equiv="x-ua-compatible" content="ie=edge">..<meta name="viewport" content="width=device-width,initial-scale=1">..<meta name="verify-v1" content="CL5YHvlJYGfQ8xfzQT4NsvEV8U1LSKl/CcjVhtu6fkc=">..<meta name="google-site-verification" content="ml6x5QoEjuCGEjr6qZ9blR4xB6cBhkAxJGIklPS-AUA" />..<meta name="yandex-verification" content="143f1ada0d65b688"

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (568)
Category:	downloaded
Size (bytes):	503430
Entropy (8bit):	5.708119764112345
Encrypted:	false
SSDEEP:	6144:HEYt9e4UlnQyfZLsIB74RSHywNGte2fp0YROQVZT+DSUAZqH/:Hi9fpj140SwQz0YRO+ZSj/
MD5:	3E528C5BD4E8985F914F84BC5F86DF5F
SHA1:	34104EA645A6789DD9CB58C264E20ED6855EA1DE
SHA-256:	E51E616D124133B0FB24968469097A4D311B972F78455143D940703EA0639BA6
SHA-512:	C59A1D40F649446F33FF0FF3FA9A8E997D3CFF10F968D35226BA08BB91C9013AE937460CF2DAB0888848ABE1B693D4377FBD6904E3E03360B15035A8C3E9BC97
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var C=function(){return[function(f,q,S,Z,P,X,U){return(f\|((X=[1,6,4],(f+X[1]&X[2])<X[0]&&3<=((f^17)&7))&&(this.X=S,this.N=q),X[1]))>>3\|\|(P=0,P=void 0===P?0:P,U=I[16](14,q,L[13](26,Z,S),P)),U},function(f,q,S,Z,P,X,U,b,k,E,J,K,B,n,F,c){if(1<=((f\|(F=(f-7>>3\|\|(c=q instanceof qd&&q.constructor===qd?q.N:"type_error:SafeUrl"),["T","call",0]),72))==f&&(c=u[22](26,function(r,g,m){m=["could not contact reCAPTCHA.",15,(g=[2,3,6],"recaptcha::2fa")];switch(r.N){case 1:if(!U.C)throw Error(m[0]);if(!U.X)return r.return(I[19](72,.g[0]));if("string"!==typeof X\|\|X.length!=g[2])return r.return(I[19](32,P));return u[10]((r.C=g[0],m[1]),P,U.C,r);case P:C[2

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2584
Entropy (8bit):	7.811369088836822
Encrypted:	false
SSDEEP:	48:1j1F7tbZcPeBltVuZrP2OBlkE0IrQhi0IqmdtnhFZcO4XyReEUZT:1j1JcPfZrPBWiQhiaOnhPcZUq
MD5:	4C6F3DE823F62F41D3E6FBA169EAEDC0
SHA1:	598A304E6BF43026A0893B806B11706630CE7CCB
SHA-256:	E22085101D303DF48A273F69D17393A20D3844D7E69CFDC701E4CD2D61357722
SHA-512:	82D7B8BAE72B21A280F0318EA1405F2639AA714509529B5D5FD9C9009879B435588CB6E8FD91AE03EC24B0B3818B29D3093FA054ACA77CF82599A85625DE2405
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME......-.$I.....IDATX..kp]U...{.s..<.4iH..BiKy.C.t,.. V@."...:.V..:V.?.."PF>..H}.H..).-.R.......mBn....}.s..{..-...\|.5..9..Z........u...g>..i/..kj.q.1..m...hm.....e...V.?..:.....\|b..7.bo.0.".[..E.8.Xk.ugH...cE....u)...v?...._......m.........P...T..\Y.-.....cE]X...3..0....5......&.&?...{.....T.u.W.>......%..f.]....~zY.H.m...p.3@._D.{.v..P,.&..`.%..p#.V....b....+...Y...p.............["@.D`C`c .F...K.8..qN$.C.&....`..$..Un...^0oe}9......... .....}OB..C...... `./&.FS......A....1`m@...ZrE.-..-.M..'....S.l^<..w.C.c...:95+&.... ...X#v.:.....MU.....=..S...T...Kl.'{..-...X>.Q...6.b. ..k.D.YbG."tf\|....@y.-'...........l...,...<5.....4..w.......D....,.bH"t'....o...bz.z.l7I;..X-..\W.$.).e.5a<.O.....l+...\|.@.e.+.-..F..R....@H.,` .j}+:.!<ev=6.~.._.k.E...[.T%.....^.m"....~...no.......K..B..H.....L.6.....&....H./y.^I......)....j..

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8007
Entropy (8bit):	7.964007524235252
Encrypted:	false
SSDEEP:	192:+S4c9h8xu5xR6Pk9Y7wu6UUuDYWfebxWxivvN+cHZ/kbrBITCeDAYV+bH9:hQx4xR6Pk9Y7wu6U288L58xUTWd
MD5:	736D03DCC8B73579022004524E4261E8
SHA1:	0D009FFF81FA1590FE9EBA29FBFDD64A2F83D226
SHA-256:	395F457D20154F7FD6F0886480D492D3F614B21B631649912152F974A723CA49
SHA-512:	772DDF161E51A4B0ECA107E57D8E8A800D7EC570061EB1300624095AC6FA2DB38CE90ACF9A2EB94D006D5C1132D800C5D33484A5AC987092755D848ABC2578E6
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/qi5caegz/sticky-cart-ccleaner-proplus.png
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a.....IDATx..\|y.].y..[{o...%...@..HbWX......<......\|&Nb.....s..0...L<.......=.o8..6.F .%..PK.V.z.~.o....^...H.$....[....5........f/..;t]KuP?6Gp..y........PV.7.....uQg....+),. <...C.../.._^...g.P.....(..g......X,..=..u..]..]t.+.1...T..........A...1....W..D...!....]E.4....DQ...<..@.....?\|.]\|.... .8.11X..X...*2.vt...s..a..b...s..0B..1...,..8s...h.@.}.s...t..At}..<........Z.Z#D=...<E.......kp..CC.....m'.2..D]s.....Q..4g...Lp\`........... ..@}.,..i.@u.(......%.:.S#R........e..P.!..%...\..G.8..=f..........JD.DM........N... 0.DJp.........4..F..t...[...>8....ShPo...$..BMZ..05^.Q.. ....{>8..2.F:j.1..C....[K.e..z.a......t...\|.....W....W..9S........%.e.....q..S..>........+.aZt\|.B.j..dY.e..~C...(.E... ....2..j......'.v.Q......0..;`.?sO...L.g....!B..g...zt....=.B.U..6..>[\..%N...5...@.m..."...$C..u..]..x&....z..z...R....../+...9YO..t...~.M..Q.B.~.(.)..U\..%....)3nx\..........o.".E

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	25320
Entropy (8bit):	5.859135725488595
Encrypted:	false
SSDEEP:	768:vSzVKa08CXq92rqhgDji5A1jWHdTmqJi0o:vSz0Ef92rqhQjqyyHdet
MD5:	8AF764F8DE1FEAA90054ECB9DDBED251
SHA1:	5BD24065B0D4BCFF007CD1C9DEF1EF2FC39465AF
SHA-256:	99FECA634A96A742C1FB62B5D574720933E9164D9D1BA3C617F22CA87F58FA94
SHA-512:	2E9769CE9FB6714380BEB585B267A42F23483B0B40524DF364FAE425AD24938770C132DDEC668DD65E9597675625F6A0DCA9CD0830F48D91B4184618B89F23E4
Malicious:	false
URL:	https://cdn-uat.ccleaner.com/site/43khe3ys/cc-logo-inline-black-text.svg
Preview:	<svg width="125" height="36" viewBox="0 0 125 36" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="39.2628" height="35.8833" fill="url(#pattern0)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M49.9807 25.517C49.0129 25.517 48.1206 25.3365 47.3037 24.9754C46.4867 24.6143 45.7798 24.121 45.1828 23.4956C44.5858 22.8701 44.1176 22.1318 43.7783 21.2807C43.439 20.4295 43.2693 19.5204 43.2693 18.5531V18.5145C43.2693 17.5472 43.4358 16.6413 43.7689 15.7966C44.1019 14.9519 44.5701 14.2104 45.1734 13.572C45.7766 12.9337 46.493 12.4307 47.3225 12.0632C48.152 11.6957 49.0695 11.5119 50.075 11.5119C50.6782 11.5119 51.2281 11.5635 51.7245 11.6666C52.221 11.7698 52.6766 11.9149 53.0913 12.1019C53.5061 12.2889 53.8894 12.5113 54.2413 12.7693C54.5932 13.0272 54.9263 13.3109 55.2405 13.6204L53.7511 15.3807C53.2233 14.8778 52.664 14.4715 52.0733 14.162C51.4826 13.8525 50.8102 13.6978 50.0561 13.6978C49.4277 13.6978 48.8464 13.8235 48.3123 14.07

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 88, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	710
Entropy (8bit):	7.434828066703169
Encrypted:	false
SSDEEP:	12:6v/7mE/9Q9M2iBGTLlsbcvBzwRARaoc0hOHMS2j62KnvpcUl:j2QBiBQ2bcv1wEaorKU624pcUl
MD5:	15610F754CAD6A500E1840BC7A26A668
SHA1:	3D1D726E32C6A52354572FAFB3A30B2D0BAD0991
SHA-256:	F13157B878253A1EB2D2D768AE4C9A0D2AD36347240470F3AA4D979713FDA6E0
SHA-512:	80ADC11C54676CA6F147A89BB13B43BB133A142CF91AF20C99C1B28880D29FA219FF2F095BA96CE833E75DC44327EED4C714815DF03A4A25DE2DBE1B26AEED2E
Malicious:	false
Preview:	.PNG........IHDR...X...X........c....sRGB.........gAMA......a.....pHYs..........o.d...[IDATx^..k.q...O........HR......Z..EEQ.tq."t.7......$.:HG......Xu.].$...z...E.p...!.}...M.......x^....B@!..P.(.......B@!..P.(.......B@!..P.(....._#....a{......T....T...`...;..e.....<.?.;..x.7.S..d.i46..t....Tp...\<...d.f."...,C...8q..U2.H....5..`.b]w...z.Zs..w.t.u.....K^....s.kC..U&&g....2...!.o..j...5.....P.fU.B.l..G.....&...B..^...M..6....l.[......OS...G.><)..qr.b..y._<..W/..\...'G...*..K...7.....pv\.o...X.!..cMG..#{rk3......yc.C.....(C......G.8.......-0T.>....q.......B@!..P.(.......B@!..P.(.lB...o......'J5We\..0.@.4..P.(.......B@!..P.(.......B@!..P.(.......x..F.w..IE.....IEND.B`.

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	81
Entropy (8bit):	4.25597361375535
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8Ha2yOE9HjH2ZmjuJGlyRHfHyY:YGKed2pHDMnEljHMB5yY
MD5:	5AB6D4EF7207325687F427AEF8504E38
SHA1:	511316E2A7BC063A77CEDFBD7CFB906AB78C1FB2
SHA-256:	432D55B2BB99D6C152CE13DFEDA39F61570071A091BC3462FE7400583D27E09C
SHA-512:	DF155117ECBC1567FCE82520A15EF48262DEC52EA3C1F50B00B024CBB15E767B3AB9D24E99D2597686D7FDAF9B8007D9337F7A500DC914A97106C3CD57044EBB
Malicious:	false
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	5.416734184657188
Encrypted:	false
SSDEEP:	96:oglR8YEMdtqUaHHTE3R5Z/iaHHTE3RWJqlaHHTE3RDvN5hHaHHTE3Rw0naHHTE33:ogrTy8Z//TJFmv9eNpAcnqoMZrwVhvA
MD5:	37A6C1EFC76C59C01BAA12D75ACFA138
SHA1:	E0913A055850F712DE4B3739BEDB10C4F4A701D3
SHA-256:	061A7BA3BDB3274591F9C38693FF437949D5EE7E2CAE56EB4153F50010EF2B47
SHA-512:	2EF75ED51FE86477A4F1E2238EAD122388ADB13B976A04EEB880174C4C0F8BE58AD6372D6F47337E517B01BABF415FFC16AF4A9E5B7C9D08EC57B0387F1A64FC
Malicious:	false
Preview:	{.. "id": "1b822ab0-17c0-4d49-88b6-24186f4dd904",.. "title": "CCleaner v6.21.10918",.. "url": "/knowledge/ccleaner-v6-21-10918",.. "listing_image": "https://cdn-production.ccleaner.com/site/ysco1rxm/release-announce-blog-1560x590.jpg",.. "detail_image": "https://cdn-production.ccleaner.com/site/ysco1rxm/release-announce-blog-1560x590.jpg",.. "display_date": "14th February 2024",.. "categories": [.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "release-announcement",.. "name": "Release Announcements",.. "url": "/knowledge?c=release-announcement".. }.. ],.. "content": "<p><span class=\"NormalTextRun SCXW59212899 BCX0\">With CCleaner v6.21, we.re introducing a new version of Software Updater, which supports more programs than ever. We.ve also expanded Driver Updater.s database, Performance Optimizer now supports Windows Store apps, and cookie cleaning is refined in Chromium browsers.<

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	60295
Entropy (8bit):	5.474502986194847
Encrypted:	false
SSDEEP:	768:5sbcBWhomYYifa6pWClzuz6c18CQ3HoQqhF:5cqv7duz6c18CQXSF
MD5:	307C87905FA5D5B11953ED7F67950381
SHA1:	F900B3F5518887B44E6C565AF7F6D7CCE853DDC0
SHA-256:	B74420758DE35D9E305C4BE91525ACE39BC3961B99841AB0624834B863B7CD01
SHA-512:	E0A40C1756D9E8371B3B6AF6C4FC3814874DF7D871B0894E0E9823FD7E65CDE723E627F4C4D5CD545987768E47CE820B1DE1F360352BEF52D54488853EAD2C04
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/6.36.0/assets/v2/otPcCenter.json
Preview:	. {. "name": "otPcCenter",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImFsZXJ0ZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvdC1wYy1kZXNjIj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGNsYXNzPSJvdC1wYy1oZWFkZXIiPjwhLS0gTG9nbyBUYWcgLS0+PGRpdiBjbGFzcz0ib3QtcGMtbG9nbyIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDb21wYW55IExvZ28iPjwvZGl2PjxidXR0b24gaWQ9ImNsb3NlLXBjLWJ0bi1oYW5kbGVyIiBjbGFzcz0ib3QtY2xvc2UtaWNvbiIgYXJpYS1sYWJlbD0iQ2xvc2UiPjwvYnV0dG9uPjwvZGl2PjwhLS0gQ2xvc2UgQnV0dG9uIC0tPjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BbGxvdyBhbGw8L2J1dHRvbj48c2VjdGlvbiBjbGFzcz0ib3Qtc2RrLXJvdyBvdC1jYXQtZ3JwIj48aDMgaWQ9Im90LWNhdGVnb3J5LXRpdGxlIj5NYW5hZ2UgQ29va2llIFByZWZlcmVuY2VzPC9oMz48ZGl2IGNsYXNzPSJvdC1wbGktaGRyIj48c3BhbiBjbGFzcz0ib3QtbGktdGl0bGUiPkNvbnNlbn

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 88, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	972
Entropy (8bit):	7.598081682207088
Encrypted:	false
SSDEEP:	24:j3T0He44LI9+Vx/S5KF4fI9csyvTUelLBuTk5fcekr4Ml7:Lg+4484b/So4fI9VslBI/Rr4Ml7
MD5:	4B95F1FF1304B8D6EE6124308535E427
SHA1:	B9BDAB5A5FDAC2AF15B00A91294979F711A98BE1
SHA-256:	DBDEBE8A278551BD60D8A1C1322DA181B59D79ADDC168ED1C496B5D0EEEA9B7F
SHA-512:	121CEDDC1D3BCFB46BDBEA2E17CAAD43F9A23F674F2FE41800A6DBA5C24F17801F9C47E547F9327C035DE23584EED9C2CCAA9FBA03AD27D92BB014A45DBDFA6E
Malicious:	false
URL:	https://s1.pir.fm/pf/blog/linkedin.png
Preview:	.PNG........IHDR...X...X........c....sRGB.........gAMA......a.....pHYs..........o.d...aIDATx^..]HSa...9.R'.G.j..-...^..J./.J........./..6...H..."aAzQ.4...b.........0....q.....(.<;...9..4....$....Q...@!.B.......(.P...@!.B.......(.P...@!.B.......(.p.......#.6..=..].8&6n!......l.....7mO]......rdgT.F...O.nN.b.0n!...E.`6.96a"0n!.2.0Rqd.0....#....$8$.n!>..c....8...z..b....-}.)...D.....b X..u...s....!%%9?...u......Ux.?T.mk.u......x.Rd..X..a\|f...t.....E.7n!n..}.t.&.r..N....J..eK.(.W%..n.S...D.B......UN....n...`.!......N.........;....EO*..+0FY>[..u..TuQ....P(.Q,5.....I.V......,.9.=.~.P^`..W.%&........s.._.....(.......J....H.5...D.$#&...b5..&j?.<......)p...b>...;.b......Z.5..w...;Jk..?k...8..^h`..X!..n{.9.IXc.......}[20.L...aO]..LVx...oQd.Z0.L.....Eb...C.L".[.=.............."..0.L.......16.;.{a..fb.,......E....!.lm.........[C...5.B..[.......sD.....@[.hE..+.>...W..(.P...@!.B.......(.P...@!.B.......(.P...@!.$./.X.;..L....IEND.B`.

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2584
Entropy (8bit):	7.811369088836822
Encrypted:	false
SSDEEP:	48:1j1F7tbZcPeBltVuZrP2OBlkE0IrQhi0IqmdtnhFZcO4XyReEUZT:1j1JcPfZrPBWiQhiaOnhPcZUq
MD5:	4C6F3DE823F62F41D3E6FBA169EAEDC0
SHA1:	598A304E6BF43026A0893B806B11706630CE7CCB
SHA-256:	E22085101D303DF48A273F69D17393A20D3844D7E69CFDC701E4CD2D61357722
SHA-512:	82D7B8BAE72B21A280F0318EA1405F2639AA714509529B5D5FD9C9009879B435588CB6E8FD91AE03EC24B0B3818B29D3093FA054ACA77CF82599A85625DE2405
Malicious:	false
URL:	https://s1.pir.fm/pf/favicons--AwgCBwYOBQc/favicon-32x32.png
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME......-.$I.....IDATX..kp]U...{.s..<.4iH..BiKy.C.t,.. V@."...:.V..:V.?.."PF>..H}.H..).-.R.......mBn....}.s..{..-...\|.5..9..Z........u...g>..i/..kj.q.1..m...hm.....e...V.?..:.....\|b..7.bo.0.".[..E.8.Xk.ugH...cE....u)...v?...._......m.........P...T..\Y.-.....cE]X...3..0....5......&.&?...{.....T.u.W.>......%..f.]....~zY.H.m...p.3@._D.{.v..P,.&..`.%..p#.V....b....+...Y...p.............["@.D`C`c .F...K.8..qN$.C.&....`..$..Un...^0oe}9......... .....}OB..C...... `./&.FS......A....1`m@...ZrE.-..-.M..'....S.l^<..w.C.c...:95+&.... ...X#v.:.....MU.....=..S...T...Kl.'{..-...X>.Q...6.b. ..k.D.YbG."tf\|....@y.-'...........l...,...<5.....4..w.......D....,.bH"t'....o...bz.z.l7I;..X-..\W.$.).e.5a<.O.....l+...\|.@.e.+.-..F..R....@H.,` .j}+:.!<ev=6.~.._.k.E...[.T%.....^.m"....~...no.......K..B..H.....L.6.....&....H./y.^I......)....j..

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1027
Entropy (8bit):	4.379103488639966
Encrypted:	false
SSDEEP:	24:QEV5kybXk5EkXk1XkdQwSDQKXkTXksXk3XkzKvD:4yQ0qdto6YvEED
MD5:	EE48EA4B1F40513BC68866678E40FCCE
SHA1:	32155C91E2BD9FC8473FB92BDEA14B3073268113
SHA-256:	19FD78ACBD8904531A11791C4FE3537E51A8D5585F05E60858C806CCF8A61DC2
SHA-512:	D7EAEFCCC749B71087B87F16691D62D7E7483A383A6068678AC2ACE3091E5D3B6B648F4550B82347DD13847BE4D534434BE5C80E6D560DA4BCA412AF9ECB3D6F
Malicious:	false
URL:	https://www.ccleaner.com/en-us/api/knowledge/categories?guid=1b822ab0-17c0-4d49-88b6-24186f4dd904
Preview:	{.. "posts": [],.. "categories": [.. {.. "id": "office-tech",.. "name": "Office Tech",.. "url": "/knowledge?c=office-tech".. },.. {.. "id": "home-computing",.. "name": "Home Computing",.. "url": "/knowledge?c=home-computing".. },.. {.. "id": "in-the-news",.. "name": "In the News",.. "url": "/knowledge?c=in-the-news".. },.. {.. "id": "security-and-productivity",.. "name": "Security & Productivity",.. "url": "/knowledge?c=security-and-productivity".. },.. {.. "id": "ccleaner",.. "name": "CCleaner",.. "url": "/knowledge?c=ccleaner".. },.. {.. "id": "cloud",.. "name": "CCleaner Cloud",.. "url": "/knowledge?c=cloud".. },.. {.. "id": "ccleanerbrowser",.. "name": "CCleaner Browser",.. "url": "/knowledge?c=ccleanerbrowser".. },.. {.. "id": "release-announcement",.. "name": "Release Announcements",.. "url": "/knowledge?c=release-a

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 88 x 88, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	710
Entropy (8bit):	7.434828066703169
Encrypted:	false
SSDEEP:	12:6v/7mE/9Q9M2iBGTLlsbcvBzwRARaoc0hOHMS2j62KnvpcUl:j2QBiBQ2bcv1wEaorKU624pcUl
MD5:	15610F754CAD6A500E1840BC7A26A668
SHA1:	3D1D726E32C6A52354572FAFB3A30B2D0BAD0991
SHA-256:	F13157B878253A1EB2D2D768AE4C9A0D2AD36347240470F3AA4D979713FDA6E0
SHA-512:	80ADC11C54676CA6F147A89BB13B43BB133A142CF91AF20C99C1B28880D29FA219FF2F095BA96CE833E75DC44327EED4C714815DF03A4A25DE2DBE1B26AEED2E
Malicious:	false
URL:	https://s1.pir.fm/pf/blog/facebook.png
Preview:	.PNG........IHDR...X...X........c....sRGB.........gAMA......a.....pHYs..........o.d...[IDATx^..k.q...O........HR......Z..EEQ.tq."t.7......$.:HG......Xu.].$...z...E.p...!.}...M.......x^....B@!..P.(.......B@!..P.(.......B@!..P.(....._#....a{......T....T...`...;..e.....<.?.;..x.7.S..d.i46..t....Tp...\<...d.f."...,C...8q..U2.H....5..`.b]w...z.Zs..w.t.u.....K^....s.kC..U&&g....2...!.o..j...5.....P.fU.B.l..G.....&...B..^...M..6....l.[......OS...G.><)..qr.b..y._<..W/..\...'G...*..K...7.....pv\.o...X.!..cMG..#{rk3......yc.C.....(C......G.8.......-0T.>....q.......B@!..P.(.......B@!..P.(.lB...o......'J5We\..0.@.4..P.(.......B@!..P.(.......B@!..P.(.......x..F.w..IE.....IEND.B`.

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1333)
Category:	downloaded
Size (bytes):	1334
Entropy (8bit):	5.353703312900447
Encrypted:	false
SSDEEP:	24:cLPlmG2SptEA63kfUOD/qvSycmFACLkiKGxKGsTMiKG6KGDEKGrridGsidGiLide:gPlmG2SpjxfevSyjmCkTzArIQBcrS9S3
MD5:	56FE055DF69610C82CF721AE43D8C1D5
SHA1:	B561BDD13E935A1795495C56BD07A04BB0B5032B
SHA-256:	C1AE5B294DAFD600A8377432C1CF1F05694E1D82CED9931F8BA71A11D753C2F1
SHA-512:	790E8CAFAE23190AA29EB0BDE95BB055510C42E63AA87369C6408E7FFCBFAE08F7ACF875ADEE6F43500EE9FA51D251EEB179CA04F31EA6103C487666C578C790
Malicious:	false
URL:	https://snap.licdn.com/li.lms-analytics/insight.min.js
Preview:	!function(){"use strict";var r;"function"==typeof SuppressedError&&SuppressedError,function(r){r[r.XHR=0]="XHR",r[r.ImagePixel=1]="ImagePixel"}(r\|\|(r={}));var n=function(r){return/^\d+$/.test(r)},t={IT_TREATMENT:10,IT_ALLOW:{},IT_BLOCK:{},IT_VERSION:"0.0.134"},a=function(){try{var r=Number(t.IT_TREATMENT\|\|0),a=t.IT_ALLOW\|\|{},e=t.IT_BLOCK\|\|{};return function(r,n,t,a){for(var e=0,i=r;e<i.length;e++){var _=i[e],d=parseInt(_,10)%100<n,s=t.hasOwnProperty(_),p=a.hasOwnProperty(_);if((d\|\|s)&&!p)return!0}return!1}(function(r){var t={},a=[];if(r._bizo_data_partner_id&&(t[r._bizo_data_partner_id]=!0,a.push(r._bizo_data_partner_id)),r._bizo_data_partner_ids)for(var e=0,i=r._bizo_data_partner_ids;e<i.length;e++)!t[s=i[e]]&&n(s)&&(t[s]=!0,a.push(s));if(r._linkedin_data_partner_id&&!t[r._linkedin_data_partner_id]&&(t[r._linkedin_data_partner_id]=!0,a.push(r._linkedin_data_partner_id)),r._linkedin_data_partner_ids)for(var _=0,d=r._linkedin_data_partner_ids;_<d.length;_++){var s;!t[s=d[_]]&&n(s)&&(t[s

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:	1536:VjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvv:VeeIygP3fulzhsz8jlvaDioQ47GKK
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
URL:	https://www.ccleaner.com/scripts/vendor/jquery-3.6.4.min.js?v=1.0.95
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://wave.outbrain.com/mtWavesBundler/handler/001ac0827d67b7b38319c9517e7fa2f4cc
Preview:	{}

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 88, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7948
Entropy (8bit):	7.968102529108477
Encrypted:	false
SSDEEP:	192:+SrA67oWTbzAw53o7FbiGNtN3hzLe4LsfGEdeLeq0QS:hrA0zTYw5i7Nxe9fGEdgeqnS
MD5:	7E6798C8A2D14A57D8C0DB47929CD87A
SHA1:	ED1DBD5DD9EF14888B4FDC61C041172A019457E2
SHA-256:	D5BFF63909130BB81DB1176AD4F8B9167F4681A075C88FCE621621E196D51E7E
SHA-512:	E11F3F9E70F724EEA1AA66DC2B1E84F5BBCB7B0D25D28A67D602088E0FC0E96A9612AD9583D18909479FC0D9B4269C1FD6B348592FC9937B2C76C0FFDCDF3A53
Malicious:	false
URL:	https://cdn-production.ccleaner.com/site/lrzh0f4t/sticky-cart-ccleaner-pro.png
Preview:	.PNG........IHDR...A...X.............pHYs.................sRGB.........gAMA......a.....IDATx..\..\U......;Kg#d..Y .@....T..#qdF..a...GG.Fq.......,z...G..Q.....P.....Y!Ig..twz......~_U5../............]....\|...dr5.W..h.....s.....2.F.0.+....F..X...#YX..B.t:}.. .>..N.....(.j@...J...7.x.or. .~.....7..7........\|.<.C2......Rf...0.?.2.W.t.s.P..X...Xq..R......t..(.7]....5..#C...@...u..WJ..m..q./N@.h...."..48q...h%.Zb...9.X..K.m.......(.... ....0P.`..0....P,.WC...Jw$b.p .f...?G...!.B;5.h&@b.$y.p....r....M..T.h..... .4...,&.K@0/..........v...7..T.q.8..&...5...Hp!d@B+.......2-...+...YX...0..1.9...O_E1..U....Y.....@=/......8..l......L.Gp%i+@Kh......;.......h.$...e..7..L....V.&....p.1..b..S........J@..x'. j..+@..!..B...ke./......1.U.O._...)..!..+....8..0..j..F....s...,..^....?........[.%....O.'\.2.....4o.....s..lC.......P..G-.......^...\.=..;........m.j7.....J].E`*..!...........L.J..:.p.M%....jM......`q 2-..><.{........z...............36....j.@S....}Z...}...

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	370595
Entropy (8bit):	5.357959393935795
Encrypted:	false
SSDEEP:	6144:DoafhCzhEqqpxYvc/L1uDpFcTDrgltBVJ61VW/NWKi848:cuqqpxY0gD4sGA
MD5:	53D714B01891BF0658E567A073B78F97
SHA1:	09986C8182F1FD1B1DFE917D841CEA9B8B51C005
SHA-256:	00BAB1A0CA70BAE23E6E733C1B78045476A2D2688AA0C5CF26FC7EFA81CCAA0B
SHA-512:	3CC182FBD3C026EEDAC9DF2A448240B26A7A84ACE4991AAB92282DC93F503BA14FEBD0BE0137E2FDF7C61014487BE9D6114435C1EC340AA85A46ABBB62B89F39
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/6.36.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v6.36.0. * by OneTrust LLC. * Copyright 2022 . */.!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var k,e,r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function c(i,s,a,l){return new(a=a\|\|Promise)(function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(i,s\|\|[])).next())})}function C(o,n){var r,i,s,e,a={label:0,sent:function(){if(1&s[0])throw s[1];return s[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t){

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.544876086303667
Encrypted:	false
SSDEEP:	3:YVMCT+dVgjjQIdROMrfW9:Yn+QjsI3OCw
MD5:	5DF7DEE99A3FF0EF853B4C1A7E8A6F34
SHA1:	6CD1DFCB0C120C014D10E91D9946CC32AD68E41B
SHA-256:	A42766AC88CC70E52CFA0DF72AEE3EA8D736FCB913DA08DBA998D749631B840C
SHA-512:	9B2FB00C9DF77B4CBD096FC4AEEE651F0EF4554BAC19469891C6026161A09F98D6D4E814590D8A9FD87DF455D0AB0E7E82045AB99CC2D9B582C5497E3C42FABC
Malicious:	false
Preview:	{"pixelId":10180940,"use1stPartyCookies":true}

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2213)
Category:	downloaded
Size (bytes):	121898
Entropy (8bit):	5.553604465648927
Encrypted:	false
SSDEEP:	1536:/Axyvdc3rKwXy0u9hFI+RtQiMy0psqPGmFcTD2TB4gedV2mlXovwtyAJl/6AT:/A4v63rKOy0WhNRZJbDQBved4mlXAw4e
MD5:	4976EA4EF6228B4E3420FAD1B44B2DE0
SHA1:	5919490C048B3A9AA340402E441FF37434B27565
SHA-256:	B2A748E3F83BA00512E4267C723D3D8272C827AB2FACBFE1A23D3F3D9F2158DE
SHA-512:	6AEF37752070B838D2ECD31AE79B52A0474494A8F7CE5BAEF82ED1314DE4FC3EDF417A49EDC8985E7529918F14FF495988959683089A838BCF6BCCF5D472B477
Malicious:	false
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-5HNSJRD&l=sdl
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__f","vtp_component":"URL"},{"function":"__e"}],. "tags":[],. "predicates":[],. "rules":[].},."runtime":[ .]..........};...var ca,da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},fa=function(a){return a.raw=a},ha=function(a,b){a.raw=b;return a},ia=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:da(a)};throw Error(String(a)+" is not an iterable or ArrayLike");},ja=funct

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57596), with no line terminators
Category:	downloaded
Size (bytes):	57596
Entropy (8bit):	5.405573199272715
Encrypted:	false
SSDEEP:	1536:buM99dAoLYPNh7S5BTF94zgnSJpksMsNo5/M:buMdAVNiTF94zgnSJpksMp5/M
MD5:	32AD004436155EC972BC50E6238B5B67
SHA1:	9B2CDB645C2FA5B98A9D05DCDCA521FED4A17B7B
SHA-256:	CF7FCC9F75C8717897BFAEF72F303FAB423CE1B70C98512AEB3677E4AF988DEE
SHA-512:	7F3165DD7D6E3136448504918F92B91FC18FAFC5F83F7FEC9D07C8089953D920BF5EA908E4BFCFCAB0824D9BDCC5C9026A6763F3658E5D714A4B2E794F4380CF
Malicious:	false
URL:	https://static.ads-twitter.com/uwt.js
Preview:	!function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=globalThis.crypto),!r&&"undefined"!=typeof window&&window.msCrypto&&(r=window.msCrypto),!r&&void 0!==n.g&&n.g.crypto&&(r=n.g.crypto),!r)try{r=n(2480)}catch(t){}var i=function(){if(r){if("function"==typeof r.getRandomValues)try{return r.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof r.randomBytes)try{return r.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")},o=Object.create\|\|function(){function t(){}return function(e){var n;return t.prototype=e,n=new t,t.prototype=null,n}}(),a={},c=a.lib={},u=c.Base={extend:function(t){var e=o(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9507
Entropy (8bit):	5.3592270038592424
Encrypted:	false
SSDEEP:	192:ebkfPUyAQgtNBIWguxw68uCItctpwfTh3fYwuoOE5YBTi+1POyj/0Pp5b5LfvEf0:PSN9cO51r
MD5:	4D67D7FCE83E8D073C84E4D5B5936E71
SHA1:	E02711957EA1C637BE41485526C65E4B56C55FD3
SHA-256:	1DA25CF82F065474AADCE40A8C7369F6DF48E1847CB95C21BD9083488EFF7390
SHA-512:	1E9D7565BEF92D1C2DA126245D6392176D29A4BE7F1B4623FB367B4C345AA5381EB9022ECD3317CC946B48E2AF89073C80EDCEE0FC121073C88643B191D8E4D0
Malicious:	false
Preview:	. {. "name": "otCenterRounded",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZXRydXN0LXBvbGljeS10ZXh0Ij48ZGl2IGNsYXNzPSJvdC1zZGstcm93Ij48ZGl2IGlkPSJvbmV0cnVzdC1ncm91cC1jb250YWluZXIiIGNsYXNzPSJvdC1zZGstdHdlbHZlIG90LXNkay1jb2x1bW5zIj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3kiPjxkaXYgY2xhc3M9ImJhbm5lci1oZWFkZXIiPjxkaXYgY2xhc3M9ImJhbm5lcl9sb2dvIj48L2Rpdj48L2Rpdj48aDIgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgaWQ9ImJhbm5lci1vcHRpb25zIj48ZGl2IGNsYXNzPSJiYW5uZXItb3B0aW9uIj48YnV0dG9uIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIiBjbGFzcz0iYmFubmVyLW9wdGlvbi1pbnB1dCI+PHNwYW4gY2xhc3M9ImJhb

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	553
Entropy (8bit):	5.562776427382384
Encrypted:	false
SSDEEP:	12:ZHJYYqd/FqCHmdjCBJiFa61kwSEGMdGubBcXhtzor:8Yqd/FqHUJiFa61WMPcRtEr
MD5:	43D189065B48EA6EBA546BB31DD91950
SHA1:	022D35F8810E4AD1DC4B566683644380090DFE41
SHA-256:	FA968E1D96E32BE3B7E907F7439C552126A0B396B769407F0D43AA12CC981FDC
SHA-512:	C0EA6FDD50CF14BF6A73339A069C6789B1F90FD6B66762313457E5381DB1D2B10B419A096CAA9F394C176B86679383EEB7D774E2D0FE574BA7F64DC15C7C4C99
Malicious:	false
Preview:	{.. "business": {.. "enabled": true,.. "endpoint": "/api/site/business",.. "cookieExpiry": 90.. },.. "contentTimeout": 350,.. "referrals": {.. "rpList": "Ww0KICAgIHsNCiAgICAgICAgImZyaWVuZGx5TmFtZSI6ICJDb21taXNzaW9uIEp1bmN0aW9uIiwNCiAgICAgICAgImFiYnIiOiAiY2oiLA0KICAgICAgICAiSUQiOiAiQ2djT0F3b0RCdzAiLA0KICAgICAgICAicXVlcnlTdHJpbmdQYXJhbWV0ZXJOYW1lIjogInNvdXJjZSIsDQogICAgICAgICJwYXNzdGhyb3VnaFFTIjogImNqZXZlbnQiLA0KICAgICAgICAiY29va2llRXhwaXJ5IjogNDUsDQogICAgICAgICJ4U291cmNlVmFsdWUiOiA5MDENCiAgICB9DQpd".. },.. "platform": "windows"..}

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	234778
Entropy (8bit):	5.374921149341604
Encrypted:	false
SSDEEP:	1536:NwMdGFYngJwPOFi9HjYyTBq1w9DkP+sGg5NDbGw5RPCfF9EtMwtaGG84NmHDJC1N:tVOFw9Bq1wI76F9EtMwC8oZ3M+pSXY/Z
MD5:	6515FEE4BF019A02FA39F8E23276C390
SHA1:	E4249E919FBD55DDDE13D27DB70A4A0876C7D098
SHA-256:	6432F355492E71D3EF3F718ECE533E2B6D10D800849A41D4C308E48EF6BA128C
SHA-512:	45A1DF5D2EDCD2BB64BD949C34E84E225D6024A4060AB56CFC178EF9E06445502002AC65BCC03EA665E2E568089A113B664BE5D412ED372D883F8D81CCA029E1
Malicious:	false
URL:	https://script.hotjar.com/modules.edfa88fa094af2bba7f9.js
Preview:	/! For license information please see modules.edfa88fa094af2bba7f9.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 55 x 55, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.351616840670792
Encrypted:	false
SSDEEP:	3:yionv//thPliItAkxd7IwJNMbL5PkJkkkkkkkxvjOMtWr5DElbp:6v/lhP/WQMwbMbL5cYvjOMtselbp
MD5:	D1323B2D9208F4937CFBCC2C85F9C8EF
SHA1:	3D9C4B34ABEF3F7935548C1D5FFF7A50CF82A7B2
SHA-256:	48DF23086CE9629F42E690CFCCA07138E8BFB0002068DCE489CF2D0938C2D5A1
SHA-512:	4C0DC3F8A47AD77376B0A13C393A30CE1A224174723CA73FFE18EA5A9233785F1274B7549D9A09AE7A62EFC575F81821E6AD5CFBEE4096A654CBB6F75CAC94B3
Malicious:	false
Preview:	.PNG........IHDR...7...7........F...UIDATx^..Q..0.C...VOL.$.kR...^.................%.:.....I......I......................g.r{........IEND.B`.

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16552, version 1.0
Category:	downloaded
Size (bytes):	16552
Entropy (8bit):	7.987641213743754
Encrypted:	false
SSDEEP:	384:c82VI48ccMpXzzG5FWvzzFB74Qi2Ifh06pQvSDb:cyM1zucz774QBIZ06pvf
MD5:	283C40F79DEAB0300DF8B3FFD86DFC7B
SHA1:	2EF09414A573AC59F4B37E81C8B8A881244B345F
SHA-256:	35E5EEA83F2E5F2BAD1213AA4B4AEF30A380720E35C1821F19BC894F8E61E406
SHA-512:	A6301EFCE863F9FCAF455CE02216C21907545154FDA1A633ADE371FD3D212E21E2BAF07F8C06EC636ED1541350870DCB080CE73EDCDAD86C2C6BCE0DA06DE91A
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2
Preview:	wOF2......@........D..@/..........................q..&..&?HVAR.U.`?STAT.$'...8+...\|.../V....$."..&.0.>.6.$..H. ..~..T.....}...sHu.nU)b...pc.....B%.`..........0..j..."C. d:.6..)...D).R.Y......,+....B%w.+..Q;kg43.g......D.w..uNf;./J. ..................$.K.9bz.z..:..C.&L2....\..<..k..~....B)T.3T....}.".y.....$....K...#..%..T0.....9]..p..8.#..#.w....<?.?...`.."..,Dl..=..2.h.....Q..F.AX.#..e~Q......j.. M}....2...N.{o1.J..U....D1..@Dkz..a.BH...F'.....?............h.E.....y2C..IK...2B.P=T.b....K........p....R.A..w..",g.....)..]iU.{y.x..W....M.......$.l.......FU........_.}.o>b..YM.....?.!.7(.P41...}{.Fn.....T.....k..Z....m~Q~.....+. .U....t......&.. G....+$.L.EV..S..lY.?.h..q......D6.A?g.._...;.g@iQ..N...-....eRt2K3...Y.E.5v.:..[..z....8HE....S....4.?....s{9...01.6.........p.*...4.fw....EzJk(.........rJi<8...(........v.5.7\....."(.U3.4Z..d.......B@.y}.....@.....}....{}.:}."....>..G2H,.\..-....?{..........u..!s.{.^qR?R..!....">A.kC9.c.o....0A.c.

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.999995633499261
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	ccsetup621.zip
File size:	79'141'752 bytes
MD5:	ba0be409f31455daa2e64193336f1563
SHA1:	e41bdc0a093639ea987e2e749b5f7702a5964513
SHA256:	8e5144c8b2bfb7c48bcc9cc82d272b784b90f289fab7c3410769c59a1f2415d6
SHA512:	9157d1fbedc0e961c3b11775c2e432268290046ea3be730691261fdcf20876f246d1e190a3bb579c0e27256be31ade4b8ca207565346728dddd15767d153357c
SSDEEP:	1572864:pfd+bt9NAkqmpgg9E4+WKohbMWNtb/2+GxqaiVL91BeNQ0Y6P:5dsnkK52WbMWN5rGEaiV5jeNQq
TLSH:	07083382A2D81A917C58D30F348168993AFD8FF7D39A64A46CC5C7A3BCC54792636CC7
File Content Preview:	PK........9?[X...!....0.......ccsetup621.exe...xT..?..#..L2.$..4HP..h.%...d....0d...)d.......=D.w...Q.....{.'.CO...K....B..g.(`.5(.=..Qc.$d....L....y.s.}.}..]..^{.w..]..Zko\.lg&...I.....?'....B...7Yl..w..3..3ey..)...~]c...5..6..y...k.6..n.+]..[_..........

File Icon


Icon Hash:	1c1c1e4e4ececedc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2024 18:37:48.495662928 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:48.495702028 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:48.495784044 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:48.540103912 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:48.540137053 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:48.850668907 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:48.850801945 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:48.853774071 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:48.853780985 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:48.854024887 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:48.894512892 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.201870918 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.249906063 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397445917 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397516012 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397553921 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397584915 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397597075 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397627115 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397629023 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397644997 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397655010 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397675991 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397706985 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397825003 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.397906065 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.397913933 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.398053885 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.398113012 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.465250015 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.465267897 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:49.465301037 CET	49700	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:37:49.465317011 CET	443	49700	20.12.23.50	192.168.2.17
Feb 27, 2024 18:37:50.430088043 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:37:50.732559919 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:37:51.336553097 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:37:52.539589882 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:37:54.582820892 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:37:54.885565042 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:37:54.949565887 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:37:55.487545967 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:37:56.694530964 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:37:58.085541964 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.085618019 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.085710049 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.087227106 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.087258101 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.282766104 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.282886028 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.285553932 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.285574913 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.290115118 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.337528944 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.345943928 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.389919996 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.460890055 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.460958958 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.461158037 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.461205006 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.461225986 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.461225986 CET	49704	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.461236000 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.461249113 CET	443	49704	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.502325058 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.502362967 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.502461910 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.502785921 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.502796888 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.700166941 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.700259924 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.701565027 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.701570034 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.702543020 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.704221964 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.745904922 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.883827925 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.883903027 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.883970022 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.885438919 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.885469913 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:58.885487080 CET	49705	443	192.168.2.17	23.221.242.90
Feb 27, 2024 18:37:58.885495901 CET	443	49705	23.221.242.90	192.168.2.17
Feb 27, 2024 18:37:59.100522995 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:37:59.752605915 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:38:03.036777973 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:03.340579033 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:03.900588989 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:38:03.948631048 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:05.158694983 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:07.573585033 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:09.357745886 CET	49675	443	192.168.2.17	204.79.197.203
Feb 27, 2024 18:38:10.294898033 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.294924021 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.295013905 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.297513962 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.297523975 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.502132893 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.502374887 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.503942013 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.503957987 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.504359007 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.553594112 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.579339981 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.579583883 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.579618931 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.701451063 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.701668978 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.701745987 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.703169107 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.703188896 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:10.703212976 CET	49706	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:10.703221083 CET	443	49706	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:12.376588106 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:12.829119921 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:12.829161882 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:12.829315901 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:12.829907894 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:12.829921961 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.029041052 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.029823065 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.030968904 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.030978918 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.031277895 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.032622099 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.073904037 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.235584021 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.235670090 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.235868931 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.236419916 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.236419916 CET	49707	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:38:13.236438990 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.236449003 CET	443	49707	34.111.24.1	192.168.2.17
Feb 27, 2024 18:38:13.512641907 CET	49680	443	192.168.2.17	20.189.173.13
Feb 27, 2024 18:38:21.174832106 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.174871922 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.174964905 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.175834894 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.175851107 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.368426085 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.368549109 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.369853020 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.369867086 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.370124102 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.371364117 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.371634960 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.371702909 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.569547892 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.569644928 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.569720984 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.570033073 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.570049047 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.570080042 CET	49708	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:21.570087910 CET	443	49708	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:21.986653090 CET	49682	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:38:23.808888912 CET	49697	80	192.168.2.17	72.21.81.240
Feb 27, 2024 18:38:23.902090073 CET	80	49697	72.21.81.240	192.168.2.17
Feb 27, 2024 18:38:23.902162075 CET	49697	80	192.168.2.17	72.21.81.240
Feb 27, 2024 18:38:24.416034937 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.416081905 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.416169882 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.416647911 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.416661978 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.622864962 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.622994900 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.628839016 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.628873110 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.629373074 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.629443884 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.629836082 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.673918009 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.828809023 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.828900099 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.828939915 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.828989983 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.829015970 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.829066992 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.829094887 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.829144955 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.829235077 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:24.829288960 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.843218088 CET	49711	443	192.168.2.17	34.160.176.28
Feb 27, 2024 18:38:24.843255043 CET	443	49711	34.160.176.28	192.168.2.17
Feb 27, 2024 18:38:26.362384081 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.362445116 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.362528086 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.362984896 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.363001108 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.667368889 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.667479038 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.669114113 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.669126034 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.669449091 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.672117949 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.713908911 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956022024 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956058979 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956079960 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956127882 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956151962 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956167936 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956175089 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956196070 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956204891 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956207991 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956229925 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956250906 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956254959 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956274986 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.956304073 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.956332922 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.960225105 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.960242987 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:26.960273027 CET	49712	443	192.168.2.17	20.12.23.50
Feb 27, 2024 18:38:26.960278034 CET	443	49712	20.12.23.50	192.168.2.17
Feb 27, 2024 18:38:33.966576099 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:33.966624022 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:33.966691017 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:33.967149019 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:33.967163086 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.268614054 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.268707991 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.283459902 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.283487082 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.284483910 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.284915924 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.284949064 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.284980059 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492439032 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492475033 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492511988 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492562056 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.492577076 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492598057 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.492644072 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.492814064 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.492831945 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.492865086 CET	49713	443	192.168.2.17	20.190.151.134
Feb 27, 2024 18:38:34.492870092 CET	443	49713	20.190.151.134	192.168.2.17
Feb 27, 2024 18:38:34.495537996 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.495589972 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:34.495682001 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.528800011 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.528830051 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:34.827744961 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:34.827838898 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.830719948 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.830737114 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:34.831298113 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:34.870322943 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:34.913908958 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015429020 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015480995 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015516996 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015578985 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.015614033 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015794992 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015831947 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015844107 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.015851974 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015888929 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.015893936 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.015999079 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.016002893 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:35.016052961 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.022317886 CET	49714	443	192.168.2.17	13.107.5.88
Feb 27, 2024 18:38:35.022336960 CET	443	49714	13.107.5.88	192.168.2.17
Feb 27, 2024 18:38:36.450603962 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.450644016 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.450722933 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.451301098 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.451311111 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.654145956 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.654227972 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.655930996 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.655941963 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.656272888 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.657461882 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.657627106 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.657655001 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.811362028 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:36.811409950 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:36.811492920 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:36.813059092 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:36.813076019 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:36.859503984 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.859610081 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.859680891 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.859894991 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.859915018 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:36.859931946 CET	49716	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:36.859937906 CET	443	49716	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.014122009 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.014234066 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.015697002 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.015721083 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.016238928 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.067713022 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.142326117 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.185945988 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.250169039 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.250263929 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.250333071 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.250612974 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.250664949 CET	49717	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:37.250679016 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.250688076 CET	443	49717	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:37.600011110 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.600048065 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.600126982 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.606359959 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.606376886 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.800844908 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.800961971 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.802493095 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.802504063 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.802856922 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:37.849725962 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.909017086 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.909152031 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:37.909190893 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.110958099 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.111054897 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.111130953 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.111473083 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.111495972 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.111509085 CET	49718	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.111515045 CET	443	49718	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.116601944 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.116645098 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.116729975 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.117160082 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.117176056 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.315969944 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.316078901 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.317256927 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.317265034 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.317497015 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.318512917 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.318658113 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.319211006 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.522224903 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.522301912 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.522424936 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.522598028 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.522612095 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.522635937 CET	49721	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.522644043 CET	443	49721	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.526431084 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.526453018 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.526527882 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.526845932 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.526858091 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.719549894 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.719623089 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.721019983 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.721029997 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.721276999 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.722261906 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.722429037 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.722454071 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.926973104 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.927102089 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.927155018 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.927397013 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.927413940 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.927436113 CET	49723	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:38.927443027 CET	443	49723	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:38.954716921 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:38.954754114 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:38.954835892 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:38.956813097 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:38.956830025 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.150279045 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.150381088 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.151807070 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.151828051 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.152096987 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.198705912 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.271521091 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.313906908 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.378379107 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.378463984 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.378530025 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.378911018 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.378930092 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:39.378962994 CET	49724	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:38:39.378968000 CET	443	49724	34.149.149.62	192.168.2.17
Feb 27, 2024 18:38:41.963023901 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.963061094 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:41.963128090 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.963207960 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.963228941 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:41.963289976 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.963469028 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.963479996 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:41.964653969 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:41.964663982 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.219629049 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.219758987 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.220278025 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.220283031 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.220299006 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.220304966 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.221270084 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.221286058 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.221380949 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.221384048 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.222489119 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.222489119 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.222512960 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.222563982 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.222590923 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.222649097 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.222678900 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.262773991 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.262792110 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.265902042 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.277770042 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.277784109 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.309756041 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.325715065 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.511457920 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511523962 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511559010 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511588097 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.511612892 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511653900 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511687994 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511715889 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.511723042 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511759996 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511785030 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.511790991 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511827946 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511857986 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.511862993 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.511888981 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.512691975 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.512723923 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.512748957 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.512756109 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.513101101 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.513133049 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.513159990 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.513166904 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.513278008 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.513303995 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.514322996 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.514322996 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529484034 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529541969 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529577971 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529608011 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529639006 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529640913 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529661894 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529694080 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529706955 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529732943 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529740095 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529767990 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529793024 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529798985 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529830933 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529865026 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529897928 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529905081 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529932022 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.529956102 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.529973030 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.530009985 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.530035019 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.530040979 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.530106068 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.530153036 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.532280922 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.569607973 CET	49738	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.569619894 CET	443	49738	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:42.814733028 CET	49737	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:42.814766884 CET	443	49737	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.634062052 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.634088993 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.634216070 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.634433031 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.634447098 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.767668009 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.767692089 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.767802000 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.768006086 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.768018961 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.884011984 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.884254932 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.884267092 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.885289907 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.885364056 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.885974884 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.886035919 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.887698889 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.887710094 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:43.931775093 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:43.977519989 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.978934050 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.978957891 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.980122089 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.980295897 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.981482983 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:43.981651068 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:43.981652021 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:44.025907993 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:44.027896881 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:44.027920008 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:44.074745893 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:44.182034969 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:44.182198048 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:44.182293892 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:44.185811043 CET	49764	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:44.185816050 CET	443	49764	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:44.190897942 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.190943003 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.190982103 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.191005945 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.191019058 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.191104889 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.191133022 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.191279888 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.193658113 CET	49755	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.193671942 CET	443	49755	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.339591026 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.339627981 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.339808941 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.339996099 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.340003967 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.353408098 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.353435040 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.353508949 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.353931904 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.353946924 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.589186907 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.590009928 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.590020895 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.591068029 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.591217041 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.593456984 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.593509912 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.593795061 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.610256910 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.610928059 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.610944033 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.612000942 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.612081051 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.612694979 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.612726927 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.612848043 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.613549948 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.613609076 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.613614082 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.613619089 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.613722086 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.613729954 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.637906075 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.645967007 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.645982981 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.660762072 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.692744017 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.849487066 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.849975109 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.849988937 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.851089954 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.851185083 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.852355003 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.852437019 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.852700949 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.852713108 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:44.897912979 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:44.910182953 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.910258055 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.910815001 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.911087990 CET	49779	443	192.168.2.17	104.18.32.137
Feb 27, 2024 18:38:44.911102057 CET	443	49779	104.18.32.137	192.168.2.17
Feb 27, 2024 18:38:44.914783001 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.914807081 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.914902925 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.915858984 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.915870905 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.989940882 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.989995956 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.990058899 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.990070105 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.990087032 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.990145922 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.990150928 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.990225077 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:44.990262032 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.991245985 CET	49778	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:44.991257906 CET	443	49778	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.007445097 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.007527113 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.008158922 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.008158922 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.042706966 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.042735100 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.042886972 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.043134928 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.043149948 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.154484034 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.154525042 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.154582024 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.154777050 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.154788017 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.168155909 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.168185949 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.169791937 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.170041084 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.170053959 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.184222937 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.184235096 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.184278965 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.184588909 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.184597969 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.210562944 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.211133003 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.211147070 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.211515903 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.212018967 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.212073088 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.212438107 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.253905058 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.309639931 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.310162067 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.310187101 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.311248064 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.311306953 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.311611891 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.311678886 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.311738968 CET	49780	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.311762094 CET	443	49780	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.311877012 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.311886072 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.348226070 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.348248959 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.348514080 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.348666906 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.348679066 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.350677967 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.350702047 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.351072073 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.351284027 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.351296902 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.357719898 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.439143896 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.439160109 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.439240932 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.439444065 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.439462900 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.439681053 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.440010071 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.440018892 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.441543102 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.441598892 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.441987038 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.442219973 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.442229986 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.442487955 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.442558050 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.442632914 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.442639112 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.443341017 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.443422079 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.444220066 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.444286108 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.444430113 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.444437027 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.484747887 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.485048056 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485090017 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485104084 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.485116959 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485156059 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485174894 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.485198975 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485239029 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.485388994 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485413074 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485431910 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485441923 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.485446930 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.485531092 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.486196995 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.486227036 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.486247063 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.486268044 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.486274004 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.486289024 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.487169027 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.487196922 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.487220049 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.487240076 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.487245083 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.487250090 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.487279892 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.487292051 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.488096952 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.488178015 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.488198996 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.488240004 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.488245010 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.488354921 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.489089012 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.489132881 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.489155054 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.489175081 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.489198923 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.489202976 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.489222050 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.490078926 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.490107059 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.490127087 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.490130901 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.490138054 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.490161896 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.491048098 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.491089106 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.491110086 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.491111040 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.491121054 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.491164923 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.491998911 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.492055893 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.492077112 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.492091894 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.492096901 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.492120981 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.492130041 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.492166042 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.492170095 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.493093014 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.493153095 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.493156910 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.532727003 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.563327074 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.563364029 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.563488007 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.563802004 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.563812971 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.596440077 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.596462011 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.596494913 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.596527100 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.596529961 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.596566916 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.596992016 CET	49802	443	192.168.2.17	54.164.110.171
Feb 27, 2024 18:38:45.597006083 CET	443	49802	54.164.110.171	192.168.2.17
Feb 27, 2024 18:38:45.607527018 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.607620001 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.608072996 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.608104944 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.608115911 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.608124971 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.608144045 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.608764887 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.608814001 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.608819962 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.609127045 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.609749079 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.609805107 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.609839916 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.609911919 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.610718012 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.610784054 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.611710072 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.611773014 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.612559080 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.612608910 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.612631083 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.612634897 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.612695932 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.613640070 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.613729954 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.614573956 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.614618063 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.614685059 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.614723921 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.615200043 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.615272045 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.615319967 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.615534067 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.615580082 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.616010904 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.616084099 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.616090059 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.616095066 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.616130114 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.616455078 CET	49798	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:45.616466999 CET	443	49798	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:45.617024899 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.617070913 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.631659985 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.631686926 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.631813049 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.632308960 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.632320881 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.640614033 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640690088 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640713930 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.640723944 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640733957 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640779972 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640803099 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.640810013 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.640846014 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.647169113 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.647208929 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.647238970 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.647244930 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.647300959 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.653712988 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.653749943 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.653775930 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.653783083 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.653953075 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.660309076 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.660500050 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.666862011 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.666893959 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.666919947 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.666927099 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.667747021 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.710544109 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.710788012 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.710809946 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.712130070 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.712201118 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.712645054 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.712713003 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.712939024 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.720241070 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.720516920 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.720544100 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.721204042 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.721321106 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.721973896 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.722282887 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.723200083 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.723289967 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.723551035 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.723563910 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.727209091 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.727809906 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.727823019 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.728904963 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.728991032 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.729819059 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.729819059 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.729839087 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.729899883 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.730144024 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.730233908 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.730268955 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.730295897 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.730309963 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.730333090 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.730391026 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.730741024 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.730755091 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.730765104 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.730916977 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.731735945 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.731776953 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.731803894 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.731808901 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.731828928 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.731842041 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.731967926 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.732053995 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.732089996 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.732134104 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.732146978 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.732242107 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.732685089 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.732795000 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.732800007 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.732851028 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.732883930 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.732911110 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.733503103 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.733522892 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.733798981 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.733911991 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.733941078 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.733946085 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.733974934 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.734055042 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.734860897 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.734885931 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.734982967 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.734988928 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.735060930 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.735356092 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.735486031 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.735867977 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.736030102 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.736785889 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.736840010 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.736860037 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.737103939 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.737807989 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.737879038 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.738895893 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.738929033 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.738967896 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.738971949 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.738997936 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.739095926 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.739705086 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.739773035 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.740685940 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.740721941 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.740747929 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.740752935 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.740777016 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.741693974 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.741856098 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.741861105 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.741919041 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.741956949 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.741972923 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.741976023 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.741991043 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.742098093 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.742641926 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.742676973 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.742710114 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.742714882 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.742738962 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.742809057 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.744705915 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.744715929 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.744745016 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.744805098 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.744808912 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.744832993 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.747756958 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.747773886 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.747893095 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.747899055 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.748650074 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.748680115 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.749083042 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.749094009 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.749552965 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.749613047 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.749629021 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.749707937 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.749712944 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.752537966 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.752556086 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.753005028 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.753011942 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.753020048 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.753025055 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.754652023 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.754678965 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.754781961 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.754811049 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.755096912 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.755150080 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.757549047 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.757571936 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.757633924 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.757639885 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.757749081 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.759514093 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.759546995 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.759617090 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.759617090 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.759622097 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.761713028 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.761746883 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.761770964 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.761782885 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.762062073 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.762398958 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.762423992 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.762455940 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.762460947 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.762588024 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.768280029 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.768321991 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.768340111 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.768347025 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.768399000 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.768743992 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.774743080 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.774880886 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.780662060 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.780695915 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.780826092 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.780832052 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.780926943 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.784734011 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.784737110 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.784743071 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.786581039 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.786614895 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.786745071 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.786751986 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.786808968 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.792449951 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.792543888 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.798316956 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.798659086 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.800751925 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.801218033 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.801261902 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.801291943 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.801299095 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.801886082 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.807163954 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.807195902 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.807224035 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.807229042 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.807643890 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.816725016 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.823568106 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.824512959 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.825846910 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.825875044 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.825922966 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.825932980 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.826050043 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.830450058 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.830482960 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.830655098 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.830681086 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.830991983 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.831278086 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831478119 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831516027 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831547976 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831597090 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831636906 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.831649065 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.831876993 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.832844973 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.833997011 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834050894 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834075928 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834116936 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834151983 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834153891 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.834163904 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834177971 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.834486961 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.834518909 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.834525108 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.834593058 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.835037947 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.837553978 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.837595940 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.837981939 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.837987900 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.838099003 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.838730097 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.838771105 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.838800907 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.838810921 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.838855028 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.840678930 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.842844963 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.842875957 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.842910051 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.842916012 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.843008995 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.843386889 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.843815088 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.843919992 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.843935013 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.844825983 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.844845057 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.845172882 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.845674038 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.845745087 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.845912933 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.846889973 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.847114086 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.847142935 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.847147942 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.847177982 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.847184896 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.849998951 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.850276947 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.850284100 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.851146936 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.851181030 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.851253033 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.851260900 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.851496935 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.853080988 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.853341103 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.853353024 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.853387117 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.853410006 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.853488922 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.853501081 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.853564978 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.855099916 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.855145931 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.855186939 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.855192900 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.855228901 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.855253935 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.855283022 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.855297089 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.855525017 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.856184006 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.856323957 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.856333017 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.856358051 CET	49795	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.856369972 CET	443	49795	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.859462976 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.859498024 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.859525919 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.859534025 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.860908031 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.862368107 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.862416029 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.862556934 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.862564087 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.862843037 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.863631010 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.863663912 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.863780022 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.863790035 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.863836050 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.865461111 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.867764950 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.867839098 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.868534088 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.868546009 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.868576050 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.868720055 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.868726015 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.868729115 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.869505882 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:45.869523048 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:45.871902943 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.872379065 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.872901917 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:45.872931004 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:45.873081923 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:45.873964071 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.874001026 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.874120951 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.874145031 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.874221087 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.874691010 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.877213955 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:45.877230883 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:45.877849102 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.877861977 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.878124952 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.878155947 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.878182888 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.878202915 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.878293991 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.878334045 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.879116058 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.879122019 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.879129887 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.879223108 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.880105972 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.880179882 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.882344007 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.882426977 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.886496067 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.886512995 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.886581898 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.886591911 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.886674881 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.890590906 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.890625000 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.891206026 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.891216040 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.891433954 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.893914938 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:45.894584894 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.895591021 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.896739960 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:45.898576021 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.898611069 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.898664951 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.898673058 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.898751020 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.902600050 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.902633905 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.902718067 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.902728081 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.902796030 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.906466961 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.906588078 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.910418987 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.910454035 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.910516977 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.910526037 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.910650969 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.912863016 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.914187908 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.914216995 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.914242983 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.914253950 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.914616108 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.917980909 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.918036938 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.921744108 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.921777010 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.921801090 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.921816111 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.922404051 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.922975063 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.924391031 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.924432039 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.924500942 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.924509048 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.924746037 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.925523043 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.925545931 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.925575972 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.925585985 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.925643921 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.926050901 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926078081 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926116943 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926141024 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926181078 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926237106 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.926250935 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.927069902 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.927239895 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.927880049 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.928433895 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.928989887 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.929001093 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:45.929744959 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929770947 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929779053 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929800987 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929811954 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929833889 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.929847002 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.929876089 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.930008888 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.930224895 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.930265903 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.930286884 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.930295944 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.931139946 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.931142092 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.931159973 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.931191921 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.931644917 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.931731939 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.932543993 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.932620049 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.932653904 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.932691097 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.932764053 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.932773113 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.933552027 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.933917999 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.933926105 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.934897900 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.934992075 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.935049057 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.935309887 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.935316086 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.936503887 CET	49815	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.936525106 CET	443	49815	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.937139034 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.937175989 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.937201977 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.937211990 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.937257051 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.937412024 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.937772036 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.937777996 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.939358950 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.939389944 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.939510107 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.939518929 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.939609051 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.941569090 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.941720009 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.941740990 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.941767931 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.941804886 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.941812038 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.941833019 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.941881895 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.941914082 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.943780899 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.944437981 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.944894075 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.944936991 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.944964886 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.944972992 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.947057962 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.947098970 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.947139978 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.947149038 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.947175980 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.949224949 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.950124979 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.950150967 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.950875044 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:45.950900078 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:45.950980902 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:45.951251984 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:45.951262951 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:45.951342106 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.951379061 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.951507092 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.951515913 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.951622009 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.953387976 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.953423023 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.953469992 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.953476906 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.953576088 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.953577995 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.953613043 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.953691959 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.953965902 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.953979015 CET	443	49812	52.85.132.5	192.168.2.17
Feb 27, 2024 18:38:45.953991890 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.954143047 CET	49812	443	192.168.2.17	52.85.132.5
Feb 27, 2024 18:38:45.954879045 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:45.954895973 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:45.955483913 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.955723047 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.957496881 CET	49813	443	192.168.2.17	146.75.28.157
Feb 27, 2024 18:38:45.957505941 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.957508087 CET	443	49813	146.75.28.157	192.168.2.17
Feb 27, 2024 18:38:45.957540035 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.957566977 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.957573891 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.957632065 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.959465981 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.959543943 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.959551096 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.959889889 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:45.959904909 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:45.959980965 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:45.960345030 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:45.960355997 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:45.961450100 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.961483002 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.961525917 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.961534023 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.961683989 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.963469028 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.963548899 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.964299917 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.964369059 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.964476109 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.965066910 CET	49801	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:45.965082884 CET	443	49801	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:45.965367079 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.965404034 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.965434074 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.965445042 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.965490103 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.967343092 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.967385054 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.967406988 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.967412949 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.967473030 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.969273090 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.969366074 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.971158028 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.971199989 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.971230030 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.971236944 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.971905947 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.973083973 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.973134995 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.973161936 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.973167896 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.973303080 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.974848032 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.975085020 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.975743055 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:45.976690054 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.976741076 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.976752043 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.976759911 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.976805925 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.978477955 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.978524923 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.978611946 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.978617907 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.978975058 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.980199099 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.980287075 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.982012033 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.982052088 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.982100010 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.982105970 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.982194901 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.983763933 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.983799934 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.983828068 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.983833075 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.985502005 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.985541105 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.985547066 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.986232042 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.987186909 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.987224102 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.987898111 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.987905025 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.988986015 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.989023924 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.989049911 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.989058018 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.989808083 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.990663052 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.991806030 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.992341042 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.992384911 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.992408991 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.992414951 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.992439985 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.994067907 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.994101048 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.994132042 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.994138956 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.994187117 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.995762110 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.995893955 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.997447968 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.997481108 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.997572899 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.997579098 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.998030901 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.999027967 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.999169111 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.999206066 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:45.999212027 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:45.999536037 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.000668049 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.000813961 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.006942987 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007019997 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007049084 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.007055044 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007066011 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007111073 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007136106 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.007143974 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007160902 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007169008 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.007220030 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.007225990 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007294893 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.007378101 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.008125067 CET	49803	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:46.008136034 CET	443	49803	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:46.031095982 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:46.031173944 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:46.031728983 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:46.031728983 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:46.039568901 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.039587975 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.039664030 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.039865017 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.039876938 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.069906950 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.070826054 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.073026896 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.073055029 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.073321104 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.083667994 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.083719015 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.083874941 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.083901882 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.083944082 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.084033012 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.084259033 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.084278107 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.084484100 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.084506035 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.099148035 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.099453926 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.099472046 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.121469021 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.121783018 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.121795893 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.122282982 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.122843027 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.122843027 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.122867107 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.122932911 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.143805981 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.144155979 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.144198895 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.144270897 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.144499063 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.144526005 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.144798040 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.144814014 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.144905090 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.145128965 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.145629883 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.145875931 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.145875931 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.145953894 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.147027016 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.147066116 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.147089005 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.147491932 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.147537947 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.148663998 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.148808002 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.149758101 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.149884939 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.149913073 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.161189079 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.161216021 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.161590099 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.162153959 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.162166119 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.165513039 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.193916082 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.195732117 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.195760965 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.195821047 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.243783951 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.271930933 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.272002935 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.274898052 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.277317047 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.277348042 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.277385950 CET	49825	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.277403116 CET	443	49825	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.285186052 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.286295891 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.286314964 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.287623882 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.287826061 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.288961887 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.289026976 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.289190054 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.289197922 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.328717947 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.328833103 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.329032898 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.330722094 CET	49829	443	192.168.2.17	69.147.92.11
Feb 27, 2024 18:38:46.330741882 CET	443	49829	69.147.92.11	192.168.2.17
Feb 27, 2024 18:38:46.333559990 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.334424973 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.334477901 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.335622072 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.335756063 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.336729050 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.336807966 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.336868048 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.336874962 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.338767052 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.338865042 CET	49822	443	192.168.2.17	44.209.16.161
Feb 27, 2024 18:38:46.338886023 CET	443	49822	44.209.16.161	192.168.2.17
Feb 27, 2024 18:38:46.353998899 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354024887 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354032993 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354062080 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354079962 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354091883 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354110003 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.354154110 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.354192019 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.355918884 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.369368076 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.369419098 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.369447947 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.369599104 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.369599104 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.369599104 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.378241062 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.378319979 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.378356934 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.379499912 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.379530907 CET	443	49828	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.379571915 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.379818916 CET	49828	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.386743069 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.388493061 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.388963938 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.388977051 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.389919996 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.389940023 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.390275955 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.390296936 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.390499115 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.390499115 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.390510082 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.391570091 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.391798973 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.392245054 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.392254114 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.420157909 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.420206070 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.420470953 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.420489073 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.420542955 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.420559883 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.420906067 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.421214104 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.421304941 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.421581030 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.421616077 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.421737909 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.422751904 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.422821045 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.422924042 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.434861898 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.435708046 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435764074 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435796976 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435831070 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435858965 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.435863018 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435872078 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435897112 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.435946941 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.435985088 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436000109 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.436008930 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436033964 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.436053038 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436084032 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436122894 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436510086 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.436518908 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436553001 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.436690092 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436721087 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436754942 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436774969 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.436796904 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.436801910 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.437043905 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.437113047 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.437530041 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.437588930 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.437628984 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.437679052 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.437685013 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.438034058 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.438375950 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.438435078 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.438466072 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.438489914 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.438496113 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.438769102 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.438775063 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439358950 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439405918 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439440012 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439472914 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439486027 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.439492941 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.439500093 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.439539909 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.440211058 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.440264940 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.440305948 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.440335035 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.440342903 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.440500021 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.441066027 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.441169977 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.441209078 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.441237926 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.441241026 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.441248894 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.441557884 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.442034960 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.442070961 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.442138910 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.442138910 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.442147970 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.461920977 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.462198973 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.462238073 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.462435007 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.462703943 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.462717056 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.466747046 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.466756105 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.466768980 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.483752012 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.483817101 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.483985901 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.484357119 CET	49834	443	192.168.2.17	63.140.39.65
Feb 27, 2024 18:38:46.484371901 CET	443	49834	63.140.39.65	192.168.2.17
Feb 27, 2024 18:38:46.498797894 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.501952887 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.502568007 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.502630949 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.503850937 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.503982067 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.505099058 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.505342960 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.505348921 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.514791012 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.521409035 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.521600962 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.523922920 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.527894020 CET	49835	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:46.527918100 CET	443	49835	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:46.530814886 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530843019 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530852079 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530868053 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530899048 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530946970 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.530972958 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.530988932 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.531049967 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.543911934 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.544003963 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.546241999 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.546261072 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.546341896 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.546350002 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.546351910 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.546376944 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.546523094 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.546529055 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.546575069 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.546758890 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.546782970 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.558881998 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.558895111 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.558964968 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.558974028 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.559073925 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.559091091 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.559170008 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.559323072 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.559906006 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.559916019 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.560213089 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.560256958 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.560276031 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.560282946 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.560343027 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.561184883 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.561218023 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.561227083 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.561300039 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.561990976 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.562388897 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.562426090 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.562436104 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.562448978 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.562469006 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.562730074 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.562735081 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.563087940 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.563318968 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.563494921 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.564239025 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.564322948 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.564333916 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.564380884 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.565146923 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.565336943 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.565992117 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.566071987 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.566085100 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.566090107 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.566158056 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.594790936 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.603420019 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.605079889 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.605091095 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.606408119 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.606555939 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.607314110 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.607314110 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.607323885 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.607357025 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.607372046 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.619539022 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.619566917 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.619646072 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.619894028 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.619901896 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.620342016 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.620378017 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.620471001 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.620497942 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.620605946 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.620605946 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.630950928 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.631124973 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.631184101 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.631759882 CET	49838	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.631773949 CET	443	49838	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.638484001 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.638509035 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.638573885 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.638592005 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.638614893 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.638668060 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.650621891 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.650861025 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.650887012 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.651241064 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.651525974 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.651983023 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.652045965 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.652282000 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.652282000 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.652333975 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.655189991 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.655210972 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.655293941 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.655293941 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.655311108 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.655889034 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.658855915 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.658870935 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.679740906 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.679888010 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.679912090 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.679919004 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.679949045 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.679985046 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.680964947 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.681082964 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.681482077 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.681529999 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.681603909 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.681603909 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.681611061 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.682341099 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.682435036 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.682440996 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.682590961 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.683254957 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.683568954 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.683839083 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.683867931 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.683898926 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.683904886 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.683957100 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.684696913 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.684761047 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.684782028 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.684788942 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.684820890 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.684856892 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.684962988 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.685345888 CET	49824	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.685353994 CET	443	49824	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.690887928 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.690973997 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.691087008 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.693440914 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.693470955 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.704984903 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.705003977 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.706443071 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.706470013 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.706739902 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.706804037 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.706826925 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.706844091 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.707984924 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.708014011 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.708266973 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.708441973 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.708482027 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.708556890 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.708883047 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.708913088 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.709141016 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.709198952 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.709213972 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.709294081 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.709309101 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.709469080 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.709491014 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.718549967 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.718622923 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.718642950 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.718652964 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.718712091 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.718712091 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.733072996 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.733091116 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.733247995 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.733258963 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.737987041 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.743335009 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.743580103 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.743606091 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.744415998 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.744435072 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.744632006 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.744666100 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.744680882 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.744740009 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.744740963 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.747778893 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.747778893 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.747827053 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.747883081 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.754050016 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.758224964 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.758245945 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.758328915 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.758328915 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.758338928 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.758428097 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.759802103 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.759835005 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.759897947 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.760164022 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:46.760179996 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:46.768310070 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.768332958 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.768435001 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.768451929 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.768815041 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.768940926 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.769018888 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.769100904 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.778002024 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.778019905 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.778060913 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.778069973 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.778079987 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.778115034 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.787643909 CET	49833	443	192.168.2.17	35.167.214.190
Feb 27, 2024 18:38:46.787671089 CET	443	49833	35.167.214.190	192.168.2.17
Feb 27, 2024 18:38:46.793448925 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.793972015 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.795883894 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.795883894 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.798314095 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.798340082 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.798450947 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.798450947 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.798474073 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.800764084 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.800808907 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.800827026 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.808073997 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.808093071 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.810509920 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.810534000 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.810622931 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.811083078 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.811374903 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.811386108 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.811460018 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.811522007 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.811548948 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.811610937 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.811759949 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.811774969 CET	443	49837	99.84.191.43	192.168.2.17
Feb 27, 2024 18:38:46.811800003 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.811867952 CET	49837	443	192.168.2.17	99.84.191.43
Feb 27, 2024 18:38:46.812447071 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.812549114 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.812941074 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.813019037 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.813023090 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.813064098 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.834618092 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.834729910 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.835228920 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.841734886 CET	49840	443	192.168.2.17	69.147.92.12
Feb 27, 2024 18:38:46.841753960 CET	443	49840	69.147.92.12	192.168.2.17
Feb 27, 2024 18:38:46.848788023 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.864782095 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.864790916 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:46.866097927 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866166115 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866223097 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866240978 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866275072 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866307974 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.866308928 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.866348028 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866468906 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.866533041 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:46.866661072 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:46.899149895 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.899188042 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.899532080 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.900245905 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:46.900257111 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:46.912779093 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:46.930166960 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.930202961 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.930475950 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.930475950 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:46.930511951 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:46.944726944 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.945782900 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.945806026 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.946230888 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.946590900 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.946660995 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:46.946773052 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:46.954233885 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.955900908 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.955966949 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.956020117 CET	443	49842	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.956049919 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.956511021 CET	49842	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.956914902 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.956962109 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.957911968 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.957911968 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:46.957952023 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:46.969212055 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:46.969242096 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:46.969341040 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:46.970118046 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:46.970134020 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:46.989943981 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.005969048 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:47.006035089 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:47.006094933 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:47.006459951 CET	49845	443	192.168.2.17	63.140.38.236
Feb 27, 2024 18:38:47.006475925 CET	443	49845	63.140.38.236	192.168.2.17
Feb 27, 2024 18:38:47.011368036 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.012136936 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.012155056 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.013453960 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.013648033 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.013911963 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.014010906 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.014123917 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.020663023 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.021073103 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.021095991 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.022147894 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.022480965 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.022551060 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.022660971 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.022739887 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.022881031 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.023061991 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.023085117 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.023169041 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.023188114 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.023430109 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.024122953 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.024122953 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.024139881 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.024188042 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.024251938 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.024333000 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.024696112 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.024696112 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.024713993 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.024760008 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.038395882 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038451910 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038492918 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038495064 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.038539886 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038629055 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038641930 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.038686037 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038698912 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.038718939 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038784981 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.038824081 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.039669037 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.039684057 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.039940119 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.053777933 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.053786039 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.069750071 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.069751978 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.069772959 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.069900036 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.092525959 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.092655897 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.101799965 CET	49839	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.101818085 CET	443	49839	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.101831913 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.102396965 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.102404118 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.102706909 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.104475021 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.104882002 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.104908943 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.117772102 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.121592045 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.122142076 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.122169971 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.123224020 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.123327971 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.123640060 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.123704910 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.124877930 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.151005983 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.151633024 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.151657104 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.152033091 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.152514935 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.152576923 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.152648926 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.164201021 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.165043116 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.165069103 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.165745020 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.165770054 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.166260958 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.166421890 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.167428017 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.167515993 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.167701006 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.167711973 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.193914890 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.197879076 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.211388111 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211467028 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211509943 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211514950 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211565018 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211591959 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211606979 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211606979 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211635113 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211668968 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211674929 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211688042 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211711884 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211733103 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211766958 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211790085 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211818933 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211853027 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211853981 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211894989 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211905003 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211925983 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211946011 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.211965084 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211965084 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.211992979 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212023973 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.212037086 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212057114 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212086916 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.212100029 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212130070 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.212142944 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212162018 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.212177992 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.212512970 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.212526083 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.213768959 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.213773012 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.260958910 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.270627975 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.270704985 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.273636103 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.273636103 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.278935909 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.278981924 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279031992 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279043913 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279078960 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.279086113 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279104948 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279120922 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.279202938 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279230118 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279230118 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.279242992 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.279273033 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.279985905 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280178070 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280219078 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280247927 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280257940 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280267954 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280277014 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280287981 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280296087 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280302048 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280303955 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280314922 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280322075 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280330896 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280345917 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280348063 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280354023 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280375957 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280383110 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280525923 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280595064 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280635118 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280771017 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.280781031 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.280987024 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281017065 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281048059 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281071901 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281081915 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281104088 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281328917 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281358004 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281383038 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281416893 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281428099 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281579971 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281821966 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281867027 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281867981 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281904936 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281908035 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281924963 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281929970 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281949997 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281950951 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281956911 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281959057 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281968117 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.281986952 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.281989098 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282223940 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282247066 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282269001 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282269001 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282280922 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282341957 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282366037 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282385111 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282412052 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282437086 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282557011 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282563925 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282624960 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282694101 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282721996 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282733917 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282740116 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282742977 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282763958 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282778025 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282799959 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.282804012 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.282921076 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.283574104 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.283605099 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.283637047 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.283663988 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.283667088 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.283677101 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.283696890 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.283721924 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.284466982 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.284524918 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.284558058 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.284729004 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.284744978 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.284832001 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.285254955 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.285305023 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.285336018 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.286139011 CET	49848	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.286158085 CET	443	49848	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.286161900 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.286187887 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.286197901 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.286220074 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.286287069 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.286305904 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.286467075 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.290162086 CET	49847	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.290188074 CET	443	49847	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.291572094 CET	49849	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.291587114 CET	443	49849	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.295814991 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.295892954 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.296900988 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.306400061 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.306629896 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.306730986 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.325445890 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.325469971 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.325875044 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.327373028 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.327403069 CET	443	49852	52.85.132.82	192.168.2.17
Feb 27, 2024 18:38:47.327426910 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.327830076 CET	49852	443	192.168.2.17	52.85.132.82
Feb 27, 2024 18:38:47.327874899 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.327888966 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.337127924 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.337157011 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.337174892 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.337194920 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.337224007 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.337620974 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.337635994 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.337673903 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.338845968 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.338857889 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.340512991 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.340591908 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.340595007 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.340624094 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.340806007 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.340812922 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.341280937 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.341295004 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.341345072 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.341372967 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.346137047 CET	49851	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.346163034 CET	443	49851	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.358438015 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358489990 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358526945 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358560085 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358560085 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.358607054 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358659029 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358690023 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.358696938 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358707905 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.358773947 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.358773947 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.358798027 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359306097 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359337091 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359368086 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359399080 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359419107 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.359440088 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.359467030 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.359582901 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.360138893 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.360366106 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.360399008 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.360430956 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.360445976 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.360562086 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.360574007 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361074924 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361107111 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361136913 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361171007 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.361183882 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361213923 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.361912966 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361946106 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361979008 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.361985922 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.361995935 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362705946 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362770081 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362804890 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362804890 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.362817049 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362874985 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.362874985 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.362885952 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.362915039 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.363024950 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.363024950 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.363042116 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.363622904 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.363640070 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:47.363656998 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.363660097 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:47.363688946 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.363692999 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.363706112 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.363739967 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.364470959 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.364507914 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.364531994 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.364537954 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.364548922 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.364595890 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.364609957 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.364712000 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.365403891 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.365479946 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.370752096 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.370882034 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.372629881 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.372994900 CET	49853	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:47.373007059 CET	443	49853	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:47.383395910 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383466959 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383481026 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383496046 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383516073 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383554935 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383557081 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383591890 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383605957 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383630037 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383634090 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383668900 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383702040 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383702040 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383713007 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383724928 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383753061 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383771896 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383779049 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383790016 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383812904 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.383832932 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383891106 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.383909941 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392725945 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392776966 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392817020 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.392819881 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392833948 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392867088 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.392869949 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392908096 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392924070 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.392944098 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392962933 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.392978907 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.392978907 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393008947 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393012047 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393023968 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393043041 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393064976 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393105030 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393107891 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393141031 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393158913 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393173933 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393173933 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393203020 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393234968 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393243074 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393254042 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393274069 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393285990 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393315077 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393327951 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393353939 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393358946 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393382072 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393393040 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393415928 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393431902 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393459082 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393491983 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393506050 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393527031 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393532038 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393568039 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393604040 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393606901 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393616915 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393640041 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393647909 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393676996 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393676996 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.393692970 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.393785954 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.413969040 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.414128065 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.414598942 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.414648056 CET	443	49854	99.86.229.20	192.168.2.17
Feb 27, 2024 18:38:47.414680004 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.415616989 CET	49854	443	192.168.2.17	99.86.229.20
Feb 27, 2024 18:38:47.452215910 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.452250957 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.452373981 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.453371048 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.453392029 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.476670980 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:47.476701975 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:47.476799965 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:47.477035046 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:47.477055073 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:47.480195045 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.480967999 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.481003046 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.481029034 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.481065035 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.481370926 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.483827114 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.483843088 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.483961105 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488040924 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488090992 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488123894 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488126993 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488141060 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488162041 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488178015 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488178015 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488204002 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488234043 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488248110 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488267899 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488284111 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488317966 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488409996 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488431931 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488431931 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488445997 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488481998 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488557100 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488735914 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488774061 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488804102 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488812923 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488825083 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.488864899 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.488864899 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.498934984 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.499031067 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.499795914 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.500176907 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.500190020 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.526422024 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.527216911 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.527229071 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.527678013 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.527817011 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.527906895 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.527932882 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.528054953 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.528232098 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.528321028 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.528548002 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.555546045 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555602074 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555643082 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555679083 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555700064 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555727959 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555751085 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555757999 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555783033 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555793047 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555807114 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555826902 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555901051 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555948019 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555948019 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.555949926 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555963039 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.555999041 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556030035 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556042910 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556042910 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556051970 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556065083 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556107044 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556107044 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556118011 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556126118 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556159019 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556185961 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556191921 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556204081 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556224108 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556257963 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556282997 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.556291103 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556346893 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.556365967 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.558238983 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.558253050 CET	443	49830	20.50.2.53	192.168.2.17
Feb 27, 2024 18:38:47.558273077 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.558736086 CET	49830	443	192.168.2.17	20.50.2.53
Feb 27, 2024 18:38:47.560185909 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.560234070 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.560457945 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.560798883 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.560813904 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.573904991 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.579777956 CET	49850	443	192.168.2.17	104.244.42.5
Feb 27, 2024 18:38:47.579809904 CET	443	49850	104.244.42.5	192.168.2.17
Feb 27, 2024 18:38:47.601977110 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.602118969 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.602739096 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.602801085 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.602837086 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.602864027 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.602931023 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.603169918 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.603545904 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.603563070 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.603874922 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.603985071 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.604033947 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.604067087 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.604080915 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.604115009 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.604543924 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.604857922 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.605135918 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.605684996 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.605920076 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.605953932 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.605953932 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.605967045 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.605994940 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.606214046 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.606764078 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.606873989 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.606900930 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.607172012 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.607172012 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.607990026 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.609162092 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.609190941 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.609571934 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.610016108 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.610016108 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.610107899 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.619502068 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.620038986 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.620049000 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.621119976 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.621490955 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.621490955 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.621556044 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.621902943 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.621907949 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.641699076 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.642199993 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.642216921 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.642769098 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.643197060 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.643323898 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.646188974 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.649867058 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.650506973 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.650536060 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.651613951 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.651771069 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.653058052 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.653058052 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.653080940 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.653129101 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.657754898 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.673824072 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.685532093 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.685882092 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.685904026 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.686237097 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.686781883 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.686781883 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.686795950 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.686849117 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.693902016 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.707051992 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.707082033 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.729331017 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.730948925 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.730974913 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.732110023 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.732217073 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.733076096 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.733148098 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.735697031 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.736859083 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.752804041 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.757544041 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.757906914 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.757917881 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.758347034 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.759633064 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.759640932 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.759854078 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.764713049 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.764753103 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.764772892 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.764790058 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.764853001 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.771239996 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.771292925 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.771436930 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.771446943 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.771927118 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.777550936 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.777791977 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.781910896 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.783921003 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.784316063 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.784734011 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.784746885 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:47.790568113 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.790657997 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.791071892 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.795974016 CET	49859	443	192.168.2.17	64.202.112.191
Feb 27, 2024 18:38:47.795995951 CET	443	49859	64.202.112.191	192.168.2.17
Feb 27, 2024 18:38:47.813047886 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.814121962 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.814141989 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.814517975 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.814984083 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.814984083 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.814997911 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.815048933 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.832741022 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:47.837147951 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.837198019 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.837230921 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.837291956 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.837320089 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.837451935 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.838012934 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.838053942 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.838219881 CET	443	49867	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.838283062 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.838283062 CET	49867	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.842050076 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.842091084 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.842300892 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.842546940 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:47.842561960 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:47.849083900 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.849128008 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.849149942 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.849179983 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.849268913 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.852209091 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.852361917 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.858669996 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.858793974 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.858822107 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.858836889 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.859689951 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.864759922 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.865077019 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.865106106 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.865252018 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.865266085 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.865562916 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.871462107 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.871825933 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.879163980 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.879192114 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.879272938 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.879317045 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.879406929 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.884208918 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.884260893 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.884287119 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.884326935 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.884560108 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.890242100 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.890428066 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.896234035 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.896378994 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.896392107 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.902244091 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.902270079 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.902694941 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.902709007 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.902916908 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.908266068 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.908294916 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.908421040 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.908433914 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.908638954 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.912765980 CET	49846	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.912800074 CET	443	49846	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.914283037 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.914421082 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.918798923 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918848991 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918906927 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918940067 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918967962 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.918977976 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918991089 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.918999910 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.919064999 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919070005 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.919083118 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919152975 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.919408083 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919483900 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919528961 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919563055 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919584990 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.919593096 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.919616938 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.920367002 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920409918 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920432091 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.920439005 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920480013 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920504093 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.920511007 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920552969 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.920737028 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.921155930 CET	49860	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.921165943 CET	443	49860	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924596071 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924643993 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924678087 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924705982 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924725056 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.924738884 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924766064 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.924813986 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924850941 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924856901 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.924873114 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924880028 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.924899101 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.924906015 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.924932003 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.924937963 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.924959898 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.925415039 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.925580978 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.925611019 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.925637960 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.925671101 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.925674915 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.925699949 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.926255941 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.926387072 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.926409960 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.926444054 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.926474094 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.926501036 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.926506042 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.926529884 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.927246094 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.927316904 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.927323103 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.927375078 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.927406073 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.927422047 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.927427053 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.927474976 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.928098917 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.928251982 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.928283930 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.928302050 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.928308010 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.928571939 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.928575993 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929109097 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929136992 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929166079 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.929166079 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929177999 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929240942 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.929248095 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929301977 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.929883957 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929944038 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929991961 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.929996014 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.930002928 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.930285931 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.930831909 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.930891991 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.930926085 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.930953026 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.930953979 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.930962086 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.931077957 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.931570053 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.931659937 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.931690931 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.931694031 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.931705952 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.931720972 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.931752920 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.932450056 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.932518959 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.932691097 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.933938980 CET	49861	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.933954000 CET	443	49861	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940392017 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940443039 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940471888 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940484047 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.940493107 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940495968 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.940521002 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940540075 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.940551996 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.940572023 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.940583944 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.940644979 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940671921 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940694094 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.940700054 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940700054 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.940784931 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.940807104 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.940838099 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.942935944 CET	49862	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:47.942950010 CET	443	49862	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:47.943196058 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.943228960 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.943366051 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.943378925 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.948164940 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.948194981 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.948385954 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.948401928 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.949037075 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.952891111 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.952969074 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.957293987 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.957324982 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.957367897 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.957389116 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.957531929 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.961792946 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.961817980 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.961884975 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.961901903 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.962013006 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.965859890 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.966037989 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.970082045 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.970114946 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.970151901 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.970165014 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.970432997 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.974308968 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.974422932 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.974432945 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.974481106 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:47.974608898 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.975007057 CET	49857	443	192.168.2.17	31.13.66.19
Feb 27, 2024 18:38:47.975023031 CET	443	49857	31.13.66.19	192.168.2.17
Feb 27, 2024 18:38:48.034831047 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.035624981 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.035648108 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.036777973 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.037205935 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.037205935 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.037292957 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.037545919 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.043652058 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.043904066 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.043941021 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.045042992 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.046050072 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.046050072 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.046164036 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.046627998 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.051384926 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.051445961 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.051546097 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.051795006 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.051811934 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.064069033 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:48.064141989 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:48.064204931 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:48.064987898 CET	49869	443	192.168.2.17	104.244.42.131
Feb 27, 2024 18:38:48.065013885 CET	443	49869	104.244.42.131	192.168.2.17
Feb 27, 2024 18:38:48.081901073 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.086899042 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.086899996 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.086918116 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.086930037 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.121303082 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.121356964 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.121397018 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.121426105 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.121442080 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.121494055 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.121587992 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.122525930 CET	49871	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.122545958 CET	443	49871	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.127039909 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.127078056 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.127286911 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.127460003 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.127475977 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.134737968 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.134928942 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.143587112 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.143625975 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.143985033 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.144159079 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.144177914 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.144195080 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.144196033 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.144318104 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.144440889 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.144458055 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.194489002 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.194545984 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.194719076 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.195075035 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.195087910 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.236052990 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.236135960 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.236254930 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.237971067 CET	49872	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.237994909 CET	443	49872	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.247150898 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.247426033 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.247447968 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.248519897 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.249011993 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.249712944 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.249789000 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.249955893 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.249968052 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.294751883 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.363765001 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.363806963 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.363898993 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.364130974 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.364145994 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.398930073 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.399454117 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.399470091 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.400218010 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.401015997 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.401058912 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.401082993 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.401145935 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402178049 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402379990 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.402422905 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402453899 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.402537107 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402827024 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402858019 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.402867079 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.403001070 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.414876938 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.415544033 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.415575027 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.416263103 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.416706085 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.416820049 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.416865110 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.417671919 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.418005943 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.418016911 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.419061899 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.419454098 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.419454098 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.419528008 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.419919968 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.425436020 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425462008 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425470114 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425498009 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425518990 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425528049 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425534010 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425573111 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425587893 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425606966 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425710917 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425870895 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425904036 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425949097 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.425981045 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425981045 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.425992012 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.426012039 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.426014900 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.426368952 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.426368952 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.438322067 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.438380003 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.438757896 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.439023972 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.439040899 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.443681002 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.443761110 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.443849087 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.444331884 CET	49875	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.444360018 CET	443	49875	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.445913076 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.446846008 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.446882963 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.446962118 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.447510004 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.447525024 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.452771902 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.452799082 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.452898026 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.452909946 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.461905956 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.468776941 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.468802929 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.468815088 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.500756979 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.501430988 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.517529964 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.528383970 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.528436899 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.528562069 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.528776884 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.528798103 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.543391943 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.543471098 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.543600082 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.544159889 CET	49879	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.544181108 CET	443	49879	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.559115887 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.559170008 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.559238911 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.559266090 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.559355974 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.559525967 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.560307980 CET	49878	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:48.560333967 CET	443	49878	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:48.573581934 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.573636055 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.573916912 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.574424028 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.574449062 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.615802050 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.616287947 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.616324902 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.616625071 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:48.616785049 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:48.617412090 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.617525101 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.618021011 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.618104935 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.618134022 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.628128052 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:48.628169060 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:48.628545046 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:48.639529943 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.640810013 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.640844107 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.641292095 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.641860008 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.641860008 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.641875029 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.641964912 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.659801006 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.659835100 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.672271013 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.672318935 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.672419071 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.672486067 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.672540903 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.672647953 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.672765970 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.672779083 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.673387051 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.673403025 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.675760984 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:48.691814899 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.702116966 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.702171087 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.702214003 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.702277899 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.702797890 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.703113079 CET	49877	443	192.168.2.17	104.18.131.236
Feb 27, 2024 18:38:48.703133106 CET	443	49877	104.18.131.236	192.168.2.17
Feb 27, 2024 18:38:48.707760096 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.728091955 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.730654001 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.730674982 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.731839895 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.732204914 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.732633114 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.732633114 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.732706070 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.739738941 CET	49868	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.739759922 CET	443	49868	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.765773058 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.765855074 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.766041994 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.766402006 CET	49880	443	192.168.2.17	104.244.42.67
Feb 27, 2024 18:38:48.766422987 CET	443	49880	104.244.42.67	192.168.2.17
Feb 27, 2024 18:38:48.768359900 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.768898964 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.768937111 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.770025969 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.770173073 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.770673990 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.770673990 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.770701885 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.770756960 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.786823988 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.786844969 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.819171906 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.819214106 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.827079058 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.828186989 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.828206062 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.828659058 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.829664946 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.829664946 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.829695940 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.829781055 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:48.832740068 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.832825899 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.833950996 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.834733009 CET	49882	443	192.168.2.17	34.96.102.137
Feb 27, 2024 18:38:48.834752083 CET	443	49882	34.96.102.137	192.168.2.17
Feb 27, 2024 18:38:48.834806919 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.851037025 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.851238966 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.851947069 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.852299929 CET	49884	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:48.852317095 CET	443	49884	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:48.865371943 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:48.865575075 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:48.865591049 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:48.865787983 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.880796909 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:48.914470911 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.917237997 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.948757887 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.948945045 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.949139118 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.955054998 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.955074072 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.955239058 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.955267906 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.956497908 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.956564903 CET	49887	443	192.168.2.17	35.244.154.8
Feb 27, 2024 18:38:48.956589937 CET	443	49887	35.244.154.8	192.168.2.17
Feb 27, 2024 18:38:48.956624031 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.957741976 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.957824945 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.957849026 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.959152937 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.959304094 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.960376978 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.960376978 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:48.960397959 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.960556030 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:48.969927073 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.970011950 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.970366001 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.970705986 CET	49888	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:48.970727921 CET	443	49888	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:48.987250090 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:48.987287998 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:48.987397909 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:48.987667084 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:48.987678051 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:48.997912884 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.007776976 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.007801056 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.007805109 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.007812023 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.054758072 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.054876089 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.070142984 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.070229053 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.071253061 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.071345091 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.071362972 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.071418047 CET	49863	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.071424007 CET	443	49863	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.076672077 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.076697111 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.077632904 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.077634096 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.077763081 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.094003916 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.094103098 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.094297886 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.095104933 CET	49890	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.095124006 CET	443	49890	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.108037949 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.108103037 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.108203888 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.108298063 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.108426094 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.109225988 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.109225988 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.180649042 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.180978060 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.181008101 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.182086945 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.182220936 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.182532072 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.182605028 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.182751894 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.213151932 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.213244915 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.214477062 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.214915991 CET	49883	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.214951992 CET	443	49883	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.225914955 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.227799892 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.227817059 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.272876978 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.274406910 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.274406910 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.274454117 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.274789095 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.275783062 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.276575089 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.276999950 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.277007103 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.371599913 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.371643066 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.371896029 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.371972084 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.371980906 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.389544964 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.389643908 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.389825106 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.390197992 CET	49892	443	192.168.2.17	142.251.163.106
Feb 27, 2024 18:38:49.390219927 CET	443	49892	142.251.163.106	192.168.2.17
Feb 27, 2024 18:38:49.416774988 CET	49891	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:49.416807890 CET	443	49891	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:49.481219053 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.481298923 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.481450081 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.481667995 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.481667995 CET	49893	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.481688976 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.481700897 CET	443	49893	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.487298012 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.487346888 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.487755060 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.487899065 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.487909079 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.683845043 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.684160948 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.685904026 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.685921907 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.686233997 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.688165903 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.688165903 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.688188076 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.761178017 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.762198925 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.762228012 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.763673067 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.763813019 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.764199018 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.764285088 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.764410019 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.764424086 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:49.811731100 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:49.882122040 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.882249117 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.882348061 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.892330885 CET	49898	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.892350912 CET	443	49898	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.895931005 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.895972967 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:49.896214008 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.896497965 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.896508932 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:49.897197008 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.897228003 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:49.897284985 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.897630930 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:49.897644997 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:49.907727003 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.907767057 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:49.907862902 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.908441067 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:49.908473015 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.067224979 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.067286015 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.067359924 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.067790985 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.067806959 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.092041016 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.092305899 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.092323065 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.093033075 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.093400002 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.093485117 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.093556881 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.093590021 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.095761061 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.095788002 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.096239090 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.096573114 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.096671104 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.096803904 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.096820116 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.101178885 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.101313114 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.102802038 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.102826118 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.103106022 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.104327917 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.104464054 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.104486942 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.137900114 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.143764019 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.147401094 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:50.147494078 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:50.147667885 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:50.148806095 CET	49897	443	192.168.2.17	52.30.38.148
Feb 27, 2024 18:38:50.148833036 CET	443	49897	52.30.38.148	192.168.2.17
Feb 27, 2024 18:38:50.270843983 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.270945072 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.271008968 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.272315025 CET	49901	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.272327900 CET	443	49901	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.275316000 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.275357962 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.275422096 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.275696039 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.275710106 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.290631056 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.290688038 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.290730953 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.290756941 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.290865898 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.291656017 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.292685986 CET	49902	443	192.168.2.17	157.240.229.35
Feb 27, 2024 18:38:50.292697906 CET	443	49902	157.240.229.35	192.168.2.17
Feb 27, 2024 18:38:50.295114994 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.295145988 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.295213938 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.295423031 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.295434952 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.302999020 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.303076029 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.303117990 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.303447008 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.303468943 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.303487062 CET	49903	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.303493023 CET	443	49903	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.325468063 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.325731039 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.325767994 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.325957060 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.326075077 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.326090097 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.326206923 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.326224089 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.327318907 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.327382088 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.328427076 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.328625917 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.328629017 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.369904041 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.380908966 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.380929947 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.427745104 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.465099096 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.466419935 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.466445923 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.466784954 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.467161894 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.467225075 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.467350006 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.483520031 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.484113932 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.484132051 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.484683037 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.485100031 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.485158920 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.485333920 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.513911009 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.529911995 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.587153912 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.587477922 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.587502003 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.587865114 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.588191986 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.588258982 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.588299036 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.629909039 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.633759022 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.651294947 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.651392937 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.651776075 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.652122974 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.652148008 CET	443	49907	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.652164936 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.652997971 CET	49907	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.682813883 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.682885885 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.682951927 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.682977915 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.683075905 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.683152914 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.684137106 CET	49908	443	192.168.2.17	31.13.66.35
Feb 27, 2024 18:38:50.684153080 CET	443	49908	31.13.66.35	192.168.2.17
Feb 27, 2024 18:38:50.751096010 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.751178980 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.751224995 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.751715899 CET	49906	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.751730919 CET	443	49906	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.752765894 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.752811909 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.752873898 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.753202915 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:50.753215075 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:50.761710882 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.761786938 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.761894941 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.762145996 CET	49910	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.762159109 CET	443	49910	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.764704943 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:50.764743090 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.764888048 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:50.765223980 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:50.765238047 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.765676022 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.765707970 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.765758991 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.765994072 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.766009092 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.921921968 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.921967983 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.922142982 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.922497988 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:50.922517061 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:50.980632067 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.981333017 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.981618881 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.981652021 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.981741905 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:50.981770039 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.982163906 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.982434988 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.982800961 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.982880116 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:50.983067989 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:50.983148098 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:50.983208895 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:50.983261108 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:51.013746977 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.014008999 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.014034986 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.014658928 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.015010118 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.015170097 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.015177011 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.015216112 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.021758080 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.021876097 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.025906086 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:51.029911995 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:51.066505909 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.115441084 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.115617037 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.117470980 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.117481947 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.117782116 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.118643999 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.118930101 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.118940115 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.162636995 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:51.162740946 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:51.162914038 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:51.163280010 CET	49914	443	192.168.2.17	172.253.122.156
Feb 27, 2024 18:38:51.163297892 CET	443	49914	172.253.122.156	192.168.2.17
Feb 27, 2024 18:38:51.173692942 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:51.173795938 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:51.173979044 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:51.175328970 CET	49913	443	192.168.2.17	142.251.163.103
Feb 27, 2024 18:38:51.175360918 CET	443	49913	142.251.163.103	192.168.2.17
Feb 27, 2024 18:38:51.200885057 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.201014996 CET	443	49912	172.64.155.119	192.168.2.17
Feb 27, 2024 18:38:51.201097965 CET	49912	443	192.168.2.17	172.64.155.119
Feb 27, 2024 18:38:51.230375051 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:51.230505943 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:51.230700016 CET	443	49821	172.253.122.103	192.168.2.17
Feb 27, 2024 18:38:51.230700970 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:51.230829000 CET	49821	443	192.168.2.17	172.253.122.103
Feb 27, 2024 18:38:51.318097115 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.318185091 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.318373919 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.318676949 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.318676949 CET	49915	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.318710089 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.318725109 CET	443	49915	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.324007034 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.324058056 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.324153900 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.324656010 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.324670076 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.522774935 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.522857904 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.524241924 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.524249077 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.524485111 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.525526047 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.525681973 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.525686979 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.725151062 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.725238085 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.725331068 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.725788116 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.725802898 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:38:51.725835085 CET	49922	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:38:51.725841045 CET	443	49922	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.765438080 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.765495062 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.765721083 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.766362906 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.766381979 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.971636057 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.971766949 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.975904942 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.975925922 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.976226091 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:06.977286100 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.977648020 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:06.977683067 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.171323061 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.171642065 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.171791077 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.171792030 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.171909094 CET	49923	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.171947956 CET	443	49923	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.175672054 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.175713062 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.176012993 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.177129984 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.177145004 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.374145985 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.375900984 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.416703939 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.416724920 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.417089939 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.460879087 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.539612055 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.539804935 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.539825916 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.737942934 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.738030910 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.738078117 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.738377094 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.738390923 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.738414049 CET	49924	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.738420010 CET	443	49924	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.742430925 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.742470026 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.742562056 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.743186951 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.743201017 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.908953905 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:07.908966064 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:07.909054995 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:07.909066916 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:07.909128904 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:07.909166098 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:07.910314083 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:07.910342932 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:07.910362959 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:07.910379887 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:07.947758913 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.947835922 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.949110031 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.949121952 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.949369907 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:07.950445890 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.950690985 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:07.950719118 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.144810915 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.144906998 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.146183014 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.146253109 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.150029898 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.150212049 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.150269985 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.150402069 CET	49925	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.150422096 CET	443	49925	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.152122021 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.152138948 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.152153015 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.152177095 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.152424097 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.152465105 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.152477980 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.152544022 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.152559042 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.152609110 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.152643919 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.152951956 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.153040886 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.153094053 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.153213978 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.197907925 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.197918892 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.341834068 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.341927052 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.341955900 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.341975927 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.342001915 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.342027903 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.352104902 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.352197886 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.353400946 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.353413105 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.353681087 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.354535103 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.354707003 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.354712963 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.372741938 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.372843981 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.372880936 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.372905970 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.372929096 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.372951984 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.372983932 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.372997046 CET	443	49927	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:08.373018980 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.373038054 CET	49927	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:08.400160074 CET	49926	443	192.168.2.17	34.149.149.62
Feb 27, 2024 18:39:08.400196075 CET	443	49926	34.149.149.62	192.168.2.17
Feb 27, 2024 18:39:08.554285049 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.554349899 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.554424047 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.554733992 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.554784060 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.554814100 CET	49930	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.554831028 CET	443	49930	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.556828976 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.556884050 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.556958914 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.557480097 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.557504892 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.763027906 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.763123989 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.764374971 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.764403105 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.764661074 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.765446901 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.765605927 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.765631914 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.960648060 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.960849047 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.960913897 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.961184025 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.961201906 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.961236000 CET	49931	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.961241961 CET	443	49931	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.963468075 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.963509083 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:08.963574886 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.964010000 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:08.964021921 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.161304951 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.161389112 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.162664890 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.162674904 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.162915945 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.163754940 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.163924932 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.163948059 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.364039898 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.364219904 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.364284039 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.364586115 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.364607096 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.364633083 CET	49933	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.364639997 CET	443	49933	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.367577076 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.367667913 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.367793083 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.368202925 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.368231058 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.565480947 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.565587997 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.567126989 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.567153931 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.567425013 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.568239927 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.568403959 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.568409920 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.773581028 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.773772001 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.773849010 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.774249077 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.774271011 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:09.774322033 CET	49934	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:09.774329901 CET	443	49934	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.128499031 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.128595114 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.128690004 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.129317045 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.129353046 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.275532961 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.275569916 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.275628090 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.276530981 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.276540041 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.322491884 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.322566032 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.324079037 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.324105024 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.324465990 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.325256109 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.325393915 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.325407028 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.470352888 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.470418930 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.470886946 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.470896006 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.471220970 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.471225023 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.525567055 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.525660992 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.525715113 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.525947094 CET	49935	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.525964975 CET	443	49935	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.528032064 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.528074026 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.528148890 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.528512001 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.528523922 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.688702106 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.688729048 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.688760996 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.688802958 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.688828945 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.688846111 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.688872099 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.694960117 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.695033073 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.695565939 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.695617914 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.701374054 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.701435089 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.707806110 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.707864046 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.714308977 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.714380980 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.722302914 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.722368002 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.723567963 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.723577976 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.723846912 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.724683046 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.724845886 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.724850893 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.781362057 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.781434059 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.784476995 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.784543991 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.791021109 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.791089058 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.791162968 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.791167021 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.791210890 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.791397095 CET	49936	443	192.168.2.17	34.111.24.1
Feb 27, 2024 18:39:10.791414976 CET	443	49936	34.111.24.1	192.168.2.17
Feb 27, 2024 18:39:10.926282883 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.926393032 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.926455975 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.926662922 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.926676035 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:10.926698923 CET	49938	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:10.926703930 CET	443	49938	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:11.048207045 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:11.048233986 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:11.048335075 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:11.050913095 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:11.050924063 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:11.245397091 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:11.245529890 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.185957909 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.185978889 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.186336994 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.197756052 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.197896957 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.197910070 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.399586916 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.399667025 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.399744987 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.400072098 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.400089025 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.400109053 CET	49940	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.400115013 CET	443	49940	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.405313015 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.405350924 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.405428886 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.405859947 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.405874014 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.605348110 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.605432034 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.608231068 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.608242035 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.608526945 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.609395027 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.609529018 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.609560013 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.804666042 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.804857969 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.804925919 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.805192947 CET	49942	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.805208921 CET	443	49942	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.809556961 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.809596062 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:12.809696913 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.810136080 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:12.810148001 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.005763054 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.005844116 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.007110119 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.007117033 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.007344007 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.008135080 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.008268118 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.008290052 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.208327055 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.208544016 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.208617926 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.208688021 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.208702087 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.208750963 CET	49944	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.208755970 CET	443	49944	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.214806080 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.214848995 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.214920044 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.215712070 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.215729952 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.407861948 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.407947063 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.409178972 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.409189939 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.409440041 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.411659002 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.411818027 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.411823034 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.609601021 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.609718084 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.609783888 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.610091925 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.610111952 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.610171080 CET	49945	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.610177994 CET	443	49945	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.945903063 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.945951939 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:13.946043015 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.946830988 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:13.946845055 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.116519928 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.116586924 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.116697073 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.116986990 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.117012024 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.142416954 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.142508030 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.291306019 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.291382074 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.291712046 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.292756081 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.293046951 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.293059111 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.321063042 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.321151018 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.325454950 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.325469971 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.325769901 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.325881004 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.326294899 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.369915009 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.490840912 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.490927935 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.491013050 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.491312981 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.491353035 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.491379976 CET	49947	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.491396904 CET	443	49947	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.495317936 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.495354891 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.495424032 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.495980978 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.495995045 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.528758049 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.528832912 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.528835058 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.528877020 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.529957056 CET	49951	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.529962063 CET	443	49951	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.689007044 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.689106941 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.690422058 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.690432072 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.690686941 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.691473007 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.691607952 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.691648960 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.895751953 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.895840883 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.895911932 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.896174908 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.896188974 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.896204948 CET	49953	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.896209955 CET	443	49953	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.900038958 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.900068998 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:14.900410891 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.901061058 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:14.901076078 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.097759008 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.097862005 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.099136114 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.099150896 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.099404097 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.100567102 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.100737095 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.100747108 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.303205967 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.303314924 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.303381920 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.304559946 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.304583073 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.304599047 CET	49954	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.304605961 CET	443	49954	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.307461023 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.307518005 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.307694912 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.308059931 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.308074951 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.500849009 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.500930071 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.502494097 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.502504110 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.502814054 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.503649950 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.503834009 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.503842115 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.702244043 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.702372074 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.702433109 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.702672005 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.702701092 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.702737093 CET	49955	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.702744961 CET	443	49955	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.706518888 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.706614017 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.706708908 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.707084894 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.707124949 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.900398016 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.900486946 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.901699066 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.901724100 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.901988983 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:15.902779102 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.902946949 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:15.902980089 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.105005026 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.105156898 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.105232000 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.105462074 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.105485916 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.105530024 CET	49956	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.105537891 CET	443	49956	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.109508991 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.109560013 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.109661102 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.110133886 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.110151052 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.302664042 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.302730083 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.304039001 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.304059982 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.304321051 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.305075884 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.305207014 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.305233002 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.505063057 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.505148888 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.505220890 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.505482912 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.505501032 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.505526066 CET	49957	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.505532980 CET	443	49957	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.509377956 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.509412050 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.509531975 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.509922981 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.509938002 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.538005114 CET	49699	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:39:16.631238937 CET	80	49699	192.229.211.108	192.168.2.17
Feb 27, 2024 18:39:16.631311893 CET	49699	80	192.168.2.17	192.229.211.108
Feb 27, 2024 18:39:16.702768087 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.703125000 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.704243898 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.704252958 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.704509974 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.705305099 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.705965996 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.705987930 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.907658100 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.907855034 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.908001900 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.908155918 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.908171892 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:16.908237934 CET	49958	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:16.908242941 CET	443	49958	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.345148087 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.345190048 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.345277071 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.346787930 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.346801043 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.545243025 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.545321941 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.657445908 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.657471895 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.657850981 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.659447908 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.659898996 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.659904957 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.857322931 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.857405901 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.857470036 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.857738018 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.857760906 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.857779980 CET	49959	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.857786894 CET	443	49959	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.859749079 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.859796047 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:17.860234022 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.860564947 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:17.860573053 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.055283070 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.055378914 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.056632996 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.056648970 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.056912899 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.057805061 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.057955980 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.057965040 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.259076118 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.259150028 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.259203911 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.259438038 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.259459019 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:18.259471893 CET	49962	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:18.259479046 CET	443	49962	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.408629894 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.501008034 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.501108885 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.501358032 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.501435995 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.594060898 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.594316006 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.611988068 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.616564989 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.616596937 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.616858959 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.617238045 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.617248058 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.655914068 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:19.815543890 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:19.815649033 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:20.736342907 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:20.736342907 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:20.826318979 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:20.826345921 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:20.826931000 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:20.828983068 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:20.846625090 CET	80	49964	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:20.871129990 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:20.886971951 CET	49964	80	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:22.861826897 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:22.905908108 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.729005098 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.729062080 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.838812113 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.838913918 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.839586020 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.841156960 CET	49966	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.841185093 CET	443	49966	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.844686031 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.844731092 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.844824076 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.845240116 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.845251083 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.904922962 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.904973984 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:25.905133009 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.907540083 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:25.907552958 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.052061081 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.052182913 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.053452015 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.053462982 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.053872108 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.054748058 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.054900885 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.054908037 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.120744944 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.120815992 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.121795893 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.121809006 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.122251987 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.169868946 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.246715069 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.246803045 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.246993065 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.247064114 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.247085094 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.247102022 CET	49967	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.247107983 CET	443	49967	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.247751951 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.247806072 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.247817039 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.445724010 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.445815086 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:26.446119070 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.592339993 CET	49968	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:26.592376947 CET	443	49968	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.198587894 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.198626041 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.198714972 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.199244022 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.199260950 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.405101061 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.405174971 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.406682014 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.406687975 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.406944036 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.408556938 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.408644915 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:27.408651114 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.607249975 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.607433081 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:27.607574940 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:28.087450981 CET	49970	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:28.087465048 CET	443	49970	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.452554941 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.452601910 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.452681065 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.453201056 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.453216076 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.648540020 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.648658037 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.649955988 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.649965048 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.650309086 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.651093960 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.651276112 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.651279926 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.849865913 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.850128889 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.850188971 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.861696005 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.861720085 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:37.861745119 CET	49975	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:37.861751080 CET	443	49975	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.526393890 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.526475906 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.526555061 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.527026892 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.527064085 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.720927954 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.721002102 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.722160101 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.722170115 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.722420931 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.723505020 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.723673105 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.723679066 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.923820972 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.923902035 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.924001932 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.924232960 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.924280882 CET	443	49977	34.117.223.223	192.168.2.17
Feb 27, 2024 18:39:41.924312115 CET	49977	443	192.168.2.17	34.117.223.223
Feb 27, 2024 18:39:41.924329996 CET	443	49977	34.117.223.223	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2024 18:38:10.158162117 CET	62281	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:10.282598019 CET	53	62281	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:12.705156088 CET	61680	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:12.827869892 CET	53	61680	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:22.936279058 CET	49241	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:23.573662043 CET	55218	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:24.290976048 CET	61943	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:24.414621115 CET	53	61943	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:36.534615040 CET	60904	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:36.657385111 CET	53	60904	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:36.674664974 CET	54597	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:36.800093889 CET	53	54597	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:37.412868023 CET	63177	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:37.515491962 CET	51356	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:37.543898106 CET	56354	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:37.865923882 CET	57066	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:37.993917942 CET	61032	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:40.639482975 CET	62898	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:40.640105963 CET	57042	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:40.685307980 CET	60061	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:40.685781002 CET	55273	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:40.755470037 CET	53	53715	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:40.765664101 CET	53	54149	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:41.361588001 CET	53	58329	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:41.838310957 CET	51100	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.838556051 CET	51172	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.839020967 CET	53753	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.839267969 CET	52760	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.935806036 CET	53882	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.936249018 CET	57465	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:41.960967064 CET	53	51172	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:41.962168932 CET	53	51100	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:42.511866093 CET	53468	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:42.512614012 CET	51766	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:42.574245930 CET	57078	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:42.574444056 CET	63780	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.097779989 CET	53	52675	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:43.613002062 CET	53	52184	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:43.639386892 CET	52170	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.639386892 CET	52168	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.639894962 CET	58914	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.640141010 CET	58948	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.642333984 CET	57118	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.642802000 CET	52310	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:43.765662909 CET	53	57118	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:43.767000914 CET	53	52310	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:43.885772943 CET	53	62126	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.214657068 CET	52031	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.214767933 CET	61965	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.228043079 CET	50623	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.228374958 CET	65472	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.338912964 CET	53	52031	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.338973045 CET	53	61965	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.350770950 CET	53	65472	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.352929115 CET	53	50623	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.488305092 CET	64294	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.488451958 CET	60272	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.491009951 CET	57793	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.491009951 CET	50210	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.610783100 CET	53	64294	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.611747026 CET	53	60272	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.915240049 CET	64757	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.915405035 CET	60815	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:44.924490929 CET	53	57723	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:44.927175999 CET	53	60875	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.018832922 CET	49446	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.019810915 CET	62923	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.027250051 CET	49856	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.027494907 CET	52804	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.030817986 CET	65138	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.030999899 CET	62282	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.040738106 CET	53	60815	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.041070938 CET	53	64757	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.058579922 CET	62239	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.058784008 CET	56139	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.141844988 CET	53	49446	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.152817011 CET	53	52804	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.153564930 CET	53	65138	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.153728962 CET	53	62282	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.167728901 CET	53	62923	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.181730986 CET	53	62239	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.182611942 CET	53	56139	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.213398933 CET	54857	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.213566065 CET	53586	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.221745014 CET	49621	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.222023964 CET	49834	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.222472906 CET	52346	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.222691059 CET	62667	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.223114014 CET	50458	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.223428011 CET	56755	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.314295053 CET	53651	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.314553022 CET	55265	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.321630001 CET	56955	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.323923111 CET	51602	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.347162008 CET	53	49834	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.347649097 CET	53	49621	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.348818064 CET	53	62667	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.348982096 CET	53	52346	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.436548948 CET	53	55265	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.438469887 CET	53	53651	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.438519001 CET	50795	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.438782930 CET	61989	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.561244965 CET	53	61989	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.562391043 CET	53	50795	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.817065954 CET	60417	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.817296982 CET	51778	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.824933052 CET	53809	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.825210094 CET	64846	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.948339939 CET	53	64846	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.950053930 CET	53	53809	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.952224970 CET	57199	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.952575922 CET	52157	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.953445911 CET	53	51778	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.958748102 CET	49686	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.959027052 CET	54579	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.959330082 CET	53	60417	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:45.970669031 CET	64726	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:45.970669031 CET	54033	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.018413067 CET	64223	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.018625021 CET	60417	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.036170959 CET	60026	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.036436081 CET	56915	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.077064991 CET	53	52157	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.080102921 CET	53	57199	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.081720114 CET	53	49686	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.082890987 CET	53	54579	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.141239882 CET	53	64223	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.143074989 CET	53	60417	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.158823013 CET	53	60026	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.160032034 CET	53	56915	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.334408998 CET	54565	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.335392952 CET	53446	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.415930986 CET	58505	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.416328907 CET	52844	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.459049940 CET	53	54565	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.461097002 CET	53	53446	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.473119020 CET	63471	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.473423958 CET	58557	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.487850904 CET	59750	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.488744020 CET	57174	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.502027035 CET	53	53368	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.539007902 CET	53	58505	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.539259911 CET	53	52844	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.595623970 CET	53	58557	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.612454891 CET	53	59750	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.617583990 CET	53	57174	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.634815931 CET	54558	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.634815931 CET	64036	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.758752108 CET	53	64036	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.759010077 CET	53	54558	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.803908110 CET	57104	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.804115057 CET	56446	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.842468977 CET	57443	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.842674017 CET	55709	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:46.928626060 CET	53	56446	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.929582119 CET	53	57104	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.967405081 CET	53	55709	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:46.967624903 CET	53	57443	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.324289083 CET	57467	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.324419975 CET	55016	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.326608896 CET	52023	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.326797009 CET	55576	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.345396996 CET	62312	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.345716000 CET	58584	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.374418974 CET	58120	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.374659061 CET	56981	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.391804934 CET	64897	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.391804934 CET	56388	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.450747967 CET	53	52023	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.450762033 CET	53	55576	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.473563910 CET	53	55016	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.474734068 CET	53	57467	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.497406960 CET	53	58120	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.497517109 CET	53	56981	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:47.927041054 CET	57369	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.927673101 CET	60583	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.953629017 CET	56059	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:47.954134941 CET	62877	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.019510984 CET	56602	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.019849062 CET	54234	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.049213886 CET	53	57369	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.050862074 CET	53	60583	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.068537951 CET	50142	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.069545031 CET	50935	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.077879906 CET	53	62877	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.142333031 CET	53	56602	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.143112898 CET	53	54234	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.192715883 CET	53	50142	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.193825960 CET	53	50935	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.217706919 CET	52444	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.218183994 CET	59585	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.239447117 CET	57547	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.239635944 CET	51784	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.362153053 CET	53	57547	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.363183022 CET	53	51784	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.401859045 CET	57862	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.402146101 CET	60140	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.448065042 CET	54634	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.448357105 CET	50011	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.450125933 CET	53	60330	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.527365923 CET	53	60140	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.527546883 CET	53	57862	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.548485041 CET	51454	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.548830032 CET	51026	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.572712898 CET	53	54634	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.572745085 CET	53	50011	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.671329975 CET	53	51026	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.671511889 CET	53	51454	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.856347084 CET	56794	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.856517076 CET	50065	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:48.983783960 CET	53	56794	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:48.983809948 CET	53	50065	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:49.156388044 CET	64138	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:49.156569958 CET	63056	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:49.219715118 CET	54411	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:49.220467091 CET	54984	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:49.280504942 CET	53	63056	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:49.344887018 CET	53	54411	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:49.370924950 CET	53	54984	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:49.924778938 CET	65250	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:49.924957991 CET	51592	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:38:50.049598932 CET	53	65250	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:50.049693108 CET	53	51592	1.1.1.1	192.168.2.17
Feb 27, 2024 18:38:51.806500912 CET	138	138	192.168.2.17	192.168.2.255
Feb 27, 2024 18:39:07.872963905 CET	64823	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:08.528760910 CET	59854	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:10.161669016 CET	56592	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:10.824368954 CET	50085	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:13.989552975 CET	57653	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:14.114705086 CET	53	57653	1.1.1.1	192.168.2.17
Feb 27, 2024 18:39:17.356117964 CET	60606	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:19.283070087 CET	61653	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:19.283070087 CET	52297	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:19.407080889 CET	53	52297	1.1.1.1	192.168.2.17
Feb 27, 2024 18:39:41.664527893 CET	59431	53	192.168.2.17	1.1.1.1
Feb 27, 2024 18:39:41.748380899 CET	64713	53	192.168.2.17	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 27, 2024 18:38:40.853960991 CET	192.168.2.17	1.1.1.1	c27f	(Port unreachable)	Destination Unreachable
Feb 27, 2024 18:38:45.479448080 CET	192.168.2.17	1.1.1.1	c27f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 27, 2024 18:38:10.158162117 CET	192.168.2.17	1.1.1.1	0xade	Standard query (0)	analytics.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:12.705156088 CET	192.168.2.17	1.1.1.1	0x6c3e	Standard query (0)	ipm-provider.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:22.936279058 CET	192.168.2.17	1.1.1.1	0xadb4	Standard query (0)	service.piriform.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:23.573662043 CET	192.168.2.17	1.1.1.1	0xe3c1	Standard query (0)	license.piriform.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:24.290976048 CET	192.168.2.17	1.1.1.1	0xbcd3	Standard query (0)	shepherd.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:36.534615040 CET	192.168.2.17	1.1.1.1	0x864	Standard query (0)	ip-info.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:36.674664974 CET	192.168.2.17	1.1.1.1	0x7a50	Standard query (0)	ip-info.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.412868023 CET	192.168.2.17	1.1.1.1	0xe6c8	Standard query (0)	emupdate.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.515491962 CET	192.168.2.17	1.1.1.1	0x910c	Standard query (0)	ncc.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.543898106 CET	192.168.2.17	1.1.1.1	0x91e9	Standard query (0)	emupdate.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.865923882 CET	192.168.2.17	1.1.1.1	0xa27c	Standard query (0)	ccleaner.tools.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.993917942 CET	192.168.2.17	1.1.1.1	0x117c	Standard query (0)	ccleaner.tools.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:40.639482975 CET	192.168.2.17	1.1.1.1	0x4a8f	Standard query (0)	www.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:40.640105963 CET	192.168.2.17	1.1.1.1	0xf6ad	Standard query (0)	www.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:40.685307980 CET	192.168.2.17	1.1.1.1	0xbc86	Standard query (0)	www.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:40.685781002 CET	192.168.2.17	1.1.1.1	0x4824	Standard query (0)	www.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:41.838310957 CET	192.168.2.17	1.1.1.1	0x27ac	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:41.838556051 CET	192.168.2.17	1.1.1.1	0x1eee	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 27, 2024 18:38:41.839020967 CET	192.168.2.17	1.1.1.1	0xaf01	Standard query (0)	s1.pir.fm	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:41.839267969 CET	192.168.2.17	1.1.1.1	0x1daf	Standard query (0)	s1.pir.fm	65	IN (0x0001)	false
Feb 27, 2024 18:38:41.935806036 CET	192.168.2.17	1.1.1.1	0xaba5	Standard query (0)	cdn-production.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:41.936249018 CET	192.168.2.17	1.1.1.1	0x8320	Standard query (0)	cdn-production.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:42.511866093 CET	192.168.2.17	1.1.1.1	0x4e7c	Standard query (0)	s1.pir.fm	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:42.512614012 CET	192.168.2.17	1.1.1.1	0xd9cf	Standard query (0)	s1.pir.fm	65	IN (0x0001)	false
Feb 27, 2024 18:38:42.574245930 CET	192.168.2.17	1.1.1.1	0x35d7	Standard query (0)	cdn-production.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:42.574444056 CET	192.168.2.17	1.1.1.1	0x3c12	Standard query (0)	cdn-production.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:43.639386892 CET	192.168.2.17	1.1.1.1	0xfa51	Standard query (0)	s7.addthis.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.639386892 CET	192.168.2.17	1.1.1.1	0x587a	Standard query (0)	s7.addthis.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:43.639894962 CET	192.168.2.17	1.1.1.1	0x8baf	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.640141010 CET	192.168.2.17	1.1.1.1	0xc6d9	Standard query (0)	assets.adobedtm.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:43.642333984 CET	192.168.2.17	1.1.1.1	0x867f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.642802000 CET	192.168.2.17	1.1.1.1	0xd971	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:44.214657068 CET	192.168.2.17	1.1.1.1	0xae5a	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.214767933 CET	192.168.2.17	1.1.1.1	0x3052	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 27, 2024 18:38:44.228043079 CET	192.168.2.17	1.1.1.1	0xa9e5	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.228374958 CET	192.168.2.17	1.1.1.1	0xd6e	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:44.488305092 CET	192.168.2.17	1.1.1.1	0xdd5b	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.488451958 CET	192.168.2.17	1.1.1.1	0xf80b	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:44.491009951 CET	192.168.2.17	1.1.1.1	0x957d	Standard query (0)	www.nortonlifelock.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.491009951 CET	192.168.2.17	1.1.1.1	0xd3bd	Standard query (0)	www.nortonlifelock.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:44.915240049 CET	192.168.2.17	1.1.1.1	0xfb64	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.915405035 CET	192.168.2.17	1.1.1.1	0x2dd7	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.018832922 CET	192.168.2.17	1.1.1.1	0xcab	Standard query (0)	symantec.demdex.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.019810915 CET	192.168.2.17	1.1.1.1	0x5525	Standard query (0)	symantec.demdex.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.027250051 CET	192.168.2.17	1.1.1.1	0x1365	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.027494907 CET	192.168.2.17	1.1.1.1	0xc69e	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.030817986 CET	192.168.2.17	1.1.1.1	0x7828	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.030999899 CET	192.168.2.17	1.1.1.1	0xb928	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.058579922 CET	192.168.2.17	1.1.1.1	0x4329	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.058784008 CET	192.168.2.17	1.1.1.1	0x6be	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.213398933 CET	192.168.2.17	1.1.1.1	0x411b	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.213566065 CET	192.168.2.17	1.1.1.1	0x6ca2	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.221745014 CET	192.168.2.17	1.1.1.1	0x1852	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.222023964 CET	192.168.2.17	1.1.1.1	0x867f	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.222472906 CET	192.168.2.17	1.1.1.1	0x21f2	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.222691059 CET	192.168.2.17	1.1.1.1	0x2d78	Standard query (0)	static.ads-twitter.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.223114014 CET	192.168.2.17	1.1.1.1	0x7189	Standard query (0)	amplify.outbrain.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.223428011 CET	192.168.2.17	1.1.1.1	0x51d2	Standard query (0)	amplify.outbrain.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.314295053 CET	192.168.2.17	1.1.1.1	0x5baa	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.314553022 CET	192.168.2.17	1.1.1.1	0xeb40	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.321630001 CET	192.168.2.17	1.1.1.1	0x2d7b	Standard query (0)	www.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.323923111 CET	192.168.2.17	1.1.1.1	0x5585	Standard query (0)	www.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.438519001 CET	192.168.2.17	1.1.1.1	0x54f8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.438782930 CET	192.168.2.17	1.1.1.1	0xea5a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.817065954 CET	192.168.2.17	1.1.1.1	0x3ec8	Standard query (0)	mstatic.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.817296982 CET	192.168.2.17	1.1.1.1	0x252e	Standard query (0)	mstatic.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.824933052 CET	192.168.2.17	1.1.1.1	0x622	Standard query (0)	www.mczbf.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.825210094 CET	192.168.2.17	1.1.1.1	0x27f0	Standard query (0)	www.mczbf.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.952224970 CET	192.168.2.17	1.1.1.1	0xc2c	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.952575922 CET	192.168.2.17	1.1.1.1	0xc946	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.958748102 CET	192.168.2.17	1.1.1.1	0xae95	Standard query (0)	tr.outbrain.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.959027052 CET	192.168.2.17	1.1.1.1	0xf437	Standard query (0)	tr.outbrain.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:45.970669031 CET	192.168.2.17	1.1.1.1	0x4924	Standard query (0)	wave.outbrain.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.970669031 CET	192.168.2.17	1.1.1.1	0x55a0	Standard query (0)	wave.outbrain.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.018413067 CET	192.168.2.17	1.1.1.1	0x2dba	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.018625021 CET	192.168.2.17	1.1.1.1	0x6a0	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.036170959 CET	192.168.2.17	1.1.1.1	0xdc6a	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.036436081 CET	192.168.2.17	1.1.1.1	0x53ca	Standard query (0)	t.co	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.334408998 CET	192.168.2.17	1.1.1.1	0x7881	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.335392952 CET	192.168.2.17	1.1.1.1	0xb42c	Standard query (0)	s.yimg.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.415930986 CET	192.168.2.17	1.1.1.1	0x71cd	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.416328907 CET	192.168.2.17	1.1.1.1	0x5ed3	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.473119020 CET	192.168.2.17	1.1.1.1	0x23f	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.473423958 CET	192.168.2.17	1.1.1.1	0x179a	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.487850904 CET	192.168.2.17	1.1.1.1	0xb7ea	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.488744020 CET	192.168.2.17	1.1.1.1	0xaa08	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.634815931 CET	192.168.2.17	1.1.1.1	0xf8bd	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.634815931 CET	192.168.2.17	1.1.1.1	0x7077	Standard query (0)	t.co	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.803908110 CET	192.168.2.17	1.1.1.1	0x3f0a	Standard query (0)	www.mczbf.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.804115057 CET	192.168.2.17	1.1.1.1	0x4a34	Standard query (0)	www.mczbf.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:46.842468977 CET	192.168.2.17	1.1.1.1	0x5f5d	Standard query (0)	vc.hotjar.io	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.842674017 CET	192.168.2.17	1.1.1.1	0x3c16	Standard query (0)	vc.hotjar.io	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.324289083 CET	192.168.2.17	1.1.1.1	0xcf39	Standard query (0)	c5.adalyser.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.324419975 CET	192.168.2.17	1.1.1.1	0xab5d	Standard query (0)	c5.adalyser.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.326608896 CET	192.168.2.17	1.1.1.1	0x11ec	Standard query (0)	dev.visualwebsiteoptimizer.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.326797009 CET	192.168.2.17	1.1.1.1	0xce31	Standard query (0)	dev.visualwebsiteoptimizer.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.345396996 CET	192.168.2.17	1.1.1.1	0xa759	Standard query (0)	cdn-uat.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.345716000 CET	192.168.2.17	1.1.1.1	0xe8cb	Standard query (0)	cdn-uat.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.374418974 CET	192.168.2.17	1.1.1.1	0x6850	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.374659061 CET	192.168.2.17	1.1.1.1	0x40ce	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.391804934 CET	192.168.2.17	1.1.1.1	0xf7e6	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.391804934 CET	192.168.2.17	1.1.1.1	0x8443	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.927041054 CET	192.168.2.17	1.1.1.1	0x59ee	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.927673101 CET	192.168.2.17	1.1.1.1	0xe50b	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:47.953629017 CET	192.168.2.17	1.1.1.1	0x6788	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.954134941 CET	192.168.2.17	1.1.1.1	0x7ec8	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.019510984 CET	192.168.2.17	1.1.1.1	0xe1b8	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.019849062 CET	192.168.2.17	1.1.1.1	0xd569	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.068537951 CET	192.168.2.17	1.1.1.1	0xad52	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.069545031 CET	192.168.2.17	1.1.1.1	0xb089	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.217706919 CET	192.168.2.17	1.1.1.1	0x44b	Standard query (0)	cdn-uat.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.218183994 CET	192.168.2.17	1.1.1.1	0x6fb5	Standard query (0)	cdn-uat.ccleaner.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.239447117 CET	192.168.2.17	1.1.1.1	0xb3d6	Standard query (0)	dev.visualwebsiteoptimizer.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.239635944 CET	192.168.2.17	1.1.1.1	0x23d4	Standard query (0)	dev.visualwebsiteoptimizer.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.401859045 CET	192.168.2.17	1.1.1.1	0x4646	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.402146101 CET	192.168.2.17	1.1.1.1	0xee1	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.448065042 CET	192.168.2.17	1.1.1.1	0x402d	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.448357105 CET	192.168.2.17	1.1.1.1	0xd059	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.548485041 CET	192.168.2.17	1.1.1.1	0x90fa	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.548830032 CET	192.168.2.17	1.1.1.1	0x6668	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:48.856347084 CET	192.168.2.17	1.1.1.1	0x8398	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.856517076 CET	192.168.2.17	1.1.1.1	0x8851	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:49.156388044 CET	192.168.2.17	1.1.1.1	0xe816	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.156569958 CET	192.168.2.17	1.1.1.1	0x9440	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:49.219715118 CET	192.168.2.17	1.1.1.1	0xeab6	Standard query (0)	c5.adalyser.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.220467091 CET	192.168.2.17	1.1.1.1	0x5628	Standard query (0)	c5.adalyser.com	65	IN (0x0001)	false
Feb 27, 2024 18:38:49.924778938 CET	192.168.2.17	1.1.1.1	0x651f	Standard query (0)	privacyportal-de.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.924957991 CET	192.168.2.17	1.1.1.1	0x5d56	Standard query (0)	privacyportal-de.onetrust.com	65	IN (0x0001)	false
Feb 27, 2024 18:39:07.872963905 CET	192.168.2.17	1.1.1.1	0x497d	Standard query (0)	www.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:08.528760910 CET	192.168.2.17	1.1.1.1	0xc5a9	Standard query (0)	license-api.ccleaner.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:10.161669016 CET	192.168.2.17	1.1.1.1	0xde87	Standard query (0)	ncc.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:10.824368954 CET	192.168.2.17	1.1.1.1	0xd33c	Standard query (0)	ipmcdn.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:13.989552975 CET	192.168.2.17	1.1.1.1	0xacaf	Standard query (0)	analytics.ff.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:17.356117964 CET	192.168.2.17	1.1.1.1	0xfd16	Standard query (0)	bits.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:19.283070087 CET	192.168.2.17	1.1.1.1	0x372e	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:19.283070087 CET	192.168.2.17	1.1.1.1	0xb429	Standard query (0)	v7event.stats.avast.com	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:41.664527893 CET	192.168.2.17	1.1.1.1	0x1640	Standard query (0)	honzik.avcdn.net	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:41.748380899 CET	192.168.2.17	1.1.1.1	0x3354	Standard query (0)	ncc.avast.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 27, 2024 18:38:10.282598019 CET	1.1.1.1	192.168.2.17	0xade	No error (0)	analytics.avcdn.net	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:10.282598019 CET	1.1.1.1	192.168.2.17	0xade	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:10.282598019 CET	1.1.1.1	192.168.2.17	0xade	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:12.827869892 CET	1.1.1.1	192.168.2.17	0x6c3e	No error (0)	ipm-provider.ff.avast.com	ipm-gcp-prod.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:12.827869892 CET	1.1.1.1	192.168.2.17	0x6c3e	No error (0)	ipm-gcp-prod.ff.avast.com		34.111.24.1	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:23.146105051 CET	1.1.1.1	192.168.2.17	0xadb4	No error (0)	service.piriform.com	service.piriform.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:23.711666107 CET	1.1.1.1	192.168.2.17	0xe3c1	No error (0)	license.piriform.com	license.piriform.com-v2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:24.414621115 CET	1.1.1.1	192.168.2.17	0xbcd3	No error (0)	shepherd.ff.avast.com	shepherd-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:24.414621115 CET	1.1.1.1	192.168.2.17	0xbcd3	No error (0)	shepherd-gcp.ff.avast.com		34.160.176.28	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:36.657385111 CET	1.1.1.1	192.168.2.17	0x864	No error (0)	ip-info.ff.avast.com	ip-info-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:36.657385111 CET	1.1.1.1	192.168.2.17	0x864	No error (0)	ip-info-gcp.ff.avast.com		34.149.149.62	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:36.800093889 CET	1.1.1.1	192.168.2.17	0x7a50	No error (0)	ip-info.ff.avast.com	ip-info-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:36.800093889 CET	1.1.1.1	192.168.2.17	0x7a50	No error (0)	ip-info-gcp.ff.avast.com		34.149.149.62	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:37.541904926 CET	1.1.1.1	192.168.2.17	0xe6c8	No error (0)	emupdate.avcdn.net	emupdate.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:37.643249035 CET	1.1.1.1	192.168.2.17	0x910c	No error (0)	ncc.avast.com	ncc.avast.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:37.671231985 CET	1.1.1.1	192.168.2.17	0x91e9	No error (0)	emupdate.avcdn.net	emupdate.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:37.991941929 CET	1.1.1.1	192.168.2.17	0xa27c	No error (0)	ccleaner.tools.avcdn.net	tools.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:38.122459888 CET	1.1.1.1	192.168.2.17	0x117c	No error (0)	ccleaner.tools.avcdn.net	tools.avcdn.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:40.766696930 CET	1.1.1.1	192.168.2.17	0x4a8f	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:40.779628038 CET	1.1.1.1	192.168.2.17	0xf6ad	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:40.811537981 CET	1.1.1.1	192.168.2.17	0xbc86	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:40.852968931 CET	1.1.1.1	192.168.2.17	0x4824	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:41.960967064 CET	1.1.1.1	192.168.2.17	0x1eee	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 27, 2024 18:38:41.962168932 CET	1.1.1.1	192.168.2.17	0x27ac	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:41.962168932 CET	1.1.1.1	192.168.2.17	0x27ac	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:41.964056015 CET	1.1.1.1	192.168.2.17	0xaf01	No error (0)	s1.pir.fm	s1.pir.fm.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:41.988400936 CET	1.1.1.1	192.168.2.17	0x1daf	No error (0)	s1.pir.fm	s1.pir.fm.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.075620890 CET	1.1.1.1	192.168.2.17	0x8320	No error (0)	cdn-production.ccleaner.com	cdn-production.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.091815948 CET	1.1.1.1	192.168.2.17	0xaba5	No error (0)	cdn-production.ccleaner.com	cdn-production.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.650933027 CET	1.1.1.1	192.168.2.17	0xd9cf	No error (0)	s1.pir.fm	s1.pir.fm.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.662594080 CET	1.1.1.1	192.168.2.17	0x4e7c	No error (0)	s1.pir.fm	s1.pir.fm.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.713851929 CET	1.1.1.1	192.168.2.17	0x35d7	No error (0)	cdn-production.ccleaner.com	cdn-production.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:42.726792097 CET	1.1.1.1	192.168.2.17	0x3c12	No error (0)	cdn-production.ccleaner.com	cdn-production.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.762868881 CET	1.1.1.1	192.168.2.17	0x587a	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.762868881 CET	1.1.1.1	192.168.2.17	0x587a	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.763441086 CET	1.1.1.1	192.168.2.17	0x8baf	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.764259100 CET	1.1.1.1	192.168.2.17	0xfa51	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.764259100 CET	1.1.1.1	192.168.2.17	0xfa51	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.764647007 CET	1.1.1.1	192.168.2.17	0xc6d9	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.103	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.105	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.99	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.147	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.104	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.765662909 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	www.google.com		142.251.163.106	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:43.767000914 CET	1.1.1.1	192.168.2.17	0xd971	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 27, 2024 18:38:44.338912964 CET	1.1.1.1	192.168.2.17	0xae5a	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.338912964 CET	1.1.1.1	192.168.2.17	0xae5a	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.338973045 CET	1.1.1.1	192.168.2.17	0x3052	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 27, 2024 18:38:44.350770950 CET	1.1.1.1	192.168.2.17	0xd6e	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 27, 2024 18:38:44.352929115 CET	1.1.1.1	192.168.2.17	0xa9e5	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.352929115 CET	1.1.1.1	192.168.2.17	0xa9e5	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.209.16.161	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.209.221.84	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.196.29.48	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.195.9.80	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.224.142.177	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.205.183.234	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.89.78.181	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.610783100 CET	1.1.1.1	192.168.2.17	0xdd5b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.205.41.36	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:44.611747026 CET	1.1.1.1	192.168.2.17	0xf80b	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.611747026 CET	1.1.1.1	192.168.2.17	0xf80b	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.611747026 CET	1.1.1.1	192.168.2.17	0xf80b	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.615211964 CET	1.1.1.1	192.168.2.17	0x957d	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:44.616444111 CET	1.1.1.1	192.168.2.17	0xd3bd	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.040738106 CET	1.1.1.1	192.168.2.17	0x2dd7	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 27, 2024 18:38:45.041070938 CET	1.1.1.1	192.168.2.17	0xfb64	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.041070938 CET	1.1.1.1	192.168.2.17	0xfb64	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.164.110.171	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.209.16.161	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.84.59.91	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.210.30.180	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.204.210.218	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.175.157.16	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.207.55.164	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.141844988 CET	1.1.1.1	192.168.2.17	0xcab	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.222.225.37	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.149821997 CET	1.1.1.1	192.168.2.17	0x1365	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.152817011 CET	1.1.1.1	192.168.2.17	0xc69e	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		35.167.214.190	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.148.134.78	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.89.95.148	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		35.164.169.37	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.213.96.237	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		54.148.119.109	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.210.5.217	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153564930 CET	1.1.1.1	192.168.2.17	0x7828	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.210.199.77	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153728962 CET	1.1.1.1	192.168.2.17	0xb928	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153728962 CET	1.1.1.1	192.168.2.17	0xb928	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.153728962 CET	1.1.1.1	192.168.2.17	0xb928	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.167728901 CET	1.1.1.1	192.168.2.17	0x5525	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.167728901 CET	1.1.1.1	192.168.2.17	0x5525	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.167728901 CET	1.1.1.1	192.168.2.17	0x5525	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.181730986 CET	1.1.1.1	192.168.2.17	0x4329	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.181730986 CET	1.1.1.1	192.168.2.17	0x4329	No error (0)	scontent.xx.fbcdn.net		31.13.66.19	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.182611942 CET	1.1.1.1	192.168.2.17	0x6be	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.339430094 CET	1.1.1.1	192.168.2.17	0x411b	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.340575933 CET	1.1.1.1	192.168.2.17	0x6ca2	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347162008 CET	1.1.1.1	192.168.2.17	0x867f	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347649097 CET	1.1.1.1	192.168.2.17	0x1852	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347649097 CET	1.1.1.1	192.168.2.17	0x1852	No error (0)	static-cdn.hotjar.com		52.85.132.5	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347649097 CET	1.1.1.1	192.168.2.17	0x1852	No error (0)	static-cdn.hotjar.com		52.85.132.25	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347649097 CET	1.1.1.1	192.168.2.17	0x1852	No error (0)	static-cdn.hotjar.com		52.85.132.15	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.347649097 CET	1.1.1.1	192.168.2.17	0x1852	No error (0)	static-cdn.hotjar.com		52.85.132.14	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.348818064 CET	1.1.1.1	192.168.2.17	0x2d78	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.348982096 CET	1.1.1.1	192.168.2.17	0x21f2	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.348982096 CET	1.1.1.1	192.168.2.17	0x21f2	No error (0)	platform.twitter.map.fastly.net		146.75.28.157	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.349699974 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	amplify.outbrain.com	wildcard.outbrain.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.350243092 CET	1.1.1.1	192.168.2.17	0x7189	No error (0)	amplify.outbrain.com	wildcard.outbrain.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.436548948 CET	1.1.1.1	192.168.2.17	0xeb40	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.438469887 CET	1.1.1.1	192.168.2.17	0x5baa	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.438469887 CET	1.1.1.1	192.168.2.17	0x5baa	No error (0)	edge.gycpi.b.yahoodns.net		69.147.92.11	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.438469887 CET	1.1.1.1	192.168.2.17	0x5baa	No error (0)	edge.gycpi.b.yahoodns.net		69.147.92.12	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.446362972 CET	1.1.1.1	192.168.2.17	0x2d7b	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.479361057 CET	1.1.1.1	192.168.2.17	0x5585	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.561244965 CET	1.1.1.1	192.168.2.17	0xea5a	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.103	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.105	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.147	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.106	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.99	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.562391043 CET	1.1.1.1	192.168.2.17	0x54f8	No error (0)	www.google.com		172.253.122.104	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.948339939 CET	1.1.1.1	192.168.2.17	0x27f0	No error (0)	www.mczbf.com	dcjdc5qmbbux7.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.950053930 CET	1.1.1.1	192.168.2.17	0x622	No error (0)	www.mczbf.com	dcjdc5qmbbux7.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:45.950053930 CET	1.1.1.1	192.168.2.17	0x622	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.82	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.950053930 CET	1.1.1.1	192.168.2.17	0x622	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.103	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.950053930 CET	1.1.1.1	192.168.2.17	0x622	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.115	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.950053930 CET	1.1.1.1	192.168.2.17	0x622	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.116	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:45.959330082 CET	1.1.1.1	192.168.2.17	0x3ec8	No error (0)	mstatic.ccleaner.com		20.50.2.53	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.077064991 CET	1.1.1.1	192.168.2.17	0xc946	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.189	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.080102921 CET	1.1.1.1	192.168.2.17	0xc2c	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.081720114 CET	1.1.1.1	192.168.2.17	0xae95	No error (0)	tr.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.081720114 CET	1.1.1.1	192.168.2.17	0xae95	No error (0)	alldcs.outbrain.org	nydc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.081720114 CET	1.1.1.1	192.168.2.17	0xae95	No error (0)	nydc1.outbrain.org		64.202.112.191	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.082890987 CET	1.1.1.1	192.168.2.17	0xf437	No error (0)	tr.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.082890987 CET	1.1.1.1	192.168.2.17	0xf437	No error (0)	alldcs.outbrain.org	chidc2.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.094013929 CET	1.1.1.1	192.168.2.17	0x4924	No error (0)	wave.outbrain.com	wildcard.outbrain.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.095732927 CET	1.1.1.1	192.168.2.17	0x55a0	No error (0)	wave.outbrain.com	wildcard.outbrain.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.141239882 CET	1.1.1.1	192.168.2.17	0x2dba	No error (0)	script.hotjar.com		99.84.191.43	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.141239882 CET	1.1.1.1	192.168.2.17	0x2dba	No error (0)	script.hotjar.com		99.84.191.77	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.141239882 CET	1.1.1.1	192.168.2.17	0x2dba	No error (0)	script.hotjar.com		99.84.191.41	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.141239882 CET	1.1.1.1	192.168.2.17	0x2dba	No error (0)	script.hotjar.com		99.84.191.81	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.158823013 CET	1.1.1.1	192.168.2.17	0xdc6a	No error (0)	t.co		104.244.42.5	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.158823013 CET	1.1.1.1	192.168.2.17	0xdc6a	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.158823013 CET	1.1.1.1	192.168.2.17	0xdc6a	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.158823013 CET	1.1.1.1	192.168.2.17	0xdc6a	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.459049940 CET	1.1.1.1	192.168.2.17	0x7881	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.459049940 CET	1.1.1.1	192.168.2.17	0x7881	No error (0)	edge.gycpi.b.yahoodns.net		69.147.92.12	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.459049940 CET	1.1.1.1	192.168.2.17	0x7881	No error (0)	edge.gycpi.b.yahoodns.net		69.147.92.11	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.461097002 CET	1.1.1.1	192.168.2.17	0xb42c	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.539007902 CET	1.1.1.1	192.168.2.17	0x71cd	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.595393896 CET	1.1.1.1	192.168.2.17	0x23f	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.595393896 CET	1.1.1.1	192.168.2.17	0x23f	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.595623970 CET	1.1.1.1	192.168.2.17	0x179a	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.595623970 CET	1.1.1.1	192.168.2.17	0x179a	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.236	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.612454891 CET	1.1.1.1	192.168.2.17	0xb7ea	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.617583990 CET	1.1.1.1	192.168.2.17	0xaa08	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.759010077 CET	1.1.1.1	192.168.2.17	0xf8bd	No error (0)	t.co		104.244.42.5	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.759010077 CET	1.1.1.1	192.168.2.17	0xf8bd	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.759010077 CET	1.1.1.1	192.168.2.17	0xf8bd	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.759010077 CET	1.1.1.1	192.168.2.17	0xf8bd	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.928626060 CET	1.1.1.1	192.168.2.17	0x4a34	No error (0)	www.mczbf.com	dcjdc5qmbbux7.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.929582119 CET	1.1.1.1	192.168.2.17	0x3f0a	No error (0)	www.mczbf.com	dcjdc5qmbbux7.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.929582119 CET	1.1.1.1	192.168.2.17	0x3f0a	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.82	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.929582119 CET	1.1.1.1	192.168.2.17	0x3f0a	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.103	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.929582119 CET	1.1.1.1	192.168.2.17	0x3f0a	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.115	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.929582119 CET	1.1.1.1	192.168.2.17	0x3f0a	No error (0)	dcjdc5qmbbux7.cloudfront.net		52.85.132.116	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967405081 CET	1.1.1.1	192.168.2.17	0x3c16	No error (0)	vc.hotjar.io	vc-live-cf.hotjar.io		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967624903 CET	1.1.1.1	192.168.2.17	0x5f5d	No error (0)	vc.hotjar.io	vc-live-cf.hotjar.io		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967624903 CET	1.1.1.1	192.168.2.17	0x5f5d	No error (0)	vc-live-cf.hotjar.io		99.86.229.20	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967624903 CET	1.1.1.1	192.168.2.17	0x5f5d	No error (0)	vc-live-cf.hotjar.io		99.86.229.38	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967624903 CET	1.1.1.1	192.168.2.17	0x5f5d	No error (0)	vc-live-cf.hotjar.io		99.86.229.112	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:46.967624903 CET	1.1.1.1	192.168.2.17	0x5f5d	No error (0)	vc-live-cf.hotjar.io		99.86.229.126	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.450747967 CET	1.1.1.1	192.168.2.17	0x11ec	No error (0)	dev.visualwebsiteoptimizer.com		34.96.102.137	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.473563910 CET	1.1.1.1	192.168.2.17	0xab5d	No error (0)	c5.adalyser.com	peso-1422535133.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.474734068 CET	1.1.1.1	192.168.2.17	0xcf39	No error (0)	c5.adalyser.com	peso-1422535133.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.474734068 CET	1.1.1.1	192.168.2.17	0xcf39	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		52.30.38.148	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.474734068 CET	1.1.1.1	192.168.2.17	0xcf39	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		63.33.94.70	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.474734068 CET	1.1.1.1	192.168.2.17	0xcf39	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		54.171.134.186	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.488255024 CET	1.1.1.1	192.168.2.17	0xe8cb	No error (0)	cdn-uat.ccleaner.com	cdn-uat.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	s.twitter.com		104.244.42.3	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497406960 CET	1.1.1.1	192.168.2.17	0x6850	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497517109 CET	1.1.1.1	192.168.2.17	0x40ce	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.497517109 CET	1.1.1.1	192.168.2.17	0x40ce	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:47.501255989 CET	1.1.1.1	192.168.2.17	0xa759	No error (0)	cdn-uat.ccleaner.com	cdn-uat.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.049213886 CET	1.1.1.1	192.168.2.17	0x59ee	No error (0)	stats.g.doubleclick.net		172.253.122.156	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.049213886 CET	1.1.1.1	192.168.2.17	0x59ee	No error (0)	stats.g.doubleclick.net		172.253.122.155	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.076386929 CET	1.1.1.1	192.168.2.17	0x6788	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.077879906 CET	1.1.1.1	192.168.2.17	0x7ec8	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.142333031 CET	1.1.1.1	192.168.2.17	0xe1b8	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.142333031 CET	1.1.1.1	192.168.2.17	0xe1b8	No error (0)	star-mini.c10r.facebook.com		157.240.229.35	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.143112898 CET	1.1.1.1	192.168.2.17	0xd569	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.192715883 CET	1.1.1.1	192.168.2.17	0xad52	No error (0)	s.twitter.com		104.244.42.3	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.193825960 CET	1.1.1.1	192.168.2.17	0xb089	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.193825960 CET	1.1.1.1	192.168.2.17	0xb089	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.356859922 CET	1.1.1.1	192.168.2.17	0x6fb5	No error (0)	cdn-uat.ccleaner.com	cdn-uat.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.358490944 CET	1.1.1.1	192.168.2.17	0x44b	No error (0)	cdn-uat.ccleaner.com	cdn-uat.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.362153053 CET	1.1.1.1	192.168.2.17	0xb3d6	No error (0)	dev.visualwebsiteoptimizer.com		34.96.102.137	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.527546883 CET	1.1.1.1	192.168.2.17	0x4646	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.572712898 CET	1.1.1.1	192.168.2.17	0x402d	No error (0)	stats.g.doubleclick.net		172.253.122.156	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.572712898 CET	1.1.1.1	192.168.2.17	0x402d	No error (0)	stats.g.doubleclick.net		172.253.122.155	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.671329975 CET	1.1.1.1	192.168.2.17	0x6668	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.671511889 CET	1.1.1.1	192.168.2.17	0x90fa	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:48.671511889 CET	1.1.1.1	192.168.2.17	0x90fa	No error (0)	star-mini.c10r.facebook.com		31.13.66.35	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.106	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.103	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.105	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.104	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.147	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983783960 CET	1.1.1.1	192.168.2.17	0x8398	No error (0)	www.google.com		142.251.163.99	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:48.983809948 CET	1.1.1.1	192.168.2.17	0x8851	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 27, 2024 18:38:49.278517008 CET	1.1.1.1	192.168.2.17	0xe816	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:49.278517008 CET	1.1.1.1	192.168.2.17	0xe816	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:49.280504942 CET	1.1.1.1	192.168.2.17	0x9440	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:49.280504942 CET	1.1.1.1	192.168.2.17	0x9440	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:49.344887018 CET	1.1.1.1	192.168.2.17	0xeab6	No error (0)	c5.adalyser.com	peso-1422535133.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:49.344887018 CET	1.1.1.1	192.168.2.17	0xeab6	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		52.30.38.148	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.344887018 CET	1.1.1.1	192.168.2.17	0xeab6	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		63.33.94.70	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.344887018 CET	1.1.1.1	192.168.2.17	0xeab6	No error (0)	peso-1422535133.eu-west-1.elb.amazonaws.com		54.171.134.186	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:49.370924950 CET	1.1.1.1	192.168.2.17	0x5628	No error (0)	c5.adalyser.com	peso-1422535133.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:38:50.049598932 CET	1.1.1.1	192.168.2.17	0x651f	No error (0)	privacyportal-de.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:50.049598932 CET	1.1.1.1	192.168.2.17	0x651f	No error (0)	privacyportal-de.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:38:50.049693108 CET	1.1.1.1	192.168.2.17	0x5d56	No error (0)	privacyportal-de.onetrust.com			65	IN (0x0001)	false
Feb 27, 2024 18:39:08.015830994 CET	1.1.1.1	192.168.2.17	0x497d	No error (0)	www.ccleaner.com	www.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:08.668133020 CET	1.1.1.1	192.168.2.17	0xc5a9	No error (0)	license-api.ccleaner.com	license-api.ccleaner.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:10.286257982 CET	1.1.1.1	192.168.2.17	0xde87	No error (0)	ncc.avast.com	ncc.avast.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:10.949911118 CET	1.1.1.1	192.168.2.17	0xd33c	No error (0)	ipmcdn.avast.com	ipmcdn.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:14.114705086 CET	1.1.1.1	192.168.2.17	0xacaf	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:14.114705086 CET	1.1.1.1	192.168.2.17	0xacaf	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:17.502171040 CET	1.1.1.1	192.168.2.17	0xfd16	No error (0)	bits.avcdn.net	bits.avast.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:19.407080889 CET	1.1.1.1	192.168.2.17	0xb429	No error (0)	v7event.stats.avast.com	analytics.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:19.407080889 CET	1.1.1.1	192.168.2.17	0xb429	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:19.407080889 CET	1.1.1.1	192.168.2.17	0xb429	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
Feb 27, 2024 18:39:19.408865929 CET	1.1.1.1	192.168.2.17	0x372e	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:41.788455009 CET	1.1.1.1	192.168.2.17	0x1640	No error (0)	honzik.avcdn.net	s-honzik.avcdn.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2024 18:39:41.892501116 CET	1.1.1.1	192.168.2.17	0x3354	No error (0)	ncc.avast.com	ncc.avast.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

analytics.avcdn.net

ipm-provider.ff.avast.com

shepherd.ff.avast.com

evoke-windowsservices-tas.msedge.net

ip-info.ff.avast.com

https:

cdn.cookielaw.org

www.google.com

geolocation.onetrust.com

dpm.demdex.net

connect.facebook.net

symantec.demdex.net

s.yimg.com

static.hotjar.com

static.ads-twitter.com

www.mczbf.com

oms.norton.com

script.hotjar.com

t.co

tr.outbrain.com

mstatic.ccleaner.com

idsync.rlcdn.com

vc.hotjar.io

dev.visualwebsiteoptimizer.com

analytics.twitter.com

c5.adalyser.com

stats.g.doubleclick.net

www.facebook.com

privacyportal-de.onetrust.com

analytics.ff.avast.com

v7event.stats.avast.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49964	34.117.223.223	80	6248	C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2024 18:39:19.501358032 CET	175	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: AVG Microstub/2.1 Content-Length: 268 Host: v7event.stats.avast.com
Feb 27, 2024 18:39:19.501435995 CET	268	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 63 63 6c 5f 70 72 6d 5f 30 30 36 5f 36 37 35 5f 61 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 73 74 61 72 74 0a 6d 69 64 65 78 3d 30 46 42 31 46 31 44 30 32 45 39 37 45 38 Data Ascii: cookie=mmm_ccl_prm_006_675_aedition=15event=microstub-startmidex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632Bstat_session=a08dcfa1-7b47-48ad-af19-cdaa4e470b06statsSendTime=1709055558os=win,10,0,2,19045,0,AMD64exe_ver
Feb 27, 2024 18:39:19.611988068 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 27 Feb 2024 17:39:19 GMT Via: 1.1 google
Feb 27, 2024 18:39:20.736342907 CET	175	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Connection: Keep-Alive Content-Type: iavs4/stats User-Agent: AVG Microstub/2.1 Content-Length: 282 Host: v7event.stats.avast.com
Feb 27, 2024 18:39:20.736342907 CET	282	OUT	Data Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 63 63 6c 5f 70 72 6d 5f 30 30 36 5f 36 37 35 5f 61 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 64 6f 77 6e 6c 6f 61 64 0a 6d 69 64 65 78 3d 30 46 42 31 46 31 44 30 32 45 39 Data Ascii: cookie=mmm_ccl_prm_006_675_aedition=15event=microstub-downloadmidex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632Bstat_session=a08dcfa1-7b47-48ad-af19-cdaa4e470b06statsSendTime=1709055589os=win,10,0,2,19045,0,AMD64exe_
Feb 27, 2024 18:39:20.846625090 CET	96	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 27 Feb 2024 17:39:20 GMT Via: 1.1 google

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49700	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:37:49 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RAvA9Dno27h14MB&MD=4Cg9+NHD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-02-27 17:37:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4a6b7a23-6d19-43af-a2d0-98ffeeeb5924 MS-RequestId: bc1c6412-ff80-44f6-ac08-a7a49aa3ff8b MS-CV: sejIgMwFx0KinIPT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Feb 2024 17:37:48 GMT Connection: close Content-Length: 24490
2024-02-27 17:37:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-02-27 17:37:49 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49704	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:37:58 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-27 17:37:58 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=92850 Date: Tue, 27 Feb 2024 17:37:58 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49705	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:37:58 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-27 17:37:58 UTC	773	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=92873 Date: Tue, 27 Feb 2024 17:37:58 GMT Content-Length: 55 Connection: close X-CID: 2
2024-02-27 17:37:58 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49706	34.117.223.223	443	3708	C:\Users\user\Desktop\ccsetup621.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:10 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 290 Host: analytics.avcdn.net
2024-02-27 17:38:10 UTC	290	OUT	Data Raw: 0a 9f 02 0a 42 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 12 84 01 0a 03 3b 06 01 10 82 f8 f0 dd 0c 28 78 5a 73 08 0a 10 00 18 e5 94 01 20 01 28 00 32 24 31 66 66 39 34 34 64 32 2d 32 39 38 63 2d 34 34 38 36 2d 61 39 63 64 2d 35 31 39 35 35 65 34 36 34 30 33 38 38 00 42 2c 35 51 39 54 2d 51 55 57 41 2d 54 34 4b 46 2d 4d 42 48 48 2d 53 4e 36 59 2d 43 55 39 53 2d 57 50 44 37 2d 4a 59 58 36 2d 50 44 47 49 48 01 52 00 58 00 60 32 6a 00 72 00 78 00 82 01 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 Data Ascii: BB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B;(xZs (2$1ff944d2-298c-4486-a9cd-51955e4640388B,5Q9T-QUWA-T4KF-MBHH-SN6Y-CU9S-WPD7-JYX6-PDGIHRX`2jrx`"F6.21.10918"/10.0 (Build 19045, Release 2009
2024-02-27 17:38:10 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:10 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:10 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49707	34.111.24.1	443	3708	C:\Users\user\Desktop\ccsetup621.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:13 UTC	421	OUT	GET /?p_elm=76&action=1&p_age=0&p_bau=0&p_bsls=0&p_chcc=2&p_chr=0&p_dvt=3&p_fds=172544&p_gis=0&p_hid=88804a8d-d694-4779-ab31-d171f97a6233&p_lid=en-CH&p_lng=en&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_osv=10.0&p_pro=90&p_sbi=0&p_scbu=0&p_tos=0&p_vbd=10918&p_vep=6&p_ves=21&p_wid=1657563960 HTTP/1.1 Connection: Keep-Alive User-Agent: Avast Antivirus Host: ipm-provider.ff.avast.com
2024-02-27 17:38:13 UTC	696	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 27 Feb 2024 17:38:13 GMT Content-Type: text/plain IPM-Asset-Base-URL: https://ipm-static.avcdn.net/content-assets-prod/,https://ipmcdn.avast.com/images/ Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Identifier: Do not track element ETag: W/1505 Set-Cookie: ClientId=311f90c8-c9b0-47a6-90e4-675591517d17; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:38:13 GMT; Secure; SameSite=None Set-Cookie: ClientId=311f90c8-c9b0-47a6-90e4-675591517d17; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:38:13 GMT; Secure; SameSite=None Content-Length: 0 Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49708	34.117.223.223	443	3708	C:\Users\user\Desktop\ccsetup621.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:21 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 290 Host: analytics.avcdn.net
2024-02-27 17:38:21 UTC	290	OUT	Data Raw: 0a 9f 02 0a 42 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 12 84 01 0a 03 3b 06 02 10 90 f9 f0 dd 0c 28 78 5a 73 08 0a 10 00 18 e5 94 01 20 01 28 00 32 24 31 66 66 39 34 34 64 32 2d 32 39 38 63 2d 34 34 38 36 2d 61 39 63 64 2d 35 31 39 35 35 65 34 36 34 30 33 38 38 00 42 2c 35 51 39 54 2d 51 55 57 41 2d 54 34 4b 46 2d 4d 42 48 48 2d 53 4e 36 59 2d 43 55 39 53 2d 57 50 44 37 2d 4a 59 58 36 2d 50 44 47 49 48 01 52 00 58 00 60 32 6a 00 72 00 78 00 82 01 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 Data Ascii: BB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B;(xZs (2$1ff944d2-298c-4486-a9cd-51955e4640388B,5Q9T-QUWA-T4KF-MBHH-SN6Y-CU9S-WPD7-JYX6-PDGIHRX`2jrx`"F6.21.10918"/10.0 (Build 19045, Release 2009
2024-02-27 17:38:21 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:21 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:21 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49711	34.160.176.28	443	3708	C:\Users\user\Desktop\ccsetup621.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:24 UTC	323	OUT	GET /?p_vep=6&p_ves=21&p_vbd=10918&p_lit=0&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_pro=90&p_osv=10.0&p_gksw=0&p_lng=en&p_lid=en-us HTTP/1.1 User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918) Host: shepherd.ff.avast.com Cache-Control: no-cache
2024-02-27 17:38:24 UTC	1050	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:24 GMT Content-Type: text/plain Content-Length: 958 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread Config-Id: 33 Config-Name: CCleaner_test-group-health-check-new-flow_cc-ui-launch-in-the-background_distribution---driver-updater_distribution---opswatsoftwareupdater_distribution---opswatsoftwareupdaterhc_feedback---performance-optimizer_distribution---easy-clean-ipm_showoffers3rdparty---usa-opt-out_surveygroupuninstall-75686bac9f38245558377789420cd50f871401af32129f073512c15238a51d28 Config-Version: 249 Segments: test group health check new flow,cc ui launch in the background,distribution - driver updater,distribution - opswatsoftwareupdater,distribution - opswatsoftwareupdaterhc,feedback - performance optimizer,distribution - easy clean ipm,showoffers3rdparty - usa opt-out,surveygroupuninstall TTL: 86400 TTL-Spread: 43200 Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-27 17:38:24 UTC	202	IN	Data Raw: 5b 45 6e 63 72 79 70 74 5d 0d 0a 41 42 54 65 73 74 69 6e 67 4e 61 6d 65 73 3d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 0d 0a 43 43 50 4f 43 3d 44 49 53 41 42 4c 45 44 0d 0a 44 54 4e 50 3d 31 32 30 30 0d 0a 44 55 4e 50 3d 39 30 30 0d 0a 5b 43 6f 6d 6d 6f 6e 5d 0d 0a 41 6c 70 68 61 49 6e 74 65 67 72 61 74 69 6f 6e 3d 31 0d 0a 41 6c 70 68 61 4d 69 67 72 61 74 69 6f 6e 3d 31 0d 0a 41 55 32 3d 31 0d 0a 44 72 69 76 65 72 53 63 61 6e 49 6e 74 65 72 76 61 6c 3d 37 0d 0a 44 72 69 76 65 72 55 70 64 61 74 65 72 3d 31 0d 0a 44 72 69 76 65 72 55 70 64 61 74 65 72 56 65 72 73 69 6f 6e 3d 31 0d 0a 44 75 6d 70 52 65 Data Ascii: [Encrypt]ABTestingNames=HealthCheckNFCCPOC=DISABLEDDTNP=1200DUNP=900[Common]AlphaIntegration=1AlphaMigration=1AU2=1DriverScanInterval=7DriverUpdater=1DriverUpdaterVersion=1DumpRe
2024-02-27 17:38:24 UTC	756	IN	Data Raw: 70 6f 72 74 69 6e 67 3d 31 0d 0a 44 55 53 6b 69 70 4f 6e 62 6f 61 72 64 69 6e 67 3d 30 0d 0a 48 43 53 6b 69 70 41 64 76 61 6e 63 65 64 3d 30 0d 0a 48 65 61 6c 74 68 43 68 65 63 6b 3d 31 0d 0a 48 65 61 6c 74 68 43 68 65 63 6b 49 70 6d 3d 31 0d 0a 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 3d 30 0d 0a 48 65 61 6c 74 68 43 68 65 63 6b 56 65 72 73 69 6f 6e 3d 31 0d 0a 4e 6f 74 69 66 69 63 61 74 69 6f 6e 43 65 6e 74 72 65 3d 30 0d 0a 4f 50 53 57 41 54 53 6f 66 74 77 61 72 65 55 70 64 61 74 65 72 3d 31 0d 0a 4f 50 53 57 41 54 53 6f 66 74 77 61 72 65 55 70 64 61 74 65 72 48 43 3d 31 0d 0a 50 43 3d 30 0d 0a 50 45 3d 31 0d 0a 50 45 4e 50 3d 32 37 0d 0a 50 65 72 66 6f 72 6d 61 6e 63 65 4f 70 74 69 6d 69 7a 65 72 56 65 72 73 69 6f 6e 3d 31 0d 0a 50 4f 53 6b 69 70 4f 6e Data Ascii: porting=1DUSkipOnboarding=0HCSkipAdvanced=0HealthCheck=1HealthCheckIpm=1HealthCheckNF=0HealthCheckVersion=1NotificationCentre=0OPSWATSoftwareUpdater=1OPSWATSoftwareUpdaterHC=1PC=0PE=1PENP=27PerformanceOptimizerVersion=1POSkipOn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49712	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:26 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RAvA9Dno27h14MB&MD=4Cg9+NHD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-02-27 17:38:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: c01b02ea-abc5-48ad-874c-f556127357af MS-RequestId: 3d92d636-e226-4c06-bc63-8e3f951ff033 MS-CV: ZgXzDNYWPkiURnpY.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Feb 2024 17:38:25 GMT Connection: close Content-Length: 25457
2024-02-27 17:38:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-02-27 17:38:26 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.17	49713	20.190.151.134	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4784 Host: login.live.com
2024-02-27 17:38:34 UTC	4784	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-02-27 17:38:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 27 Feb 2024 17:37:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C106_BL2 x-ms-request-id: 3b541fde-4d27-4133-9a8d-1723c1271b99 PPServer: PPV: 30 H: BL02PF7EC632C5C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 27 Feb 2024 17:38:33 GMT Connection: close Content-Length: 11153
2024-02-27 17:38:34 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.17	49714	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:34 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-02-27 17:38:35 UTC	430	IN	HTTP/1.1 200 OK Content-Length: 7321 Content-Type: application/json; charset=utf-8 ETag: 457479138_46590805 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: 01e33de7-4abb-4472-a0cf-bf5625e065af X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4BE2FF59B0644F9C872140E61D8BF387 Ref B: BL2EDGE1410 Ref C: 2024-02-27T17:38:34Z Date: Tue, 27 Feb 2024 17:38:34 GMT Connection: close
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 68 69 67 68 71 75 61 6c 69 74 79 63 61 70 74 75 72 65 63 22 2c 22 79 6f 61 6c 77 39 38 30 31 63 66 22 2c 22 79 6f 63 33 37 32 31 22 2c 22 61 61 74 65 73 31 32 31 22 2c 22 79 6f 63 61 6c 38 33 30 22 2c 22 65 6d 70 72 6f 37 30 32 22 2c 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 79 6f 79 70 70 31 31 37 22 2c 22 79 6f 79 70 70 35 36 31 22 2c 22 79 6f 70 68 6f 31 35 36 22 2c 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 79 6f 72 65 6d 37 38 32 22 2c 22 79 6f 72 65 6d 33 32 35 22 2c 22 79 6f 72 6f 6d 39 33 39 22 2c 22 79 6f 79 70 70 36 33 38 22 2c 22 79 6f 61 61 6f 77 63 34 36 63 66 22 2c 22 79 6f 35 35 36 63 66 22 2c 22 79 6f 61 61 6f 32 36 37 22 2c 22 79 6f 70 72 69 Data Ascii: {"Features":["highqualitycapturec","yoalw9801cf","yoc3721","aates121","yocal830","empro702","yonon248","contactsv2synconly","yoypp117","yoypp561","yopho156","ypromeless","yorem782","yorem325","yorom939","yoypp638","yoaaowc46cf","yo556cf","yoaao267","yopri
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 31 22 2c 22 31 34 67 36 22 3a 22 61 61 74 65 73 31 32 31 22 2c 22 31 38 66 7a 22 3a 22 79 6f 63 61 6c 38 33 30 22 2c 22 31 68 6a 65 22 3a 22 65 6d 70 72 6f 37 30 32 22 2c 22 31 71 61 38 22 3a 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 31 77 6d 74 22 3a 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 32 69 77 6a 22 3a 22 79 6f 79 70 70 31 31 37 22 2c 22 32 6a 36 61 22 3a 22 79 6f 79 70 70 35 36 31 22 2c 22 32 6b 71 32 22 3a 22 79 6f 70 68 6f 31 35 36 22 2c 22 32 6c 61 64 22 3a 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 32 6f 63 64 22 3a 22 79 6f 72 65 6d 37 38 32 22 2c 22 32 72 65 6b 22 3a 22 79 6f 72 65 6d 33 32 35 22 2c 22 32 73 63 78 22 3a 22 79 6f 72 6f 6d 39 33 39 22 2c 22 32 74 70 33 22 3a 22 79 6f 79 70 70 36 33 38 22 2c 22 33 30 62 38 22 Data Ascii: 1","14g6":"aates121","18fz":"yocal830","1hje":"empro702","1qa8":"yonon248","1wmt":"contactsv2synconly","2iwj":"yoypp117","2j6a":"yoypp561","2kq2":"yopho156","2lad":"ypromeless","2ocd":"yorem782","2rek":"yorem325","2scx":"yorom939","2tp3":"yoypp638","30b8"
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 33 6a 37 35 32 36 34 22 2c 22 35 39 30 71 22 3a 22 34 61 33 30 64 34 35 35 22 2c 22 35 39 67 67 22 3a 22 32 69 32 68 65 31 31 38 22 2c 22 35 39 67 6a 22 3a 22 34 64 65 35 67 35 34 32 22 2c 22 35 39 76 7a 22 3a 22 62 65 63 34 34 37 35 37 22 2c 22 35 61 39 73 22 3a 22 39 38 34 65 39 37 37 34 22 2c 22 35 61 74 6b 22 3a 22 35 35 35 64 37 39 37 38 22 2c 22 35 62 61 74 22 3a 22 65 6a 66 34 36 37 39 35 22 2c 22 35 63 70 66 22 3a 22 34 39 62 34 67 31 33 33 22 2c 22 35 63 72 73 22 3a 22 33 62 66 39 67 38 35 35 22 2c 22 35 64 77 37 22 3a 22 69 34 37 62 65 31 37 38 22 2c 22 35 65 74 36 22 3a 22 32 34 38 66 61 31 38 36 22 2c 22 35 66 6c 32 22 3a 22 68 35 31 66 30 33 34 32 22 2c 22 35 66 79 6f 22 3a 22 68 64 65 31 67 32 36 37 22 2c 22 35 66 79 71 22 3a 22 34 6a 6a 66 Data Ascii: 3j75264","590q":"4a30d455","59gg":"2i2he118","59gj":"4de5g542","59vz":"bec44757","5a9s":"984e9774","5atk":"555d7978","5bat":"ejf46795","5cpf":"49b4g133","5crs":"3bf9g855","5dw7":"i47be178","5et6":"248fa186","5fl2":"h51f0342","5fyo":"hde1g267","5fyq":"4jjf
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 64 22 3a 66 61 6c 73 65 2c 22 4f 6e 65 44 72 69 76 65 4f 6e 6c 69 6e 65 53 65 61 72 63 68 5f 49 6e 64 65 78 57 61 72 6d 69 6e 67 5f 49 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4f 6e 65 44 72 69 76 65 4f 6e 6c 69 6e 65 53 65 61 72 63 68 5f 49 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 7d 7d 2c 7b 22 49 64 22 3a 22 59 6f 75 72 50 68 6f 6e 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 41 4f 57 43 34 36 22 3a 36 34 30 30 2c 22 41 41 4f 57 43 34 37 22 3a 37 34 30 30 2c 22 41 41 4f 57 43 36 31 22 3a 31 36 30 30 2c 22 41 41 4f 57 43 36 32 22 3a 32 36 30 30 2c 22 41 41 4f 57 43 36 33 22 3a 33 36 30 30 2c 22 41 69 72 70 6c 61 6e 65 4d 6f 64 65 53 74 61 74 75 73 22 3a 74 72 75 65 2c 22 41 75 74 6f 48 79 64 72 61 74 65 64 49 6d 61 67 65 73 43 6f 75 Data Ascii: d":false,"OneDriveOnlineSearch_IndexWarming_IsEnabled":true,"OneDriveOnlineSearch_IsEnabled":true}},{"Id":"YourPhone","Parameters":{"AAOWC46":6400,"AAOWC47":7400,"AAOWC61":1600,"AAOWC62":2600,"AAOWC63":3600,"AirplaneModeStatus":true,"AutoHydratedImagesCou
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 74 65 4d 6f 64 65 22 3a 74 72 75 65 2c 22 49 6f 73 52 65 76 69 65 77 41 70 70 50 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 49 73 41 75 74 68 56 32 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4d 65 64 69 61 50 61 63 6b 43 68 65 63 6b 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 68 61 74 46 69 6c 74 65 72 54 6f 67 67 6c 65 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 73 65 6e 74 56 32 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 76 65 72 73 61 74 69 6f 6e 56 69 65 77 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 48 69 64 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 4d 75 74 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 50 69 6e 6e 69 Data Ascii: teMode":true,"IosReviewAppPrompt":true,"IsAuthV2Enabled":true,"MediaPackCheck":true,"MessagingChatFilterToggle":true,"MessagingConsentV2":true,"MessagingConversationView":true,"MessagingEnableHiding":true,"MessagingEnableMuting":true,"MessagingEnablePinni
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 30 35 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 31 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 32 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 35 22 3a 74 72 75 65 2c 22 52 6f 6d 65 44 69 73 61 62 6c 65 64 22 3a 34 34 31 35 30 33 2c 22 53 65 63 75 72 65 43 6f 6e 74 65 6e 74 22 3a 74 72 75 65 2c 22 53 68 65 6c 6c 45 78 74 65 6e 64 65 64 4c 65 66 74 50 61 6e 65 22 3a 74 72 75 65 2c 22 54 65 73 74 46 65 61 74 75 72 65 32 22 3a 66 61 6c 73 65 2c 22 55 6e 69 76 65 72 73 61 6c 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 22 3a 74 72 75 65 2c 22 57 68 61 74 73 4e 65 77 43 4e 22 3a 74 72 75 65 2c 22 59 50 50 43 61 74 61 73 74 72 6f 70 68 69 63 45 72 Data Ascii: true,"RemotingTop005":true,"RemotingTop011":true,"RemotingTop012":true,"RemotingTop015":true,"RomeDisabled":441503,"SecureContent":true,"ShellExtendedLeftPane":true,"TestFeature2":false,"UniversalBluetoothPairing":true,"WhatsNewCN":true,"YPPCatastrophicEr
2024-02-27 17:38:35 UTC	1024	IN	Data Raw: 36 33 38 3a 33 30 34 33 39 38 38 30 3b 79 6f 61 61 6f 77 63 34 36 63 66 3a 33 30 34 33 33 36 33 31 3b 79 6f 35 35 36 63 66 3a 33 30 37 38 38 37 30 33 3b 79 6f 61 61 6f 32 36 37 3a 33 30 34 33 34 36 37 32 3b 79 6f 70 72 69 32 35 37 3a 33 30 34 36 34 34 33 33 3b 79 6f 31 37 39 3a 33 30 34 34 35 33 31 30 3b 79 6f 69 73 61 38 36 31 3a 33 30 35 32 35 38 36 38 3b 79 6f 72 65 6d 31 34 31 3a 33 30 34 38 36 33 35 33 3b 79 6f 79 70 70 36 35 32 3a 33 30 35 31 35 34 38 33 3b 79 6f 35 32 35 3a 33 30 35 35 33 39 38 35 3b 79 6f 36 30 36 3a 33 30 35 32 37 38 35 30 3b 79 6f 6e 6f 74 36 33 33 3a 33 30 36 32 36 30 37 38 3b 79 6f 79 70 70 38 35 39 3a 33 30 36 38 37 38 35 39 3b 79 6f 69 6e 64 36 36 35 3a 33 30 35 39 35 31 36 33 3b 79 6f 64 63 67 38 33 30 3a 33 30 37 31 32 39 Data Ascii: 638:30439880;yoaaowc46cf:30433631;yo556cf:30788703;yoaao267:30434672;yopri257:30464433;yo179:30445310;yoisa861:30525868;yorem141:30486353;yoypp652:30515483;yo525:30553985;yo606:30527850;yonot633:30626078;yoypp859:30687859;yoind665:30595163;yodcg830:307129
2024-02-27 17:38:35 UTC	153	IN	Data Raw: 38 34 39 35 36 34 3b 34 6a 6a 66 62 37 36 38 3a 33 30 38 33 37 35 31 36 3b 36 61 66 67 62 36 35 31 3a 33 30 38 33 38 35 30 33 3b 35 30 63 37 39 31 30 36 3a 33 30 38 33 38 36 31 39 3b 68 33 65 64 34 31 36 31 3a 33 30 38 39 31 37 38 34 3b 61 62 69 30 67 38 31 37 3a 33 30 39 35 32 38 37 35 3b 64 69 66 32 32 32 31 39 3a 33 30 39 36 30 34 30 32 3b 35 33 65 39 67 37 32 39 3a 33 30 39 37 30 36 34 39 3b 33 6a 39 33 63 38 34 32 3a 33 30 39 37 30 36 35 30 3b 22 7d Data Ascii: 849564;4jjfb768:30837516;6afgb651:30838503;50c79106:30838619;h3ed4161:30891784;abi0g817:30952875;dif22219:30960402;53e9g729:30970649;3j93c842:30970650;"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49716	34.117.223.223	443	3708	C:\Users\user\Desktop\ccsetup621.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:36 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 290 Host: analytics.avcdn.net
2024-02-27 17:38:36 UTC	290	OUT	Data Raw: 0a 9f 02 0a 42 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 12 84 01 0a 03 3b 06 03 10 ea f9 f0 dd 0c 28 78 5a 73 08 0a 10 00 18 e5 94 01 20 01 28 00 32 24 31 66 66 39 34 34 64 32 2d 32 39 38 63 2d 34 34 38 36 2d 61 39 63 64 2d 35 31 39 35 35 65 34 36 34 30 33 38 38 00 42 2c 35 51 39 54 2d 51 55 57 41 2d 54 34 4b 46 2d 4d 42 48 48 2d 53 4e 36 59 2d 43 55 39 53 2d 57 50 44 37 2d 4a 59 58 36 2d 50 44 47 49 48 01 52 00 58 00 60 32 6a 00 72 00 78 00 82 01 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 Data Ascii: BB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B;(xZs (2$1ff944d2-298c-4486-a9cd-51955e4640388B,5Q9T-QUWA-T4KF-MBHH-SN6Y-CU9S-WPD7-JYX6-PDGIHRX`2jrx`"F6.21.10918"/10.0 (Build 19045, Release 2009
2024-02-27 17:38:36 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:36 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:36 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49717	34.149.149.62	443	3460	C:\Program Files\CCleaner\CCUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:37 UTC	155	OUT	GET /v2/info HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: CCleaner Update Agent Host: ip-info.ff.avast.com
2024-02-27 17:38:37 UTC	176	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:37 GMT Content-Type: application/json Content-Length: 348 Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-27 17:38:37 UTC	348	IN	Data Raw: 7b 22 69 70 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 32 30 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 73 75 62 64 69 76 69 73 69 6f 6e 73 22 3a 5b 22 44 43 22 5d 2c 22 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 38 2e 38 39 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 37 2e 30 33 36 35 2c 22 69 73 70 22 3a 22 69 4e 45 53 20 47 52 4f 55 50 22 2c 22 61 73 6e 4e 75 6d 62 65 72 Data Ascii: {"ip":"89.149.18.20","continent":"North America","continentCode":"NA","country":"US","countryName":"United States","subdivisions":["DC"],"city":"Washington","timezone":"America/New_York","latitude":38.894,"longitude":-77.0365,"isp":"iNES GROUP","asnNumber

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49718	34.117.223.223	443	400	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:37 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 255 Host: analytics.avcdn.net
2024-02-27 17:38:37 UTC	255	OUT	Data Raw: 0a fc 01 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 3c 0a 03 3b 09 01 10 b8 f8 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 17 08 99 3d 12 08 0a 04 48 4b 4c 4d 10 06 12 08 0a 04 48 4b 43 55 10 06 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 12 52 08 08 01 10 9c bc f8 ae 06 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6<;HealthCheckNF0(xZ=HKLMHKCU`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@R
2024-02-27 17:38:38 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:38 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:38 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49721	34.117.223.223	443	400	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:38 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 266 Host: analytics.avcdn.net
2024-02-27 17:38:38 UTC	266	OUT	Data Raw: 0a 87 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 47 0a 03 3b 09 01 10 b8 f8 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 22 08 c9 34 12 1d 0a 19 50 6e 61 63 6c 54 72 61 6e 73 6c 61 74 69 6f 6e 43 61 63 68 65 53 69 7a 65 10 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6G;HealthCheckNF0(xZ"4PnaclTranslationCacheSize`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@
2024-02-27 17:38:38 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:38 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:38 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49723	34.117.223.223	443	400	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:38 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 274 Host: analytics.avcdn.net
2024-02-27 17:38:38 UTC	274	OUT	Data Raw: 0a 8f 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 4f 0a 03 3b 09 01 10 b8 f8 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 2a 08 fc 44 12 0e 0a 0a 47 61 6d 65 72 53 63 6f 72 65 10 02 12 15 0a 11 47 61 6d 65 72 53 63 6f 72 65 56 65 72 73 69 6f 6e 10 04 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6O;HealthCheckNF0(xZ*DGamerScoreGamerScoreVersion`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)
2024-02-27 17:38:38 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:38 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:38 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49724	34.149.149.62	443	5836	C:\Program Files\CCleaner\CCUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:39 UTC	155	OUT	GET /v2/info HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: CCleaner Update Agent Host: ip-info.ff.avast.com
2024-02-27 17:38:39 UTC	176	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:39 GMT Content-Type: application/json Content-Length: 348 Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-27 17:38:39 UTC	348	IN	Data Raw: 7b 22 69 70 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 32 30 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 73 75 62 64 69 76 69 73 69 6f 6e 73 22 3a 5b 22 44 43 22 5d 2c 22 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 38 2e 38 39 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 37 2e 30 33 36 35 2c 22 69 73 70 22 3a 22 69 4e 45 53 20 47 52 4f 55 50 22 2c 22 61 73 6e 4e 75 6d 62 65 72 Data Ascii: {"ip":"89.149.18.20","continent":"North America","continentCode":"NA","country":"US","countryName":"United States","subdivisions":["DC"],"city":"Washington","timezone":"America/New_York","latitude":38.894,"longitude":-77.0365,"isp":"iNES GROUP","asnNumber

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49738	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:42 UTC	576	OUT	GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:42 UTC	902	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:42 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85c233f71bca5950-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 18817 Cache-Control: public, max-age=86400 Expires: Wed, 28 Feb 2024 17:38:42 GMT Last-Modified: Mon, 20 Jun 2022 08:17:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: OjiXocbqAbrCiKradNtQtQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 493b0f49-201e-0017-641c-129088000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-27 17:38:42 UTC	467	IN	Data Raw: 35 32 34 33 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 64 29 7b 76 61 72 20 67 3d 5b 5d 2c 61 3d 5b 5d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 66 6f 72 28 76 61 72 20 62 3d 7b 7d 2c 65 3d 30 3b 65 3c 7a 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 68 3d 7a 5b 65 5d 3b 69 66 28 68 2e 54 61 67 3d 3d 3d 63 29 7b 62 3d 68 3b 62 72 65 61 6b 7d 76 61 72 20 6b 3d 28 72 3d 68 2e 54 61 67 2c 74 3d 78 3d 6c 3d 76 6f 69 64 20 30 2c 6c 3d 2d 31 21 3d 3d 28 74 3d 72 29 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 74 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 74 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 78 3d 6c 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f Data Ascii: 5243!function(){function n(d){var g=[],a=[],f=function(c){for(var b={},e=0;e<z.length;e++){var h=z[e];if(h.Tag===c){b=h;break}var k=(r=h.Tag,t=x=l=void 0,l=-1!==(t=r).indexOf("http:")?t.replace("http:",""):t.replace("https:",""),-1!==(x=l.indexOf("?"))?
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 6f 6e 28 63 29 7b 76 61 72 20 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 6b 2e 68 72 65 66 3d 68 3b 68 3d 6b 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 3b 72 65 74 75 72 6e 2d 31 21 3d 3d 68 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 68 2e 6c 65 6e 67 74 68 3f 68 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6b 2e 68 6f 73 74 6e 61 6d 65 7d 28 63 29 3b 79 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 3d 3d 3d 65 7d 29 26 26 28 62 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 62 7d 28 64 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 67 2c 76 73 43 61 Data Ascii: on(c){var b=[],e=function(h){var k=document.createElement("a");k.href=h;h=k.hostname.split(".");return-1!==h.indexOf("www")\|\|2<h.length?h.slice(1).join("."):k.hostname}(c);y.some(function(h){return h===e})&&(b=["C0004"]);return b}(d)),{categoryIds:g,vsCa
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 70 61 72 73 65 28 27 5b 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 63 6c 65 61 6e 65 72 2e 73 70 65 65 64 74 65 73 74 63 75 73 74 6f 6d 2e 63 6f 6d 2f 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 69 6c 64 65 72 2d 75 70 6c 6f 61 64 2e 65 75 2f 74 68 75 6d 62 2f 32 65 30 66 66 65 2d 31 34 32 39 39 36 32 32 35 38 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 70 69 78 70 69 70 65 6c 69 6e 65 2e 63 6f 6d 2f 73 74 2f 30 64 38 37 31 32 38 32 38 37 37 38 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f Data Ascii: parse('[{"Tag":"https://ccleaner.speedtestcustom.com/","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://www.bilder-upload.eu/thumb/2e0ffe-1429962258.jpg","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://pixpipeline.com/st/0d8712828778.jpg","Catego
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 2f 70 6c 75 67 69 6e 73 2f 75 61 2f 65 63 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 74 72 2e 6f 75 74 62 72 61 69 6e 2e 63 6f 6d 2f 63 61 63 68 65 64 43 6c 69 63 6b 49 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 2e 76 69 73 75 61 6c 77 65 62 73 69 74 65 6f Data Ascii: ,"CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.google-analytics.com/plugins/ua/ec.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://tr.outbrain.com/cachedClickId","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://dev.visualwebsiteo
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 67 22 3a 22 68 74 74 70 3a 2f 2f 6c 65 63 6b 74 72 6f 6e 69 78 2e 63 6f 6d 2f 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 69 6c 64 65 72 2d 75 70 6c 6f 61 64 2e 65 75 2f 74 68 75 6d 62 2f 37 39 66 36 31 38 2d 31 34 33 39 32 30 33 38 35 35 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 64 65 76 2e 76 69 73 75 61 6c 77 65 62 73 69 74 65 6f 70 74 69 6d 69 7a 65 72 2e 63 6f 6d 2f 6a 2e 70 68 70 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e Data Ascii: g":"http://lecktronix.com/","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://www.bilder-upload.eu/thumb/79f618-1439203855.jpg","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://dev.visualwebsiteoptimizer.com/j.php","CategoryId":["C0002"],"Vendor":n
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6f 6e 70 69 74 63 68 65 72 70 68 6f 74 6f 67 72 61 70 68 79 2e 63 6f 6d 2f 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 79 2e 78 66 69 6e 69 74 79 2e 63 6f 6d 2f 7e 70 72 67 61 75 6c 74 2f 67 69 72 6c 66 69 67 68 74 2e 67 69 66 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 2f 70 6c 75 67 69 6e 73 Data Ascii: Id":["C0004"],"Vendor":null},{"Tag":"http://www.donpitcherphotography.com/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://my.xfinity.com/~prgault/girlfight.gif","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.google-analytics.com/plugins
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 71 75 61 6e 74 73 65 72 76 65 2e 63 6f 6d 2f 70 69 78 65 6c 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 2f 73 69 67 6e 61 6c 73 2f 63 6f 6e 66 69 67 2f 32 36 37 39 34 37 35 33 34 35 37 30 38 31 30 31 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 66 6f 72 75 6d 73 2e 6c 75 6e 61 72 73 6f 66 74 2e 6e 65 74 2f 22 2c 22 43 Data Ascii: "C0002"],"Vendor":null},{"Tag":"https://pixel.quantserve.com/pixel","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/2679475345708101","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://forums.lunarsoft.net/","C
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 74 72 2f 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 69 6c 64 65 72 2d 75 70 6c 6f 61 64 2e 65 75 2f 74 68 75 6d 62 2f 64 63 64 65 37 32 2d 31 34 33 39 30 34 39 32 39 33 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 63 6c 65 61 6e 65 72 63 6f 6d 2d 70 72 6f 64 75 63 Data Ascii: pg","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://www.bilder-upload.eu/thumb/dcde72-1439049293.jpg","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ccleanercom-produc
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 75 62 65 2e 63 6f 6d 2f 65 6d 62 65 64 2f 61 4c 4f 38 64 5a 30 72 34 70 51 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 2c 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 64 61 6a 2e 72 73 2f 66 2f 33 38 2f 68 34 2f 33 6e 42 78 48 6a 76 73 2f 73 70 65 63 63 79 2e 70 6e 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 6f 67 70 72 6f 64 75 63 74 73 68 6f 70 2e 63 6f 2e 75 6b 2f 73 6d 69 6c 65 2f 68 61 70 70 79 2f 68 61 70 70 79 30 30 30 35 2e 67 69 66 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 35 22 5d 2c Data Ascii: ube.com/embed/aLO8dZ0r4pQ","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://dodaj.rs/f/38/h4/3nBxHjvs/speccy.png","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://www.dogproductshop.co.uk/smile/happy/happy0005.gif","CategoryId":["C0005"],
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 61 62 33 64 33 61 65 61 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 35 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 62 69 6c 64 65 72 2d 75 70 6c 6f 61 64 2e 65 75 2f 74 68 75 6d 62 2f 65 66 65 65 31 38 2d 31 34 34 34 32 35 37 37 35 31 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f 2f 70 69 78 70 69 70 65 6c 69 6e 65 2e 63 6f 6d 2f 73 74 2f 38 38 33 34 64 66 65 62 38 61 61 33 2e 6a 70 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 3a 2f Data Ascii: ab3d3aea","CategoryId":["C0005"],"Vendor":null},{"Tag":"http://www.bilder-upload.eu/thumb/efee18-1444257751.jpg","CategoryId":["C0004"],"Vendor":null},{"Tag":"http://pixpipeline.com/st/8834dfeb8aa3.jpg","CategoryId":["C0004"],"Vendor":null},{"Tag":"http:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49737	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:42 UTC	545	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:42 UTC	815	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:42 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: OKrCs7nhvutcs03VCUskmw== Last-Modified: Tue, 27 Feb 2024 03:06:26 GMT x-ms-request-id: 3633ee45-101e-00a5-122a-696ff9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29490 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c233f71ee920ae-IAD
2024-02-27 17:38:42 UTC	554	IN	Data Raw: 35 32 36 63 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 2c 6f 2c 70 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 Data Ascii: 526cvar OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIAB
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d 5d 22 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 44 6f 6d 61 69 6e 49 64 3d 22 5b 5b 4e 65 77 44 6f 6d 61 69 6e 49 64 5d 5d 22 2c 74 68 Data Ascii: HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",th
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 65 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 74 2c 65 5d 29 2c 22 73 74 79 6c 65 Data Ascii: his.camelize(a[0])]=a[1].trim()}return e},e);function e(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=function(t,e){if("style"!==t.toLowerCase()&&o.apply(this,[t,e]),"style
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 28 69 3d 73 2e 77 69 6e 29 3f Data Ascii: oveGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];var i=null==(i=s.win)?
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 28 69 3d 6e 29 26 26 69 2e 6c 61 73 74 49 64 7c 7c 28 6e 2e 6c 61 73 74 49 64 3d 30 29 2c 6e 2e 6c 61 73 74 49 64 2b 2b 2c 6e 2e 65 76 65 6e 74 73 2e 70 Data Ascii: name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],null!=(i=n)&&i.lastId\|\|(n.lastId=0),n.lastId++,n.events.p
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 Data Ascii: ce=function(){this.nonce=p.stubScriptElement.nonce\|\|p.stubScriptElement.getAttribute("nonce")\|\|null},h.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL(),this.crossOrigin=p.stubScriptElement.getAttribute("crossorigin")\|\|null,this.pr
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 69 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 69 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 28 69 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 74 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 Data Ascii: ponse,this.setGeoLocation(i.countryCode,i.stateCode),this.addBannerSDKScript(t)):(i=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam))\|\|t.SkipGeolocation?(e=i.split(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScri
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 65 29 7b 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 3d 7b 63 6f 75 6e 74 72 79 3a 74 2c 73 74 61 74 65 3a 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 2c 6e 2c 61 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f Data Ascii: e){p.userLocation={country:t,state:e=void 0===e?"":e}},h.prototype.otFetch=function(t,i,e,n,a){void 0===e&&(e=!1),void 0===n&&(n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.o
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 6f 6e 2c 6f 3d 74 2e 52 75 6c 65 53 65 74 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 74 2e 44 65 66 61 75 6c 74 7d 29 3b 69 66 28 21 61 2e 63 6f 75 6e 74 72 79 26 26 21 61 2e 73 74 61 74 65 29 72 65 74 75 72 6e 20 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 3f 6f 5b 30 5d 3a 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 6c 3d 74 2e 52 75 Data Ascii: on,o=t.RuleSet.filter(function(t){return!0===t.Default});if(!a.country&&!a.state)return o&&0<o.length?o[0]:null;for(var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var l=t.Ru
2024-02-27 17:38:42 UTC	1369	IN	Data Raw: 74 43 6f 6f 6b 69 65 28 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 29 29 3a 70 2e 69 73 53 74 75 62 52 65 61 64 79 3d 21 31 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 69 64 61 74 65 49 41 42 47 44 50 52 41 70 70 6c 69 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 3b 74 3f 74 68 69 73 2e 69 73 42 6f 6f 6c 65 61 6e 28 74 29 3f 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 22 74 72 75 65 22 3d 3d 3d 74 3a 70 2e 6f 6e 65 Data Ascii: tCookie(p.oneTrustIABCookieName)):p.isStubReady=!1},h.prototype.validateIABGDPRApplied=function(){var t=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam).split(";")[0];t?this.isBoolean(t)?p.oneTrustIABgdprAppliesGlobally="true"===t:p.one

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49755	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:43 UTC	633	OUT	GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:44 UTC	901	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:44 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85c2340189d4878b-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 6732 Cache-Control: public, max-age=86400 Expires: Wed, 28 Feb 2024 17:38:44 GMT Last-Modified: Mon, 20 Jun 2022 08:17:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: +ktymhPnSWqyEqeVb81i+w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5b0f01dd-001e-0152-28e1-5a8341000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-27 17:38:44 UTC	468	IN	Data Raw: 66 65 63 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 36 2e 33 36 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 38 33 31 62 38 65 65 30 2d 65 39 35 32 2d 34 39 61 35 2d 61 66 36 62 2d 30 31 33 38 32 63 37 32 32 37 37 34 22 2c 22 47 65 6f 6c 6f 63 61 74 69 6f 6e 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 65 6f 6c 6f 63 Data Ascii: fec{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.36.0","OptanonDataJSON":"831b8ee0-e952-49a5-af6b-01382c722774","GeolocationUrl":"https://geoloc
2024-02-27 17:38:44 UTC	1369	IN	Data Raw: 50 52 29 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 61 6c 22 2c 22 61 6d 22 2c 22 61 6f 22 2c 22 61 71 22 2c 22 61 72 22 2c 22 61 73 22 2c 22 61 75 22 2c 22 61 77 22 2c 22 61 7a 22 2c 22 62 61 22 2c 22 62 62 22 2c 22 72 73 22 2c 22 62 64 22 2c 22 72 75 22 2c 22 62 66 22 2c 22 72 77 22 2c 22 62 68 22 2c 22 62 69 22 2c 22 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 62 71 22 2c 22 73 62 22 2c 22 62 72 22 2c 22 73 63 22 2c 22 62 73 22 2c 22 73 64 22 2c 22 62 74 22 2c 22 62 76 22 2c 22 73 67 22 2c 22 73 68 22 2c 22 62 77 22 2c 22 62 79 22 2c 22 73 6a 22 2c 22 62 Data Ascii: PR)","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","br","sc","bs","sd","bt","bv","sg","sh","bw","by","sj","b
2024-02-27 17:38:44 UTC	1369	IN	Data Raw: 50 52 20 74 65 6d 70 6c 61 74 65 2e 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 7d 2c 7b 22 49 64 22 3a 22 32 36 62 65 64 30 30 37 2d 36 63 37 30 2d 34 64 61 37 2d 62 38 33 30 2d 32 35 65 32 35 63 36 34 34 33 33 36 22 2c 22 4e 61 6d 65 22 3a 22 49 72 65 6c 61 6e 64 20 28 41 6c 6c 20 4f 70 74 2d 69 6e 29 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 69 65 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 64 65 22 3a 22 64 65 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 65 73 22 3a Data Ascii: PR template.","Conditions":[],"GCEnable":false},{"Id":"26bed007-6c70-4da7-b830-25e25c644336","Name":"Ireland (All Opt-in)","Countries":["ie"],"States":{},"LanguageSwitcherPlaceholder":{"de":"de","default":"en","ru":"ru","pt":"pt","it":"it","fr":"fr","es":
2024-02-27 17:38:44 UTC	877	IN	Data Raw: 38 3a 31 37 3a 30 30 2e 38 33 37 32 31 37 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e 75 6c 6c 2c 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 3a 30 2c 22 6d 61 78 56 65 6e 64 6f 72 49 64 22 3a 30 2c 22 65 6e 63 6f 64 69 6e 67 54 79 70 65 22 3a 22 30 22 2c 22 67 6c 6f 62 61 6c 56 65 6e 64 6f 72 4c 69 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6f 6b 69 65 6c 61 77 2e 6f 72 67 2f 76 65 6e 64 6f 72 6c 69 73 74 2f 69 61 62 32 44 61 74 61 2e 6a 73 6f 6e 22 7d 2c 22 47 6f 6f 67 6c 65 44 61 74 61 22 3a 7b 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 Data Ascii: 8:17:00.837217","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":null,"vendorListVersion":0,"maxVendorId":0,"encodingType":"0","globalVendorListUrl":"https://cdn.cookielaw.org/vendorlist/iab2Data.json"},"GoogleData":{"vendorListVersion"
2024-02-27 17:38:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49764	142.251.163.103	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:43 UTC	873	OUT	GET /recaptcha/api.js?onload=ccleaner_recaptcha_onloadCallback&render=explicit HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-02-27 17:38:44 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Tue, 27 Feb 2024 17:38:44 GMT Date: Tue, 27 Feb 2024 17:38:44 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-27 17:38:44 UTC	724	IN	Data Raw: 35 31 34 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 514/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-27 17:38:44 UTC	583	IN	Data Raw: 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 31 6b 52 44 59 43 33 62 66 41 2d 6f 36 2d 74 73 57 7a 49 42 76 70 37 6b 2f 72 65 Data Ascii: jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/re
2024-02-27 17:38:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49778	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:44 UTC	427	OUT	GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:44 UTC	890	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:44 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85c23405f87b05cc-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Expires: Wed, 28 Feb 2024 17:38:44 GMT Last-Modified: Mon, 20 Jun 2022 08:17:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: +ktymhPnSWqyEqeVb81i+w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 41ab3c9c-c01e-0042-7940-148003000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-27 17:38:44 UTC	479	IN	Data Raw: 66 65 63 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 36 2e 33 36 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 38 33 31 62 38 65 65 30 2d 65 39 35 32 2d 34 39 61 35 2d 61 66 36 62 2d 30 31 33 38 32 63 37 32 32 37 37 34 22 2c 22 47 65 6f 6c 6f 63 61 74 69 6f 6e 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 65 6f 6c 6f 63 Data Ascii: fec{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.36.0","OptanonDataJSON":"831b8ee0-e952-49a5-af6b-01382c722774","GeolocationUrl":"https://geoloc
2024-02-27 17:38:44 UTC	1369	IN	Data Raw: 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 61 6c 22 2c 22 61 6d 22 2c 22 61 6f 22 2c 22 61 71 22 2c 22 61 72 22 2c 22 61 73 22 2c 22 61 75 22 2c 22 61 77 22 2c 22 61 7a 22 2c 22 62 61 22 2c 22 62 62 22 2c 22 72 73 22 2c 22 62 64 22 2c 22 72 75 22 2c 22 62 66 22 2c 22 72 77 22 2c 22 62 68 22 2c 22 62 69 22 2c 22 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 62 71 22 2c 22 73 62 22 2c 22 62 72 22 2c 22 73 63 22 2c 22 62 73 22 2c 22 73 64 22 2c 22 62 74 22 2c 22 62 76 22 2c 22 73 67 22 2c 22 73 68 22 2c 22 62 77 22 2c 22 62 79 22 2c 22 73 6a 22 2c 22 62 7a 22 2c 22 73 6c 22 2c 22 73 6e Data Ascii: ries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","br","sc","bs","sd","bt","bv","sg","sh","bw","by","sj","bz","sl","sn
2024-02-27 17:38:44 UTC	1369	IN	Data Raw: 2e 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 7d 2c 7b 22 49 64 22 3a 22 32 36 62 65 64 30 30 37 2d 36 63 37 30 2d 34 64 61 37 2d 62 38 33 30 2d 32 35 65 32 35 63 36 34 34 33 33 36 22 2c 22 4e 61 6d 65 22 3a 22 49 72 65 6c 61 6e 64 20 28 41 6c 6c 20 4f 70 74 2d 69 6e 29 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 69 65 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 64 65 22 3a 22 64 65 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 6e 6c 22 3a 22 Data Ascii: .","Conditions":[],"GCEnable":false},{"Id":"26bed007-6c70-4da7-b830-25e25c644336","Name":"Ireland (All Opt-in)","Countries":["ie"],"States":{},"LanguageSwitcherPlaceholder":{"de":"de","default":"en","ru":"ru","pt":"pt","it":"it","fr":"fr","es":"es","nl":"
2024-02-27 17:38:44 UTC	866	IN	Data Raw: 32 31 37 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e 75 6c 6c 2c 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 3a 30 2c 22 6d 61 78 56 65 6e 64 6f 72 49 64 22 3a 30 2c 22 65 6e 63 6f 64 69 6e 67 54 79 70 65 22 3a 22 30 22 2c 22 67 6c 6f 62 61 6c 56 65 6e 64 6f 72 4c 69 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6f 6b 69 65 6c 61 77 2e 6f 72 67 2f 76 65 6e 64 6f 72 6c 69 73 74 2f 69 61 62 32 44 61 74 61 2e 6a 73 6f 6e 22 7d 2c 22 47 6f 6f 67 6c 65 44 61 74 61 22 3a 7b 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 3a 31 2c 22 67 6f 6f 67 6c 65 56 Data Ascii: 217","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":null,"vendorListVersion":0,"maxVendorId":0,"encodingType":"0","globalVendorListUrl":"https://cdn.cookielaw.org/vendorlist/iab2Data.json"},"GoogleData":{"vendorListVersion":1,"googleV
2024-02-27 17:38:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49779	104.18.32.137	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:44 UTC	599	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:44 UTC	370	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:44 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85c234060cdf8790-IAD
2024-02-27 17:38:44 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49780	44.209.16.161	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:44 UTC	719	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1709055523652 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	819	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:44 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: piB6acxZQvo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.ccleaner.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-1-v056-0dfa16039.edge-va6.demdex.com 2 ms set-cookie: demdex=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:44 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-27 17:38:45 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 36 35 31 33 37 34 30 30 36 30 32 35 38 33 32 30 38 35 31 30 31 32 39 32 37 36 38 30 38 34 38 39 31 36 36 37 39 36 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"65137400602583208510129276808489166796","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49795	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	554	OUT	GET /scripttemplates/6.36.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	815	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:45 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: 8atDBk1Pe2rTtV5h1AnhkA== Last-Modified: Tue, 07 Jun 2022 19:29:06 GMT x-ms-request-id: 2c8c1376-601e-0064-69a8-13c81b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 33706 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23409ae0005e9-IAD
2024-02-27 17:38:45 UTC	554	IN	Data Raw: 37 63 36 66 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 36 2e 33 36 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 6f 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 29 Data Ascii: 7c6f/** * onetrust-banner-sdk * v6.36.0 * by OneTrust LLC * Copyright 2022 */!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 29 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 72 28 6c 2e 6e 65 78 74 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 74 72 79 7b 72 28 6c 2e 74 68 72 6f 77 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 74 29 7b 74 2e 64 6f 6e 65 3f 65 28 74 2e 76 61 6c 75 65 29 3a 6e 65 77 20 61 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 2e 76 61 6c 75 65 29 7d 29 2e 74 68 65 6e 28 6f 2c 6e 29 7d 72 28 28 6c 3d 6c 2e 61 70 70 6c 79 28 69 2c 73 7c 7c 5b 5d 29 29 2e 6e 65 78 74 28 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 6f 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 73 2c 65 2c 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 Data Ascii: )(function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(i,s\|\|[])).next())})}function C(o,n){var r,i,s,e,a={label:0,s
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 29 2c 72 3d 30 3b 66 6f 72 28 74 3d 30 3b 74 3c 6f 3b 74 2b 2b 29 66 6f 72 28 76 61 72 20 69 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 2c 73 3d 30 2c 61 3d 69 2e 6c 65 6e 67 74 68 3b 73 3c 61 3b 73 2b 2b 2c 72 2b 2b 29 6e 5b 72 5d 3d 69 5b 73 5d 3b 72 65 74 75 72 6e 20 6e 7d 28 65 3d 6b 3d 6b 7c 7c 7b 7d 29 5b 65 2e 41 43 54 49 56 45 3d 30 5d 3d 22 41 43 54 49 56 45 22 2c 65 5b 65 2e 41 4c 57 41 59 53 5f 41 43 54 49 56 45 3d 31 5d 3d 22 41 4c 57 41 59 53 5f 41 43 54 49 56 45 22 2c 65 5b 65 2e 45 58 50 49 52 45 44 3d 32 5d 3d 22 45 58 50 49 52 45 44 22 2c 65 5b 65 2e 4e 4f 5f 43 4f 4e 53 45 4e 54 3d 33 5d 3d 22 4e 4f 5f 43 4f 4e 53 45 4e 54 22 2c 65 5b 65 2e 4f 50 54 5f 4f 55 54 3d 34 5d 3d 22 4f 50 54 5f 4f 55 54 22 2c 65 5b 65 2e 50 45 4e 44 49 4e 47 3d 35 Data Ascii: ),r=0;for(t=0;t<o;t++)for(var i=arguments[t],s=0,a=i.length;s<a;s++,r++)n[r]=i[s];return n}(e=k=k\|\|{})[e.ACTIVE=0]="ACTIVE",e[e.ALWAYS_ACTIVE=1]="ALWAYS_ACTIVE",e[e.EXPIRED=2]="EXPIRED",e[e.NO_CONSENT=3]="NO_CONSENT",e[e.OPT_OUT=4]="OPT_OUT",e[e.PENDING=5
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 65 64 69 61 74 65 46 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 68 61 6e 64 6c 65 64 7c 7c 69 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 28 65 2e 5f 76 61 6c 75 65 29 7d 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6f 3d 65 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 73 28 65 2c 65 2e 5f 64 65 66 65 72 72 65 64 73 5b 74 5d 29 3b 65 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6f 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 6e 75 6c 6c 2c 74 68 69 73 2e 6f 6e 52 65 6a 65 63 74 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 6e 75 6c 6c Data Ascii: ediateFn(function(){e._handled\|\|i._unhandledRejectionFn(e._value)});for(var t=0,o=e._deferreds.length;t<o;t++)s(e,e._deferreds[t]);e._deferreds=null}function p(e,t,o){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 6c 28 72 29 29 72 65 74 75 72 6e 20 74 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 6f 3d 30 2c 6e 3d 72 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 69 2e 72 65 73 6f 6c 76 65 28 72 5b 6f 5d 29 2e 74 68 65 6e 28 65 2c 74 29 7d 29 7d 2c 69 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 65 74 49 6d 6d 65 64 69 61 74 65 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 65 2c 30 29 7d 2c 69 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 Data Ascii: function(e,t){if(!l(r))return t(new TypeError("Promise.race accepts an array"));for(var o=0,n=r.length;o<n;o++)i.resolve(r[o]).then(e,t)})},i._immediateFn="function"==typeof setImmediate?function(e){setImmediate(e)}:function(e){t(e,0)},i._unhandledRejecti
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 67 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 43 6c 6f 73 65 73 74 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 7c 7c 28 45 6c 65 6d 65 6e 74 2e 70 72 6f Data Ascii: roperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable:!0,configurable:!0})},g.prototype.initClosestPolyfill=function(){Element.prototype.matches\|\|(Element.pro
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 6e 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 6e 2c 6f 29 2c 69 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 73 3d 76 6f 69 64 20 30 3d 3d 3d 69 3f 6f 3a 69 3e 3e 30 2c 61 3d 73 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 73 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 73 2c 6f 29 3b 72 3c 61 3b 29 74 5b 72 5d 3d 65 Data Ascii: lue:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max(o+n,0):Math.min(n,o),i=arguments[2],s=void 0===i?o:i>>0,a=s<0?Math.max(o+s,0):Math.min(s,o);r<a;)t[r]=e
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 22 2c 28 54 3d 41 3d 41 7c 7c 7b 7d 29 5b 54 2e 50 75 72 70 6f 73 65 3d 31 5d 3d 22 50 75 72 70 6f 73 65 22 2c 54 5b 54 2e 53 70 65 63 69 61 6c 46 65 61 74 75 72 65 3d 32 5d 3d 22 53 70 65 63 69 61 6c 46 65 61 74 75 72 65 22 2c 28 49 3d 47 3d 47 7c 7c 7b 7d 29 2e 4c 65 67 61 6c 3d 22 6c 65 67 61 6c 22 2c 49 2e 55 73 65 72 46 72 69 65 6e 64 6c 79 3d 22 75 73 65 72 5f 66 72 69 65 6e 64 6c 79 22 2c 28 4c 3d 45 3d 45 7c 7c 7b 7d 29 2e 54 6f 70 3d 22 74 6f 70 22 2c 4c 2e 42 6f 74 74 6f 6d 3d 22 62 6f 74 74 6f 6d 22 2c 28 56 3d 5f 3d 5f 7c 7c 7b 7d 29 5b 56 2e 42 61 6e 6e 65 72 3d 30 5d 3d 22 42 61 6e 6e 65 72 22 2c 56 5b 56 2e 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 3d 31 5d 3d 22 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 22 2c 56 5b 56 2e 56 65 6e 64 6f 72 Data Ascii: ",(T=A=A\|\|{})[T.Purpose=1]="Purpose",T[T.SpecialFeature=2]="SpecialFeature",(I=G=G\|\|{}).Legal="legal",I.UserFriendly="user_friendly",(L=E=E\|\|{}).Top="top",L.Bottom="bottom",(V=_=_\|\|{})[V.Banner=0]="Banner",V[V.PrefCenterHome=1]="PrefCenterHome",V[V.Vendor
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 2e 6d 69 6e 44 61 79 73 3d 31 5d 3d 22 6d 69 6e 44 61 79 73 22 2c 5a 5b 5a 2e 6d 61 78 44 61 79 73 3d 33 30 5d 3d 22 6d 61 78 44 61 79 73 22 2c 5a 5b 5a 2e 6d 61 78 59 65 61 72 3d 33 31 35 33 36 65 33 5d 3d 22 6d 61 78 59 65 61 72 22 2c 5a 5b 5a 2e 6d 61 78 53 65 63 54 6f 44 61 79 73 3d 38 36 34 30 30 5d 3d 22 6d 61 78 53 65 63 54 6f 44 61 79 73 22 2c 28 74 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 74 65 2e 52 54 4c 3d 30 5d 3d 22 52 54 4c 22 2c 74 65 5b 74 65 2e 4c 54 52 3d 31 5d 3d 22 4c 54 52 22 2c 28 6e 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 5b 6e 65 2e 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 3d 31 5d 3d 22 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 22 2c 6e 65 5b 6e 65 2e 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 3d 32 5d 3d 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 22 Data Ascii: .minDays=1]="minDays",Z[Z.maxDays=30]="maxDays",Z[Z.maxYear=31536e3]="maxYear",Z[Z.maxSecToDays=86400]="maxSecToDays",(te=ee=ee\|\|{})[te.RTL=0]="RTL",te[te.LTR=1]="LTR",(ne=oe=oe\|\|{})[ne.GoogleVendor=1]="GoogleVendor",ne[ne.GeneralVendor=2]="GeneralVendor"
2024-02-27 17:38:45 UTC	1369	IN	Data Raw: 49 41 42 47 6c 6f 62 61 6c 22 2c 78 65 3d 22 4e 6f 74 4c 61 6e 64 69 6e 67 50 61 67 65 22 2c 47 65 3d 22 69 73 47 70 63 45 6e 61 62 6c 65 64 22 2c 4f 65 3d 7b 41 44 44 49 54 49 4f 4e 41 4c 5f 43 4f 4e 53 45 4e 54 5f 53 54 52 49 4e 47 3a 22 4f 54 41 64 64 69 74 69 6f 6e 61 6c 43 6f 6e 73 65 6e 74 53 74 72 69 6e 67 22 2c 41 4c 45 52 54 5f 42 4f 58 5f 43 4c 4f 53 45 44 3a 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 4f 50 54 41 4e 4f 4e 5f 43 4f 4e 53 45 4e 54 3a 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 45 55 5f 50 55 42 5f 43 4f 4e 53 45 4e 54 3a 22 65 75 70 75 62 63 6f 6e 73 65 6e 74 2d 76 32 22 2c 45 55 5f 43 4f 4e 53 45 4e 54 3a 22 65 75 63 6f 6e 73 65 6e 74 2d 76 32 22 2c 53 45 4c 45 43 54 45 44 5f 56 41 52 49 41 4e Data Ascii: IABGlobal",xe="NotLandingPage",Ge="isGpcEnabled",Oe={ADDITIONAL_CONSENT_STRING:"OTAdditionalConsentString",ALERT_BOX_CLOSED:"OptanonAlertBoxClosed",OPTANON_CONSENT:"OptanonConsent",EU_PUB_CONSENT:"eupubconsent-v2",EU_CONSENT:"euconsent-v2",SELECTED_VARIAN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49798	172.64.155.119	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:45 GMT Content-Type: text/javascript Content-Length: 92 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85c2340a7f813910-IAD
2024-02-27 17:38:45 UTC	92	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49803	31.13.66.19	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	537	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	1973	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy" permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
2024-02-27 17:38:45 UTC	699	IN	Data Raw: 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 72 65 73 6f 75 72 63 65 2d 70 6f 6c 69 63 79 3a 20 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 65 6d 62 65 64 64 65 72 2d 70 6f 6c 69 63 79 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 3a 20 72 65 71 75 69 72 65 2d 63 6f 72 70 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 65 70 5f 72 65 70 6f 72 74 22 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 6f 70 65 6e 65 72 2d 70 6f 6c 69 63 79 3a 20 73 61 6d 65 2d 6f 72 69 67 69 6e 2d 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 0d 0a 50 72 61 67 6d 61 3a 20 70 75 62 6c 69 63 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 31 32 30 30 0d 0a Data Ascii: cross-origin-resource-policy: cross-origincross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"Pragma: publicCache-Control: public, max-age=1200
2024-02-27 17:38:45 UTC	801	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 4f 20 45 56 45 4e 54 20 53 48 41 4c 4c 20 54 48 45 20 41 55 54 48 4f 52 53 20 4f 52 0a 2a 20 43 4f 50 59 52 49 47 48 54 20 48 4f 4c 44 45 52 53 20 42 45 20 4c 49 41 42 4c 45 20 46 4f 52 20 41 4e 59 20 43 4c 41 49 4d 2c 20 44 41 4d 41 47 45 53 20 4f 52 20 4f 54 48 45 52 20 4c 49 41 42 49 4c 49 54 59 2c 20 57 48 45 54 48 45 52 0a 2a 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f 52 20 4f 54 48 45 52 57 49 53 45 2c 20 41 52 49 53 49 4e 47 20 46 52 4f 4d 2c 20 4f 55 54 20 4f 46 20 4f 52 20 49 4e 0a 2a 20 43 4f 4e 4e 45 43 54 49 4f 4e 20 57 49 54 48 20 54 48 45 20 53 4f 46 54 57 41 52 45 20 4f 52 20 54 48 45 20 55 53 45 20 4f 52 20 4f 54 48 45 52 20 44 45 41 4c 49 4e 47 53 20 49 4e 20 54 48 45 20 53 4f 46 54 Data Ascii: O EVENT SHALL THE AUTHORS OR* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFT
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 72 69 74 61 62 6c 65 3d 21 30 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 64 2e 6b 65 79 2c 64 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 63 26 26 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 2c 63 29 3b 64 26 26 61 28 62 2c 64 29 3b 72 65 74 75 72 6e 20 62 7d 7d 28 29 2c 69 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 3f 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 7d 3a 66 75 6e 63 74 69 6f 6e Data Ascii: ritable=!0);Object.defineProperty(a,d.key,d)}}return function(b,c,d){c&&a(b.prototype,c);d&&a(b,d);return b}}(),i=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?function(a){return typeof a}:function
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 6e 21 21 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 61 5d 7d 2c 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 61 29 7b 66 2e 66 62 49 73 4d 6f 64 75 6c 65 4c 6f 61 64 65 64 28 62 29 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 62 5d 3d 61 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 67 65 6e 65 72 61 74 65 55 55 49 44 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 2c 69 29 7b 76 61 72 20 6a 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6a 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f Data Ascii: n!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("generateUUID",function(){return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";functio
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 42 3a 31 2c 54 52 59 3a 31 2c 54 57 44 3a 31 2c 55 53 44 3a 31 2c 55 59 55 3a 31 2c 56 45 46 3a 31 2c 56 4e 44 3a 31 2c 5a 41 52 3a 31 7d 3b 61 3d 7b 76 61 6c 75 65 3a 7b 69 73 52 65 71 75 69 72 65 64 3a 21 30 2c 74 79 70 65 3a 64 7d 2c 63 75 72 72 65 6e 63 79 3a 7b 69 73 52 65 71 75 69 72 65 64 3a 21 30 2c 74 79 70 65 3a 65 7d 7d 3b 76 61 72 20 68 3d 7b 41 64 64 50 61 79 6d 65 6e 74 49 6e 66 6f 3a 7b 7d 2c 41 64 64 54 6f 43 61 72 74 3a 7b 7d 2c 41 64 64 54 6f 57 69 73 68 6c 69 73 74 3a 7b 7d 2c 43 6f 6d 70 6c 65 74 65 52 65 67 69 73 74 72 61 74 69 6f 6e 3a 7b 7d 2c 43 6f 6e 74 61 63 74 3a 7b 7d 2c 43 75 73 74 6f 6d 45 76 65 6e 74 3a 7b 76 61 6c 69 64 61 74 69 6f 6e 53 63 68 65 6d 61 3a 7b 65 76 65 6e 74 3a 7b 69 73 52 65 71 75 69 72 65 64 3a 21 30 7d 7d Data Ascii: B:1,TRY:1,TWD:1,USD:1,UYU:1,VEF:1,VND:1,ZAR:1};a={value:{isRequired:!0,type:d},currency:{isRequired:!0,type:e}};var h={AddPaymentInfo:{},AddToCart:{},AddToWishlist:{},CompleteRegistration:{},Contact:{},CustomEvent:{validationSchema:{event:{isRequired:!0}}
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 6c 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 21 21 67 5b 6c 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 5d 3b 62 72 65 61 6b 7d 69 66 28 21 6f 29 72 65 74 75 72 6e 20 6d 28 7b 65 76 65 6e 74 4e 61 6d 65 3a 61 2c 70 61 72 61 6d 3a 69 2c 74 79 70 65 3a 22 49 4e 56 41 4c 49 44 5f 50 41 52 41 4d 22 7d 29 7d 7d 7d 72 65 74 75 72 6e 20 6e 28 68 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 61 2c 63 29 7b 61 3d 70 28 61 2c 63 29 3b 61 2e 65 72 72 6f 72 26 26 62 28 61 2e 65 72 72 6f 72 29 3b 69 66 28 61 2e 77 61 72 6e 69 6e 67 73 29 66 6f 72 28 63 3d 30 3b 63 3c 61 2e 77 61 72 6e 69 6e 67 73 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 62 28 61 2e 77 61 72 6e 69 6e 67 73 5b 63 5d 29 3b 72 65 74 75 72 6e 20 61 7d 6b 2e 65 78 70 6f 72 74 73 3d 7b 76 61 6c 69 64 61 74 65 45 76 65 6e 74 Data Ascii: l==="string"&&!!g[l.toUpperCase()];break}if(!o)return m({eventName:a,param:i,type:"INVALID_PARAM"})}}}return n(h)}function r(a,c){a=p(a,c);a.error&&b(a.error);if(a.warnings)for(c=0;c<a.warnings.length;c++)b(a.warnings[c]);return a}k.exports={validateEvent
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 29 7b 76 61 72 20 6c 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6c 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 43 6f 6e 66 69 67 53 74 6f 72 65 22 29 2c 62 3d 31 65 33 2c 63 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 76 61 72 20 62 3d 61 2e 67 65 74 28 6e 75 6c 6c 2c 22 62 61 74 63 68 69 6e 67 22 29 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 3f 62 2e 6d 61 78 42 61 74 63 68 53 69 7a 65 3a 63 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 63 3d 61 2e 67 65 74 28 6e 75 6c 6c 2c 22 62 61 74 63 68 69 6e 67 22 29 3b 72 65 74 75 72 6e 20 63 21 3d 6e 75 6c 6c 3f Data Ascii: ){var l={exports:{}};l.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsConfigStore"),b=1e3,c=10;function d(){var b=a.get(null,"batching");return b!=null?b.maxBatchSize:c}function e(){var c=a.get(null,"batching");return c!=null?
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 3d 62 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 64 65 6c 61 79 49 6e 4d 73 3a 62 2e 6e 75 6d 62 65 72 28 29 2c 65 78 70 65 72 69 6d 65 6e 74 4e 61 6d 65 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 73 74 72 69 6e 67 28 29 29 2c 65 6e 61 62 6c 65 4d 75 6c 74 69 45 69 64 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 43 43 52 75 6c 65 45 76 61 6c 75 61 74 6f 72 43 6f 6e 66 69 67 54 79 Data Ascii: b=a.Typed;a.coerce;a=b.objectWithFields({delayInMs:b.number(),experimentName:b.allowNull(b.string()),enableMultiEid:b.allowNull(b["boolean"]())});k.exports=a})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsCCRuleEvaluatorConfigTy
2024-02-27 17:38:45 UTC	1500	IN	Data Raw: 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 63 6f 65 72 63 65 3b 61 3d 61 2e 54 79 70 65 64 3b 76 61 72 20 63 3d 61 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 73 65 6c 65 63 74 65 64 4d 61 74 63 68 4b 65 79 73 3a 61 2e 61 72 72 61 79 4f 66 28 61 2e 73 74 72 69 6e 67 28 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 62 28 61 2c 63 29 7d 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 43 6f 65 72 Data Ascii: var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.coerce;a=a.Typed;var c=a.objectWithFields({selectedMatchKeys:a.arrayOf(a.string())});k.exports=function(a){return b(a,c)}})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsCoer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49802	54.164.110.171	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	756	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: symantec.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=64982516487112820180108176489468717949
2024-02-27 17:38:45 UTC	605	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:45 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: CM2ibzYOR2U= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Fri, 23 Feb 2024 08:33:01 GMT DCS: dcs-prod-va6-2-v056-089198ec0.edge-va6.demdex.com 0 ms
2024-02-27 17:38:45 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49801	35.167.214.190	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	519	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1709055523652 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=64982516487112820180108176489468717949
2024-02-27 17:38:45 UTC	712	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:45 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: KKoiAjt6S8I= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-usw2-1-v053-0561e9af8.edge-usw2.demdex.com 5 ms set-cookie: demdex=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:45 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-27 17:38:45 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 36 35 31 33 37 34 30 30 36 30 32 35 38 33 32 30 38 35 31 30 31 32 39 32 37 36 38 30 38 34 38 39 31 36 36 37 39 36 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 39 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"65137400602583208510129276808489166796","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":9,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49815	69.147.92.11	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	519	OUT	GET /wi/ytc.js HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	946	IN	HTTP/1.1 200 OK x-amz-id-2: FrEJC4YURFLuOdAdah33AmUevnzcfA8LQviCVikAqpAgqXa57cC8hvqkmVoctyJgEBt9v1cd34U= x-amz-request-id: VAQ46K6STXXCE2ME Date: Tue, 27 Feb 2024 17:16:56 GMT Last-Modified: Mon, 26 Jun 2023 09:26:35 GMT x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle" ETag: "5c6ed25dce803fd84288922b8928409e" x-amz-server-side-encryption: AES256 Cache-Control: public,max-age=3600 x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW Accept-Ranges: bytes Content-Type: application/javascript Server: ATS Content-Length: 18187 Referrer-Policy: no-referrer-when-downgrade Vary: Origin Age: 1310 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 6e 2e 6d 3d 65 2c 6e 2e 63 3d 74 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 6e 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 6e 2e 72 3d 66 75 6e Data Ascii: !function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=fun
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 41 74 28 61 29 29 3e 3d 35 36 33 32 30 26 26 6f 3c 3d 35 37 33 34 33 29 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 33 39 2c 72 5b 6e 2b 3d 31 5d 3d 31 39 31 2c 72 5b 6e 2b 3d 31 5d 3d 31 38 39 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 61 2b 3d 31 2c 28 69 3d 31 30 32 34 2a 28 69 2d 35 35 32 39 36 29 2b 6f 2d 35 36 33 32 30 2b 36 35 35 33 36 29 3e 36 35 35 33 35 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 34 30 7c 69 3e 3e 3e 31 38 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 31 32 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 36 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 36 33 26 69 3b 63 6f 6e 74 69 6e 75 65 7d 7d 69 3c 3d 31 32 37 3f 72 5b 6e 2b 3d 31 5d 3d 30 7c 69 3a 69 3c 3d 32 30 34 37 3f 28 72 5b 6e 2b 3d 31 5d 3d 31 39 32 7c 69 3e 3e 3e 36 2c 72 Data Ascii: At(a))>=56320&&o<=57343)){r[n+=1]=239,r[n+=1]=191,r[n+=1]=189;continue}if(a+=1,(i=1024*(i-55296)+o-56320+65536)>65535){r[n+=1]=240\|i>>>18,r[n+=1]=128\|i>>>12&63,r[n+=1]=128\|i>>>6&63,r[n+=1]=128\|63&i;continue}}i<=127?r[n+=1]=0\|i:i<=2047?(r[n+=1]=192\|i>>>6,r
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 61 29 7b 69 66 28 21 74 28 61 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 72 61 79 2e 66 72 6f 6d 3a 20 77 68 65 6e 20 70 72 6f 76 69 64 65 64 2c 20 74 68 65 20 73 65 63 6f 6e 64 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 28 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 66 6f 72 28 76 61 72 20 73 2c 75 3d 72 28 69 2e 6c 65 6e 67 74 68 29 2c 64 3d 74 28 6e 29 3f 4f 62 6a 65 63 74 28 6e 65 77 20 6e 28 75 29 29 3a 6e 65 77 20 41 72 72 61 79 28 75 29 2c 63 3d 30 3b 63 3c 75 3b 29 73 3d 69 5b 63 5d 2c 64 5b 63 5d 3d 61 3f 76 Data Ascii: arguments[1]:void 0;if(void 0!==a){if(!t(a))throw new TypeError("Array.from: when provided, the second argument must be a function");arguments.length>2&&(o=arguments[2])}for(var s,u=r(i.length),d=t(n)?Object(new n(u)):new Array(u),c=0;c<u;)s=i[c],d[c]=a?v
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 63 68 28 65 29 7b 7d 69 66 28 6e 3d 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 62 72 65 61 6b 3b 6e 3d 6e 2e 70 61 72 65 6e 74 7d 72 65 74 75 72 6e 20 74 7d 28 74 29 3b 69 66 28 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 76 28 65 29 3b 76 61 72 20 6f 3d 7b 7d 2c 61 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 22 22 3b 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 3d 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 77 69 6e 64 6f 77 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 7b 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3a 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 61 2c 76 65 72 73 69 6f 6e 3a 69 2c 63 61 6c 6c 49 64 3a 72 7d 7d 3b 6e 5b 72 5d 3d 6f 2c 6c 28 74 2c 73 2c 22 2a 22 29 Data Ascii: ch(e){}if(n===window.top)break;n=n.parent}return t}(t);if(!i)return void v(e);var o={},a=Math.random()+"";"__tcfapiLocator"===t?function(e,t,n,r){window[e]=function(e,i,o,a){var s={__tcfapiCall:{command:e,parameter:a,version:i,callId:r}};n[r]=o,l(t,s,"*")
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 6e 67 3a 6e 2e 75 73 70 53 74 72 69 6e 67 2c 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 3a 6e 2e 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 7d 2c 21 30 29 3a 65 28 76 6f 69 64 20 30 2c 21 31 29 7d 29 29 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3b 6d 28 22 5f 5f 74 63 66 61 70 69 22 2c 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 2c 22 5f 5f 74 63 66 61 70 69 43 61 6c 6c 22 2c 22 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3f 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 3f 28 68 28 65 29 2c 76 28 22 5f 5f 74 63 66 61 70 69 22 29 29 3a 67 28 29 7d 2c 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 76 6f 69 64 20 30 2c 21 Data Ascii: ng:n.uspString,isOathFirstParty:n.isOathFirstParty},!0):e(void 0,!1)})))},y=function(){var e,t;m("__tcfapi","__tcfapiLocator","__tcfapiCall","__tcfapiReturn"),window.__tcfapi?(e=function(e,t){t?(h(e),v("__tcfapi")):g()},t=setTimeout((function(){e(void 0,!
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 3a 22 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 2d 4a 61 6e 2d 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 22 2c 6e 3d 65 2e 6e 61 6d 65 2b 22 3d 22 2b 65 2e 76 61 6c 75 65 2b 74 2b 22 3b 20 70 61 74 68 3d 22 2b 65 2e 70 61 74 68 2b 28 22 22 21 3d 3d 65 2e 64 6f 6d 61 69 6e 3f 22 3b 20 64 6f 6d 61 69 6e 3d 2e 22 2b 65 2e 64 6f 6d 61 69 6e 3a 22 22 29 2b 22 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 7d 28 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 74 2c 65 78 70 69 72 79 4f 66 66 73 65 74 3a 6e 2c 64 6f 6d 61 69 6e 3a 61 28 29 2c 70 61 74 68 3a 22 2f 22 7d 29 3b 76 61 72 20 72 3d 7b 69 64 3a 74 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 Data Ascii: .toGMTString():"; expires=Thu, 01-Jan-1970 00:00:01 GMT",n=e.name+"="+e.value+t+"; path="+e.path+(""!==e.domain?"; domain=."+e.domain:"")+"; SameSite=Lax",document.cookie=n}({name:e,value:t,expiryOffset:n,domain:a(),path:"/"});var r={id:t,timestamp:(new D
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 29 7d 7d 76 61 72 20 48 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 67 65 2e 70 6c 61 69 6e 41 75 69 64 73 29 7b 76 61 72 20 72 3d 41 72 72 61 79 2e 66 72 6f 6d 28 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 65 5b 74 5d 29 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 70 61 64 53 74 61 72 74 28 32 2c 22 30 22 29 7d 29 29 3b 67 65 2e 68 61 73 68 65 64 41 75 69 64 73 5b 6e 5d 3d 72 2e 6a 6f 69 6e 28 22 22 29 2c 74 2b 2b 7d 67 65 2e 61 75 69 64 73 41 72 65 48 61 73 68 65 64 3d 21 30 2c 79 65 28 29 7d 2c 4d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 Data Ascii: )}}var H=function(e){var t=0;for(var n in ge.plainAuids){var r=Array.from(new Uint8Array(e[t])).map((function(e){return e.toString(16).padStart(2,"0")}));ge.hashedAuids[n]=r.join(""),t++}ge.auidsAreHashed=!0,ye()},M=function(e,t){var n=function(n){t.push(
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 3b 72 65 74 75 72 6e 28 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2e 73 75 62 74 6c 65 2e 64 69 67 65 73 74 28 22 53 48 41 2d 32 35 36 22 2c 74 29 7d 3b 76 61 72 20 56 2c 7a 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 59 28 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2c 6e 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 77 69 2f 63 6f 6e 66 69 67 2f 22 2b 65 2b 22 2e 6a 73 6f 6e 22 3b 74 2e 6f 70 65 6e 28 22 47 45 54 22 2c 6e 2c 21 30 29 2c 74 2e 74 69 6d 65 6f 75 74 3d 32 65 33 2c 74 2e 6f 6e 74 69 6d 65 6f 75 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 71 2d 2d 2c 79 65 28 29 7d 2c 74 2e 73 65 6e 64 28 29 2c 74 2e Data Ascii: ;return(window.crypto\|\|window.msCrypto).subtle.digest("SHA-256",t)};var V,z=!1;function Y(e){if(void 0!==e){var t=new XMLHttpRequest,n="https://s.yimg.com/wi/config/"+e+".json";t.open("GET",n,!0),t.timeout=2e3,t.ontimeout=function(e){q--,ye()},t.send(),t.
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 6d 61 69 6c 26 26 28 74 2e 75 73 65 72 45 6d 61 69 6c 3d 67 65 2e 65 6d 61 69 6c 73 5b 74 2e 70 69 78 65 6c 49 64 5d 29 2c 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 26 26 28 49 65 28 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7c 7c 64 65 6c 65 74 65 20 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7d 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 6e 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 2c 74 2e 6c 65 6e 67 74 68 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 5a 28 74 29 7d 3b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 65 29 65 5b 72 5d 2e 6f 6e 63 6f 6d 70 6c 65 74 65 3d 6e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b Data Ascii: mail&&(t.userEmail=ge.emails[t.pixelId]),t.userHashedEmail&&(Ie(t.userHashedEmail)\|\|delete t.userHashedEmail)}var $=function(e,t){var n=function(n){t.push(n.target.result),t.length===e.length&&Z(t)};for(var r in e)e[r].oncomplete=n},Z=function(e){var t=0;
2024-02-27 17:38:45 UTC	1300	IN	Data Raw: 6f 6d 70 6f 6e 65 6e 74 28 70 61 72 73 65 49 6e 74 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 2f 36 30 2c 31 30 29 2b 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 3c 74 2e 79 77 61 53 74 61 6e 64 61 72 64 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 3f 22 64 22 3a 22 22 29 29 29 2c 65 2e 6a 6f 69 6e 28 22 22 29 7d 28 29 29 2c 72 2e 6a 6f 69 6e 28 22 22 29 7d 76 61 72 20 72 65 3d 5b 7b 6e 61 6d 65 3a 22 74 65 61 6c 69 75 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 75 74 61 67 5f 64 61 74 61 22 7d 2c 7b 6e 61 6d 65 3a 22 67 74 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 67 6f 6f 67 6c 65 5f 74 61 67 5f 6d 61 6e 61 67 65 72 22 7d 2c 7b 6e 61 6d 65 3a 22 61 64 6f 62 65 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 5f 73 61 74 65 Data Ascii: omponent(parseInt(t.getTimezoneOffset()/60,10)+(t.getTimezoneOffset()<t.ywaStandardTimezoneOffset?"d":""))),e.join("")}()),r.join("")}var re=[{name:"tealium",interface:"utag_data"},{name:"gtm",interface:"google_tag_manager"},{name:"adobe",interface:"_sate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49812	52.85.132.5	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	540	OUT	GET /c/hotjar-857043.js?sv=6 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	633	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Tue, 27 Feb 2024 17:38:45 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin ETag: W/405f8eb9ddad21deb58bb2ff5b5dd427 Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: iKsLL9xddwlCzx83FQSHh2i2QYPjj0cxacqpGgg6mclFNl6lC4nkcw==
2024-02-27 17:38:45 UTC	9002	IN	Data Raw: 32 33 32 32 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 38 35 37 30 34 33 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 31 2e 30 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 61 75 74 6f 6d 61 74 69 63 5f 77 69 74 68 5f 66 72 61 67 6d 65 6e 74 73 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 66 61 6c 73 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f Data Ascii: 2322window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":857043,"rec_value":1.0,"state_change_listen_mode":"automatic_with_fragments","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_co
2024-02-27 17:38:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49813	146.75.28.157	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	528	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:45 UTC	511	IN	HTTP/1.1 200 OK Connection: close Content-Length: 57596 Last-Modified: Thu, 27 Oct 2022 18:55:37 GMT ETag: "32ad004436155ec972bc50e6238b5b67" x-amz-server-side-encryption: AES256 Cache-Control: no-cache Content-Type: application/javascript; charset=utf-8 Accept-Ranges: bytes Date: Tue, 27 Feb 2024 17:38:45 GMT X-Served-By: cache-iad-kiad7000113-IAD X-Cache: HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 36 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3b 74 2e 65 78 70 6f 72 74 73 3d 28 72 3d 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 26 26 28 72 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2e 63 72 79 70 74 6f 26 26 28 72 3d 73 65 6c 66 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 26 26 28 72 3d Data Ascii: !function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 68 69 73 2e 77 6f 72 64 73 3d 74 7c 7c 5b 5d 2c 74 68 69 73 2e 73 69 67 42 79 74 65 73 3d 6e 75 6c 6c 21 3d 65 3f 65 3a 34 2a 74 2e 6c 65 6e 67 74 68 7d 2c 74 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 66 29 2e 73 74 72 69 6e 67 69 66 79 28 74 68 69 73 29 7d 2c 63 6f 6e 63 61 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 77 6f 72 64 73 2c 6e 3d 74 2e 77 6f 72 64 73 2c 72 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 2c 69 3d 74 2e 73 69 67 42 79 74 65 73 3b 69 66 28 74 68 69 73 2e 63 6c 61 6d 70 28 29 2c 72 25 34 29 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 3b 6f 2b 2b 29 7b 76 61 72 20 61 3d 6e 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 72 2b 6f 3e Data Ascii: his.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|f).stringify(this)},concat:function(t){var e=this.words,n=t.words,r=this.sigBytes,i=t.sigBytes;if(this.clamp(),r%4)for(var o=0;o<i;o++){var a=n[o>>>2]>>>24-o%48&255;e[r+o>
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 2e 70 61 72 73 65 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 7d 2c 70 3d 63 2e 42 75 66 66 65 72 65 64 42 6c 6f 63 6b 41 6c 67 6f 72 69 74 68 6d 3d 75 2e 65 78 74 65 6e 64 28 7b 72 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 64 61 74 61 3d 6e 65 77 20 73 2e 69 6e 69 74 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 3d 30 7d 2c 5f 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 68 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 Data Ascii: n(t){return d.parse(unescape(encodeURIComponent(t)))}},p=c.BufferedBlockAlgorithm=u.extend({reset:function(){this._data=new s.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=h.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 65 28 72 29 26 26 28 69 3c 38 26 26 28 63 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c 75 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 31 2f 33 29 29 2c 69 2b 2b 29 2c 72 2b 2b 7d 28 29 3b 76 61 72 20 73 3d 5b 5d 2c 6c 3d 61 2e 53 48 41 32 35 36 3d 6f 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 69 2e 69 6e 69 74 28 63 2e 73 6c 69 63 65 28 30 29 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 68 69 73 2e 5f 68 61 73 68 2e 77 6f 72 64 73 2c 72 3d 6e 5b 30 5d 2c 69 3d 6e 5b 31 5d 2c 6f 3d 6e 5b 32 5d 2c 61 3d 6e 5b 33 5d 2c 63 Data Ascii: ar r=2,i=0;i<64;)e(r)&&(i<8&&(c[i]=n(t.pow(r,.5))),u[i]=n(t.pow(r,1/3)),i++),r++}();var s=[],l=a.SHA256=o.extend({_doReset:function(){this._hash=new i.init(c.slice(0))},_doProcessBlock:function(t,e){for(var n=this._hash.words,r=n[0],i=n[1],o=n[2],a=n[3],c
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 68 69 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 74 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 69 3d 72 2e 6c 65 6e 67 74 68 3b 66 75 Data Ascii: function(t){return new this((function(e,n){if(!t\|\|void 0===t.length)return n(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(t);if(0===r.length)return e([]);var i=r.length;fu
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 64 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 70 28 28 72 3d 6e 2c 69 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 61 70 70 6c 79 28 69 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 63 61 74 63 68 28 65 29 7b 66 28 74 2c 65 29 7d 76 61 72 20 72 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 28 28 66 75 6e Data Ascii: d(t);if("function"==typeof n)return void p((r=n,i=e,function(){r.apply(i,arguments)}),t)}t._state=1,t._value=e,d(t)}catch(e){f(t,e)}var r,i}function f(t,e){t._state=2,t._value=e,d(t)}function d(t){2===t._state&&0===t._deferreds.length&&u._immediateFn((fun
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 29 7d 2c 75 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 61 28 74 29 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 75 2e 72 65 73 6f 6c 76 65 28 74 5b 72 5d 29 2e 74 68 65 6e 28 65 2c 6e 29 7d 29 29 7d 2c 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 26 26 66 75 6e 63 Data Ascii: ew u((function(e,n){n(t)}))},u.race=function(t){return new u((function(e,n){if(!a(t))return n(new TypeError("Promise.race accepts an array"));for(var r=0,i=t.length;r<i;r++)u.resolve(t[r]).then(e,n)}))},u._immediateFn="function"==typeof setImmediate&&func
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 3d 69 29 74 68 72 6f 77 20 6f 3b 72 65 74 75 72 6e 20 43 28 29 7d 66 6f 72 28 6e 2e 6d 65 74 68 6f 64 3d 69 2c 6e 2e 61 72 67 3d 6f 3b 3b 29 7b 76 61 72 20 61 3d 6e 2e 64 65 6c 65 67 61 74 65 3b 69 66 28 61 29 7b 76 61 72 20 63 3d 67 28 61 2c 6e 29 3b 69 66 28 63 29 7b 69 66 28 63 3d 3d 3d 6c 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 20 63 7d 7d 69 66 28 22 6e 65 78 74 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 6e 2e 73 65 6e 74 3d 6e 2e 5f 73 65 6e 74 3d 6e 2e 61 72 67 3b 65 6c 73 65 20 69 66 28 22 74 68 72 6f 77 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 7b 69 66 28 22 73 75 73 70 65 6e 64 65 64 53 74 61 72 74 22 3d 3d 3d 72 29 74 68 72 6f 77 20 72 3d 22 63 6f 6d 70 6c 65 74 65 64 22 2c 6e 2e 61 72 67 3b 6e 2e 64 69 73 70 61 74 63 68 45 78 63 65 70 74 69 Data Ascii: =i)throw o;return C()}for(n.method=i,n.arg=o;;){var a=n.delegate;if(a){var c=g(a,n);if(c){if(c===l)continue;return c}}if("next"===n.method)n.sent=n._sent=n.arg;else if("throw"===n.method){if("suspendedStart"===r)throw r="completed",n.arg;n.dispatchExcepti
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 2c 61 29 7d 29 29 7d 72 65 74 75 72 6e 20 72 3d 72 3f 72 2e 74 68 65 6e 28 61 2c 61 29 3a 61 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 2e 69 74 65 72 61 74 6f 72 5b 65 2e 6d 65 74 68 6f 64 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6e 29 7b 69 66 28 65 2e 64 65 6c 65 67 61 74 65 3d 6e 75 6c 6c 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 7b 69 66 28 74 2e 69 74 65 72 61 74 6f 72 2e 72 65 74 75 72 6e 26 26 28 65 2e 6d 65 74 68 6f 64 3d 22 72 65 74 75 72 6e 22 2c 65 2e 61 72 67 3d 76 6f 69 64 20 30 2c 67 28 74 2c 65 29 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 29 72 65 74 75 72 6e 20 6c 3b 65 2e 6d 65 74 68 6f 64 3d 22 74 68 72 6f 77 22 2c 65 2e 61 72 67 3d 6e 65 77 20 54 79 70 65 45 72 Data Ascii: ,a)}))}return r=r?r.then(a,a):a()}}function g(t,e){var n=t.iterator[e.method];if(void 0===n){if(e.delegate=null,"throw"===e.method){if(t.iterator.return&&(e.method="return",e.arg=void 0,g(t,e),"throw"===e.method))return l;e.method="throw",e.arg=new TypeEr
2024-02-27 17:38:45 UTC	1379	IN	Data Raw: 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 21 21 65 26 26 28 65 3d 3d 3d 64 7c 7c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 3d 3d 3d 28 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 7c 7c 65 2e 6e 61 6d 65 29 29 7d 2c 74 2e 6d 61 72 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 68 29 3a 28 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 68 2c 63 28 74 2c 61 2c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 29 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 3d Data Ascii: ion=function(t){var e="function"==typeof t&&t.constructor;return!!e&&(e===d\|\|"GeneratorFunction"===(e.displayName\|\|e.name))},t.mark=function(t){return Object.setPrototypeOf?Object.setPrototypeOf(t,h):(t.__proto__=h,c(t,a,"GeneratorFunction")),t.prototype=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49822	44.209.16.161	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:45 UTC	665	OUT	GET /ibs:dpid=411&dpuuid=Zd4eJQAAAG_qkwMv HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=64982516487112820180108176489468717949
2024-02-27 17:38:46 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:45 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: jobjXvPOSgQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v056-0b61058b4.edge-va6.demdex.com 3 ms set-cookie: dpm=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:45 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:45 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-27 17:38:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49825	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 319 Host: analytics.avcdn.net
2024-02-27 17:38:46 UTC	319	OUT	Data Raw: 0a bc 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 7c 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 57 0a 13 55 70 64 61 74 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6\|;HealthCheckNF0(xZWUpdateNotificationsActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10
2024-02-27 17:38:46 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:46 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:46 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49824	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	636	OUT	GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	902	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:46 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85c2340f8acd28ae-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 13253 Cache-Control: public, max-age=86400 Expires: Wed, 28 Feb 2024 17:38:46 GMT Last-Modified: Mon, 20 Jun 2022 08:17:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: i0ofUXVu/TqOH4J3xgmSUw== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: be350dd2-101e-008a-79aa-0b6232000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-27 17:38:46 UTC	467	IN	Data Raw: 37 63 31 38 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 63 63 74 49 64 22 3a 22 38 33 31 62 38 65 65 30 2d 65 39 35 32 2d Data Ascii: 7c18{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccloseButtonType":"Icon","pccontinueWithoutAcceptText":"Continue without Accepting","cctId":"831b8ee0-e952-
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 64 20 65 6e 61 62 6c 65 20 75 73 20 74 6f 20 73 68 6f 77 20 72 65 6c 65 76 61 6e 74 20 6d 61 72 6b 65 74 69 6e 67 20 63 6f 6e 74 65 6e 74 2e 20 59 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 73 65 74 74 69 6e 67 73 20 62 65 6c 6f 77 2e 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 9c 43 6f 6e 66 69 72 6d 20 53 65 6c 65 63 74 69 6f 6e e2 80 9d 20 79 6f 75 20 61 67 72 65 65 20 77 69 74 68 20 74 68 65 20 63 75 72 72 65 6e 74 20 73 65 74 74 69 6e 67 73 2e 20 53 65 65 22 2c 22 41 62 6f 75 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 70 6f 6c 69 63 79 22 2c 22 41 62 6f 75 74 43 6f 6f 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 63 63 65 70 74 20 41 6c 6c 22 2c 22 Data Ascii: d enable us to show relevant marketing content. You can manage cookie settings below. By clicking Confirm Selection you agree with the current settings. See","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept All","
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 44 65 74 61 69 6c 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 20 4d 61 6e 61 67 65 20 43 6f 6e 73 65 6e 74 20 50 72 65 66 65 72 65 6e 63 65 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 49 6e 66 6f 53 63 72 65 65 6e 52 65 61 64 65 72 22 3a 22 4f 70 65 6e 73 20 69 6e 20 61 20 6e 65 77 20 54 61 62 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 54 69 74 6c 65 22 3a 22 43 6f 6f 6b 69 65 20 4c 69 73 74 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 44 65 73 63 72 69 70 74 69 6f 6e Data Ascii: xt":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies Details","PreferenceCenterManagePreferencesText":" Manage Consent Preferences","PreferenceCenterMoreInfoScreenReader":"Opens in a new Tab","CookieListTitle":"Cookie List","CookieListDescription
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 20 74 6f 20 73 65 63 75 72 65 20 61 72 65 61 73 20 6f 66 20 74 68 65 20 77 65 62 73 69 74 65 2e 20 54 68 65 20 77 65 62 73 69 74 65 20 63 61 6e 6e 6f 74 20 66 75 6e 63 74 69 6f 6e 20 70 72 6f 70 65 72 6c 79 20 77 69 74 68 6f 75 74 20 74 68 65 73 65 20 63 6f 6f 6b 69 65 73 2e 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4d 6f 62 69 6c 65 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4f 54 54 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 49 73 49 61 62 50 75 72 70 6f 73 65 22 3a 66 61 6c 73 65 2c 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 49 64 73 22 3a 5b 5d 2c 22 46 69 72 73 74 50 61 72 74 79 43 Data Ascii: to secure areas of the website. The website cannot function properly without these cookies.","GroupNameMobile":"Necessary cookies","GroupNameOTT":"Necessary cookies","GroupName":"Necessary cookies","IsIabPurpose":false,"GeneralVendorsIds":[],"FirstPartyC
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 2c 22 69 64 22 3a 22 63 38 39 38 35 65 61 62 2d 66 66 64 30 2d 34 61 30 34 2d 38 63 65 66 2d 66 64 32 63 37 33 31 65 64 31 32 61 22 2c 22 4e 61 6d 65 22 3a 22 5f 63 63 5f 6c 61 6e 67 43 68 6f 69 63 65 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 Data Ascii: ,"id":"c8985eab-ffd0-4a04-8cef-fd2c731ed12a","Name":"_cc_langChoice","Host":"www.ccleaner.com","IsSession":false,"Length":"364","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdP
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 77 77 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 77 65 62 73 69 74 65 73 20 72 75 6e 20 6f 6e 20 74 68 65 20 57 69 6e 64 6f 77 73 20 41 7a 75 72 65 20 63 6c 6f 75 64 20 70 6c 61 74 66 6f 72 6d 2e 20 49 74 20 69 73 20 75 73 65 64 20 66 6f 72 20 6c 6f 61 64 20 62 61 6c 61 6e 63 69 6e 67 20 74 6f 20 6d 61 6b 65 20 73 75 72 65 20 74 68 65 20 76 69 73 69 74 6f 72 20 70 61 67 65 20 72 65 71 75 65 73 74 73 20 61 72 65 20 72 6f 75 74 65 64 20 74 6f 20 74 68 65 20 73 61 6d 65 20 73 65 72 76 65 72 20 69 6e 20 61 6e 79 20 62 72 6f 77 73 69 6e 67 20 73 65 73 73 69 6f Data Ascii: ww.ccleaner.com","IsSession":true,"Length":"0","description":"This cookie is set by websites run on the Windows Azure cloud platform. It is used for load balancing to make sure the visitor page requests are routed to the same server in any browsing sessio
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 43 6f 6f 6b 69 65 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 69 64 22 3a 22 33 36 65 33 33 32 31 30 2d 36 64 30 36 2d 34 63 34 63 2d 38 38 66 66 2d 66 62 37 64 31 31 37 39 39 64 61 35 22 2c 22 4e 61 6d 65 22 3a 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 77 65 62 73 69 74 Data Ascii: Key":null,"thirdPartyKey":"","firstPartyKey":"CookieOptanonAlertBoxClosed","id":"36e33210-6d06-4c4c-88ff-fb7d11799da5","Name":"OptanonAlertBoxClosed","Host":"secure.ccleaner.com","IsSession":false,"Length":"364","description":"This cookie is set by websit
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 67 74 6d 5f 55 41 2d 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 5f 64 63 5f 67 74 6d 5f 55 41 2d 22 2c 22 69 64 22 3a 22 65 61 31 38 39 31 66 63 2d 33 30 34 39 2d 34 62 66 34 2d 61 32 61 37 2d 63 66 66 37 35 33 39 34 38 37 36 36 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f Data Ascii: gtm_UA-","firstPartyKey":"Pattern\|_dc_gtm_UA-","id":"ea1891fc-3049-4bf4-a2a7-cff753948766","Name":"_dc_gtm_UA-xxxxxxxx","Host":"ccleaner.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to lo
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 6f 6f 6b 69 65 73 20 69 6e 20 65 61 63 68 20 63 61 74 65 67 6f 72 79 20 66 72 6f 6d 20 62 65 69 6e 67 20 73 65 74 20 69 6e 20 74 68 65 20 75 73 65 72 73 20 62 72 6f 77 73 65 72 2c 20 77 68 65 6e 20 63 6f 6e 73 65 6e 74 20 69 73 20 6e 6f 74 20 67 69 76 65 6e 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 61 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 63 6f 6e 74 61 69 6e 73 20 6e 6f 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 68 61 74 20 63 61 6e 20 69 64 65 6e 74 69 Data Ascii: ookies in each category from being set in the users browser, when consent is not given. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identi
2024-02-27 17:38:46 UTC	1369	IN	Data Raw: 22 31 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 61 39 36 61 37 36 65 61 2d 39 66 30 65 2d 34 32 38 61 2d 38 39 64 35 2d 32 63 65 65 63 66 32 65 64 37 34 39 22 2c 22 4e 61 6d 65 22 3a 22 63 62 73 65 73 73 69 6f 6e 31 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 63 63 6c 65 61 6e 65 72 2e 63 Data Ascii: "1","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"a96a76ea-9f0e-428a-89d5-2ceecf2ed749","Name":"cbsession1","Host":"secure.ccleaner.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49829	69.147.92.11	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	563	OUT	GET /wi/config/10180940.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	1031	IN	HTTP/1.1 200 OK x-amz-id-2: QckG4Nr0l6emYLyT1caZ8+Ui3HSWpwrROksRb5UCnttxqMDR5EeukKFmuekAarThF1GkuoGx0Fw= x-amz-request-id: 8DN7BVPJ2PJAD4NZ Date: Tue, 27 Feb 2024 17:14:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method Last-Modified: Tue, 27 Feb 2024 16:44:39 GMT x-amz-expiration: expiry-date="Thu, 03 Apr 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle" ETag: "5df7dee99a3ff0ef853b4c1a7e8a6f34" x-amz-server-side-encryption: AES256 x-amz-version-id: 3nll5eCRDwkW_aSJ3SJ_Gwbcp3hOkOvt Accept-Ranges: bytes Content-Type: application/json Server: ATS Content-Length: 46 Referrer-Policy: no-referrer-when-downgrade Age: 1432 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-02-27 17:38:46 UTC	46	IN	Data Raw: 7b 22 70 69 78 65 6c 49 64 22 3a 31 30 31 38 30 39 34 30 2c 22 75 73 65 31 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 22 3a 74 72 75 65 7d Data Ascii: {"pixelId":10180940,"use1stPartyCookies":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49828	52.85.132.82	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	537	OUT	GET /tags/563151391133/tag.js HTTP/1.1 Host: www.mczbf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	477	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Content-Length: 39367 Connection: close Date: Tue, 27 Feb 2024 17:38:46 GMT X-Request-ID: 0ef613eb-d597-11ee-998a-b1e525d3fead Cache-Control: max-age=1800 Server: nginx X-Robots-Tag: noindex, nofollow X-Cache: Miss from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NxNz7mYv1PciXwF_diEGkD8AZrBlM46uyot4InaSgifamSLScvHGkQ==
2024-02-27 17:38:46 UTC	15668	IN	Data Raw: 76 61 72 20 43 4a 41 70 69 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 38 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f Data Ascii: var CJApi;!function(){"use strict";var e={885:function(e,t){var n=this&&this.__assign\|\|function(){return n=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 2c 69 2e 6c 61 62 65 6c 3d 31 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 20 69 2e 74 72 79 73 2e 70 75 73 68 28 5b 31 2c 33 2c 2c 34 5d 29 2c 5b 34 2c 4f 28 6f 2c 72 2c 61 2c 63 2c 73 29 5d 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 20 69 2e 73 65 6e 74 28 29 2c 5b 33 2c 34 5d 3b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 20 6c 3d 69 2e 73 65 6e 74 28 29 2c 66 3d 28 30 2c 75 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 29 28 6c 29 2c 64 2e 72 65 70 6f 72 74 65 72 2e 73 65 6e 64 28 7b 74 61 67 3a 22 66 61 69 6c 65 64 54 6f 53 65 6e 64 50 61 67 65 49 6e 66 6f 22 2c 70 61 79 6c 6f 61 64 3a 66 2c 6c 6f 67 4c 65 76 65 6c 3a 22 45 52 52 4f 52 22 7d 29 2c 5b 33 2c 34 5d 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 5b 32 5d 7d 7d 29 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 53 Data Ascii: ,i.label=1;case 1:return i.trys.push([1,3,,4]),[4,O(o,r,a,c,s)];case 2:return i.sent(),[3,4];case 3:return l=i.sent(),f=(0,u.errorMessage)(l),d.reporter.send({tag:"failedToSendPageInfo",payload:f,logLevel:"ERROR"}),[3,4];case 4:return[2]}}))}))}function S
2024-02-27 17:38:46 UTC	7315	IN	Data Raw: 63 6b 73 65 71 26 26 28 63 3d 63 2b 31 26 31 36 33 38 33 29 2c 28 79 3c 30 7c 7c 75 3e 76 29 26 26 76 6f 69 64 20 30 3d 3d 3d 65 2e 6e 73 65 63 73 26 26 28 67 3d 30 29 2c 67 3e 3d 31 65 34 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 75 75 69 64 2e 76 31 28 29 3a 20 43 61 6e 27 74 20 63 72 65 61 74 65 20 6d 6f 72 65 20 74 68 61 6e 20 31 30 4d 20 75 75 69 64 73 2f 73 65 63 22 29 3b 76 3d 75 2c 70 3d 67 2c 66 3d 63 3b 76 61 72 20 68 3d 28 31 65 34 2a 28 32 36 38 34 33 35 34 35 35 26 28 75 2b 3d 31 32 32 31 39 32 39 32 38 65 35 29 29 2b 67 29 25 34 32 39 34 39 36 37 32 39 36 3b 6f 5b 72 2b 2b 5d 3d 68 3e 3e 3e 32 34 26 32 35 35 2c 6f 5b 72 2b 2b 5d 3d 68 3e 3e 3e 31 36 26 32 35 35 2c 6f 5b 72 2b 2b 5d 3d 68 3e 3e 3e 38 26 32 35 35 2c 6f 5b 72 2b 2b Data Ascii: ckseq&&(c=c+1&16383),(y<0\|\|u>v)&&void 0===e.nsecs&&(g=0),g>=1e4)throw new Error("uuid.v1(): Can't create more than 10M uuids/sec");v=u,p=g,f=c;var h=(1e4*(268435455&(u+=122192928e5))+g)%4294967296;o[r++]=h>>>24&255,o[r++]=h>>>16&255,o[r++]=h>>>8&255,o[r++

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49834	63.140.39.65	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	1553	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s56254480568556?AQB=1&ndh=1&pf=1&t=27%2F1%2F2024%2018%3A38%3A44%202%20-60&mid=65137400602583208510129276808489166796&aamlh=7&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-02-06&c48=CCleaner%20v6.21.10918&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=65137400602583208510129276808489166796&c59=ccleaner%3Aknowledge%3Accleaner-v6-21-10918&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 27 Feb 2024 17:38:46 GMT expires: Mon, 26 Feb 2024 17:38:46 GMT last-modified: Wed, 28 Feb 2024 17:38:46 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3670168796147941376-4617864859108993018 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-27 17:38:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49837	99.84.191.43	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	548	OUT	GET /modules.edfa88fa094af2bba7f9.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	718	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 234778 Connection: close Date: Mon, 26 Feb 2024 14:34:19 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "6515fee4bf019a02fa39f8e23276c390" Last-Modified: Mon, 26 Feb 2024 14:33:54 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a97d638d4e395a6f27b927572cf3bfda.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C2 X-Amz-Cf-Id: aox34q6zOx8m7Gcc45SJ-XjMOGsK7goFVmd_LMWFQyDy6C6gw8DIcg== Age: 97467
2024-02-27 17:38:46 UTC	15666	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 65 64 66 61 38 38 66 61 30 39 34 61 66 32 62 62 61 37 66 39 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.edfa88fa094af2bba7f9.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 2e 62 72 69 64 67 65 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 2f 5e 28 28 5b 5e 3c 3e 28 29 5b 5c 5d 5c 5c 2e 2c 3b 3a 5c 73 40 22 5d 2b 28 5c 2e 5b 5e 3c 3e 28 29 5b 5c 5d 5c 5c 2e 2c 3b 3a 5c 73 40 22 5d 2b 29 2a 29 7c 28 22 2e 2b 22 29 29 40 28 28 5c 5b 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5d 29 7c 28 28 5b 61 2d 7a 41 2d 5a 5c 2d 30 2d 39 5d 2b 5c 2e 29 2b 5b 61 2d 7a 41 2d 5a 5d 7b 32 2c 7d 29 29 24 2f 2e 74 65 73 74 28 65 29 7d 29 2c 22 75 74 69 6c 73 22 29 2c 68 6a 2e 62 72 69 64 67 65 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 6a 2e 75 73 65 72 44 65 76 69 Data Ascii: .bridge.tryCatch((function(e){return/^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)\|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])\|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(e)}),"utils"),hj.bridge.tryCatch((function(){return hj.userDevi
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 20 74 3d 68 6a 2e 68 71 2e 74 72 69 6d 28 65 5b 64 5d 29 3b 69 66 28 74 2e 6c 65 6e 67 74 68 26 26 74 2e 6c 65 6e 67 74 68 3c 3d 68 6a 2e 6d 61 78 52 65 63 6f 72 64 69 6e 67 54 61 67 4c 65 6e 67 74 68 29 7b 76 61 72 20 72 3d 7b 6e 61 6d 65 3a 74 2c 74 69 6d 65 3a 68 6a 2e 74 69 6d 65 2e 67 65 74 4e 6f 77 28 29 2c 74 69 6d 65 73 74 61 6d 70 3a 63 2e 66 5f 2e 6e 6f 77 28 29 7d 3b 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 26 26 28 72 2e 73 65 6c 65 63 74 6f 72 3d 6e 2e 73 65 6c 65 63 74 6f 72 2c 72 2e 70 61 67 65 5f 78 3d 6e 2e 70 61 67 65 58 2c 72 2e 70 61 67 65 5f 79 3d 6e 2e 70 61 67 65 59 2c 72 2e 6f 66 66 73 65 74 5f 78 3d 6e 2e 6f 66 66 73 65 74 58 2c 72 2e 6f 66 66 73 65 74 5f 79 3d 6e 2e 6f 66 66 73 65 74 59 29 7d 29 Data Ascii: t=hj.hq.trim(e[d]);if(t.length&&t.length<=hj.maxRecordingTagLength){var r={name:t,time:hj.time.getNow(),timestamp:c.f_.now()};hj.tryCatch((function(){n&&(r.selector=n.selector,r.page_x=n.pageX,r.page_y=n.pageY,r.offset_x=n.offsetX,r.offset_y=n.offsetY)})
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 2f 5c 2f 24 2f 2c 22 22 29 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 3f 74 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 3a 6e 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 65 26 26 76 6f 69 64 20 30 21 3d 3d 74 26 26 6e 75 6c 6c 21 3d 3d 65 26 26 6e 75 6c 6c 21 3d 3d 74 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 21 69 73 4e 61 4e 28 65 2e 70 61 74 74 65 72 6e 29 26 26 21 69 73 4e 61 4e 28 74 29 26 26 22 22 21 3d 3d 74 26 26 Data Ascii: /\/$/,"")},d=function(e,t,n){return function(){return e.apply(null,arguments)?t.apply(null,arguments):n.apply(null,arguments)}},h=function(e,t){return void 0!==e&&void 0!==t&&null!==e&&null!==t},f=function(e,t){return!isNaN(e.pattern)&&!isNaN(t)&&""!==t&&
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 72 61 63 74 65 72 44 61 74 61 43 68 61 6e 67 65 64 28 29 7d 29 2c 22 4d 75 74 61 74 69 6f 6e 50 72 6f 6a 65 63 74 69 6f 6e 2e 67 65 74 43 68 61 6e 67 65 64 22 29 2c 74 68 69 73 2e 61 74 74 72 69 62 75 74 65 43 68 61 6e 67 65 64 4e 6f 64 65 73 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 6f 2e 74 72 65 65 43 68 61 6e 67 65 73 2e 61 6e 79 41 74 74 72 69 62 75 74 65 73 43 68 61 6e 67 65 64 29 72 65 74 75 72 6e 7b 7d 3b 76 61 72 20 65 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 74 72 65 65 43 68 61 6e 67 65 73 2e 6b 65 79 73 28 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 6f 2e 74 72 65 65 43 68 61 6e 67 65 73 2e 67 65 74 28 74 29 3b 69 66 28 6e 2e 61 74 74 72 69 62 75 74 65 73 26 Data Ascii: racterDataChanged()}),"MutationProjection.getChanged"),this.attributeChangedNodes=hj.tryCatch((function(){if(!o.treeChanges.anyAttributesChanged)return{};var e={};return o.treeChanges.keys().forEach((function(t){var n=o.treeChanges.get(t);if(n.attributes&
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 26 26 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 72 2e 72 6f 6f 74 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 54 79 70 65 29 7b 63 61 73 65 20 4e 6f 64 65 2e 43 4f 4d 4d 45 4e 54 5f 4e 4f 44 45 3a 61 3d 73 2e 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 28 65 2e 74 65 78 74 43 6f 6e 74 65 6e 74 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 4e 6f 64 65 2e 54 45 58 54 5f 4e 4f 44 45 3a 61 3d 73 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 65 2e 74 65 78 74 43 6f 6e 74 65 6e 74 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 4e 6f 64 65 2e 44 4f 43 55 4d 45 4e 54 5f 54 59 50 45 5f 4e 4f 44 45 3a 61 3d 73 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 54 79 70 65 28 65 2e 6e 61 6d 65 2c 65 2e 70 75 62 6c 69 63 49 64 2c 65 2e 73 79 73 74 65 Data Ascii: &&void 0!==n?n:r.root;switch(e.nodeType){case Node.COMMENT_NODE:a=s.createComment(e.textContent);break;case Node.TEXT_NODE:a=s.createTextNode(e.textContent);break;case Node.DOCUMENT_TYPE_NODE:a=s.implementation.createDocumentType(e.name,e.publicId,e.syste
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 65 72 74 79 28 53 68 61 64 6f 77 52 6f 6f 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 61 64 6f 70 74 65 64 53 74 79 6c 65 53 68 65 65 74 73 22 2c 6e 29 2c 6e 3d 6e 75 6c 6c 2c 69 3d 21 31 29 2c 6f 26 26 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 44 6f 63 75 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 61 64 6f 70 74 65 64 53 74 79 6c 65 53 68 65 65 74 73 22 2c 6f 29 2c 6f 3d 6e 75 6c 6c 2c 69 3d 21 31 29 2c 74 2e 6c 65 6e 67 74 68 3d 30 7d 2c 65 7d 28 29 7d 29 2c 22 68 6a 2e 61 64 6f 70 74 65 64 53 74 79 6c 65 53 68 65 65 74 73 22 29 28 29 7d 2c 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3b 68 6a 2e 63 73 73 42 6c 6f 62 73 3d 28 74 3d 5b Data Ascii: erty(ShadowRoot.prototype,"adoptedStyleSheets",n),n=null,i=!1),o&&(Object.defineProperty(Document.prototype,"adoptedStyleSheets",o),o=null,i=!1),t.length=0},e}()}),"hj.adoptedStyleSheets")()},289:function(){hj.tryCatch((function(){var e,t;hj.cssBlobs=(t=[
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 6f 5f 6c 61 72 67 65 22 2c 7b 73 69 7a 65 3a 74 2c 73 6f 75 72 63 65 3a 22 70 61 67 65 5f 76 69 73 69 74 22 2c 74 69 6d 65 73 74 61 6d 70 3a 69 2e 66 5f 2e 6e 6f 77 28 29 7d 2c 21 31 29 7d 7d 29 2c 7b 71 75 65 72 79 3a 22 73 69 74 65 5f 69 64 3d 22 2e 63 6f 6e 63 61 74 28 68 6a 2e 73 65 74 74 69 6e 67 73 2e 73 69 74 65 5f 69 64 29 2b 28 73 3f 22 26 67 7a 69 70 3d 31 22 3a 22 22 29 7d 29 7d 3b 72 3f 73 28 7b 73 75 63 63 65 73 73 3a 21 31 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 6f 2c 69 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 72 79 7b 65 26 26 68 6a 2e 6d 65 74 72 69 63 73 2e 63 6f 75 6e 74 28 22 73 65 73 73 69 6f 6e 2d 65 78 63 65 70 74 69 6f 6e 22 2c 7b 74 61 67 3a 7b 6d 6f 64 75 6c 65 3a 22 63 6f 6d 70 72 65 73 Data Ascii: o_large",{size:t,source:"page_visit",timestamp:i.f_.now()},!1)}}),{query:"site_id=".concat(hj.settings.site_id)+(s?"&gzip=1":"")})};r?s({success:!1}):function(e,t){var n,r,o,i,a=function(e){try{e&&hj.metrics.count("session-exception",{tag:{module:"compres
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 68 7c 7c 68 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 66 2c 61 2e 6f 66 66 28 75 2c 65 29 29 7d 29 29 29 7d 7d 76 61 72 20 67 3b 69 28 73 29 26 26 28 6e 75 6c 6c 3d 3d 3d 28 67 3d 6f 5b 65 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 67 7c 7c 67 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 28 73 2c 61 2e 6f 66 66 28 65 2c 74 29 29 7d 29 29 29 7d 63 61 74 63 68 28 65 29 7b 68 6a 2e 65 78 63 65 70 74 69 6f 6e 73 2e 6c 6f 67 28 65 2c 22 68 6a 2e 73 74 6f 72 65 2e 22 2e 63 6f 6e 63 61 74 28 74 29 29 7d 7d 2c 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 Data Ascii: void 0===h\|\|h.forEach((function(e){e(f,a.off(u,e))})))}}var g;i(s)&&(null===(g=o[e])\|\|void 0===g\|\|g.forEach((function(t){t(s,a.off(e,t))})))}catch(e){hj.exceptions.log(e,"hj.store.".concat(t))}},on:function(e,t){var n,r=arguments.length>2&&void 0!==argume
2024-02-27 17:38:46 UTC	16384	IN	Data Raw: 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 7b 69 73 4e 61 4e 28 74 2e 63 68 61 72 41 74 28 31 29 29 7c 7c 22 2e 22 21 3d 3d 74 2e 63 68 61 72 41 74 28 30 29 26 26 22 23 22 21 3d 3d 74 2e 63 68 61 72 41 74 28 30 29 7c 7c 28 74 3d 74 2e 63 68 61 72 41 74 28 30 29 2b 22 5c 5c 33 22 2b 74 2e 63 68 61 72 41 74 28 31 29 2b 22 20 22 2b 74 2e 73 6c 69 63 65 28 32 29 29 3b 74 72 79 7b 69 3d 73 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 74 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 3d 30 2c 74 68 69 73 7d 66 6f 72 28 61 3d 30 3b 61 3c 69 2e 6c 65 6e 67 74 68 3b 61 2b 3d 31 29 74 68 69 73 5b 61 5d 3d 69 5b 61 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 3d 69 2e 6c 65 6e Data Ascii: ;if("string"==typeof t){isNaN(t.charAt(1))\|\|"."!==t.charAt(0)&&"#"!==t.charAt(0)\|\|(t=t.charAt(0)+"\\3"+t.charAt(1)+" "+t.slice(2));try{i=s.querySelectorAll(t)}catch(e){return this.length=0,this}for(a=0;a<i.length;a+=1)this[a]=i[a];return this.length=i.len

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49838	104.244.42.5	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	965	OUT	GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	551	IN	HTTP/1.1 200 OK date: Tue, 27 Feb 2024 17:38:45 GMT perf: 7469935968 server: tsa_b set-cookie: muc_ads=1692164b-248c-485d-99bb-aee2b9f7031b; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:38:46 GMT; Path=/; Domain=t.co; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: a25c308d98965558 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: d4fd4c9746c31d6f005738c9cbf74ac5e3285b19e6aea2434ba8550070668070 connection: close
2024-02-27 17:38:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49833	35.167.214.190	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	473	OUT	GET /ibs:dpid=411&dpuuid=Zd4eJQAAAG_qkwMv HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=64982516487112820180108176489468717949; dpm=64982516487112820180108176489468717949
2024-02-27 17:38:46 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:46 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: LOoYz6rcQOs= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-usw2-2-v053-0b6355859.edge-usw2.demdex.com 2 ms set-cookie: dpm=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:46 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=64982516487112820180108176489468717949; Max-Age=15552000; Expires=Sun, 25 Aug 2024 17:38:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-02-27 17:38:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49835	64.202.112.191	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	820	OUT	POST /unifiedPixel?optOut=true&bust=08860062136667297&referrer=&cht=ot&marketerId=001ac0827d67b7b38319c9517e7fa2f4cc&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&g=1&obApiVersion=1.1&obtpVersion=2.0.5 HTTP/1.1 Host: tr.outbrain.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:46 GMT Content-Type: image/gif; Content-Length: 53 Connection: close Cache-Control: no-cache X-TraceId: 160a0f76e48dabe73ebb15cd2dcc2daf Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-02-27 17:38:46 UTC	53	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 ef bf bd 00 00 00 00 00 ef bf bd ef bf bd ef bf bd 21 ef bf bd 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 40 02 02 44 01 00 3b Data Ascii: GIF89a!,@D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49830	20.50.2.53	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	1197	OUT	GET /api/mhubc.js HTTP/1.1 Host: mstatic.ccleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19781%7CMCMID%7C65137400602583208510129276808489166796%7CMCAAMLH-1709660324%7C7%7CMCAAMB-1709660324%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1709062724s%7CNONE%7CvVersion%7C5.5.0; _gcl_au=1.1.514650152.1709055524; __srcCookie=007_z8b\|\|source=(Other)\|medium=(none)\|campaign=(not set)\|segmentCode=z; pglpid=undefined; s_nr=1709055524593-New; event69=event69; channelStack=s_eVar72~ccleaner; s_tbm=true; s_gpv=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918; s_gpv_custom=ccleaner%3Aknowledge%3Accleaner-v6-21-10918; s_cc=true
2024-02-27 17:38:46 UTC	304	IN	HTTP/1.1 200 OK Content-Length: 280367 Connection: close Content-Type: application/javascript; charset=utf-8 Date: Tue, 27 Feb 2024 17:38:46 GMT Cache-Control: public, max-age=86400, private Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Robots-Tag: noindex,nofollow
2024-02-27 17:38:46 UTC	3589	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 61 70 69 55 72 6c 29 7b 0d 0a 77 69 6e 64 6f 77 2e 6d 68 75 62 63 3d 7b 61 64 73 3a 5b 5d 2c 70 75 73 68 3a 66 75 6e 63 74 69 6f 6e 28 75 29 7b 77 69 6e 64 6f 77 2e 6d 68 75 62 63 2e 71 75 65 75 65 2e 70 75 73 68 28 75 29 7d 2c 71 75 65 75 65 3a 77 69 6e 64 6f 77 2e 6d 68 75 62 63 26 26 77 69 6e 64 6f 77 2e 6d 68 75 62 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 77 69 6e 64 6f 77 2e 6d 68 75 62 63 3a 5b 5d 7d 3b 76 61 72 20 75 74 69 6c 3d 7b 64 65 66 69 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 75 2c 6f 2c 74 29 7b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 74 69 6c 2e 6d 6f 64 75 6c 65 73 5b 75 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 6f 2e Data Ascii: (function(apiUrl){window.mhubc={ads:[],push:function(u){window.mhubc.queue.push(u)},queue:window.mhubc&&window.mhubc instanceof Array?window.mhubc:[]};var util={define:function(u,o,t){window.setTimeout((function(){var e=util.modules[u]=function(){},i=o.
2024-02-27 17:38:46 UTC	4096	IN	Data Raw: 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 65 29 3f 74 3d 6f 5b 65 5d 3a 72 26 26 76 6f 69 64 20 30 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 65 29 26 26 28 74 3d 72 5b 65 5d 29 7d 72 65 74 75 72 6e 20 74 7d 2c 67 6f 6f 67 2e 46 45 41 54 55 52 45 53 45 54 5f 59 45 41 52 3d 32 30 31 32 2c 67 6f 6f 67 2e 44 45 42 55 47 3d 21 30 2c 67 6f 6f 67 2e 4c 4f 43 41 4c 45 3d 22 65 6e 22 2c 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 53 49 54 45 3d 21 30 2c 67 6f 6f 67 2e 53 54 52 49 43 54 5f 4d 4f 44 45 5f 43 4f 4d 50 41 54 49 42 4c 45 3d 21 31 2c 67 6f 6f 67 2e 44 49 53 41 4c 4c 4f 57 5f 54 45 53 54 5f 4f 4e 4c 59 5f 43 4f 44 45 3d 43 4f 4d 50 49 4c Data Ascii: roperty.call(o,e)?t=o[e]:r&&void 0===r.nodeType&&Object.prototype.hasOwnProperty.call(r,e)&&(t=r[e])}return t},goog.FEATURESET_YEAR=2012,goog.DEBUG=!0,goog.LOCALE="en",goog.TRUSTED_SITE=!0,goog.STRICT_MODE_COMPATIBLE=!1,goog.DISALLOW_TEST_ONLY_CODE=COMPIL
2024-02-27 17:38:46 UTC	1678	IN	Data Raw: 67 6f 6f 67 2e 66 6f 72 77 61 72 64 44 65 63 6c 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 7d 2c 43 4f 4d 50 49 4c 45 44 7c 7c 28 67 6f 6f 67 2e 69 73 50 72 6f 76 69 64 65 64 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 20 67 6f 6f 67 2e 6c 6f 61 64 65 64 4d 6f 64 75 6c 65 73 5f 7c 7c 21 67 6f 6f 67 2e 69 6d 70 6c 69 63 69 74 4e 61 6d 65 73 70 61 63 65 73 5f 5b 65 5d 26 26 6e 75 6c 6c 21 3d 67 6f 6f 67 2e 67 65 74 4f 62 6a 65 63 74 42 79 4e 61 6d 65 28 65 29 7d 2c 67 6f 6f 67 2e 69 6d 70 6c 69 63 69 74 4e 61 6d 65 73 70 61 63 65 73 5f 3d 7b 22 67 6f 6f 67 2e 6d 6f 64 75 6c 65 22 3a 21 30 7d 29 2c 67 6f 6f 67 2e 67 65 74 4f 62 6a 65 63 74 42 79 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 65 2e 73 70 6c Data Ascii: goog.forwardDeclare=function(e){},COMPILED\|\|(goog.isProvided_=function(e){return e in goog.loadedModules_\|\|!goog.implicitNamespaces_[e]&&null!=goog.getObjectByName(e)},goog.implicitNamespaces_={"goog.module":!0}),goog.getObjectByName=function(e,t){e=e.spl
2024-02-27 17:38:46 UTC	4096	IN	Data Raw: 61 6e 73 70 69 6c 65 2e 6a 73 22 2c 67 6f 6f 67 2e 68 61 73 42 61 64 4c 65 74 53 63 6f 70 69 6e 67 3d 6e 75 6c 6c 2c 67 6f 6f 67 2e 75 73 65 53 61 66 61 72 69 31 30 57 6f 72 6b 61 72 6f 75 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 75 6c 6c 3d 3d 67 6f 6f 67 2e 68 61 73 42 61 64 4c 65 74 53 63 6f 70 69 6e 67 29 7b 74 72 79 7b 76 61 72 20 61 3d 21 65 76 61 6c 28 27 22 75 73 65 20 73 74 72 69 63 74 22 3b 6c 65 74 20 78 20 3d 20 31 3b 20 66 75 6e 63 74 69 6f 6e 20 66 28 29 20 7b 20 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 78 3b 20 7d 3b 66 28 29 20 3d 3d 20 22 6e 75 6d 62 65 72 22 3b 27 29 7d 63 61 74 63 68 28 65 29 7b 61 3d 21 31 7d 67 6f 6f 67 2e 68 61 73 42 61 64 4c 65 74 53 63 6f 70 69 6e 67 3d 61 7d 72 65 74 75 72 6e 20 67 6f 6f 67 2e 68 61 Data Ascii: anspile.js",goog.hasBadLetScoping=null,goog.useSafari10Workaround=function(){if(null==goog.hasBadLetScoping){try{var a=!eval('"use strict";let x = 1; function f() { return typeof x; };f() == "number";')}catch(e){a=!1}goog.hasBadLetScoping=a}return goog.ha
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 69 66 28 21 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 29 3b 69 66 28 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 32 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 73 68 69 66 74 2e 61 70 70 6c 79 28 6f 2c 72 29 2c 65 2e 61 70 70 6c 79 28 74 2c 6f 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 6c 79 Data Ascii: function(e,t,o){if(!e)throw Error();if(2<arguments.length){var r=Array.prototype.slice.call(arguments,2);return function(){var o=Array.prototype.slice.call(arguments);return Array.prototype.unshift.apply(o,r),e.apply(t,o)}}return function(){return e.apply
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 54 4f 54 59 50 45 5f 46 49 45 4c 44 53 5f 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 6f 3d 67 6f 6f 67 2e 64 65 66 69 6e 65 43 6c 61 73 73 2e 4f 42 4a 45 43 54 5f 50 52 4f 54 4f 54 59 50 45 5f 46 49 45 4c 44 53 5f 5b 72 5d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 7d 2c 67 6f 6f 67 2e 74 61 67 55 6e 73 65 61 6c 61 62 6c 65 43 6c 61 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 21 43 4f 4d 50 49 4c 45 44 26 26 67 6f 6f 67 2e 64 65 66 69 6e 65 43 6c 61 73 73 2e 53 45 41 4c 5f 43 4c 41 53 53 5f 49 4e 53 54 41 4e 43 45 53 26 26 28 65 2e 70 72 6f 74 6f 74 79 70 65 5b 67 6f 6f 67 2e 55 4e 53 45 41 4c 41 42 4c 45 5f 43 4f 4e 53 54 52 55 43 54 4f 52 Data Ascii: TOTYPE_FIELDS_.length;r++)o=goog.defineClass.OBJECT_PROTOTYPE_FIELDS_[r],Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])},goog.tagUnsealableClass=function(e){!COMPILED&&goog.defineClass.SEAL_CLASS_INSTANCES&&(e.prototype[goog.UNSEALABLE_CONSTRUCTOR
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 74 3d 74 68 69 73 2c 6f 3d 5b 5d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 73 3d 74 2e 67 65 74 50 61 74 68 46 72 6f 6d 44 65 70 73 5f 28 65 29 3b 69 66 28 21 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 64 65 70 65 6e 64 65 6e 63 79 20 70 61 74 68 20 6f 72 20 73 79 6d 62 6f 6c 3a 20 22 2b 65 29 3b 69 66 28 21 74 2e 77 72 69 74 74 65 6e 5f 5b 73 5d 29 7b 66 6f 72 28 74 2e 77 72 69 74 74 65 6e 5f 5b 73 5d 3d 21 30 2c 65 3d 74 2e 64 65 70 65 6e 64 65 6e 63 69 65 73 5f 5b 73 5d 2c 73 3d 30 3b 73 3c 65 2e 72 65 71 75 69 72 65 73 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 67 6f 6f 67 2e 69 73 50 72 6f 76 69 64 65 64 5f 28 65 2e 72 65 71 75 69 72 65 73 5b 73 5d 29 7c 7c 72 28 65 2e 72 65 71 75 69 72 65 73 5b 73 5d 29 3b 6f 2e 70 75 73 68 28 Data Ascii: t=this,o=[],r=function(e){var s=t.getPathFromDeps_(e);if(!s)throw Error("Bad dependency path or symbol: "+e);if(!t.written_[s]){for(t.written_[s]=!0,e=t.dependencies_[s],s=0;s<e.requires.length;s++)goog.isProvided_(e.requires[s])\|\|r(e.requires[s]);o.push(
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 3f 29 2e 22 29 3b 66 6f 72 28 76 61 72 20 6f 3d 67 6f 6f 67 2e 44 65 70 65 6e 64 65 6e 63 79 2e 63 61 6c 6c 62 61 63 6b 4d 61 70 5f 5b 65 5d 2c 72 3d 5b 5d 2c 73 3d 31 3b 73 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 3b 6f 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 72 29 7d 2c 67 6f 6f 67 2e 44 65 70 65 6e 64 65 6e 63 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 43 4c 4f 53 55 52 45 5f 49 4d 50 4f 52 54 5f 53 43 52 49 50 54 29 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 43 4c 4f 53 55 52 45 5f 49 4d 50 4f 52 54 5f 53 43 52 49 50 54 28 74 68 69 73 Data Ascii: ed more than once?).");for(var o=goog.Dependency.callbackMap_[e],r=[],s=1;s<arguments.length;s++)r.push(arguments[s]);o.apply(void 0,r)},goog.Dependency.prototype.load=function(e){if(goog.global.CLOSURE_IMPORT_SCRIPT)goog.global.CLOSURE_IMPORT_SCRIPT(this
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 68 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 69 66 28 72 2e 6c 61 7a 79 46 65 74 63 68 5f 26 26 74 28 29 2c 72 2e 63 6f 6e 74 65 6e 74 73 5f 29 7b 73 26 26 65 2e 73 65 74 4d 6f 64 75 6c 65 53 74 61 74 65 28 67 6f 6f 67 2e 4d 6f 64 75 6c 65 54 79 70 65 2e 45 53 36 29 3b 74 72 79 7b 76 61 72 20 6f 3d 72 2e 63 6f 6e 74 65 6e 74 73 5f 3b 69 66 28 72 2e 63 6f 6e 74 65 6e 74 73 5f 3d 6e 75 6c 6c 2c 67 6f 6f 67 2e 67 6c 6f 62 61 6c 45 76 61 6c 28 6f 29 2c 73 29 76 61 72 20 6e 3d 67 6f 6f 67 2e 6d 6f 64 75 6c 65 4c 6f 61 64 65 72 53 74 61 74 65 5f 2e 6d 6f 64 75 6c 65 4e 61 6d 65 7d 66 69 6e 61 6c 6c 79 7b 73 26 26 65 2e 63 6c 65 61 72 4d 6f 64 75 6c 65 53 74 61 74 65 28 29 7d 73 26 26 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 24 6a 73 63 6f 6d 70 2e 72 65 71 75 Data Ascii: h))}function o(){if(r.lazyFetch_&&t(),r.contents_){s&&e.setModuleState(goog.ModuleType.ES6);try{var o=r.contents_;if(r.contents_=null,goog.globalEval(o),s)var n=goog.moduleLoaderState_.moduleName}finally{s&&e.clearModuleState()}s&&goog.global.$jscomp.requ
2024-02-27 17:38:47 UTC	4096	IN	Data Raw: 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 4e 41 4d 45 3d 22 22 2c 67 6f 6f 67 2e 69 64 65 6e 74 69 74 79 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 67 6f 6f 67 2e 63 72 65 61 74 65 54 72 75 73 74 65 64 54 79 70 65 73 50 6f 6c 69 63 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6e 75 6c 6c 2c 6f 3d 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 74 72 75 73 74 65 64 54 79 70 65 73 7c 7c 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 54 72 75 73 74 65 64 54 79 70 65 73 3b 69 66 28 21 6f 7c 7c 21 6f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 74 3b 74 72 79 7b 74 3d 6f 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 65 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 67 6f 6f 67 2e 69 64 65 6e 74 69 74 79 5f 2c 63 72 65 Data Ascii: USTED_TYPES_POLICY_NAME="",goog.identity_=function(e){return e},goog.createTrustedTypesPolicy=function(e){var t=null,o=goog.global.trustedTypes\|\|goog.global.TrustedTypes;if(!o\|\|!o.createPolicy)return t;try{t=o.createPolicy(e,{createHTML:goog.identity_,cre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49839	52.85.132.82	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	661	OUT	POST /563151391133/pageInfo HTTP/1.1 Host: www.mczbf.com Connection: keep-alive Content-Length: 519 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	519	OUT	Data Raw: 69 64 3d 33 35 64 64 65 65 37 38 2d 36 30 38 33 2d 34 33 39 65 2d 39 36 37 66 2d 38 33 63 38 35 62 64 36 33 34 32 62 26 66 75 6c 6c 52 65 66 65 72 72 65 72 55 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 25 32 46 6b 6e 6f 77 6c 65 64 67 65 25 32 46 63 63 6c 65 61 6e 65 72 2d 76 36 2d 32 31 2d 31 30 39 31 38 25 33 46 63 76 25 33 44 76 36 2d 32 31 2d 31 30 39 31 38 26 70 61 79 6c 6f 61 64 3d 25 37 42 25 32 32 73 69 74 65 50 61 67 65 25 32 32 25 33 41 25 37 42 25 32 32 65 6e 74 65 72 70 72 69 73 65 49 64 25 32 32 25 33 41 25 32 32 31 35 36 34 34 37 32 25 32 32 25 37 44 25 37 44 26 70 61 72 74 6e 65 72 73 68 69 70 73 3d 25 37 42 25 32 32 6c 69 76 65 52 61 6d 70 25 32 32 25 33 41 25 37 42 25 32 32 69 73 43 Data Ascii: id=35ddee78-6083-439e-967f-83c85bd6342b&fullReferrerUrl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&payload=%7B%22sitePage%22%3A%7B%22enterpriseId%22%3A%221564472%22%7D%7D&partnerships=%7B%22liveRamp%22%3A%7B%22isC
2024-02-27 17:38:46 UTC	641	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 68 Connection: close Date: Tue, 27 Feb 2024 17:38:46 GMT X-Request-ID: 0f3b33df-d597-11ee-b493-87f93622eb11 Access-Control-Allow-Origin: * Set-Cookie: cjUser=82ab0b25-a8ef-4fef-8435-1de230d584d8; Expires=Fri, 28 Mar 2025 17:38:46 GMT; Domain=.mczbf.com; Path=/; Secure; SameSite=None; $x-enc=URI_ENCODING Cache-Control: no-store Server: nginx X-Robots-Tag: noindex, nofollow X-Cache: Miss from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 17q6_kszlj9vvU4Q98-rs1T-d_sxXjrK_9d6vNnUsSfJR5JwsgfATg==
2024-02-27 17:38:46 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0b 49 44 41 54 78 da 63 64 60 00 00 00 06 00 02 30 81 d0 2f 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxcd`0/IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49840	69.147.92.12	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	357	OUT	GET /wi/config/10180940.json HTTP/1.1 Host: s.yimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	877	IN	HTTP/1.1 200 OK x-amz-id-2: I2IHLvqrOvH1oVjZnRfq2ROwER+avjQM27g71sIAcXvPCiXB3hngt7yijS/06Z8vIc5BDBVK4vI= x-amz-request-id: 307JBZ9QQYR7Q5MV Date: Tue, 27 Feb 2024 17:24:32 GMT Last-Modified: Tue, 27 Feb 2024 16:44:39 GMT x-amz-expiration: expiry-date="Thu, 03 Apr 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle" x-amz-server-side-encryption: AES256 x-amz-version-id: 3nll5eCRDwkW_aSJ3SJ_Gwbcp3hOkOvt Accept-Ranges: bytes Content-Type: application/json Server: ATS Content-Length: 46 Referrer-Policy: no-referrer-when-downgrade Vary: Origin Etag: "5df7dee99a3ff0ef853b4c1a7e8a6f34" Age: 855 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-02-27 17:38:46 UTC	46	IN	Data Raw: 7b 22 70 69 78 65 6c 49 64 22 3a 31 30 31 38 30 39 34 30 2c 22 75 73 65 31 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 22 3a 74 72 75 65 7d Data Ascii: {"pixelId":10180940,"use1stPartyCookies":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49842	35.244.154.8	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	635	OUT	GET /711037.gif?partner_uid=82ab0b25-a8ef-4fef-8435-1de230d584d8 HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:46 UTC	735	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://idsync.rlcdn.com/1000.gif?memo=CP2yKxIwCiwIARCl_gkaJDgyYWIwYjI1LWE4ZWYtNGZlZi04NDM1LTFkZTIzMGQ1ODRkOBAAGg0Iprz4rgYSBQjoBxAAQgBKAA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=ktTeDD6OzBnt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; Path=/; Domain=rlcdn.com; Expires=Wed, 26 Feb 2025 17:38:46 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 27 Apr 2024 17:38:46 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 27 Feb 2024 17:38:46 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49845	63.140.38.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	1317	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s56254480568556?AQB=1&ndh=1&pf=1&t=27%2F1%2F2024%2018%3A38%3A44%202%20-60&mid=65137400602583208510129276808489166796&aamlh=7&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-21-10918&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-02-06&c48=CCleaner%20v6.21.10918&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=65137400602583208510129276808489166796&c59=ccleaner%3Aknowledge%3Accleaner-v6-21-10918&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 27 Feb 2024 17:38:46 GMT expires: Mon, 26 Feb 2024 17:38:46 GMT last-modified: Wed, 28 Feb 2024 17:38:46 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3670168796769714176-4617760774566879197 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-02-27 17:38:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49846	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:46 UTC	430	OUT	GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	890	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 85c23414af530801-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Expires: Wed, 28 Feb 2024 17:38:47 GMT Last-Modified: Mon, 20 Jun 2022 08:17:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: i0ofUXVu/TqOH4J3xgmSUw== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d6116a57-101e-00a5-1230-616ff9000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-27 17:38:47 UTC	479	IN	Data Raw: 37 63 32 34 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 63 63 74 49 64 22 3a 22 38 33 31 62 38 65 65 30 2d 65 39 35 32 2d Data Ascii: 7c24{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccloseButtonType":"Icon","pccontinueWithoutAcceptText":"Continue without Accepting","cctId":"831b8ee0-e952-
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 6f 20 73 68 6f 77 20 72 65 6c 65 76 61 6e 74 20 6d 61 72 6b 65 74 69 6e 67 20 63 6f 6e 74 65 6e 74 2e 20 59 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 73 65 74 74 69 6e 67 73 20 62 65 6c 6f 77 2e 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 9c 43 6f 6e 66 69 72 6d 20 53 65 6c 65 63 74 69 6f 6e e2 80 9d 20 79 6f 75 20 61 67 72 65 65 20 77 69 74 68 20 74 68 65 20 63 75 72 72 65 6e 74 20 73 65 74 74 69 6e 67 73 2e 20 53 65 65 22 2c 22 41 62 6f 75 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 70 6f 6c 69 63 79 22 2c 22 41 62 6f 75 74 43 6f 6f 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 63 63 65 70 74 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 Data Ascii: to show relevant marketing content. You can manage cookie settings below. By clicking Confirm Selection you agree with the current settings. See","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept All","AllowAllText
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 44 65 74 61 69 6c 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 20 4d 61 6e 61 67 65 20 43 6f 6e 73 65 6e 74 20 50 72 65 66 65 72 65 6e 63 65 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 49 6e 66 6f 53 63 72 65 65 6e 52 65 61 64 65 72 22 3a 22 4f 70 65 6e 73 20 69 6e 20 61 20 6e 65 77 20 54 61 62 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 54 69 74 6c 65 22 3a 22 43 6f 6f 6b 69 65 20 4c 69 73 74 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 63 6f 6f 6b 69 65 20 Data Ascii: IAB Vendors","ThirdPartyCookieListText":"Cookies Details","PreferenceCenterManagePreferencesText":" Manage Consent Preferences","PreferenceCenterMoreInfoScreenReader":"Opens in a new Tab","CookieListTitle":"Cookie List","CookieListDescription":"A cookie
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 72 65 61 73 20 6f 66 20 74 68 65 20 77 65 62 73 69 74 65 2e 20 54 68 65 20 77 65 62 73 69 74 65 20 63 61 6e 6e 6f 74 20 66 75 6e 63 74 69 6f 6e 20 70 72 6f 70 65 72 6c 79 20 77 69 74 68 6f 75 74 20 74 68 65 73 65 20 63 6f 6f 6b 69 65 73 2e 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4d 6f 62 69 6c 65 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4f 54 54 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 22 3a 22 4e 65 63 65 73 73 61 72 79 20 63 6f 6f 6b 69 65 73 22 2c 22 49 73 49 61 62 50 75 72 70 6f 73 65 22 3a 66 61 6c 73 65 2c 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 49 64 73 22 3a 5b 5d 2c 22 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 74 Data Ascii: reas of the website. The website cannot function properly without these cookies.","GroupNameMobile":"Necessary cookies","GroupNameOTT":"Necessary cookies","GroupName":"Necessary cookies","IsIabPurpose":false,"GeneralVendorsIds":[],"FirstPartyCookies":[{"t
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 65 61 62 2d 66 66 64 30 2d 34 61 30 34 2d 38 63 65 66 2d 66 64 32 63 37 33 31 65 64 31 32 61 22 2c 22 4e 61 6d 65 22 3a 22 5f 63 63 5f 6c 61 6e 67 43 68 6f 69 63 65 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c Data Ascii: eab-ffd0-4a04-8cef-fd2c731ed12a","Name":"_cc_langChoice","Host":"www.ccleaner.com","IsSession":false,"Length":"364","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"",
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 77 65 62 73 69 74 65 73 20 72 75 6e 20 6f 6e 20 74 68 65 20 57 69 6e 64 6f 77 73 20 41 7a 75 72 65 20 63 6c 6f 75 64 20 70 6c 61 74 66 6f 72 6d 2e 20 49 74 20 69 73 20 75 73 65 64 20 66 6f 72 20 6c 6f 61 64 20 62 61 6c 61 6e 63 69 6e 67 20 74 6f 20 6d 61 6b 65 20 73 75 72 65 20 74 68 65 20 76 69 73 69 74 6f 72 20 70 61 67 65 20 72 65 71 75 65 73 74 73 20 61 72 65 20 72 6f 75 74 65 64 20 74 6f 20 74 68 65 20 73 61 6d 65 20 73 65 72 76 65 72 20 69 6e 20 61 6e 79 20 62 72 6f 77 73 69 6e 67 20 73 65 73 73 69 6f 6e 2e 22 2c 22 44 75 72 61 74 69 6f Data Ascii: com","IsSession":true,"Length":"0","description":"This cookie is set by websites run on the Windows Azure cloud platform. It is used for load balancing to make sure the visitor page requests are routed to the same server in any browsing session.","Duratio
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 43 6f 6f 6b 69 65 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 69 64 22 3a 22 33 36 65 33 33 32 31 30 2d 36 64 30 36 2d 34 63 34 63 2d 38 38 66 66 2d 66 62 37 64 31 31 37 39 39 64 61 35 22 2c 22 4e 61 6d 65 22 3a 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 77 65 62 73 69 74 65 73 20 75 73 69 6e 67 20 63 65 72 Data Ascii: hirdPartyKey":"","firstPartyKey":"CookieOptanonAlertBoxClosed","id":"36e33210-6d06-4c4c-88ff-fb7d11799da5","Name":"OptanonAlertBoxClosed","Host":"secure.ccleaner.com","IsSession":false,"Length":"364","description":"This cookie is set by websites using cer
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 5f 64 63 5f 67 74 6d 5f 55 41 2d 22 2c 22 69 64 22 3a 22 65 61 31 38 39 31 66 63 2d 33 30 34 39 2d 34 62 66 34 2d 61 32 61 37 2d 63 66 66 37 35 33 39 34 38 37 36 36 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f 61 64 20 6f 74 68 65 72 20 73 63 72 Data Ascii: rstPartyKey":"Pattern\|_dc_gtm_UA-","id":"ea1891fc-3049-4bf4-a2a7-cff753948766","Name":"_dc_gtm_UA-xxxxxxxx","Host":"ccleaner.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to load other scr
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 63 68 20 63 61 74 65 67 6f 72 79 20 66 72 6f 6d 20 62 65 69 6e 67 20 73 65 74 20 69 6e 20 74 68 65 20 75 73 65 72 73 20 62 72 6f 77 73 65 72 2c 20 77 68 65 6e 20 63 6f 6e 73 65 6e 74 20 69 73 20 6e 6f 74 20 67 69 76 65 6e 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 61 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 63 6f 6e 74 61 69 6e 73 20 6e 6f 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 68 61 74 20 63 61 6e 20 69 64 65 6e 74 69 66 79 20 74 68 65 20 73 69 74 65 20 Data Ascii: ch category from being set in the users browser, when consent is not given. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 61 39 36 61 37 36 65 61 2d 39 66 30 65 2d 34 32 38 61 2d 38 39 64 35 2d 32 63 65 65 63 66 32 65 64 37 34 39 22 2c 22 4e 61 6d 65 22 3a 22 63 62 73 65 73 73 69 6f 6e 31 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 63 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 Data Ascii: tion":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"a96a76ea-9f0e-428a-89d5-2ceecf2ed749","Name":"cbsession1","Host":"secure.ccleaner.com","IsSessi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	49849	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	597	OUT	GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: eB5KwLWtcYPmjc/KKwC/xQ== Last-Modified: Tue, 07 Jun 2022 19:28:57 GMT x-ms-request-id: 4e3459e0-901e-0002-6c2c-24873b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8620 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23414e81e2899-IAD
2024-02-27 17:38:47 UTC	561	IN	Data Raw: 32 35 32 33 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 51 32 56 75 64 47 56 79 55 6d 39 31 62 6d 52 6c 5a 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 52 72 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 75 5a 58 Data Ascii: 2523 { "name": "otCenterRounded", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZX
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 61 58 52 73 5a 53 49 2b 56 47 6c 30 62 47 55 38 4c 32 67 79 50 6a 78 77 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 56 34 64 44 78 68 49 47 68 79 5a 57 59 39 49 69 4d 69 50 6e 42 76 62 47 6c 6a 65 54 77 76 59 54 34 38 4c 33 41 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 50 6a 78 77 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 5a 47 56 7a 59 79 49 2b 50 43 39 77 50 6a 77 Data Ascii: aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjw
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6a 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 7b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 35 3b 74 6f 70 3a 31 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 36 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 2e 35 70 Data Ascii: j48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otCenterRounded{z-index:2147483645;top:10%;position:fixed;right:0;background-color:#fff;width:60%;max-width:650px;border-radius:2.5p
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 33 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e Data Ascii: dding:0;border:0;height:auto;width:auto}#onetrust-banner-sdk .ot-b-addl-desc{display:block}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 30px;text-align:center}#onetrust-banner-sdk #onetrust-button-group-parent:not(.has-reject-all-button
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2e 63 6f 6f 6b 69 65 2d 73 65 74 74 69 6e 67 2d 6c 69 6e 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 2e 62 61 6e 6e 65 72 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 36 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 34 34 70 78 3b 68 65 69 67 68 74 3a 34 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 38 70 78 Data Ascii: t-pc-btn-handler.cookie-setting-link{text-align:left;margin-right:0}#onetrust-banner-sdk .has-reject-all-button .banner-actions-container{max-width:60%;width:auto}#onetrust-banner-sdk .ot-close-icon{width:44px;height:44px;background-size:12px;margin:-18px
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 36 70 Data Ascii: ebkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#onetrust-banner-sdk .ot-arrow-container{display:inline-block;border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:6p
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 31 35 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 72 69 67 68 74 3a 31 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 77 72 61 70 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 66 6f 6e 74 Data Ascii: ose-btn-link #onetrust-close-btn-container{top:15px;transform:none;right:15px}#onetrust-banner-sdk.ot-close-btn-link #onetrust-close-btn-container button{padding:0;white-space:pre-wrap;border:none;height:auto;line-height:1.5;text-decoration:underline;font
2024-02-27 17:38:47 UTC	740	IN	Data Raw: 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 73 7b 70 61 64 64 69 6e 67 3a 30 20 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 Data Ascii: 2px;width:calc(100% - 44px)}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 22px}#onetrust-banner-sdk #banner-options{padding:0 22px;width:calc(100% - 44px)}#onetrust-banner-sdk .banner-option{margin-bottom:6px}#onetrust-banner-sdk .has-re
2024-02-27 17:38:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	49847	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	595	OUT	GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: ee1LIfkTbcemCp7i24lw6Q== Last-Modified: Tue, 07 Jun 2022 19:28:58 GMT x-ms-request-id: bb638d0f-801e-006c-44c6-0bd214000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9182 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23414ef645766-IAD
2024-02-27 17:38:47 UTC	561	IN	Data Raw: 37 63 37 37 0d 0a 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 50 63 43 65 6e 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 4d 74 63 32 52 72 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 52 51 59 30 4e 6c 62 6e 52 6c 63 69 42 76 64 43 31 6f 61 57 52 6c 49 47 39 30 4c 57 5a 68 5a 47 55 74 61 57 34 69 49 47 46 79 61 57 45 74 62 57 39 6b 59 57 77 39 49 6e 52 79 64 57 55 69 49 48 4a 76 62 47 55 39 49 6d 46 73 5a 58 4a 30 5a 47 6c 68 62 47 39 6e 49 69 42 68 63 6d 6c 68 4c 57 52 6c 63 32 4e 79 61 57 4a 6c 5a 47 4a 35 50 53 4a 76 64 43 31 77 59 79 31 6b 5a 58 4e 6a 49 6a 34 38 49 53 30 74 49 45 4e Data Ascii: 7c77 { "name": "otPcCenter", "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImFsZXJ0ZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvdC1wYy1kZXNjIj48IS0tIEN
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 47 39 75 49 43 30 74 50 6a 78 6b 61 58 59 67 61 57 51 39 49 6d 39 30 4c 58 42 6a 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 77 59 79 31 7a 59 33 4a 76 62 47 78 69 59 58 49 69 50 6a 78 6f 4d 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 64 47 6c 30 62 47 55 69 50 6c 6c 76 64 58 49 67 55 48 4a 70 64 6d 46 6a 65 54 77 76 61 44 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 5a 47 56 7a 59 79 49 2b 50 43 39 6b 61 58 59 2b 50 47 4a 31 64 48 52 76 62 69 42 70 5a 44 30 69 59 57 4e 6a 5a 58 42 30 4c 58 4a 6c 59 32 39 74 62 57 56 75 5a 47 56 6b 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 42 62 47 78 76 64 79 42 68 62 47 77 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 63 32 56 6a 64 47 6c 76 62 69 42 6a Data Ascii: G9uIC0tPjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BbGxvdyBhbGw8L2J1dHRvbj48c2VjdGlvbiBj
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 4a 6b 61 57 39 75 49 45 64 79 62 33 56 77 49 48 4e 6c 59 33 52 70 62 32 34 67 5a 57 35 6b 63 79 41 74 4c 54 34 38 4c 33 4e 6c 59 33 52 70 62 32 34 2b 50 43 39 6b 61 58 59 2b 50 48 4e 6c 59 33 52 70 62 32 34 67 61 57 51 39 49 6d 39 30 4c 58 42 6a 4c 57 78 7a 64 43 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 68 70 5a 47 55 67 62 33 51 74 61 47 39 7a 64 48 4d 74 64 57 6b 67 62 33 51 74 63 47 4d 74 63 32 4e 79 62 32 78 73 59 6d 46 79 49 6a 34 38 5a 47 6c 32 49 47 6c 6b 50 53 4a 76 64 43 31 77 59 79 31 6f 5a 48 49 69 50 6a 78 6b 61 58 59 67 61 57 51 39 49 6d 39 30 4c 57 78 7a 64 43 31 30 61 58 52 73 5a 53 49 2b 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 47 6c 75 61 79 31 69 64 47 34 67 59 6d 46 6a 61 79 31 69 64 47 34 74 61 Data Ascii: JkaW9uIEdyb3VwIHNlY3Rpb24gZW5kcyAtLT48L3NlY3Rpb24+PC9kaXY+PHNlY3Rpb24gaWQ9Im90LXBjLWxzdCIgY2xhc3M9Im90LWhpZGUgb3QtaG9zdHMtdWkgb3QtcGMtc2Nyb2xsYmFyIj48ZGl2IGlkPSJvdC1wYy1oZHIiPjxkaXYgaWQ9Im90LWxzdC10aXRsZSI+PGJ1dHRvbiBjbGFzcz0ib3QtbGluay1idG4gYmFjay1idG4ta
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 48 4e 30 4c 58 4e 31 59 6d 68 6b 63 69 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 68 63 6d 4e 6f 4c 57 4e 75 64 48 49 69 50 6a 78 77 49 48 4a 76 62 47 55 39 49 6e 4e 30 59 58 52 31 63 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6a 63 6d 34 74 63 6d 52 79 49 6a 34 38 4c 33 41 2b 50 47 78 68 59 6d 56 73 49 47 5a 76 63 6a 30 69 64 6d 56 75 5a 47 39 79 4c 58 4e 6c 59 58 4a 6a 61 43 31 6f 59 57 35 6b 62 47 56 79 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 4e 79 62 69 31 79 5a 48 49 69 50 6a 77 76 62 47 46 69 5a 57 77 2b 49 44 78 70 62 6e 42 31 64 43 42 70 5a 44 30 69 64 6d 56 75 5a 47 39 79 4c 58 4e 6c 59 58 4a 6a 61 43 31 6f 59 57 35 6b 62 47 Data Ascii: +PGRpdiBjbGFzcz0ib3QtbHN0LXN1YmhkciI+PGRpdiBjbGFzcz0ib3Qtc2VhcmNoLWNudHIiPjxwIHJvbGU9InN0YXR1cyIgY2xhc3M9Im90LXNjcm4tcmRyIj48L3A+PGxhYmVsIGZvcj0idmVuZG9yLXNlYXJjaC1oYW5kbGVyIiBjbGFzcz0ib3Qtc2Nybi1yZHIiPjwvbGFiZWw+IDxpbnB1dCBpZD0idmVuZG9yLXNlYXJjaC1oYW5kbG
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 4f 6e 68 73 61 57 35 72 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 33 68 73 61 57 35 72 49 69 42 34 50 53 49 77 63 48 67 69 49 48 6b 39 49 6a 42 77 65 43 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 51 77 4d 69 34 31 4e 7a 63 67 4e 44 41 79 4c 6a 55 33 4e 79 49 67 65 47 31 73 4f 6e 4e 77 59 57 4e 6c 50 53 4a 77 63 6d 56 7a 5a 58 4a 32 5a 53 49 2b 50 48 52 70 64 47 78 6c 50 6b 5a 70 62 48 52 6c 63 69 42 4a 59 32 39 75 50 43 39 30 61 58 52 73 5a 54 34 38 5a 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a 6d 5a 6d 49 69 42 6b 50 53 4a 4e 4e 44 41 77 4c 6a 67 31 4f 43 77 78 4d 53 34 30 4d 6a 64 6a 4c 54 4d 75 4d 6a 51 78 4c 54 63 75 4e 44 49 78 4c 54 67 75 4f 44 55 74 4d 54 45 Data Ascii: OnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIgdmlld0JveD0iMCAwIDQwMi41NzcgNDAyLjU3NyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+PHRpdGxlPkZpbHRlciBJY29uPC90aXRsZT48Zz48cGF0aCBmaWxsPSIjZmZmIiBkPSJNNDAwLjg1OCwxMS40MjdjLTMuMjQxLTcuNDIxLTguODUtMTE
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 58 42 6a 4c 58 4e 6a 63 6d 39 73 62 47 4a 68 63 69 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 32 56 73 4c 57 4a 73 61 79 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 73 4c 57 46 73 62 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 73 4c 57 46 73 62 43 31 6f 5a 48 49 69 50 6a 78 7a 63 47 46 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6a 62 32 35 7a 5a 57 35 30 4c 57 68 6b 63 69 49 2b 51 32 39 75 63 32 56 75 64 44 77 76 63 33 42 68 62 6a 34 67 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 70 4c 57 68 6b 63 69 49 2b 54 47 56 6e 4c 6b 6c 75 64 47 56 79 5a 58 4e 30 50 43 39 7a 63 47 46 75 50 6a 77 76 5a 47 6c 32 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 Data Ascii: XBjLXNjcm9sbGJhciI+PGRpdiBpZD0ib3Qtc2VsLWJsayI+PGRpdiBjbGFzcz0ib3Qtc2VsLWFsbCI+PGRpdiBjbGFzcz0ib3Qtc2VsLWFsbC1oZHIiPjxzcGFuIGNsYXNzPSJvdC1jb25zZW50LWhkciI+Q29uc2VudDwvc3Bhbj4gPHNwYW4gY2xhc3M9Im90LWxpLWhkciI+TGVnLkludGVyZXN0PC9zcGFuPjwvZGl2PjxkaXYgY2xhc3M9
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 35 72 49 43 30 74 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 5a 6c 62 69 31 6f 5a 48 49 69 50 6a 78 6f 4d 79 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 64 6d 56 75 4c 57 35 68 62 57 55 69 50 6a 77 76 61 44 4d 2b 50 47 45 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 5a 6c 62 69 31 73 61 57 35 72 49 69 42 6f 63 6d 56 6d 50 53 49 6a 49 6a 35 57 61 57 56 33 49 46 42 79 61 58 5a 68 59 33 6b 67 54 6d 39 30 61 57 4e 6c 50 43 39 68 50 6a 77 76 5a 47 6c 32 50 6a 77 68 4c 53 30 67 64 47 39 6e 5a 32 78 6c 63 79 42 68 62 6d 51 67 59 58 4a 79 62 33 63 67 4c 53 30 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 64 47 64 73 4c 57 4e 75 64 48 49 69 50 6a 77 76 5a 47 6c 32 50 6a 77 76 63 32 56 6a 64 47 6c 76 62 6a 34 38 5a 47 6c 32 49 Data Ascii: 5rIC0tPjxkaXYgY2xhc3M9Im90LXZlbi1oZHIiPjxoMyBjbGFzcz0ib3QtdmVuLW5hbWUiPjwvaDM+PGEgY2xhc3M9Im90LXZlbi1saW5rIiBocmVmPSIjIj5WaWV3IFByaXZhY3kgTm90aWNlPC9hPjwvZGl2PjwhLS0gdG9nZ2xlcyBhbmQgYXJyb3cgLS0+PGRpdiBjbGFzcz0ib3QtdGdsLWNudHIiPjwvZGl2Pjwvc2VjdGlvbj48ZGl2I
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 79 49 6a 34 38 59 6e 56 30 64 47 39 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 73 61 57 35 72 4c 57 4a 30 62 69 42 6a 59 58 52 6c 5a 32 39 79 65 53 31 32 5a 57 35 6b 62 33 4a 7a 4c 57 78 70 63 33 51 74 61 47 46 75 5a 47 78 6c 63 69 49 2b 56 6d 6c 6c 64 79 42 57 5a 57 35 6b 62 33 49 67 54 47 6c 7a 64 44 77 76 59 6e 56 30 64 47 39 75 50 6a 77 76 5a 47 6c 32 50 6a 77 68 4c 53 30 67 51 32 39 76 61 32 6c 6c 49 47 78 76 63 33 51 67 62 47 6c 75 61 79 41 74 4c 54 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6f 62 48 4e 30 4c 57 4e 75 64 48 49 69 50 6a 78 69 64 58 52 30 62 32 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 70 62 6d 73 74 59 6e 52 75 49 47 4e 68 64 47 56 6e 62 33 4a 35 4c 57 68 76 63 33 51 74 62 47 6c 7a 64 43 31 6f 59 57 Data Ascii: yIj48YnV0dG9uIGNsYXNzPSJvdC1saW5rLWJ0biBjYXRlZ29yeS12ZW5kb3JzLWxpc3QtaGFuZGxlciI+VmlldyBWZW5kb3IgTGlzdDwvYnV0dG9uPjwvZGl2PjwhLS0gQ29va2llIGxvc3QgbGluayAtLT48ZGl2IGNsYXNzPSJvdC1obHN0LWNudHIiPjxidXR0b24gY2xhc3M9Im90LWxpbmstYnRuIGNhdGVnb3J5LWhvc3QtbGlzdC1oYW
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 64 43 31 79 61 57 64 6f 64 43 49 67 63 6d 39 73 5a 54 30 69 61 57 31 6e 49 69 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 5a 70 5a 58 64 43 62 33 67 39 49 6a 41 67 4d 43 41 78 4f 54 49 67 4e 54 45 79 49 6a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 4a 6a 64 58 4a 79 5a 57 35 30 51 32 39 73 62 33 49 69 49 47 51 39 49 6b 30 78 4e 6a 59 75 4f 53 41 79 4e 6a 51 75 4e 57 77 74 4d 54 45 33 4c 6a 67 67 4d 54 45 32 59 79 30 30 4c 6a 63 67 4e 43 34 33 4c 54 45 79 4c 6a 4d 67 4e 43 34 33 4c 54 45 33 49 44 42 73 4c 54 63 75 4d 53 30 33 4c 6a 46 6a 4c 54 51 75 4e 79 30 30 4c 6a 63 74 4e 43 34 33 4c 54 45 79 4c 6a 4d 67 4d 43 30 78 4e 30 77 78 4d 6a 63 75 4d 79 41 Data Ascii: dC1yaWdodCIgcm9sZT0iaW1nIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxOTIgNTEyIj48cGF0aCBmaWxsPSJjdXJyZW50Q29sb3IiIGQ9Ik0xNjYuOSAyNjQuNWwtMTE3LjggMTE2Yy00LjcgNC43LTEyLjMgNC43LTE3IDBsLTcuMS03LjFjLTQuNy00LjctNC43LTEyLjMgMC0xN0wxMjcuMyA
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 57 46 30 61 57 39 75 49 48 4e 30 62 33 4a 68 5a 32 55 67 59 57 35 6b 49 47 46 6a 59 32 56 7a 63 79 42 30 5a 58 4e 30 50 43 39 6f 4e 44 34 38 4c 32 52 70 64 6a 34 38 49 53 30 74 49 47 46 6a 59 32 39 79 5a 47 6c 76 62 69 42 6b 5a 58 52 68 61 57 77 67 4c 53 30 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 59 57 4e 6a 4c 57 64 79 63 47 4e 75 64 48 49 67 62 33 51 74 59 57 4e 6a 4c 58 52 34 64 43 42 76 64 43 31 32 62 6d 51 74 61 57 35 6d 62 79 31 6a 62 6e 52 79 49 6a 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 32 62 6d 51 74 61 57 35 6d 62 79 49 2b 50 47 67 31 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 32 62 6d 51 74 62 47 4a 73 49 6a 35 54 5a 58 4a 32 61 57 4e 6c 49 45 35 68 62 57 55 38 4c 32 67 31 50 6a 78 6f 4e 69 42 6a Data Ascii: WF0aW9uIHN0b3JhZ2UgYW5kIGFjY2VzcyB0ZXN0PC9oND48L2Rpdj48IS0tIGFjY29yZGlvbiBkZXRhaWwgLS0+PGRpdiBjbGFzcz0ib3QtYWNjLWdycGNudHIgb3QtYWNjLXR4dCBvdC12bmQtaW5mby1jbnRyIj48ZGl2IGNsYXNzPSJvdC12bmQtaW5mbyI+PGg1IGNsYXNzPSJvdC12bmQtbGJsIj5TZXJ2aWNlIE5hbWU8L2g1PjxoNiBj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	49848	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	595	OUT	GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	825	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: text/css Content-Length: 21866 Connection: close Content-MD5: /wtHD+oYY7dZRzCx50GZrQ== Last-Modified: Tue, 07 Jun 2022 19:29:11 GMT ETag: 0x8DA48BBFFACBC2F x-ms-request-id: ee661ea6-c01e-0020-3440-0d4224000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6734 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23414ed5f0616-IAD
2024-02-27 17:38:47 UTC	544	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 32 5a 58 4a 7a 61 57 39 75 50 53 49 78 4c 6a 45 69 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 4c Data Ascii: #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 3a 31 32 70 78 3b 77 69 64 74 68 3a 31 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e Data Ascii: t:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-logo a,#ot-sync-ntfy .powered-by-logo,#ot-sync-ntfy .ot-pc-footer-logo a{background-size:con
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 72 6f 77 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 72 6f 77 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 3b 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 6e 6f 74 28 3a 63 68 65 63 Data Ascii: #onetrust-pc-sdk .ot-sdk-row .ot-sdk-column{padding:0}#onetrust-pc-sdk .ot-sdk-container{padding-right:0}#onetrust-pc-sdk .ot-sdk-row{flex-direction:initial;width:100%}#onetrust-pc-sdk [type="checkbox"]:checked,#onetrust-pc-sdk [type="checkbox"]:not(:chec
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 2c 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 66 61 64 65 2d 69 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 66 61 64 65 2d 69 6e 7b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 34 30 30 6d 73 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 65 61 73 65 2d 69 6e 2d 6f 75 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e Data Ascii: ,.onetrust-pc-dark-filter.ot-fade-in,#onetrust-banner-sdk.ot-fade-in{animation-name:onetrust-fade-in;animation-duration:400ms;animation-timing-function:ease-in-out}#onetrust-pc-sdk.ot-hide{display:none !important}.onetrust-pc-dark-filter.ot-hide{display:n
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 6c 65 3e 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 75 73 65 72 69 64 2d 74 69 6d 65 73 74 61 6d 70 3e 73 70 61 6e 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 75 73 65 72 69 64 2d 64 65 73 63 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 6f 73 74 2d 64 65 73 63 20 61 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 76 65 6e 2d 68 64 72 3e 70 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 Data Ascii: tle>span,#onetrust-pc-sdk .ot-userid-timestamp>span{font-weight:700}#onetrust-pc-sdk .ot-userid-desc{font-style:italic}#onetrust-pc-sdk .ot-host-desc a{pointer-events:initial}#onetrust-pc-sdk .ot-ven-hdr>p a{position:relative;z-index:2;pointer-events:init
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 Data Ascii: t,#onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 Data Ascii: t-sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-nt
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 Data Ascii: nner-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:befor
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a Data Ascii: ot-sdk-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	49850	104.244.42.5	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	783	OUT	GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1 Host: t.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: muc_ads=1692164b-248c-485d-99bb-aee2b9f7031b
2024-02-27 17:38:47 UTC	392	IN	HTTP/1.1 200 OK date: Tue, 27 Feb 2024 17:38:46 GMT perf: 7469935968 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: a5b98dc29c2b8576 strict-transport-security: max-age=0 x-response-time: 6 x-connection-hash: 74c19cd1272b8198c2708216601d747117a21b2b4f138d2faace42fdc2afeb70 connection: close
2024-02-27 17:38:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	49851	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 311 Host: analytics.avcdn.net
2024-02-27 17:38:47 UTC	311	OUT	Data Raw: 0a b4 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 74 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4f 0a 0b 41 75 74 6f 55 70 64 61 74 65 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6t;HealthCheckNF0(xZOAutoUpdatesActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Buil
2024-02-27 17:38:47 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:47 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	49852	52.85.132.82	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	358	OUT	GET /563151391133/pageInfo HTTP/1.1 Host: www.mczbf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	399	IN	HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Tue, 27 Feb 2024 17:38:47 GMT X-Request-ID: 0f8a3d8b-d597-11ee-aa65-3353c84f96eb Server: nginx X-Robots-Tag: noindex, nofollow X-Cache: Error from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 8pDVhwAAIfXS5gN7x4C6KKBFs3uSdtUCutv9k-p0S3SZTI2qzYBtXg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	49853	35.244.154.8	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	759	OUT	GET /1000.gif?memo=CP2yKxIwCiwIARCl_gkaJDgyYWIwYjI1LWE4ZWYtNGZlZi04NDM1LTFkZTIzMGQ1ODRkOBAAGg0Iprz4rgYSBQjoBxAAQgBKAA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=ktTeDD6OzBnt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; pxrc=CAA=
2024-02-27 17:38:47 UTC	612	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=IM4UTIqonsTt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; Path=/; Domain=rlcdn.com; Expires=Wed, 26 Feb 2025 17:38:47 GMT; Secure; SameSite=None Set-Cookie: pxrc=CKe8+K4GEgUI6AcQAA==; Path=/; Domain=rlcdn.com; Expires=Sat, 27 Apr 2024 17:38:47 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	49854	99.86.229.20	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	586	OUT	GET /sessions/857043?s=0.25&r=0.21376483259072088 HTTP/1.1 Host: vc.hotjar.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	371	IN	HTTP/1.1 204 No Content Connection: close Access-Control-Allow-Origin: * Cache-Control: no-store Date: Tue, 27 Feb 2024 17:38:47 GMT Server: Python/3.8 aiohttp/3.9.3 X-Cache: Miss from cloudfront Via: 1.1 23546b21bebd898e1f4c79789ae527ca.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C3 X-Amz-Cf-Id: q5_CNtRN0mTEkx2LI4Tyu2_1v6PTQzzG6SIDy2dXx002G0qPe3pwSA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.17	49857	31.13.66.19	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	1282	OUT	GET /signals/config/2679475345708101?v=2.9.147&r=stable&domain=www.ccleaner.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	1973	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy" permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
2024-02-27 17:38:47 UTC	698	IN	Data Raw: 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 72 65 73 6f 75 72 63 65 2d 70 6f 6c 69 63 79 3a 20 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 65 6d 62 65 64 64 65 72 2d 70 6f 6c 69 63 79 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 3a 20 72 65 71 75 69 72 65 2d 63 6f 72 70 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 65 70 5f 72 65 70 6f 72 74 22 0d 0a 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 6f 70 65 6e 65 72 2d 70 6f 6c 69 63 79 3a 20 73 61 6d 65 2d 6f 72 69 67 69 6e 2d 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 3b 72 65 70 6f 72 74 2d 74 6f 3d 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 0d 0a 50 72 61 67 6d 61 3a 20 70 75 62 6c 69 63 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 31 32 30 30 0d 0a Data Ascii: cross-origin-resource-policy: cross-origincross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"Pragma: publicCache-Control: public, max-age=1200
2024-02-27 17:38:47 UTC	1377	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 29 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 20 45 72 72 6f 72 3a 20 50 69 78 65 6c 20 63 6f 64 65 20 69 73 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 69 73 20 70 61 67 65 22 29 3b 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 28 29 29 72 65 74 75 72 6e 3b 76 61 72 20 67 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 3f 66 75 6e 63 74 69 Data Ascii: );"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;var g=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?functi
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 2b 74 79 70 65 6f 66 20 62 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 62 26 26 62 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 61 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 3b 62 26 26 28 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 61 2c 62 29 3a 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 61 2c 62 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c Data Ascii: +typeof b);a.prototype=Object.create(b&&b.prototype,{constructor:{value:a,enumerable:!1,writable:!0,configurable:!0}});b&&(Object.setPrototypeOf?Object.setPrototypeOf(a,b):a.__proto__=b)}function l(a,b){if(!(a instanceof b))throw new TypeError("Cannot cal
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 74 72 61 63 74 50 61 67 65 46 65 61 74 75 72 65 73 22 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 61 29 7b 76 61 72 20 65 3d 61 2e 62 75 74 74 6f 6e 2c 66 3d 61 2e 62 75 74 74 6f 6e 46 65 61 74 75 72 65 73 2c 67 3d 61 2e 62 75 74 74 6f 6e 54 65 78 74 2c 69 3d 61 2e 66 6f 72 6d 2c 6a 3d 61 2e 70 69 78 65 6c 3b 61 3d 61 2e 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3b 76 61 72 20 6b 3d 61 26 26 69 3d 3d 6e 75 6c 6c 3b 69 3d 63 28 7b 62 75 74 74 6f 6e 3a 65 2c 63 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 3a 6b 3f 68 3a 69 2c 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3a 61 7d 29 3b 61 3d 64 28 29 3b 76 61 72 20 6c 3d 69 2e 66 6f 72 6d Data Ascii: ntsModules("signalsFBEventsExtractPageFeatures");function e(a){var e=a.button,f=a.buttonFeatures,g=a.buttonText,i=a.form,j=a.pixel;a=a.shouldExtractUserData;var k=a&&i==null;i=c({button:e,containerElement:k?h:i,shouldExtractUserData:a});a=d();var l=i.form
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 3d 31 35 2c 65 3d 22 69 6e 70 75 74 2c 74 65 78 74 61 72 65 61 2c 73 65 6c 65 63 74 2c 62 75 74 74 6f 6e 22 3b 66 75 6e 63 74 69 6f 6e 20 67 28 66 29 7b 76 61 72 20 67 3d 66 2e 62 75 74 74 6f 6e 2c 68 3d 66 2e 63 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 3b 66 3d 66 2e 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3b 76 61 72 20 6a 3d 6e 65 77 20 61 28 29 2c 6b 3d 5b 5d 2c 6c 3d 7b 7d 3b 69 66 28 68 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 7b 66 6f 72 6d 46 69 65 6c 64 46 65 61 74 75 72 65 73 3a 6b 2c 75 73 65 72 44 61 74 61 3a 6c 7d 3b 68 3d 68 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3b 66 6f 72 28 76 61 72 20 6d 3d 30 3b 6d 3c 68 2e 6c 65 6e 67 74 68 3b 6d 2b 2b 29 7b 76 61 72 20 6e 3d 68 5b 6d 5d 3b 69 66 28 6e 20 Data Ascii: =15,e="input,textarea,select,button";function g(f){var g=f.button,h=f.containerElement;f=f.shouldExtractUserData;var j=new a(),k=[],l={};if(h==null)return{formFieldFeatures:k,userData:l};h=h.querySelectorAll(e);for(var m=0;m<h.length;m++){var n=h[m];if(n
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 31 3b 62 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 7b 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 5b 62 5d 3b 66 6f 72 28 76 61 72 20 64 20 69 6e 20 63 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 63 2c 64 29 26 26 28 61 5b 64 5d 3d 63 5b 64 5d 29 7d 72 65 74 75 72 6e 20 61 7d 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 Data Ascii: ts:{}};k.exports;(function(){"use strict";var a=Object.assign\|\|function(a){for(var b=1;b<arguments.length;b++){var c=arguments[b];for(var d in c)Object.prototype.hasOwnProperty.call(c,d)&&(a[d]=c[d])}return a},b=f.getFbeventsModules("SignalsFBEventsUtils"
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 21 3d 3d 76 6f 69 64 20 30 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 61 3b 6c 28 74 68 69 73 2c 62 29 3b 74 68 69 73 2e 5f 6c 61 73 74 41 72 67 73 3d 6e 75 6c 6c 3b 74 68 69 73 2e 5f 6c 61 73 74 54 69 6d 65 3d 30 3b 74 68 69 73 2e 5f 72 61 74 65 4d 53 3d 63 7d 68 28 62 2c 5b 7b 6b 65 79 3a 22 5f 70 61 73 73 65 73 54 68 72 6f 74 74 6c 65 49 6d 70 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 5f 6c 61 73 74 41 72 67 73 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 62 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 63 3d 62 2d 74 68 69 73 2e 5f 6c 61 73 74 Data Ascii: tion b(){var c=arguments.length>0&&arguments[0]!==void 0?arguments[0]:a;l(this,b);this._lastArgs=null;this._lastTime=0;this._rateMS=c}h(b,[{key:"_passesThrottleImpl",value:function(){var a=this._lastArgs;if(a==null)return!0;var b=Date.now(),c=b-this._last
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4d 61 6b 65 53 61 66 65 22 29 2c 79 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4d 61 6b 65 53 61 66 65 53 74 72 69 6e 67 22 29 2c 7a 3d 76 2e 65 61 63 68 2c 41 3d 76 2e 6b 65 79 73 3b 76 2e 73 6f 6d 65 3b 76 61 72 20 42 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 74 72 61 63 74 46 72 6f 6d 49 6e 70 75 74 73 22 29 2c 43 3d 6e 65 77 20 75 28 29 2c 44 3d 31 30 30 3b 66 75 6e 63 74 69 6f 6e 20 45 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 62 2e 62 75 74 74 6f 6e 53 65 6c 65 63 74 6f 72 3d 3d 3d 22 65 78 74 65 6e 64 65 64 22 7d Data Ascii: dules("signalsFBEventsMakeSafe"),y=f.getFbeventsModules("signalsFBEventsMakeSafeString"),z=v.each,A=v.keys;v.some;var B=f.getFbeventsModules("signalsFBEventsExtractFromInputs"),C=new u(),D=100;function E(a,b){return b!=null&&b.buttonSelector==="extended"}
2024-02-27 17:38:47 UTC	1500	IN	Data Raw: 6d 2e 74 72 69 67 67 65 72 28 62 29 3a 46 28 61 2c 62 2c 66 2c 65 29 7d 76 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6b 28 62 2c 61 29 3b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 61 2c 63 2c 64 3b 6c 28 74 68 69 73 2c 62 29 3b 76 61 72 20 65 3b 66 6f 72 28 76 61 72 20 66 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 67 3d 41 72 72 61 79 28 66 29 2c 68 3d 30 3b 68 3c 66 3b 68 2b 2b 29 67 5b 68 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 68 5d 3b 72 65 74 75 72 6e 20 64 3d 28 65 3d 28 63 3d 6a 28 74 68 69 73 2c 28 61 3d 62 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 62 29 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 61 2c 5b 74 68 69 73 5d 2e 63 6f 6e 63 61 74 28 67 29 29 29 2c 63 29 2c 63 2e 65 78 Data Ascii: m.trigger(b):F(a,b,f,e)}v=function(a){k(b,a);function b(){var a,c,d;l(this,b);var e;for(var f=arguments.length,g=Array(f),h=0;h<f;h++)g[h]=arguments[h];return d=(e=(c=j(this,(a=b.__proto__\|\|Object.getPrototypeOf(b)).call.apply(a,[this].concat(g))),c),c.ex

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	49860	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	389	OUT	GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	826	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: text/css Content-Length: 21866 Connection: close Content-MD5: /wtHD+oYY7dZRzCx50GZrQ== Last-Modified: Tue, 07 Jun 2022 19:29:11 GMT ETag: 0x8DA48BBFFACBC2F x-ms-request-id: 6b1b790f-901e-003d-4640-0d4f98000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 39394 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23418dec1080d-IAD
2024-02-27 17:38:47 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 32 5a 58 4a 7a 61 57 39 75 50 53 49 78 4c 6a 45 69 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAw
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 68 74 3a 31 32 70 78 3b 77 69 64 74 68 3a 31 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f Data Ascii: ht:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-logo a,#ot-sync-ntfy .powered-by-logo,#ot-sync-ntfy .ot-pc-footer-logo a{background-size:co
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 72 6f 77 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 72 6f 77 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 3b 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 6e 6f 74 28 3a 63 68 65 Data Ascii: }#onetrust-pc-sdk .ot-sdk-row .ot-sdk-column{padding:0}#onetrust-pc-sdk .ot-sdk-container{padding-right:0}#onetrust-pc-sdk .ot-sdk-row{flex-direction:initial;width:100%}#onetrust-pc-sdk [type="checkbox"]:checked,#onetrust-pc-sdk [type="checkbox"]:not(:che
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6e 2c 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 66 61 64 65 2d 69 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 66 61 64 65 2d 69 6e 7b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 34 30 30 6d 73 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 65 61 73 65 2d 69 6e 2d 6f 75 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a Data Ascii: n,.onetrust-pc-dark-filter.ot-fade-in,#onetrust-banner-sdk.ot-fade-in{animation-name:onetrust-fade-in;animation-duration:400ms;animation-timing-function:ease-in-out}#onetrust-pc-sdk.ot-hide{display:none !important}.onetrust-pc-dark-filter.ot-hide{display:
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 69 74 6c 65 3e 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 75 73 65 72 69 64 2d 74 69 6d 65 73 74 61 6d 70 3e 73 70 61 6e 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 75 73 65 72 69 64 2d 64 65 73 63 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 6f 73 74 2d 64 65 73 63 20 61 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 76 65 6e 2d 68 64 72 3e 70 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 Data Ascii: itle>span,#onetrust-pc-sdk .ot-userid-timestamp>span{font-weight:700}#onetrust-pc-sdk .ot-userid-desc{font-style:italic}#onetrust-pc-sdk .ot-host-desc a{pointer-events:initial}#onetrust-pc-sdk .ot-ven-hdr>p a{position:relative;z-index:2;pointer-events:ini
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 Data Ascii: nt,#onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e Data Ascii: ot-sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-n
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f Data Ascii: anner-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:befo
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 Data Ascii: .ot-sdk-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	49861	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	389	OUT	GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	809	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: ee1LIfkTbcemCp7i24lw6Q== Last-Modified: Tue, 07 Jun 2022 19:28:58 GMT x-ms-request-id: 9678d4df-e01e-006a-26c6-0be1ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 30654 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c23418eb1c9c3d-IAD
2024-02-27 17:38:47 UTC	560	IN	Data Raw: 37 63 37 36 0d 0a 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 50 63 43 65 6e 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 4d 74 63 32 52 72 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 52 51 59 30 4e 6c 62 6e 52 6c 63 69 42 76 64 43 31 6f 61 57 52 6c 49 47 39 30 4c 57 5a 68 5a 47 55 74 61 57 34 69 49 47 46 79 61 57 45 74 62 57 39 6b 59 57 77 39 49 6e 52 79 64 57 55 69 49 48 4a 76 62 47 55 39 49 6d 46 73 5a 58 4a 30 5a 47 6c 68 62 47 39 6e 49 69 42 68 63 6d 6c 68 4c 57 52 6c 63 32 4e 79 61 57 4a 6c 5a 47 4a 35 50 53 4a 76 64 43 31 77 59 79 31 6b 5a 58 4e 6a 49 6a 34 38 49 53 30 74 49 45 4e Data Ascii: 7c76 { "name": "otPcCenter", "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImFsZXJ0ZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvdC1wYy1kZXNjIj48IS0tIEN
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 64 47 39 75 49 43 30 74 50 6a 78 6b 61 58 59 67 61 57 51 39 49 6d 39 30 4c 58 42 6a 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 77 59 79 31 7a 59 33 4a 76 62 47 78 69 59 58 49 69 50 6a 78 6f 4d 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 64 47 6c 30 62 47 55 69 50 6c 6c 76 64 58 49 67 55 48 4a 70 64 6d 46 6a 65 54 77 76 61 44 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 5a 47 56 7a 59 79 49 2b 50 43 39 6b 61 58 59 2b 50 47 4a 31 64 48 52 76 62 69 42 70 5a 44 30 69 59 57 4e 6a 5a 58 42 30 4c 58 4a 6c 59 32 39 74 62 57 56 75 5a 47 56 6b 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 42 62 47 78 76 64 79 42 68 62 47 77 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 63 32 56 6a 64 47 6c 76 62 69 42 Data Ascii: dG9uIC0tPjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BbGxvdyBhbGw8L2J1dHRvbj48c2VjdGlvbiB
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 33 4a 6b 61 57 39 75 49 45 64 79 62 33 56 77 49 48 4e 6c 59 33 52 70 62 32 34 67 5a 57 35 6b 63 79 41 74 4c 54 34 38 4c 33 4e 6c 59 33 52 70 62 32 34 2b 50 43 39 6b 61 58 59 2b 50 48 4e 6c 59 33 52 70 62 32 34 67 61 57 51 39 49 6d 39 30 4c 58 42 6a 4c 57 78 7a 64 43 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 68 70 5a 47 55 67 62 33 51 74 61 47 39 7a 64 48 4d 74 64 57 6b 67 62 33 51 74 63 47 4d 74 63 32 4e 79 62 32 78 73 59 6d 46 79 49 6a 34 38 5a 47 6c 32 49 47 6c 6b 50 53 4a 76 64 43 31 77 59 79 31 6f 5a 48 49 69 50 6a 78 6b 61 58 59 67 61 57 51 39 49 6d 39 30 4c 57 78 7a 64 43 31 30 61 58 52 73 5a 53 49 2b 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 47 6c 75 61 79 31 69 64 47 34 67 59 6d 46 6a 61 79 31 69 64 47 34 74 Data Ascii: 3JkaW9uIEdyb3VwIHNlY3Rpb24gZW5kcyAtLT48L3NlY3Rpb24+PC9kaXY+PHNlY3Rpb24gaWQ9Im90LXBjLWxzdCIgY2xhc3M9Im90LWhpZGUgb3QtaG9zdHMtdWkgb3QtcGMtc2Nyb2xsYmFyIj48ZGl2IGlkPSJvdC1wYy1oZHIiPjxkaXYgaWQ9Im90LWxzdC10aXRsZSI+PGJ1dHRvbiBjbGFzcz0ib3QtbGluay1idG4gYmFjay1idG4t
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 59 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 48 4e 30 4c 58 4e 31 59 6d 68 6b 63 69 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 68 63 6d 4e 6f 4c 57 4e 75 64 48 49 69 50 6a 78 77 49 48 4a 76 62 47 55 39 49 6e 4e 30 59 58 52 31 63 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6a 63 6d 34 74 63 6d 52 79 49 6a 34 38 4c 33 41 2b 50 47 78 68 59 6d 56 73 49 47 5a 76 63 6a 30 69 64 6d 56 75 5a 47 39 79 4c 58 4e 6c 59 58 4a 6a 61 43 31 6f 59 57 35 6b 62 47 56 79 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 4e 79 62 69 31 79 5a 48 49 69 50 6a 77 76 62 47 46 69 5a 57 77 2b 49 44 78 70 62 6e 42 31 64 43 42 70 5a 44 30 69 64 6d 56 75 5a 47 39 79 4c 58 4e 6c 59 58 4a 6a 61 43 31 6f 59 57 35 6b 62 Data Ascii: Y+PGRpdiBjbGFzcz0ib3QtbHN0LXN1YmhkciI+PGRpdiBjbGFzcz0ib3Qtc2VhcmNoLWNudHIiPjxwIHJvbGU9InN0YXR1cyIgY2xhc3M9Im90LXNjcm4tcmRyIj48L3A+PGxhYmVsIGZvcj0idmVuZG9yLXNlYXJjaC1oYW5kbGVyIiBjbGFzcz0ib3Qtc2Nybi1yZHIiPjwvbGFiZWw+IDxpbnB1dCBpZD0idmVuZG9yLXNlYXJjaC1oYW5kb
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 7a 4f 6e 68 73 61 57 35 72 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 33 68 73 61 57 35 72 49 69 42 34 50 53 49 77 63 48 67 69 49 48 6b 39 49 6a 42 77 65 43 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 51 77 4d 69 34 31 4e 7a 63 67 4e 44 41 79 4c 6a 55 33 4e 79 49 67 65 47 31 73 4f 6e 4e 77 59 57 4e 6c 50 53 4a 77 63 6d 56 7a 5a 58 4a 32 5a 53 49 2b 50 48 52 70 64 47 78 6c 50 6b 5a 70 62 48 52 6c 63 69 42 4a 59 32 39 75 50 43 39 30 61 58 52 73 5a 54 34 38 5a 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a 6d 5a 6d 49 69 42 6b 50 53 4a 4e 4e 44 41 77 4c 6a 67 31 4f 43 77 78 4d 53 34 30 4d 6a 64 6a 4c 54 4d 75 4d 6a 51 78 4c 54 63 75 4e 44 49 78 4c 54 67 75 4f 44 55 74 4d 54 Data Ascii: zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIgdmlld0JveD0iMCAwIDQwMi41NzcgNDAyLjU3NyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+PHRpdGxlPkZpbHRlciBJY29uPC90aXRsZT48Zz48cGF0aCBmaWxsPSIjZmZmIiBkPSJNNDAwLjg1OCwxMS40MjdjLTMuMjQxLTcuNDIxLTguODUtMT
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 4c 58 42 6a 4c 58 4e 6a 63 6d 39 73 62 47 4a 68 63 69 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 32 56 73 4c 57 4a 73 61 79 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 73 4c 57 46 73 62 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 56 73 4c 57 46 73 62 43 31 6f 5a 48 49 69 50 6a 78 7a 63 47 46 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6a 62 32 35 7a 5a 57 35 30 4c 57 68 6b 63 69 49 2b 51 32 39 75 63 32 56 75 64 44 77 76 63 33 42 68 62 6a 34 67 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 70 4c 57 68 6b 63 69 49 2b 54 47 56 6e 4c 6b 6c 75 64 47 56 79 5a 58 4e 30 50 43 39 7a 63 47 46 75 50 6a 77 76 5a 47 6c 32 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d Data Ascii: LXBjLXNjcm9sbGJhciI+PGRpdiBpZD0ib3Qtc2VsLWJsayI+PGRpdiBjbGFzcz0ib3Qtc2VsLWFsbCI+PGRpdiBjbGFzcz0ib3Qtc2VsLWFsbC1oZHIiPjxzcGFuIGNsYXNzPSJvdC1jb25zZW50LWhkciI+Q29uc2VudDwvc3Bhbj4gPHNwYW4gY2xhc3M9Im90LWxpLWhkciI+TGVnLkludGVyZXN0PC9zcGFuPjwvZGl2PjxkaXYgY2xhc3M
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 57 35 72 49 43 30 74 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 5a 6c 62 69 31 6f 5a 48 49 69 50 6a 78 6f 4d 79 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 64 6d 56 75 4c 57 35 68 62 57 55 69 50 6a 77 76 61 44 4d 2b 50 47 45 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 5a 6c 62 69 31 73 61 57 35 72 49 69 42 6f 63 6d 56 6d 50 53 49 6a 49 6a 35 57 61 57 56 33 49 46 42 79 61 58 5a 68 59 33 6b 67 54 6d 39 30 61 57 4e 6c 50 43 39 68 50 6a 77 76 5a 47 6c 32 50 6a 77 68 4c 53 30 67 64 47 39 6e 5a 32 78 6c 63 79 42 68 62 6d 51 67 59 58 4a 79 62 33 63 67 4c 53 30 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 64 47 64 73 4c 57 4e 75 64 48 49 69 50 6a 77 76 5a 47 6c 32 50 6a 77 76 63 32 56 6a 64 47 6c 76 62 6a 34 38 5a 47 6c 32 Data Ascii: W5rIC0tPjxkaXYgY2xhc3M9Im90LXZlbi1oZHIiPjxoMyBjbGFzcz0ib3QtdmVuLW5hbWUiPjwvaDM+PGEgY2xhc3M9Im90LXZlbi1saW5rIiBocmVmPSIjIj5WaWV3IFByaXZhY3kgTm90aWNlPC9hPjwvZGl2PjwhLS0gdG9nZ2xlcyBhbmQgYXJyb3cgLS0+PGRpdiBjbGFzcz0ib3QtdGdsLWNudHIiPjwvZGl2Pjwvc2VjdGlvbj48ZGl2
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 52 79 49 6a 34 38 59 6e 56 30 64 47 39 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 73 61 57 35 72 4c 57 4a 30 62 69 42 6a 59 58 52 6c 5a 32 39 79 65 53 31 32 5a 57 35 6b 62 33 4a 7a 4c 57 78 70 63 33 51 74 61 47 46 75 5a 47 78 6c 63 69 49 2b 56 6d 6c 6c 64 79 42 57 5a 57 35 6b 62 33 49 67 54 47 6c 7a 64 44 77 76 59 6e 56 30 64 47 39 75 50 6a 77 76 5a 47 6c 32 50 6a 77 68 4c 53 30 67 51 32 39 76 61 32 6c 6c 49 47 78 76 63 33 51 67 62 47 6c 75 61 79 41 74 4c 54 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6f 62 48 4e 30 4c 57 4e 75 64 48 49 69 50 6a 78 69 64 58 52 30 62 32 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 70 62 6d 73 74 59 6e 52 75 49 47 4e 68 64 47 56 6e 62 33 4a 35 4c 57 68 76 63 33 51 74 62 47 6c 7a 64 43 31 6f 59 Data Ascii: RyIj48YnV0dG9uIGNsYXNzPSJvdC1saW5rLWJ0biBjYXRlZ29yeS12ZW5kb3JzLWxpc3QtaGFuZGxlciI+VmlldyBWZW5kb3IgTGlzdDwvYnV0dG9uPjwvZGl2PjwhLS0gQ29va2llIGxvc3QgbGluayAtLT48ZGl2IGNsYXNzPSJvdC1obHN0LWNudHIiPjxidXR0b24gY2xhc3M9Im90LWxpbmstYnRuIGNhdGVnb3J5LWhvc3QtbGlzdC1oY
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6c 64 43 31 79 61 57 64 6f 64 43 49 67 63 6d 39 73 5a 54 30 69 61 57 31 6e 49 69 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 5a 70 5a 58 64 43 62 33 67 39 49 6a 41 67 4d 43 41 78 4f 54 49 67 4e 54 45 79 49 6a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 4a 6a 64 58 4a 79 5a 57 35 30 51 32 39 73 62 33 49 69 49 47 51 39 49 6b 30 78 4e 6a 59 75 4f 53 41 79 4e 6a 51 75 4e 57 77 74 4d 54 45 33 4c 6a 67 67 4d 54 45 32 59 79 30 30 4c 6a 63 67 4e 43 34 33 4c 54 45 79 4c 6a 4d 67 4e 43 34 33 4c 54 45 33 49 44 42 73 4c 54 63 75 4d 53 30 33 4c 6a 46 6a 4c 54 51 75 4e 79 30 30 4c 6a 63 74 4e 43 34 33 4c 54 45 79 4c 6a 4d 67 4d 43 30 78 4e 30 77 78 4d 6a 63 75 4d 79 Data Ascii: ldC1yaWdodCIgcm9sZT0iaW1nIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxOTIgNTEyIj48cGF0aCBmaWxsPSJjdXJyZW50Q29sb3IiIGQ9Ik0xNjYuOSAyNjQuNWwtMTE3LjggMTE2Yy00LjcgNC43LTEyLjMgNC43LTE3IDBsLTcuMS03LjFjLTQuNy00LjctNC43LTEyLjMgMC0xN0wxMjcuMy
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 62 57 46 30 61 57 39 75 49 48 4e 30 62 33 4a 68 5a 32 55 67 59 57 35 6b 49 47 46 6a 59 32 56 7a 63 79 42 30 5a 58 4e 30 50 43 39 6f 4e 44 34 38 4c 32 52 70 64 6a 34 38 49 53 30 74 49 47 46 6a 59 32 39 79 5a 47 6c 76 62 69 42 6b 5a 58 52 68 61 57 77 67 4c 53 30 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 59 57 4e 6a 4c 57 64 79 63 47 4e 75 64 48 49 67 62 33 51 74 59 57 4e 6a 4c 58 52 34 64 43 42 76 64 43 31 32 62 6d 51 74 61 57 35 6d 62 79 31 6a 62 6e 52 79 49 6a 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 32 62 6d 51 74 61 57 35 6d 62 79 49 2b 50 47 67 31 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 32 62 6d 51 74 62 47 4a 73 49 6a 35 54 5a 58 4a 32 61 57 4e 6c 49 45 35 68 62 57 55 38 4c 32 67 31 50 6a 78 6f 4e 69 42 Data Ascii: bWF0aW9uIHN0b3JhZ2UgYW5kIGFjY2VzcyB0ZXN0PC9oND48L2Rpdj48IS0tIGFjY29yZGlvbiBkZXRhaWwgLS0+PGRpdiBjbGFzcz0ib3QtYWNjLWdycGNudHIgb3QtYWNjLXR4dCBvdC12bmQtaW5mby1jbnRyIj48ZGl2IGNsYXNzPSJvdC12bmQtaW5mbyI+PGg1IGNsYXNzPSJvdC12bmQtbGJsIj5TZXJ2aWNlIE5hbWU8L2g1PjxoNiB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	49862	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	391	OUT	GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: eB5KwLWtcYPmjc/KKwC/xQ== Last-Modified: Tue, 07 Jun 2022 19:28:57 GMT x-ms-request-id: ee8e26c2-901e-0012-5a78-0c4253000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9935 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c2341909f48f23-IAD
2024-02-27 17:38:47 UTC	561	IN	Data Raw: 32 35 32 33 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 51 32 56 75 64 47 56 79 55 6d 39 31 62 6d 52 6c 5a 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 52 72 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 75 5a 58 Data Ascii: 2523 { "name": "otCenterRounded", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZX
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 61 58 52 73 5a 53 49 2b 56 47 6c 30 62 47 55 38 4c 32 67 79 50 6a 78 77 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 56 34 64 44 78 68 49 47 68 79 5a 57 59 39 49 69 4d 69 50 6e 42 76 62 47 6c 6a 65 54 77 76 59 54 34 38 4c 33 41 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 50 6a 78 77 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 5a 47 56 7a 59 79 49 2b 50 43 39 77 50 6a 77 Data Ascii: aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjw
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6a 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 7b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 35 3b 74 6f 70 3a 31 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 36 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 2e 35 70 Data Ascii: j48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otCenterRounded{z-index:2147483645;top:10%;position:fixed;right:0;background-color:#fff;width:60%;max-width:650px;border-radius:2.5p
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 33 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e Data Ascii: dding:0;border:0;height:auto;width:auto}#onetrust-banner-sdk .ot-b-addl-desc{display:block}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 30px;text-align:center}#onetrust-banner-sdk #onetrust-button-group-parent:not(.has-reject-all-button
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2e 63 6f 6f 6b 69 65 2d 73 65 74 74 69 6e 67 2d 6c 69 6e 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 2e 62 61 6e 6e 65 72 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 36 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 34 34 70 78 3b 68 65 69 67 68 74 3a 34 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 38 70 78 Data Ascii: t-pc-btn-handler.cookie-setting-link{text-align:left;margin-right:0}#onetrust-banner-sdk .has-reject-all-button .banner-actions-container{max-width:60%;width:auto}#onetrust-banner-sdk .ot-close-icon{width:44px;height:44px;background-size:12px;margin:-18px
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 36 70 Data Ascii: ebkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#onetrust-banner-sdk .ot-arrow-container{display:inline-block;border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:6p
2024-02-27 17:38:47 UTC	1369	IN	Data Raw: 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 31 35 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 72 69 67 68 74 3a 31 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 77 72 61 70 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 66 6f 6e 74 Data Ascii: ose-btn-link #onetrust-close-btn-container{top:15px;transform:none;right:15px}#onetrust-banner-sdk.ot-close-btn-link #onetrust-close-btn-container button{padding:0;white-space:pre-wrap;border:none;height:auto;line-height:1.5;text-decoration:underline;font
2024-02-27 17:38:47 UTC	740	IN	Data Raw: 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 73 7b 70 61 64 64 69 6e 67 3a 30 20 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 Data Ascii: 2px;width:calc(100% - 44px)}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 22px}#onetrust-banner-sdk #banner-options{padding:0 22px;width:calc(100% - 44px)}#onetrust-banner-sdk .banner-option{margin-bottom:6px}#onetrust-banner-sdk .has-re
2024-02-27 17:38:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	49867	34.96.102.137	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	653	OUT	GET /j.php?a=176159&u=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&r=0.19947545942317246 HTTP/1.1 Host: dev.visualwebsiteoptimizer.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/javascript; charset=UTF-8 Vary: Accept-Encoding Cache-Control: public Cache-Control: max-age=0 Cache-Control: no-cache Cache-Control: must-revalidate server: gnv1 Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-02-27 17:38:47 UTC	855	IN	Data Raw: 64 39 34 0d 0a 74 72 79 7b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 43 3d 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 63 6f 64 65 3b 69 66 28 61 43 29 7b 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6a 5f 65 3d 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6a 5f 65 7c 7c 30 3b 69 66 28 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6a 5f 65 3d 3d 31 29 7b 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6d 74 3d 22 64 75 70 43 6f 64 65 22 3b 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 73 65 74 74 69 6e 67 73 5f 74 69 6d 65 72 29 3b 69 66 28 77 69 6e 64 6f 77 2e 56 57 4f 26 26 77 69 6e 64 6f 77 2e 56 57 4f 2e 5f 26 26 77 69 6e 64 6f 77 2e 56 57 4f 2e 5f 2e 62 49 45 29 7b 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 63 6f 64 65 2e 66 69 6e 69 73 68 28 29 7d 72 65 74 75 72 6e Data Ascii: d94try{(function(){var aC=window._vwo_code;if(aC){window._vwo_j_e=window._vwo_j_e\|\|0;if(window._vwo_j_e==1){window._vwo_mt="dupCode";clearTimeout(window._vwo_settings_timer);if(window.VWO&&window.VWO._&&window.VWO._.bIE){window._vwo_code.finish()}return
2024-02-27 17:38:47 UTC	1252	IN	Data Raw: 31 7c 7c 77 69 6e 64 6f 77 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 5f 76 69 73 5f 65 64 69 74 6f 72 22 29 3e 2d 31 7c 7c 63 63 4d 6f 64 65 7c 7c 77 69 6e 64 6f 77 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 5f 76 69 73 5f 70 72 65 76 69 65 77 22 29 3e 2d 31 29 7b 74 72 79 7b 20 69 66 20 28 77 69 6e 64 6f 77 2e 6e 61 6d 65 20 26 26 20 4a 53 4f 4e 2e 70 61 72 73 65 28 77 69 6e 64 6f 77 2e 6e 61 6d 65 29 29 20 7b 20 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6d 74 20 3d 20 77 69 6e 64 6f 77 2e 6e 61 6d 65 7d 20 65 6c 73 65 20 69 66 28 63 63 4d 6f 64 65 29 20 7b 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6d 74 20 3d 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 4c 2e 73 65 61 72 63 68 2e 6d 61 74 63 68 28 22 5f 76 77 6f 5f 6d 3d 28 5b 5e 26 5d 2a 29 Data Ascii: 1\|\|window.name.indexOf("_vis_editor")>-1\|\|ccMode\|\|window.name.indexOf("_vis_preview")>-1){try{ if (window.name && JSON.parse(window.name)) { window._vwo_mt = window.name} else if(ccMode) {window._vwo_mt = decodeURIComponent(wL.search.match("_vwo_m=([^&]*)
2024-02-27 17:38:47 UTC	1252	IN	Data Raw: 6d 61 67 65 3b 62 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 2e 76 69 73 75 61 6c 77 65 62 73 69 74 65 6f 70 74 69 6d 69 7a 65 72 2e 63 6f 6d 2f 65 2e 67 69 66 3f 73 3d 6d 6f 64 65 5f 64 65 74 26 65 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 26 26 65 2e 73 74 61 63 6b 26 26 65 2e 73 74 61 63 6b 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 31 65 33 29 29 3b 61 43 26 26 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 63 6f 64 65 2e 66 69 6e 69 73 68 28 29 7d 7d 29 28 29 3b 69 66 28 77 69 6e 64 6f 77 2e 5f 76 77 6f 5f 6d 74 3d 3d 3d 27 6c 69 76 65 27 29 7b 5f 76 77 6f 5f 63 6f 64 65 2e 73 54 3d 5f 76 77 6f 5f 63 6f 64 65 2e 66 69 6e 69 73 68 65 64 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 63 2c 61 2c 65 2c 64 2c 62 2c 7a 2c 67 29 7b 66 75 6e 63 Data Ascii: mage;b.src="https://dev.visualwebsiteoptimizer.com/e.gif?s=mode_det&e="+encodeURIComponent(e&&e.stack&&e.stack.substring(0,1e3));aC&&window._vwo_code.finish()}})();if(window._vwo_mt==='live'){_vwo_code.sT=_vwo_code.finished();(function(c,a,e,d,b,z,g){func
2024-02-27 17:38:47 UTC	129	IN	Data Raw: 70 68 70 26 65 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 20 26 26 20 65 2e 6d 65 73 73 61 67 65 20 26 26 20 65 2e 6d 65 73 73 61 67 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 31 30 30 30 29 29 2b 22 26 75 72 6c 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: php&e="+encodeURIComponent(e && e.message && e.message.substring(0,1000))+"&url"+encodeURIComponent(window.location.href)}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	49859	64.202.112.191	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	574	OUT	GET /cachedClickId?marketerId=001ac0827d67b7b38319c9517e7fa2f4cc HTTP/1.1 Host: tr.outbrain.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:47 UTC	251	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:47 GMT Content-Type: application/javascript Content-Length: 35 Connection: close X-TraceId: 5c6935d144053d13380477218609db45 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-02-27 17:38:47 UTC	35	IN	Data Raw: 6f 62 41 70 69 2e 73 65 74 43 61 63 68 65 64 43 6c 69 63 6b 49 64 28 22 4e 6f 43 6c 69 63 6b 49 64 22 29 Data Ascii: obApi.setCachedClickId("NoClickId")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	49869	104.244.42.131	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	982	OUT	GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	572	IN	HTTP/1.1 200 OK date: Tue, 27 Feb 2024 17:38:47 GMT perf: 7469935968 server: tsa_b set-cookie: personalization_id="v1_4rWWlcFOBsWfnSQ45pGHjA=="; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:38:48 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 6ae3b09b70c24199 strict-transport-security: max-age=631138519 x-response-time: 79 x-connection-hash: 5aa6d0124dc1b062f3f19f62a321dd121a0fd6307a9745d8bc37ed330418b262 connection: close
2024-02-27 17:38:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	49871	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:47 UTC	611	OUT	GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	830	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Type: image/svg+xml Content-Length: 2998 Connection: close Content-MD5: LpuayL42jB78xRllx0vkOw== Last-Modified: Mon, 26 Feb 2024 03:25:12 GMT ETag: 0x8DC367A8B008DB6 x-ms-request-id: d37a1dce-401e-0087-7181-68aae6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 42896 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c2341a1e87061b-IAD
2024-02-27 17:38:48 UTC	539	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 33 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 64 3d 22 4d 37 39 2e 30 33 39 20 37 2e 33 34 36 63 30 20 31 2e 37 38 34 2d 2e 34 34 39 20 33 2e 31 38 36 2d 31 2e 33 34 36 20 34 2e 32 30 36 2d 2e 38 39 37 20 31 2e 30 32 31 2d 32 2e 31 35 32 20 31 2e 35 33 32 2d 33 2e 37 36 37 20 31 2e 35 33 32 2d 31 2e 36 34 31 20 30 2d 32 2e 39 30 35 2d 2e 35 30 35 2d 33 2e 37 39 31 2d 31 2e 35 31 33 2d 2e 38 38 37 2d 31 2e 30 30 38 2d 31 2e 33 33 35 2d 32 2e 34 32 32 2d 31 2e 33 34 36 2d 34 2e 32 34 20 30 2d 31 2e 38 31 35 2e 34 34 39 2d 33 2e 32 32 31 20 31 2e 33 34 Data Ascii: <svg width="136" height="16" xmlns="http://www.w3.org/2000/svg"><g fill="none"><path d="M79.039 7.346c0 1.784-.449 3.186-1.346 4.206-.897 1.021-2.152 1.532-3.767 1.532-1.641 0-2.905-.505-3.791-1.513-.887-1.008-1.335-2.422-1.346-4.24 0-1.815.449-3.221 1.34
2024-02-27 17:38:48 UTC	1369	IN	Data Raw: 31 2e 32 33 35 20 30 2d 32 2e 31 37 33 2e 33 39 2d 32 2e 38 31 35 20 31 2e 31 37 2d 2e 36 34 32 2e 37 38 2d 2e 39 36 34 20 31 2e 39 31 35 2d 2e 39 36 34 20 33 2e 34 30 34 68 2d 2e 30 30 32 7a 6d 31 36 2e 38 39 31 20 35 2e 35 38 37 56 37 2e 35 33 35 63 30 2d 2e 36 38 2d 2e 31 35 35 2d 31 2e 31 38 38 2d 2e 34 36 36 2d 31 2e 35 32 33 2d 2e 33 31 2d 2e 33 33 36 2d 2e 37 39 35 2d 2e 35 30 34 2d 31 2e 34 35 35 2d 2e 35 30 34 2d 2e 38 37 34 20 30 2d 31 2e 35 31 34 2e 32 33 36 2d 31 2e 39 32 32 2e 37 30 38 2d 2e 34 30 37 2e 34 37 32 2d 2e 36 31 20 31 2e 32 35 31 2d 2e 36 31 20 32 2e 33 33 39 76 34 2e 33 37 38 68 2d 31 2e 32 36 35 56 34 2e 35 37 35 68 31 2e 30 32 38 6c 2e 32 30 34 20 31 2e 31 34 33 68 2e 30 36 32 61 32 2e 35 38 33 20 32 2e 35 38 33 20 30 20 30 31 Data Ascii: 1.235 0-2.173.39-2.815 1.17-.642.78-.964 1.915-.964 3.404h-.002zm16.891 5.587V7.535c0-.68-.155-1.188-.466-1.523-.31-.336-.795-.504-1.455-.504-.874 0-1.514.236-1.922.708-.407.472-.61 1.251-.61 2.339v4.378h-1.265V4.575h1.028l.204 1.143h.062a2.583 2.583 0 01
2024-02-27 17:38:48 UTC	1090	IN	Data Raw: 35 39 2d 31 2e 32 35 35 2d 2e 37 35 39 2d 32 2e 33 31 37 56 34 2e 35 37 35 68 31 2e 32 37 38 7a 6d 31 33 2e 37 38 31 20 36 2e 30 37 39 61 32 2e 30 39 20 32 2e 30 39 20 30 20 30 31 2d 2e 38 37 20 31 2e 37 39 37 63 2d 2e 35 37 39 2e 34 32 32 2d 31 2e 33 39 32 2e 36 33 33 2d 32 2e 34 33 37 2e 36 33 33 2d 31 2e 31 30 37 20 30 2d 31 2e 39 37 31 2d 2e 31 38 2d 32 2e 35 39 32 2d 2e 35 33 39 76 2d 31 2e 31 36 63 2e 34 31 32 2e 32 30 37 2e 38 34 35 2e 33 36 38 20 31 2e 32 39 32 2e 34 38 2e 34 33 34 2e 31 31 33 2e 38 38 2e 31 37 32 20 31 2e 33 33 2e 31 37 34 2e 35 32 36 2e 30 33 20 31 2e 30 35 31 2d 2e 30 38 20 31 2e 35 32 32 2d 2e 33 31 37 61 31 2e 30 37 36 20 31 2e 30 37 36 20 30 20 30 30 2e 31 31 2d 31 2e 37 39 38 20 36 2e 36 36 33 20 36 2e 36 36 33 20 30 20 30 Data Ascii: 59-1.255-.759-2.317V4.575h1.278zm13.781 6.079a2.09 2.09 0 01-.87 1.797c-.579.422-1.392.633-2.437.633-1.107 0-1.971-.18-2.592-.539v-1.16c.412.207.845.368 1.292.48.434.113.88.172 1.33.174.526.03 1.051-.08 1.522-.317a1.076 1.076 0 00.11-1.798 6.663 6.663 0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	49872	34.96.102.137	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	702	OUT	GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=D7AC5573972C60564976E18E332F56DDF&h=e9c9db551c738e08dbc441ee457e4a33&t=true HTTP/1.1 Host: dev.visualwebsiteoptimizer.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	312	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Type: image/gif Cache-Control: public, max-age=43200 X-Content-Type-Options: nosniff Content-Length: 35 Access-Control-Allow-Origin: * server: gnv2c Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	49868	52.30.38.148	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	539	OUT	GET /adalyser.js?cid=ccleaner HTTP/1.1 Host: c5.adalyser.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	415	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Type: application/javascript Content-Length: 33616 Connection: close X-Powered-By: Express Access-Control-Allow-Headers: origin, content-type, accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP="ADMa OUR IND DSP NON COR" ETag: "163a8a8481e067a40d4ffc0815f92684b45bd3ab" Cache-Control: public, max-age=21600
2024-02-27 17:38:48 UTC	15969	IN	Data Raw: 76 61 72 20 61 64 61 6c 79 73 65 72 4d 6f 64 75 6c 65 73 3d 74 72 61 63 6b 65 72 43 6f 72 65 3b 61 64 61 6c 79 73 65 72 4d 6f 64 75 6c 65 73 2e 41 64 61 6c 79 73 65 72 54 72 61 63 6b 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 3b 6d 75 74 53 74 61 74 65 3d 7b 6f 75 74 51 75 65 75 65 73 3a 5b 5d 2c 62 75 66 66 65 72 46 6c 75 73 68 65 72 73 3a 5b 5d 2c 65 78 70 69 72 65 44 61 74 65 54 69 6d 65 3a 6e 75 6c 6c 2c 68 61 73 4c 6f 61 64 65 64 3a 66 61 6c 73 65 2c 72 65 67 69 73 74 65 72 65 64 4f 6e 4c 6f 61 64 48 61 6e 64 6c 65 72 73 3a 5b 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 65 3b 61 64 61 6c 79 73 65 72 4d 6f 64 75 6c 65 73 2e 68 65 6c 70 65 72 73 2e 66 6f 72 45 61 63 68 28 6d 75 74 53 74 61 74 Data Ascii: var adalyserModules=trackerCore;adalyserModules.AdalyserTracker=function(e,r){var t=window;mutState={outQueues:[],bufferFlushers:[],expireDateTime:null,hasLoaded:false,registeredOnLoadHandlers:[]};function n(){var e;adalyserModules.helpers.forEach(mutStat
2024-02-27 17:38:48 UTC	16379	IN	Data Raw: 2c 73 3d 69 2e 73 70 6c 69 74 28 22 2f 22 29 5b 30 5d 2c 75 3d 69 2e 73 70 6c 69 74 28 22 2f 22 29 5b 32 5d 2c 6c 3b 69 66 28 6f 2e 6c 65 6e 67 74 68 3d 3d 32 29 7b 6c 3d 50 28 6f 5b 31 5d 29 7d 76 61 72 20 63 3d 7b 7d 3b 76 61 72 20 66 2c 64 3b 76 61 72 20 70 3d 7b 73 65 74 46 72 6f 6d 50 72 65 76 69 6f 75 73 3a 66 61 6c 73 65 7d 3b 69 66 28 61 5b 22 67 63 6c 69 64 22 5d 7c 7c 61 5b 22 67 63 6c 73 72 63 22 5d 29 7b 63 2e 73 6f 3d 22 67 6f 6f 67 6c 65 22 3b 63 2e 6d 65 3d 22 63 70 63 22 3b 63 2e 67 63 6c 69 64 3d 61 5b 22 67 63 6c 69 64 22 5d 7d 65 6c 73 65 20 69 66 28 61 5b 22 75 74 6d 5f 73 6f 75 72 63 65 22 5d 29 7b 69 66 28 74 29 7b 76 61 72 20 79 3d 66 61 6c 73 65 3b 76 61 72 20 67 3d 61 5b 22 75 74 6d 5f 73 6f 75 72 63 65 22 5d 3b 66 6f 72 28 76 61 Data Ascii: ,s=i.split("/")[0],u=i.split("/")[2],l;if(o.length==2){l=P(o[1])}var c={};var f,d;var p={setFromPrevious:false};if(a["gclid"]\|\|a["gclsrc"]){c.so="google";c.me="cpc";c.gclid=a["gclid"]}else if(a["utm_source"]){if(t){var y=false;var g=a["utm_source"];for(va
2024-02-27 17:38:48 UTC	1268	IN	Data Raw: 6f 69 64 20 30 3d 3d 3d 65 2e 63 6c 6f 63 6b 73 65 71 26 26 28 6f 3d 6f 2b 31 26 31 36 33 38 33 29 2c 28 75 3c 30 7c 7c 69 3e 5f 6c 61 73 74 4d 53 65 63 73 29 26 26 76 6f 69 64 20 30 3d 3d 3d 65 2e 6e 73 65 63 73 26 26 28 73 3d 30 29 2c 73 3e 3d 31 65 34 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 75 75 69 64 2e 76 31 28 29 3a 20 43 61 6e 27 74 20 63 72 65 61 74 65 20 6d 6f 72 65 20 74 68 61 6e 20 31 30 4d 20 75 75 69 64 73 2f 73 65 63 22 29 3b 5f 6c 61 73 74 4d 53 65 63 73 3d 69 2c 5f 6c 61 73 74 4e 53 65 63 73 3d 73 2c 5f 63 6c 6f 63 6b 73 65 71 3d 6f 2c 69 2b 3d 31 32 32 31 39 32 39 32 38 65 35 3b 76 61 72 20 6c 3d 28 31 65 34 2a 28 32 36 38 34 33 35 34 35 35 26 69 29 2b 73 29 25 34 32 39 34 39 36 37 32 39 36 3b 61 5b 6e 2b 2b 5d 3d 6c 3e 3e Data Ascii: oid 0===e.clockseq&&(o=o+1&16383),(u<0\|\|i>_lastMSecs)&&void 0===e.nsecs&&(s=0),s>=1e4)throw new Error("uuid.v1(): Can't create more than 10M uuids/sec");_lastMSecs=i,_lastNSecs=s,_clockseq=o,i+=122192928e5;var l=(1e4*(268435455&i)+s)%4294967296;a[n++]=l>>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	49875	172.253.122.156	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	868	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&gjid=1101255825&_gid=1089165544.1709055527&_u=YCDAgEABAAAAAGAEK~&z=1769775916 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.ccleaner.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	594	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.ccleaner.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 27 Feb 2024 17:38:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.17	49879	157.240.229.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	904	OUT	GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 27 Feb 2024 17:38:48 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.17	49878	157.240.229.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	1014	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-27 17:38:48 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-27 17:38:48 UTC	1270	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-27 17:38:48 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.17	49877	104.18.131.236	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	375	OUT	GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	830	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Type: image/svg+xml Content-Length: 2998 Connection: close Content-MD5: LpuayL42jB78xRllx0vkOw== Last-Modified: Mon, 26 Feb 2024 03:25:12 GMT ETag: 0x8DC367A8B008DB6 x-ms-request-id: d37a1dce-401e-0087-7181-68aae6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 42896 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 85c2341dcf570611-IAD
2024-02-27 17:38:48 UTC	539	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 33 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 64 3d 22 4d 37 39 2e 30 33 39 20 37 2e 33 34 36 63 30 20 31 2e 37 38 34 2d 2e 34 34 39 20 33 2e 31 38 36 2d 31 2e 33 34 36 20 34 2e 32 30 36 2d 2e 38 39 37 20 31 2e 30 32 31 2d 32 2e 31 35 32 20 31 2e 35 33 32 2d 33 2e 37 36 37 20 31 2e 35 33 32 2d 31 2e 36 34 31 20 30 2d 32 2e 39 30 35 2d 2e 35 30 35 2d 33 2e 37 39 31 2d 31 2e 35 31 33 2d 2e 38 38 37 2d 31 2e 30 30 38 2d 31 2e 33 33 35 2d 32 2e 34 32 32 2d 31 2e 33 34 36 2d 34 2e 32 34 20 30 2d 31 2e 38 31 35 2e 34 34 39 2d 33 2e 32 32 31 20 31 2e 33 34 Data Ascii: <svg width="136" height="16" xmlns="http://www.w3.org/2000/svg"><g fill="none"><path d="M79.039 7.346c0 1.784-.449 3.186-1.346 4.206-.897 1.021-2.152 1.532-3.767 1.532-1.641 0-2.905-.505-3.791-1.513-.887-1.008-1.335-2.422-1.346-4.24 0-1.815.449-3.221 1.34
2024-02-27 17:38:48 UTC	1369	IN	Data Raw: 31 2e 32 33 35 20 30 2d 32 2e 31 37 33 2e 33 39 2d 32 2e 38 31 35 20 31 2e 31 37 2d 2e 36 34 32 2e 37 38 2d 2e 39 36 34 20 31 2e 39 31 35 2d 2e 39 36 34 20 33 2e 34 30 34 68 2d 2e 30 30 32 7a 6d 31 36 2e 38 39 31 20 35 2e 35 38 37 56 37 2e 35 33 35 63 30 2d 2e 36 38 2d 2e 31 35 35 2d 31 2e 31 38 38 2d 2e 34 36 36 2d 31 2e 35 32 33 2d 2e 33 31 2d 2e 33 33 36 2d 2e 37 39 35 2d 2e 35 30 34 2d 31 2e 34 35 35 2d 2e 35 30 34 2d 2e 38 37 34 20 30 2d 31 2e 35 31 34 2e 32 33 36 2d 31 2e 39 32 32 2e 37 30 38 2d 2e 34 30 37 2e 34 37 32 2d 2e 36 31 20 31 2e 32 35 31 2d 2e 36 31 20 32 2e 33 33 39 76 34 2e 33 37 38 68 2d 31 2e 32 36 35 56 34 2e 35 37 35 68 31 2e 30 32 38 6c 2e 32 30 34 20 31 2e 31 34 33 68 2e 30 36 32 61 32 2e 35 38 33 20 32 2e 35 38 33 20 30 20 30 31 Data Ascii: 1.235 0-2.173.39-2.815 1.17-.642.78-.964 1.915-.964 3.404h-.002zm16.891 5.587V7.535c0-.68-.155-1.188-.466-1.523-.31-.336-.795-.504-1.455-.504-.874 0-1.514.236-1.922.708-.407.472-.61 1.251-.61 2.339v4.378h-1.265V4.575h1.028l.204 1.143h.062a2.583 2.583 0 01
2024-02-27 17:38:48 UTC	1090	IN	Data Raw: 35 39 2d 31 2e 32 35 35 2d 2e 37 35 39 2d 32 2e 33 31 37 56 34 2e 35 37 35 68 31 2e 32 37 38 7a 6d 31 33 2e 37 38 31 20 36 2e 30 37 39 61 32 2e 30 39 20 32 2e 30 39 20 30 20 30 31 2d 2e 38 37 20 31 2e 37 39 37 63 2d 2e 35 37 39 2e 34 32 32 2d 31 2e 33 39 32 2e 36 33 33 2d 32 2e 34 33 37 2e 36 33 33 2d 31 2e 31 30 37 20 30 2d 31 2e 39 37 31 2d 2e 31 38 2d 32 2e 35 39 32 2d 2e 35 33 39 76 2d 31 2e 31 36 63 2e 34 31 32 2e 32 30 37 2e 38 34 35 2e 33 36 38 20 31 2e 32 39 32 2e 34 38 2e 34 33 34 2e 31 31 33 2e 38 38 2e 31 37 32 20 31 2e 33 33 2e 31 37 34 2e 35 32 36 2e 30 33 20 31 2e 30 35 31 2d 2e 30 38 20 31 2e 35 32 32 2d 2e 33 31 37 61 31 2e 30 37 36 20 31 2e 30 37 36 20 30 20 30 30 2e 31 31 2d 31 2e 37 39 38 20 36 2e 36 36 33 20 36 2e 36 36 33 20 30 20 30 Data Ascii: 59-1.255-.759-2.317V4.575h1.278zm13.781 6.079a2.09 2.09 0 01-.87 1.797c-.579.422-1.392.633-2.437.633-1.107 0-1.971-.18-2.592-.539v-1.16c.412.207.845.368 1.292.48.434.113.88.172 1.33.174.526.03 1.051-.08 1.522-.317a1.076 1.076 0 00.11-1.798 6.663 6.663 0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	49880	104.244.42.67	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	804	OUT	GET /i/adsct?bci=3&eci=2&event_id=e414ac60-70e1-4fb1-97dc-7d82f3ebc720&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bc152a2f-e449-44ba-8f4d-88e6afc290fa&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.29 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_4rWWlcFOBsWfnSQ45pGHjA=="
2024-02-27 17:38:48 UTC	401	IN	HTTP/1.1 200 OK date: Tue, 27 Feb 2024 17:38:48 GMT perf: 7469935968 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 4f9d55422541739f strict-transport-security: max-age=631138519 x-response-time: 89 x-connection-hash: 2b1d3e402ac179d37338504b0616927d6527395ebaedf6a582fbbf79060c6f05 connection: close
2024-02-27 17:38:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.17	49882	34.96.102.137	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	466	OUT	GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=D7AC5573972C60564976E18E332F56DDF&h=e9c9db551c738e08dbc441ee457e4a33&t=true HTTP/1.1 Host: dev.visualwebsiteoptimizer.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	312	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Type: image/gif Cache-Control: public, max-age=43200 X-Content-Type-Options: nosniff Content-Length: 35 Access-Control-Allow-Origin: * server: gnv2c Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.17	49884	142.251.163.103	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	1005	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&_u=YCDAgEABAAAAAGAEK~&z=1906304434 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-02-27 17:38:48 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 27 Feb 2024 17:38:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.17	49887	35.244.154.8	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	539	OUT	GET /1000.gif?memo=CP2yKxIwCiwIARCl_gkaJDgyYWIwYjI1LWE4ZWYtNGZlZi04NDM1LTFkZTIzMGQ1ODRkOBAAGg0Iprz4rgYSBQjoBxAAQgBKAA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=IM4UTIqonsTt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; pxrc=CKe8+K4GEgUI6AcQAA==
2024-02-27 17:38:48 UTC	612	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Type: image/gif P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=OenI3tkpA/Pt7DqsEifeGMGNaK4urRyls6BE7NOeRTk=; Path=/; Domain=rlcdn.com; Expires=Wed, 26 Feb 2025 17:38:48 GMT; Secure; SameSite=None Set-Cookie: pxrc=CKe8+K4GEgUI6AcQAQ==; Path=/; Domain=rlcdn.com; Expires=Sat, 27 Apr 2024 17:38:48 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 27 Feb 2024 17:38:48 GMT Content-Length: 42 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.17	49888	172.253.122.156	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	616	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&gjid=1101255825&_gid=1089165544.1709055527&_u=YCDAgEABAAAAAGAEK~&z=1769775916 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:48 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 27 Feb 2024 17:38:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:48 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.17	49883	52.30.38.148	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	1314	OUT	GET /tracking/track/v3/p?stm=1709055527601&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cid=ccleaner&p=%7B%22et%22%3A1709055527598%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22e28a0d0b-2e22-444a-8d15-a30e979a3fd7%22%2C%22duid%22%3A%222587d276-e759-468f-83a2-75971f1649a6%22%2C%22cw%22%3A1709055527598%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1 Host: c5.adalyser.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:49 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:49 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-Powered-By: Express Access-Control-Allow-Headers: origin, content-type, accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP="ADMa OUR IND DSP NON COR" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 ETag: W/"2b-B//0C13UlayirE4cP7xgqg"
2024-02-27 17:38:49 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.17	49863	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 310 Host: analytics.avcdn.net
2024-02-27 17:38:48 UTC	310	OUT	Data Raw: 0a b3 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 73 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4e 0a 0a 53 6d 61 72 74 43 6c 65 61 6e 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6s;HealthCheckNF0(xZNSmartCleanActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Build
2024-02-27 17:38:49 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:49 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:49 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.17	49890	31.13.66.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	668	OUT	GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:49 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 27 Feb 2024 17:38:49 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.17	49891	31.13.66.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:48 UTC	705	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055527181&sw=1280&sh=1024&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&tm=1&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:49 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-27 17:38:49 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-27 17:38:49 UTC	1303	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.17	49892	142.251.163.106	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:49 UTC	769	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1046281332&_u=YCDAgEABAAAAAGAEK~&z=1906304434 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-02-27 17:38:49 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 27 Feb 2024 17:38:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.17	49893	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:49 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 322 Host: analytics.avcdn.net
2024-02-27 17:38:49 UTC	322	OUT	Data Raw: 0a bf 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 7f 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 5a 0a 15 53 6d 61 72 74 43 6c 65 61 6e 3a 4a 75 6e 6b 41 6c 65 72 74 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 03 6f 66 66 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZZSmartClean:JunkAlertsActivationoff (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"
2024-02-27 17:38:49 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:49 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:49 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.17	49898	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:49 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 326 Host: analytics.avcdn.net
2024-02-27 17:38:49 UTC	326	OUT	Data Raw: 0a c3 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 82 01 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 5d 0a 18 53 6d 61 72 74 43 6c 65 61 6e 3a 42 72 6f 77 73 65 72 41 6c 65 72 74 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 03 6f 66 66 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZ]SmartClean:BrowserAlertsActivationoff (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.1091
2024-02-27 17:38:49 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:49 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:49 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.17	49897	52.30.38.148	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:49 UTC	1078	OUT	GET /tracking/track/v3/p?stm=1709055527601&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&cid=ccleaner&p=%7B%22et%22%3A1709055527598%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22e28a0d0b-2e22-444a-8d15-a30e979a3fd7%22%2C%22duid%22%3A%222587d276-e759-468f-83a2-75971f1649a6%22%2C%22cw%22%3A1709055527598%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1 Host: c5.adalyser.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:50 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-Powered-By: Express Access-Control-Allow-Headers: origin, content-type, accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP="ADMa OUR IND DSP NON COR" Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 ETag: W/"2b-B//0C13UlayirE4cP7xgqg"
2024-02-27 17:38:50 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.17	49901	157.240.229.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	1361	OUT	GET /tr/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 27 Feb 2024 17:38:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.17	49902	157.240.229.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	1471	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger;navigation-source Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	1227	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: ps_n=0; expires=Wed, 02-Apr-2025 17:38:50 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: ps_l=0; expires=Wed, 02-Apr-2025 17:38:50 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=Lax Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-27 17:38:50 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-27 17:38:50 UTC	1270	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d
2024-02-27 17:38:50 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.17	49903	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 307 Host: analytics.avcdn.net
2024-02-27 17:38:50 UTC	307	OUT	Data Raw: 0a b0 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 70 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4b 0a 07 53 6b 69 70 55 41 43 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6p;HealthCheckNF0(xZKSkipUACActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Build 19
2024-02-27 17:38:50 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:50 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:50 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.17	49906	172.64.155.119	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	542	OUT	OPTIONS /request/v1/consentreceipts HTTP/1.1 Host: privacyportal-de.onetrust.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.ccleaner.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	478	IN	HTTP/1.1 200 OK Date: Tue, 27 Feb 2024 17:38:50 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD Access-Control-Allow-Headers: content-type CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 85c23429cb8c209a-IAD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.17	49907	31.13.66.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	1125	OUT	GET /tr/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 27 Feb 2024 17:38:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.17	49908	31.13.66.35	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	1178	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-21-10918%3Fcv%3Dv6-21-10918&rl=&if=false&ts=1709055529059&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22onetrust-accept-btn-handler%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22OK%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3Anull%2C%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D&cd[buttonText]=OK&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22CCleaner%20v6.21.10918%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.147&r=stable&ec=1&o=4126&fbp=fb.1.1709055527173.1545787529&cs_est=true&ler=empty&cdl=API_unavailable&it=1709055525192&coo=false&dpo=&es=automatic&tm=3&exp=e1&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ps_n=0
2024-02-27 17:38:50 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-02-27 17:38:50 UTC	1711	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-02-27 17:38:50 UTC	1303	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 6c 69 70 62 6f 61 72 64 2d 77 72 69 74 65 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.17	49910	172.253.122.156	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	866	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&gjid=91779804&_gid=1089165544.1709055527&_u=aCDAAEABAAAAAGAEK~&z=1791724118 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.ccleaner.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:50 UTC	594	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.ccleaner.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 27 Feb 2024 17:38:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:50 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.17	49913	142.251.163.103	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	1004	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&_u=aCDAAEABAAAAAGAEK~&z=930998961 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-02-27 17:38:51 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 27 Feb 2024 17:38:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.17	49914	172.253.122.156	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:50 UTC	614	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=1361411562.1709055525&jid=1155401934&gjid=91779804&_gid=1089165544.1709055527&_u=aCDAAEABAAAAAGAEK~&z=1791724118 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:51 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Tue, 27 Feb 2024 17:38:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:51 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.17	49912	172.64.155.119	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:51 UTC	640	OUT	POST /request/v1/consentreceipts HTTP/1.1 Host: privacyportal-de.onetrust.com Connection: keep-alive Content-Length: 7854 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://www.ccleaner.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.ccleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-27 17:38:51 UTC	7854	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 22 3a 22 65 79 4a 68 62 47 63 69 4f 69 4a 53 55 7a 55 78 4d 69 4a 39 2e 65 79 4a 76 64 45 70 33 64 46 5a 6c 63 6e 4e 70 62 32 34 69 4f 6a 45 73 49 6e 42 79 62 32 4e 6c 63 33 4e 4a 5a 43 49 36 49 6a 41 32 4e 44 56 68 4e 6d 49 35 4c 54 52 68 4e 32 59 74 4e 47 46 68 4e 69 31 69 4e 57 45 34 4c 54 55 34 4e 44 55 79 4f 44 49 78 5a 44 4e 69 4d 53 49 73 49 6e 42 79 62 32 4e 6c 63 33 4e 57 5a 58 4a 7a 61 57 39 75 49 6a 6f 79 4d 53 77 69 61 57 46 30 49 6a 6f 69 4d 6a 41 79 4d 69 30 77 4e 69 30 78 4e 56 51 77 4f 44 6f 79 4e 54 6f 78 4d 79 34 35 4e 44 63 69 4c 43 4a 74 62 32 4d 69 4f 69 4a 44 54 30 39 4c 53 55 55 69 4c 43 4a 77 62 32 78 70 59 33 6c 66 64 58 4a 70 49 6a 6f 69 59 32 4e 73 5a 57 46 75 5a 58 49 Data Ascii: {"requestInformation":"eyJhbGciOiJSUzUxMiJ9.eyJvdEp3dFZlcnNpb24iOjEsInByb2Nlc3NJZCI6IjA2NDVhNmI5LTRhN2YtNGFhNi1iNWE4LTU4NDUyODIxZDNiMSIsInByb2Nlc3NWZXJzaW9uIjoyMSwiaWF0IjoiMjAyMi0wNi0xNVQwODoyNToxMy45NDciLCJtb2MiOiJDT09LSUUiLCJwb2xpY3lfdXJpIjoiY2NsZWFuZXI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.17	49915	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:51 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 335 Host: analytics.avcdn.net
2024-02-27 17:38:51 UTC	335	OUT	Data Raw: 0a cc 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 8b 01 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 66 0a 0c 63 63 36 20 72 65 73 65 61 72 63 68 12 09 44 65 74 65 63 74 69 6f 6e 1a 19 77 65 62 76 69 65 77 32 20 3a 3a 20 31 31 37 2e 30 2e 32 30 34 35 2e 34 37 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZfcc6 researchDetectionwebview2 :: 117.0.2045.47 (2B1-aJmmm_ccl_003_999_b8b_m`"F
2024-02-27 17:38:51 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:51 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:51 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.17	49922	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:38:51 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 589 Host: analytics.avcdn.net
2024-02-27 17:38:51 UTC	589	OUT	Data Raw: 0a ca 04 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 89 03 0a 03 3b 03 01 10 84 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a e3 02 0a 07 53 74 61 72 74 75 70 12 08 67 75 69 20 6f 70 65 6e 1a 16 63 63 6c 65 61 6e 65 72 20 73 74 61 72 74 75 70 20 65 76 65 6e 74 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 8e 02 08 00 10 00 1a 03 31 2d 61 22 11 0a 0b 41 75 74 6f 55 70 64 61 74 65 73 12 02 6f 6e 22 0d 0a 07 49 73 41 64 6d 69 6e 12 02 6f 6e 22 10 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZStartupgui openccleaner startup event (2B1-a"AutoUpdateson"IsAdminon"
2024-02-27 17:38:51 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:38:51 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:38:51 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.17	49923	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:06 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 255 Host: analytics.avcdn.net
2024-02-27 17:39:06 UTC	255	OUT	Data Raw: 0a fc 01 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 3c 0a 03 3b 09 01 10 96 fc f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 17 08 99 3d 12 08 0a 04 48 4b 4c 4d 10 06 12 08 0a 04 48 4b 43 55 10 06 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 12 52 08 08 01 10 8b be f8 ae 06 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6<;HealthCheckNF0(xZ=HKLMHKCU`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@R
2024-02-27 17:39:07 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:07 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:07 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.17	49924	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:07 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 266 Host: analytics.avcdn.net
2024-02-27 17:39:07 UTC	266	OUT	Data Raw: 0a 87 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 47 0a 03 3b 09 01 10 96 fc f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 22 08 c9 34 12 1d 0a 19 50 6e 61 63 6c 54 72 61 6e 73 6c 61 74 69 6f 6e 43 61 63 68 65 53 69 7a 65 10 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6G;HealthCheckNF0(xZ"4PnaclTranslationCacheSize`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@
2024-02-27 17:39:07 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:07 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:07 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.17	49925	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:07 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 274 Host: analytics.avcdn.net
2024-02-27 17:39:07 UTC	274	OUT	Data Raw: 0a 8f 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 4f 0a 03 3b 09 01 10 96 fc f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 2a 08 fc 44 12 0e 0a 0a 47 61 6d 65 72 53 63 6f 72 65 10 02 12 15 0a 11 47 61 6d 65 72 53 63 6f 72 65 56 65 72 73 69 6f 6e 10 04 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6O;HealthCheckNF0(xZ*DGamerScoreGamerScoreVersion`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)
2024-02-27 17:39:08 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:08 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:08 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.17	49927	34.111.24.1	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:08 UTC	741	OUT	GET /?action=1&p_elm=229&p_lng=en&p_lid=en-us&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_b8b_m&p_dols=0&p_pro=90&p_vep=6&p_ves=21&p_vbd=10918&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240227 HTTP/1.1 User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918) Host: ipm-provider.ff.avast.com Cache-Control: no-cache
2024-02-27 17:39:08 UTC	690	IN	HTTP/1.1 204 No Content Server: nginx Date: Tue, 27 Feb 2024 17:39:08 GMT Content-Type: text/plain IPM-Asset-Base-URL: https://ipm-static.avcdn.net/content-assets-prod/,https://ipmcdn.avast.com/images/ Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Identifier: UNKNOWN SCREEN ETag: W/1505 Set-Cookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:39:08 GMT; Secure; SameSite=None Set-Cookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:39:08 GMT; Secure; SameSite=None Content-Length: 0 Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.17	49926	34.149.149.62	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:08 UTC	126	OUT	GET /v1/info HTTP/1.1 User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918) Host: ip-info.ff.avast.com Cache-Control: no-cache
2024-02-27 17:39:08 UTC	176	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:08 GMT Content-Type: application/json Content-Length: 348 Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-27 17:39:08 UTC	348	IN	Data Raw: 7b 22 69 70 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 32 30 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 73 75 62 64 69 76 69 73 69 6f 6e 73 22 3a 5b 22 44 43 22 5d 2c 22 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 38 2e 38 39 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 37 2e 30 33 36 35 2c 22 69 73 70 22 3a 22 69 4e 45 53 20 47 52 4f 55 50 22 2c 22 61 73 6e 4e 75 6d 62 65 72 Data Ascii: {"ip":"89.149.18.20","continent":"North America","continentCode":"NA","country":"US","countryName":"United States","subdivisions":["DC"],"city":"Washington","timezone":"America/New_York","latitude":38.894,"longitude":-77.0365,"isp":"iNES GROUP","asnNumber

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.17	49930	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:08 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 343 Host: analytics.avcdn.net
2024-02-27 17:39:08 UTC	343	OUT	Data Raw: 0a d4 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 93 01 0a 03 3b 04 01 10 96 fc f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 6e 0a 1e 48 65 61 6c 74 68 43 68 65 63 6b 2f 4f 6e 62 6f 61 72 64 69 6e 67 2f 57 65 6c 63 6f 6d 65 12 1e 48 65 61 6c 74 68 43 68 65 63 6b 2f 4f 6e 62 6f 61 72 64 69 6e 67 2f 57 65 6c 63 6f 6d 65 1a 0a 08 80 cc f4 ae 06 10 01 18 00 2a 09 08 00 10 00 1a 03 31 2d 61 32 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZnHealthCheck/Onboarding/WelcomeHealthCheck/Onboarding/Welcome*1-a2mmm_ccl_003_999_b8b
2024-02-27 17:39:08 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:08 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:08 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.17	49931	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:08 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 286 Host: analytics.avcdn.net
2024-02-27 17:39:08 UTC	286	OUT	Data Raw: 0a 9b 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 5b 0a 03 3b 09 01 10 90 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 36 08 9d 43 12 1d 0a 19 49 6e 74 65 72 6e 65 74 47 65 74 43 6f 6e 6e 65 63 74 65 64 53 74 61 74 65 10 02 12 12 0a 0e 43 6f 6e 6e 65 63 74 69 6f 6e 44 65 73 63 10 24 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6[;HealthCheckNF0(xZ6CInternetGetConnectedStateConnectionDesc$`"F6.21.10918"/10.0 (Build 19045, Release 2009, UB
2024-02-27 17:39:08 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:08 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:08 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.17	49933	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:09 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 268 Host: analytics.avcdn.net
2024-02-27 17:39:09 UTC	268	OUT	Data Raw: 0a 89 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 49 0a 03 3b 09 01 10 92 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 24 08 fe 3e 12 1f 0a 1b 41 75 74 6f 55 70 64 61 74 65 53 65 72 76 69 63 65 4f 6e 46 69 6e 69 73 68 65 64 10 06 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6I;HealthCheckNF0(xZ$>AutoUpdateServiceOnFinished`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H
2024-02-27 17:39:09 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:09 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:09 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.17	49934	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:09 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 343 Host: analytics.avcdn.net
2024-02-27 17:39:09 UTC	343	OUT	Data Raw: 0a d4 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 93 01 0a 03 3b 04 01 10 92 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 6e 0a 1e 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 67 65 74 74 69 6e 67 72 65 61 64 79 12 1e 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 67 65 74 74 69 6e 67 72 65 61 64 79 1a 0a 08 80 cc f4 ae 06 10 01 18 00 2a 09 08 00 10 00 1a 03 31 2d 61 32 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZnPopup/postinstall/gettingreadyPopup/postinstall/gettingready*1-a2mmm_ccl_003_999_b8b
2024-02-27 17:39:09 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:09 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:09 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.17	49935	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:10 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 345 Host: analytics.avcdn.net
2024-02-27 17:39:10 UTC	345	OUT	Data Raw: 0a d6 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 95 01 0a 03 3b 04 01 10 94 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 70 0a 1f 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 63 63 6c 65 61 6e 65 72 72 65 61 64 79 12 1f 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 63 63 6c 65 61 6e 65 72 72 65 61 64 79 1a 0a 08 80 cc f4 ae 06 10 01 18 00 2a 09 08 00 10 00 1a 03 31 2d 61 32 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZpPopup/postinstall/ccleanerreadyPopup/postinstall/ccleanerready*1-a2mmm_ccl_003_999_b
2024-02-27 17:39:10 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:10 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:10 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.17	49936	34.111.24.1	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:10 UTC	798	OUT	GET /?action=1&p_elm=260&p_lng=en&p_lid=en-us&p_geo=US&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B&p_hid=5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_b8b_m&p_dols=0&p_pro=90&p_vep=6&p_ves=21&p_vbd=10918&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_avt=cc-pro-trial&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240227 HTTP/1.1 User-Agent: CCleaner Host: ipm-provider.ff.avast.com Cache-Control: no-cache Cookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6
2024-02-27 17:39:10 UTC	2361	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:10 GMT Content-Type: text/html Content-Length: 23359 IPM-Asset-URL--742863063: https://ipmcdn.avast.com/images/logo-avast_133x49-rebrand1-v1.png IPM-Asset-URL-1528994374: https://ipmcdn.avast.com/images/ccleaner/img/img-pc-av-free-rebrand1-v2.png IPM-Asset-URL--264928637: https://ipmcdn.avast.com/images/ccleaner/img/setup-offer/img-setup-offer-att-2-v1.png IPM-Asset-URL--1093113317: https://ipmcdn.avast.com/images/nag/tick-v1.png IPM-Asset-URL-855118143: https://ipmcdn.avast.com/images/icon-chrome-with-text-v2.png IPM-Asset-URL-1796671977: https://ipmcdn.avast.com/images/2020/desktop/avg-antivirus/png/chrome-promotion-avg-380x300-2x-v1.png IPM-Asset-URL--757920681: https://ipmcdn.avast.com/images/nag/tick-red-v1.png IPM-Asset-URL--1062598500: https://ipmcdn.avast.com/images/Roboto/300/Roboto-Light-v1.ttf IPM-Asset-URL-1657334743: https://ipmcdn.avast.com/images/Roboto/400/Roboto-Regular-v1.ttf IPM-Asset-URL-605409381: https://ipmcdn.avast.com/images/Roboto/700/Roboto-Bold-v1.ttf IPM-Asset-URL-1299712349: https://ipmcdn.avast.com/images/Roboto/Roboto-Medium-v1.ttf IPM-Asset-URL-306408631: https://ipmcdn.avast.com/images/avg/img-add-world-class-protection-free-v2.png IPM-Asset-URL-1153561041: https://ipmcdn.avast.com/images/ccleaner/img/icon-blue-dot-v1.png IPM-Asset-Base-URL: https://ipm-static.avcdn.net/content-assets-prod/,https://ipmcdn.avast.com/images/ Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Identifier: ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html ETag: W/b8e845d1 Set-Cookie: ScreenName_260=ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html; Max-Age=3888000; Expires=Fri, 12 Apr 2024 17:39:10 GMT; Secure; SameSite=None Set-Cookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:39:10 GMT; Secure; SameSite=None Set-Cookie: ScreenName_260=ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html; Max-Age=3888000; Expires=Fri, 12 Apr 2024 17:39:10 GMT; Secure; SameSite=None Set-Cookie: ClientId=6587a581-b509-4446-ad2e-4d2acb35c8a6; Max-Age=63072000; Expires=Thu, 26 Feb 2026 17:39:10 GMT; Secure; SameSite=None Via: 1.1 google Alt-Svc: clear Connection: close
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 69 70 6d 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 20 20 20 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2f 2a 2a 0d 0a 20 2a 20 43 43 6c 65 61 6e 65 72 20 49 50 4d 20 67 6c 6f 62 61 6c 20 73 74 79 6c 65 73 0d 0a 20 2a 0d 0a 20 2a 20 61 75 74 68 6f 72 3a 20 62 65 6e 6a 61 6b 40 61 76 61 73 74 2e 63 6f 6d 0d 0a 20 2a 20 64 65 73 63 3a 20 53 63 Data Ascii: <!DOCTYPE html><html dir="ltr" class="ipm"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /> <style type="text/css"> /** * CCleaner IPM global styles * * author: benjak@avast.com * desc: Sc
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 62 66 32 66 66 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 32 36 32 36 32 36 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 63 6f 6c 6f 72 2d 6c 69 67 68 74 2d 6f 6b 2e 2d 74 65 78 74 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 65 62 66 32 66 66 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 63 6f 6c 6f 72 2d 6c 69 67 68 74 2d 63 72 69 74 69 63 61 6c 2e 2d 62 67 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 65 61 65 61 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 32 36 32 36 32 36 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 63 6f 6c 6f 72 2d 6c 69 67 68 74 2d 63 72 69 74 69 63 61 6c 2e 2d 74 65 78 74 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 65 61 65 61 3b 0d 0a 7d 0d 0a 2e 69 70 6d Data Ascii: { background-color: #ebf2ff; color: #262626;}.ipm .color-light-ok.-text { color: #ebf2ff;}.ipm .color-light-critical.-bg { background-color: #ffeaea; color: #262626;}.ipm .color-light-critical.-text { color: #ffeaea;}.ipm
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 2e 68 6c 70 2d 66 6c 6f 61 74 2e 2d 6c 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 68 6c 70 2d 66 6c 6f 61 74 2e 2d 72 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 7d 0d 0a 0d 0a 2e 69 70 6d 20 2e 68 6c 70 2d 69 73 2d 68 69 64 64 65 6e 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 68 6c 70 2d 69 73 2d 76 69 73 69 62 6c 65 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 2e 69 70 6d 20 2e 68 6c 70 2d 69 73 2d 73 65 63 72 65 74 20 7b 0d 0a 20 20 68 65 69 67 68 74 3a 20 30 3b 0d 0a 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 76 69 73 69 62 69 6c 69 74 79 Data Ascii: .hlp-float.-l { float: left;}.ipm .hlp-float.-r { float: right;}.ipm .hlp-is-hidden { display: none;}.ipm .hlp-is-visible { display: block;}.ipm .hlp-is-secret { height: 0; width: 0; position: absolute; visibility
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 20 20 20 20 72 69 67 68 74 3a 20 34 35 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 20 20 0d 0a 7d 0d 0a 0d 0a 2f 2a 20 52 54 4c 20 2a 2f 0d 0a 68 74 6d 6c 5b 64 69 72 3d 22 72 74 6c 22 5d 2e 69 70 6d 20 2e 73 70 2d 74 6f 70 20 7b 0d 0a 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 34 30 70 78 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 68 74 6d 6c 5b 64 69 72 3d 22 72 74 6c 22 5d 2e 69 70 6d 20 2e 73 70 2d 6d 69 64 64 6c 65 20 7b 0d 0a 20 20 09 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 33 36 70 78 20 30 20 34 30 70 78 3b 0d 0a 20 Data Ascii: -right: 0; position: relative; float: right; right: 45px; margin-left: 0; }/* RTL */html[dir="rtl"].ipm .sp-top { background-position: 40px center;}html[dir="rtl"].ipm .sp-middle { padding: 40px 36px 0 40px;
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 2d 52 65 67 75 6c 61 72 27 3b 0d 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 69 70 6d 63 64 6e 2e 61 76 61 73 74 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 52 6f 62 6f 74 6f 2f 34 30 30 2f 52 6f 62 6f 74 6f 2d 52 65 67 75 6c 61 72 2d 76 31 2e 74 74 66 27 29 3b 0d 0a 7d 0d 0a 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 2d 42 6f 6c 64 27 3b 0d 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 69 70 6d 63 64 6e 2e 61 76 61 73 74 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 52 6f 62 6f 74 6f 2f 37 30 30 2f 52 6f 62 6f 74 6f 2d 42 6f 6c 64 2d 76 31 2e 74 74 66 27 29 3b 0d 0a Data Ascii: ont-face { font-family: 'Roboto-Regular'; src: url('https://ipmcdn.avast.com/images/Roboto/400/Roboto-Regular-v1.ttf');}@font-face { font-family: 'Roboto-Bold'; src: url('https://ipmcdn.avast.com/images/Roboto/700/Roboto-Bold-v1.ttf');
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 3a 38 35 70 78 3b 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0d 0a 20 20 20 20 2e 69 70 6d 20 2e 70 72 6f 67 72 65 73 73 2d 62 61 72 2d 64 69 76 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 32 34 32 2c 20 32 34 32 2c 20 32 34 32 29 3b 68 65 69 67 68 74 3a 20 31 30 70 78 3b 77 69 64 74 68 3a 20 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 20 39 32 25 3b 7d 0d 0a 20 20 20 20 2e 69 70 6d 20 2e 70 72 6f 67 72 65 73 73 2d 62 61 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 32 31 34 2c 20 32 31 35 2c 20 32 31 36 29 3b 77 69 64 74 68 3a 20 37 35 25 Data Ascii: :85px; padding-left:30px; padding-right:30px;font-weight:bold;} .ipm .progress-bar-div{background-color: rgb(242, 242, 242);height: 10px;width: 100%;position: absolute;top: 92%;} .ipm .progress-bar{background-color: rgb(214, 215, 216);width: 75%
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 65 64 2d 6c 69 6e 6b 20 74 65 78 74 2d 63 65 6e 74 65 72 22 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 76 6f 69 64 28 30 29 22 3e 0d 0a 20 20 20 20 20 20 20 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 98 41 63 63 65 70 74 e2 80 99 2c 20 49 20 61 67 72 65 65 20 74 6f 20 69 6e 73 74 61 6c 6c 20 41 56 47 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 2c 20 61 6e 64 20 49 20 63 6f 6e 73 65 6e 74 20 74 6f 20 41 56 47 e2 80 99 73 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 76 67 2e 63 6f 6d 2f 65 75 6c 61 3f 63 69 64 3d 32 39 62 33 33 38 36 63 2d 32 35 30 39 2d 34 63 62 36 2d 62 38 38 39 2d 64 61 35 33 66 62 36 38 33 64 35 30 26 6c 3d 65 6e 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 45 6e 64 20 55 73 65 72 20 4c 69 63 Data Ascii: ed-link text-center" href="javascript:void(0)"> By clicking Accept, I agree to install AVG Free Antivirus, and I consent to AVGs <a href="http://www.avg.com/eula?cid=29b3386c-2509-4cb6-b889-da53fb683d50&l=en" target="_blank">End User Lic
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 2e 68 74 6d 6c 26 75 6c 3d 65 6e 2d 75 73 26 63 64 35 3d 63 63 6c 65 61 6e 65 72 25 32 46 65 6e 2d 75 73 25 32 46 74 75 74 6f 72 69 61 6c 2d 32 36 30 5f 63 72 6f 73 73 73 65 6c 6c 2d 63 63 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 2e 68 74 6d 6c 26 74 3d 65 76 65 6e 74 26 65 6c 3d 63 63 6c 65 61 6e 65 72 25 32 46 65 6e 2d 75 73 25 32 46 74 75 74 6f 72 69 61 6c 2d 32 36 30 5f 63 72 6f 73 73 73 65 6c 6c 2d 63 63 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 2e 68 74 6d 6c 26 65 63 3d 49 50 4d 25 32 30 25 33 45 25 32 30 4e 25 32 46 41 26 65 61 3d 54 4f 5f 52 45 50 4c 41 43 45 5f Data Ascii: st-installer-group-a-avg.html&ul=en-us&cd5=ccleaner%2Fen-us%2Ftutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html&t=event&el=ccleaner%2Fen-us%2Ftutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html&ec=IPM%20%3E%20N%2FA&ea=TO_REPLACE_
2024-02-27 17:39:10 UTC	2361	IN	Data Raw: 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 2e 68 74 6d 6c 25 32 32 25 32 43 25 32 32 63 6f 6e 74 65 6e 74 5f 74 79 70 65 25 32 32 25 33 41 25 32 32 53 43 52 45 45 4e 25 32 32 25 32 43 25 32 32 73 63 72 65 65 6e 5f 6c 61 6e 67 75 61 67 65 25 32 32 25 33 41 25 32 32 65 6e 25 32 32 25 32 43 25 32 32 73 63 72 65 65 6e 5f 6e 61 6d 65 25 32 32 25 33 41 25 32 32 74 75 74 6f 72 69 61 6c 2d 32 36 30 5f 63 72 6f 73 73 73 65 6c 6c 2d 63 63 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 25 32 32 25 37 44 25 32 43 25 32 32 61 63 74 69 6f 6e 25 32 32 25 33 41 25 37 42 25 32 32 61 63 74 69 6f 6e 4e 61 6d 65 25 32 32 25 33 41 25 32 32 54 4f 5f 52 45 50 4c 41 43 45 Data Ascii: leaner-post-installer-group-a-avg.html%22%2C%22content_type%22%3A%22SCREEN%22%2C%22screen_language%22%3A%22en%22%2C%22screen_name%22%3A%22tutorial-260_crosssell-ccleaner-post-installer-group-a-avg%22%7D%2C%22action%22%3A%7B%22actionName%22%3A%22TO_REPLACE
2024-02-27 17:39:10 UTC	2110	IN	Data Raw: 38 62 36 26 63 64 31 35 34 3d 31 26 63 64 31 35 35 3d 34 31 26 63 64 31 37 35 3d 62 31 62 37 37 34 35 33 2d 36 62 66 33 2d 34 63 38 36 2d 62 33 30 34 2d 65 31 39 34 32 61 33 37 36 34 31 36 26 63 64 31 37 36 3d 62 31 62 37 37 34 35 33 2d 36 62 66 33 2d 34 63 38 36 2d 62 33 30 34 2d 65 31 39 34 32 61 33 37 36 34 31 36 22 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 68 65 69 67 68 74 3a 30 3b 20 77 69 64 74 68 3a 30 3b 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 20 6f 70 61 63 69 74 79 3a 20 30 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 30 3b 20 6c 65 66 74 3a 20 30 3b 20 7a 2d 69 6e 64 65 78 3a 20 2d 31 3b 22 20 2f 3e 3c 69 6d 67 20 73 72 63 3d 22 22 20 73 74 79 Data Ascii: 8b6&cd154=1&cd155=41&cd175=b1b77453-6bf3-4c86-b304-e1942a376416&cd176=b1b77453-6bf3-4c86-b304-e1942a376416" style="margin:0; padding:0; height:0; width:0; visibility: hidden; opacity: 0; position: absolute; top: 0; left: 0; z-index: -1;" /><img src="" sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.17	49938	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:10 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 333 Host: analytics.avcdn.net
2024-02-27 17:39:10 UTC	333	OUT	Data Raw: 0a ca 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 89 01 0a 03 3b 03 01 10 94 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 64 0a 1f 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 63 63 6c 65 61 6e 65 72 72 65 61 64 79 12 05 63 6c 69 63 6b 1a 08 63 6f 6e 74 69 6e 75 65 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZdPopup/postinstall/ccleanerreadyclickcontinue (2B1-aJmmm_ccl_003_999_b8b_m`"F6.
2024-02-27 17:39:10 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:10 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:10 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.17	49940	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:12 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 319 Host: analytics.avcdn.net
2024-02-27 17:39:12 UTC	319	OUT	Data Raw: 0a bc 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 7c 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 57 0a 13 55 70 64 61 74 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6\|;HealthCheckNF0(xZWUpdateNotificationsActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10
2024-02-27 17:39:12 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:12 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:12 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.17	49942	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:12 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 311 Host: analytics.avcdn.net
2024-02-27 17:39:12 UTC	311	OUT	Data Raw: 0a b4 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 74 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4f 0a 0b 41 75 74 6f 55 70 64 61 74 65 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6t;HealthCheckNF0(xZOAutoUpdatesActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Buil
2024-02-27 17:39:12 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:12 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:12 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.17	49944	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:13 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 310 Host: analytics.avcdn.net
2024-02-27 17:39:13 UTC	310	OUT	Data Raw: 0a b3 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 73 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4e 0a 0a 53 6d 61 72 74 43 6c 65 61 6e 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6s;HealthCheckNF0(xZNSmartCleanActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Build
2024-02-27 17:39:13 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:13 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:13 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.17	49945	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:13 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 321 Host: analytics.avcdn.net
2024-02-27 17:39:13 UTC	321	OUT	Data Raw: 0a be 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 7e 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 59 0a 15 53 6d 61 72 74 43 6c 65 61 6e 3a 4a 75 6e 6b 41 6c 65 72 74 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6~;HealthCheckNF0(xZYSmartClean:JunkAlertsActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/
2024-02-27 17:39:13 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:13 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:13 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.17	49947	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:14 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 326 Host: analytics.avcdn.net
2024-02-27 17:39:14 UTC	326	OUT	Data Raw: 0a c3 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 82 01 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 5d 0a 18 53 6d 61 72 74 43 6c 65 61 6e 3a 42 72 6f 77 73 65 72 41 6c 65 72 74 73 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 03 6f 66 66 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZ]SmartClean:BrowserAlertsActivationoff (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.1091
2024-02-27 17:39:14 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:14 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:14 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.17	49951	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:14 UTC	1102	OUT	GET /v4/receive/get/json/10?data={"record":[{"event":{"type":10,"subtype":2,"request_id":"b1b77453-6bf3-4c86-b304-e1942a376416"},"identity":{"guid":"5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6","hwid":"0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632B"},"product":{"id":104,"lang":"en-us","version_app":"6.21.10918.mmm_ccl_003_999_b8b_m","build":10918,"ipm_product":90},"platform":{"version":"10.0","lang":"en-us"},"license":{"subscription_mode":false,"stack":"STACK_AVAST","gen_license":{"state":"EXPIRED"}},"shepherd":{},"ab_test":{},"ipm":{"common":{"element":260,"license_type":"STANDARD","licensing_stage":"LICENSED","installation_age":0,"remaining_days_to_expiration":-1,"flow_id":"b1b77453-6bf3-4c86-b304-e1942a376416"},"content":{"content_identifier":"ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg.html","content_type":"SCREEN","screen_language":"en","screen_name":"tutorial-260_crosssell-ccleaner-post-installer-group-a-avg"},"action":{}}}]} HTTP/1.1 User-Agent: Mozilla/4.0 (CCleaner, 6.21.10918) Host: analytics.ff.avast.com Cache-Control: no-cache
2024-02-27 17:39:14 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:14 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:14 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.17	49953	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:14 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 307 Host: analytics.avcdn.net
2024-02-27 17:39:14 UTC	307	OUT	Data Raw: 0a b0 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 70 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 4b 0a 07 53 6b 69 70 55 41 43 12 0a 41 63 74 69 76 61 74 69 6f 6e 1a 02 6f 6e 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6p;HealthCheckNF0(xZKSkipUACActivationon (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21.10918"/10.0 (Build 19
2024-02-27 17:39:14 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:14 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:14 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.17	49954	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:15 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 335 Host: analytics.avcdn.net
2024-02-27 17:39:15 UTC	335	OUT	Data Raw: 0a cc 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 8b 01 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 66 0a 0c 63 63 36 20 72 65 73 65 61 72 63 68 12 09 44 65 74 65 63 74 69 6f 6e 1a 19 77 65 62 76 69 65 77 32 20 3a 3a 20 31 31 37 2e 30 2e 32 30 34 35 2e 34 37 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZfcc6 researchDetectionwebview2 :: 117.0.2045.47 (2B1-aJmmm_ccl_003_999_b8b_m`"F
2024-02-27 17:39:15 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:15 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:15 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.17	49955	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:15 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 590 Host: analytics.avcdn.net
2024-02-27 17:39:15 UTC	590	OUT	Data Raw: 0a cb 04 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 8a 03 0a 03 3b 03 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a e4 02 0a 07 53 74 61 72 74 75 70 12 0a 6d 6f 6e 69 74 6f 72 69 6e 67 1a 16 63 63 6c 65 61 6e 65 72 20 73 74 61 72 74 75 70 20 65 76 65 6e 74 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 8d 02 08 00 10 00 1a 03 31 2d 61 22 11 0a 0b 41 75 74 6f 55 70 64 61 74 65 73 12 02 6f 6e 22 0d 0a 07 49 73 41 64 6d 69 6e 12 02 6f 6e Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZStartupmonitoringccleaner startup event (2B1-a"AutoUpdateson"IsAdminon
2024-02-27 17:39:15 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:15 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:15 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.17	49956	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:15 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 255 Host: analytics.avcdn.net
2024-02-27 17:39:15 UTC	255	OUT	Data Raw: 0a fc 01 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 3c 0a 03 3b 09 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 17 08 99 3d 12 08 0a 04 48 4b 4c 4d 10 06 12 08 0a 04 48 4b 43 55 10 06 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 12 52 08 08 01 10 94 be f8 ae 06 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6<;HealthCheckNF0(xZ=HKLMHKCU`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@R
2024-02-27 17:39:16 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:16 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:16 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.17	49957	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:16 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 266 Host: analytics.avcdn.net
2024-02-27 17:39:16 UTC	266	OUT	Data Raw: 0a 87 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 47 0a 03 3b 09 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 22 08 c9 34 12 1d 0a 19 50 6e 61 63 6c 54 72 61 6e 73 6c 61 74 69 6f 6e 43 61 63 68 65 53 69 7a 65 10 00 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 38 68 40 00 48 ed 04 40 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6G;HealthCheckNF0(xZ"4PnaclTranslationCacheSize`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)8h@H@
2024-02-27 17:39:16 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:16 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:16 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.17	49958	34.117.223.223	443	3612	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:16 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 274 Host: analytics.avcdn.net
2024-02-27 17:39:16 UTC	274	OUT	Data Raw: 0a 8f 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 4f 0a 03 3b 09 01 10 b8 f9 f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 2a 08 fc 44 12 0e 0a 0a 47 61 6d 65 72 53 63 6f 72 65 10 02 12 15 0a 11 47 61 6d 65 72 53 63 6f 72 65 56 65 72 73 69 6f 6e 10 04 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 18 01 22 2f 31 30 2e 30 20 28 42 75 69 6c 64 20 31 39 30 34 35 2c 20 52 65 6c 65 61 73 65 20 32 30 30 39 2c 20 55 42 52 20 32 30 30 36 2c 20 78 36 34 29 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6O;HealthCheckNF0(xZ*DGamerScoreGamerScoreVersion`"F6.21.10918"/10.0 (Build 19045, Release 2009, UBR 2006, x64)
2024-02-27 17:39:16 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:16 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:16 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.17	49959	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:17 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 488 Host: analytics.avcdn.net
2024-02-27 17:39:17 UTC	488	OUT	Data Raw: 0a e5 03 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 a4 02 0a 03 3b 04 01 10 a2 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a fe 01 0a 66 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 6f 66 66 65 72 2f 63 63 6c 65 61 6e 65 72 2f 65 6e 2d 77 77 2f 74 75 74 6f 72 69 61 6c 2d 32 36 30 5f 63 72 6f 73 73 73 65 6c 6c 2d 63 63 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 3a 3a 34 30 35 12 66 50 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZfPopup/postinstall/offer/ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg::405fP
2024-02-27 17:39:17 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:17 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:17 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.17	49962	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:18 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 403 Host: analytics.avcdn.net
2024-02-27 17:39:18 UTC	403	OUT	Data Raw: 0a 90 03 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 cf 01 0a 03 3b 03 01 10 a2 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a a9 01 0a 66 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 6f 66 66 65 72 2f 63 63 6c 65 61 6e 65 72 2f 65 6e 2d 77 77 2f 74 75 74 6f 72 69 61 6c 2d 32 36 30 5f 63 72 6f 73 73 73 65 6c 6c 2d 63 63 6c 65 61 6e 65 72 2d 70 6f 73 74 2d 69 6e 73 74 61 6c 6c 65 72 2d 67 72 6f 75 70 2d 61 2d 61 76 67 3a 3a 34 30 35 12 05 63 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZfPopup/postinstall/offer/ccleaner/en-ww/tutorial-260_crosssell-ccleaner-post-installer-group-a-avg::405c
2024-02-27 17:39:18 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:18 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:18 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.17	49966	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:22 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 333 Host: analytics.avcdn.net
2024-02-27 17:39:25 UTC	333	OUT	Data Raw: 0a ca 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 89 01 0a 03 3b 04 01 10 a6 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 64 0a 19 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 61 6c 6c 64 6f 6e 65 12 19 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 61 6c 6c 64 6f 6e 65 1a 0a 08 80 cc f4 ae 06 10 01 18 00 2a 09 08 00 10 00 1a 03 31 2d 61 32 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZdPopup/postinstall/alldonePopup/postinstall/alldone*1-a2mmm_ccl_003_999_b8b_m`"F6.
2024-02-27 17:39:25 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:25 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:25 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.17	49967	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:26 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 333 Host: analytics.avcdn.net
2024-02-27 17:39:26 UTC	333	OUT	Data Raw: 0a ca 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 89 01 0a 03 3b 03 01 10 a6 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 64 0a 19 50 6f 70 75 70 2f 70 6f 73 74 69 6e 73 74 61 6c 6c 2f 61 6c 6c 64 6f 6e 65 12 05 63 6c 69 63 6b 1a 0e 73 74 61 72 74 20 63 63 6c 65 61 6e 65 72 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZdPopup/postinstall/alldoneclickstart ccleaner (2B1-aJmmm_ccl_003_999_b8b_m`"F6.
2024-02-27 17:39:26 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:26 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:26 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.17	49968	34.117.223.223	443	6312	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:26 UTC	139	OUT	POST /v4/receive/json/25 HTTP/1.1 Connection: Keep-Alive User-Agent: Icarus Http/1.0 Content-Length: 1194 Host: analytics.avcdn.net
2024-02-27 17:39:26 UTC	1194	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 64 32 31 65 38 37 33 61 2d 37 34 65 38 2d 34 34 63 34 2d 38 33 37 32 2d 66 39 33 34 61 31 65 63 66 38 30 37 22 2c 22 74 69 6d 65 22 3a 31 37 30 39 30 36 30 37 33 30 39 37 39 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 61 30 38 64 63 66 61 31 2d 37 62 34 37 2d 34 38 61 64 2d 61 66 31 39 2d 63 64 61 61 34 65 34 37 30 62 30 36 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 73 74 61 72 74 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 6e Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"d21e873a-74e8-44c4-8372-f934a1ecf807","time":1709060730979},"setup":{"common":{"operation":"install","session_id":"a08dcfa1-7b47-48ad-af19-cdaa4e470b06","stage":"sfx-start","title":""},"product":{"n
2024-02-27 17:39:26 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:26 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:26 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.17	49970	34.117.223.223	443	6312	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:27 UTC	139	OUT	POST /v4/receive/json/25 HTTP/1.1 Connection: Keep-Alive User-Agent: Icarus Http/1.0 Content-Length: 1225 Host: analytics.avcdn.net
2024-02-27 17:39:27 UTC	1225	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 36 63 31 38 32 39 63 64 2d 33 34 38 63 2d 34 65 64 62 2d 62 39 37 61 2d 61 34 38 64 36 35 34 63 66 38 63 35 22 2c 22 74 69 6d 65 22 3a 31 37 30 39 30 36 30 37 33 31 35 36 34 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 61 30 38 64 63 66 61 31 2d 37 62 34 37 2d 34 38 61 64 2d 61 66 31 39 2d 63 64 61 61 34 65 34 37 30 62 30 36 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 70 72 65 70 61 72 69 6e 67 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 70 72 6f 64 75 63 74 22 Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"6c1829cd-348c-4edb-b97a-a48d654cf8c5","time":1709060731564},"setup":{"common":{"operation":"install","session_id":"a08dcfa1-7b47-48ad-af19-cdaa4e470b06","stage":"sfx-preparing","title":""},"product"
2024-02-27 17:39:27 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:27 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:27 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.17	49975	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:37 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 331 Host: analytics.avcdn.net
2024-02-27 17:39:37 UTC	331	OUT	Data Raw: 0a c8 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 87 01 0a 03 3b 03 01 10 ca fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 62 0a 1e 48 65 61 6c 74 68 43 68 65 63 6b 2f 4f 6e 62 6f 61 72 64 69 6e 67 2f 57 65 6c 63 6f 6d 65 12 05 63 6c 69 63 6b 1a 07 53 63 61 6e 20 50 43 20 00 28 01 32 0a 08 80 cc f4 ae 06 10 01 18 00 42 09 08 00 10 00 1a 03 31 2d 61 4a 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZbHealthCheck/Onboarding/WelcomeclickScan PC (2B1-aJmmm_ccl_003_999_b8b_m`"F6.21
2024-02-27 17:39:37 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:37 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:37 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.17	49977	34.117.223.223	443	1820	C:\Program Files\CCleaner\CCleaner64.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-27 17:39:41 UTC	164	OUT	POST /receive3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-enc-sb User-Agent: Avast Antivirus Content-Length: 325 Host: analytics.avcdn.net
2024-02-27 17:39:41 UTC	325	OUT	Data Raw: 0a c2 02 0a 68 42 40 30 46 42 31 46 31 44 30 32 45 39 37 45 38 43 41 34 36 30 43 36 39 32 34 34 34 44 39 39 43 41 41 44 32 45 30 34 42 37 37 31 34 31 43 33 37 42 37 39 43 45 31 33 42 31 43 42 39 35 45 36 33 32 42 4a 24 35 62 36 62 62 35 62 61 2d 66 63 31 64 2d 34 38 35 62 2d 39 61 33 32 2d 36 32 65 34 63 66 64 63 32 38 62 36 12 81 01 0a 03 3b 04 01 10 d2 fd f0 dd 0c 1a 12 0a 0d 48 65 61 6c 74 68 43 68 65 63 6b 4e 46 12 01 30 28 78 5a 5c 0a 15 48 65 61 6c 74 68 43 68 65 63 6b 2f 41 6e 61 6c 79 73 69 6e 67 12 15 48 65 61 6c 74 68 43 68 65 63 6b 2f 41 6e 61 6c 79 73 69 6e 67 1a 0a 08 80 cc f4 ae 06 10 01 18 00 2a 09 08 00 10 00 1a 03 31 2d 61 32 15 6d 6d 6d 5f 63 63 6c 5f 30 30 33 5f 39 39 39 5f 62 38 62 5f 6d 60 01 22 46 12 0a 36 2e 32 31 2e 31 30 39 31 38 Data Ascii: hB@0FB1F1D02E97E8CA460C692444D99CAAD2E04B77141C37B79CE13B1CB95E632BJ$5b6bb5ba-fc1d-485b-9a32-62e4cfdc28b6;HealthCheckNF0(xZ\HealthCheck/AnalysingHealthCheck/Analysing*1-a2mmm_ccl_003_999_b8b_m`"F6.21.10918
2024-02-27 17:39:41 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 27 Feb 2024 17:39:41 GMT Content-Type: application/octet-stream Content-Length: 24 X-ASW-Receiver-Ack: processed Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-27 17:39:41 UTC	24	IN	Data Raw: 52 65 63 65 69 76 65 72 2d 41 63 6b 3a 20 70 72 6f 63 65 73 73 65 64 0a Data Ascii: Receiver-Ack: processed

Target ID:	0
Start time:	18:37:36
Start date:	27/02/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff765570000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:37:58
Start date:	27/02/2024
Path:	C:\Users\user\Desktop\ccsetup621.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ccsetup621.exe"
Imagebase:	0x400000
File size:	79'156'784 bytes
MD5 hash:	D95266F76CEC3966255AA2B586693DD8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:37:58
Start date:	27/02/2024
Path:	C:\Users\user\Desktop\ccsetup621.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ccsetup621.exe"
Imagebase:	0x400000
File size:	79'156'784 bytes
MD5 hash:	D95266F76CEC3966255AA2B586693DD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:38:30
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC
Imagebase:	0x7ff6e1d40000
File size:	45'018'016 bytes
MD5 hash:	ED9773FFAC49BB95523BB5044924B108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:38:35
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\CCleaner\CCUpdate.exe" /reg
Imagebase:	0x9a0000
File size:	714'256 bytes
MD5 hash:	0F0B90A01F049665CA511335F9F0BF2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:38:38
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCUpdate.exe
Wow64 process (32bit):	true
Commandline:	CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\04b982fa-35dc-4ddc-b3c2-fd5815173744.dll"
Imagebase:	0x9a0000
File size:	714'256 bytes
MD5 hash:	0F0B90A01F049665CA511335F9F0BF2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:38:39
Start date:	27/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:38:39
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\CCleaner\CCleaner64.exe"
Imagebase:	0x7ff6e1d40000
File size:	45'018'016 bytes
MD5 hash:	ED9773FFAC49BB95523BB5044924B108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	18:38:39
Start date:	27/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1984,i,18427538024496017406,4920338381488815578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:38:52
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\CCleaner\CCleaner64.exe"
Imagebase:	0x7ff6e1d40000
File size:	45'018'016 bytes
MD5 hash:	ED9773FFAC49BB95523BB5044924B108
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:38:52
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\CCleaner\CCleaner.exe" /uac
Imagebase:	0x4b0000
File size:	38'778'272 bytes
MD5 hash:	09CBECE85B34B40B5D330654575F9EF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	18:38:55
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Imagebase:	0x7ff6e1d40000
File size:	45'018'016 bytes
MD5 hash:	ED9773FFAC49BB95523BB5044924B108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	18:39:17
Start date:	27/02/2024
Path:	C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a
Imagebase:	0x840000
File size:	234'936 bytes
MD5 hash:	0CCDF8EDAF3A0FB11856FEE1690E2957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	18:39:19
Start date:	27/02/2024
Path:	C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\asw.d2a83021bf4cad31\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:a08dcfa1-7b47-48ad-af19-cdaa4e470b06 /edat_dir:C:\Windows\Temp\asw.d2a83021bf4cad31
Imagebase:	0x600000
File size:	1'553'920 bytes
MD5 hash:	62D68511172418FBE4A8C75E1BE49913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	18:39:28
Start date:	27/02/2024
Path:	C:\Program Files\CCleaner\CCleaner64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\CCleaner\CCleaner.exe" /uac
Imagebase:	0x7ff6e1d40000
File size:	45'018'016 bytes
MD5 hash:	ED9773FFAC49BB95523BB5044924B108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.4%
Total number of Nodes:	54
Total number of Limit Nodes:	11

Executed Functions

Function 6BC8CFD0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 275
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(68003E89,00000000,00000000), ref: 6BC8D056
CreateFileW.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000000,00000000,?,\\.\PhysicalDrive,00000011), ref: 6BC8D137
GetLastError.KERNEL32(?,\\.\PhysicalDrive,00000011), ref: 6BC8D145
CloseHandle.KERNEL32(?,?,?,?,00000011), ref: 6BC8D2F5

Strings

\\.\PhysicalDrive, xrefs: 6BC8D072

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastVersion
String ID: \\.\PhysicalDrive
API String ID: 1515857667-1035684025
Opcode ID: eb50fbb7c7b12b1e168f2cfa0c2b69763a50caeebf67f92f7cb19040dddb457e
Instruction ID: 4385a7f534bf973d8ec43c8586869a95e290ed6d9ed1d500ba5ea37cbb8fa7be
Opcode Fuzzy Hash: eb50fbb7c7b12b1e168f2cfa0c2b69763a50caeebf67f92f7cb19040dddb457e
Instruction Fuzzy Hash: 44A1B570D50244EBDB14CFA8CC45B9EBBB1FF45718F10422EE515AB280FB78AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BC8CD00 Relevance: 12.2, APIs: 8, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 6BC8CDC1
GetLastError.KERNEL32 ref: 6BC8CDCD
GetVolumePathNameW.KERNEL32(00000000,?,?,00000104,00000000,00000000,00000000), ref: 6BC8CE50
GetVolumeNameForVolumeMountPointW.KERNEL32(?,6BD1D0CD,?,00000104,00000000,?,?), ref: 6BC8CED4

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: Volume$Name$DirectoryErrorLastMountPathPointSystem
String ID:
API String ID: 623255257-0
Opcode ID: 9488e0db7ab6d841ed6d8f1498b76e3762a9bba44729349b77088b1ab95f99d1
Instruction ID: ea862eec93d6f43306010f23464a293ddfbf33629f094a79f99709278f1d9c82
Opcode Fuzzy Hash: 9488e0db7ab6d841ed6d8f1498b76e3762a9bba44729349b77088b1ab95f99d1
Instruction Fuzzy Hash: 33910471E10248DFDF14DFE8C894AEEBBB4BF49718F14412AE505BB280E7746A45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BC9CE00 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BCCF920: SetLastError.KERNEL32(00000000), ref: 6BCCF9BC

GetLastError.KERNEL32(?,?,?,?,68003E89), ref: 6BC9CF47
SetLastError.KERNEL32(?,?,?,?,?,68003E89), ref: 6BC9CF5B

Strings

installTimestamp, xrefs: 6BC9CE76
stoll argument out of range, xrefs: 6BC9D19E, 6BC9D1B2
invalid stoll argument, xrefs: 6BC9CEA1, 6BC9CEAC, 6BC9D194, 6BC9D1A8

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: ErrorLast
String ID: installTimestamp$invalid stoll argument$stoll argument out of range
API String ID: 1452528299-933472524
Opcode ID: 8edc443f388b0564dd5829a7693fc9b86c31ecaeaa1455066f816c2220c9756f
Instruction ID: 39f99419aaae6d3e9c3df043117b28577bae632c2dd2ff71ac27cb24663393a2
Opcode Fuzzy Hash: 8edc443f388b0564dd5829a7693fc9b86c31ecaeaa1455066f816c2220c9756f
Instruction Fuzzy Hash: 7BB125B1C20219DBEF04DFE8E845BDEBBB4BF55318F10425AE415BB240EB782A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BCCEE80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000057,68003E89,00000000,?), ref: 6BCCEEC2
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,?,00000000,68003E89,00000000,?), ref: 6BCCEF15
SetLastError.KERNEL32(00000000), ref: 6BCCEF20

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 6BCCEF13

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$Open
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 1333505713-1023437679
Opcode ID: b32f708e78eeb7dc6cf7af3ed147244ed5ffa668bbe1838308dba2c80c604b57
Instruction ID: 866e306a37c859ebafd3a9e4659222c7368aac9fcaeaafaf579b10b05bbfe642
Opcode Fuzzy Hash: b32f708e78eeb7dc6cf7af3ed147244ed5ffa668bbe1838308dba2c80c604b57
Instruction Fuzzy Hash: 2A619D71D162299EEB24CF64CC99BDEB7B4FB15304F1041DAD819A7280E7786B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C37454 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,000F003F,?,69C371C5), ref: 69C3745E
OpenServiceW.ADVAPI32(00000000,CCleanerPerformanceOptimizerService,000F01FF,?,?,69C371C5), ref: 69C3747A
CloseServiceHandle.ADVAPI32(00000000,?,?,69C371C5), ref: 69C37483

Strings

CCleanerPerformanceOptimizerService, xrefs: 69C37474

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: OpenService$CloseHandleManager
String ID: CCleanerPerformanceOptimizerService
API String ID: 4136619037-3211844608
Opcode ID: 731d4584415a4dfed2e5f765bf395fd8e0bb63a777273358859ea40d5ff1e66e
Instruction ID: d6c3a182b61d4eeb19f46e7445ac7695363fec62f327a619eef59568a44364f5
Opcode Fuzzy Hash: 731d4584415a4dfed2e5f765bf395fd8e0bb63a777273358859ea40d5ff1e66e
Instruction Fuzzy Hash: 88D0C23238063172CA3116697C0EFAE2A749BC2F62F910015FB19AA1889A608443A1A1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCCA870 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BCCA9A0: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,6BCCA88F), ref: 6BCCA9BC
Part of subcall function 6BCCA9A0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,6BCCA88F), ref: 6BCCA9DD

SetEvent.KERNEL32(00000000), ref: 6BCCA890

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: Event$CloseCreateHandle
String ID:
API String ID: 585692533-0
Opcode ID: 599291315d4bc101c9519d53fc0eb91c280a6e7ccf948d70472bf2149451d0e1
Instruction ID: 1c220653d16fdaea394e73267098914fd10cbf33f4f13bdefc11b902c4564829
Opcode Fuzzy Hash: 599291315d4bc101c9519d53fc0eb91c280a6e7ccf948d70472bf2149451d0e1
Instruction Fuzzy Hash: DA411B34A0120ACFDF04CF64C49566EBBB1BF89314F5540A9E516AB344EB38EA45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6BC9CB60 Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000001,68003E89), ref: 6BC9CBCF

Memory Dump Source

Source File: 0000000F.00000002.2079521051.000000006BC63000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BC60000, based on PE: true

Associated: 0000000F.00000002.2079403577.000000006BC60000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2086375983.000000006BD25000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088015496.000000006BD52000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088087330.000000006BD53000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088170567.000000006BD54000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088238604.000000006BD55000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088675486.000000006BD5F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2088843239.000000006BD63000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6bc60000_ccsetup621.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c7f6b019dc790e817653ebb20bd8db774b2b353db585929754c8010ade270df7
Instruction ID: 8df7d72a9a1536f6b9662e81ab0428600438d25108b0ab7dc4f8046529cc522c
Opcode Fuzzy Hash: c7f6b019dc790e817653ebb20bd8db774b2b353db585929754c8010ade270df7
Instruction Fuzzy Hash: 18119672C14658DBDB11DF98E941B9EF7B4EB0A728F10425AE818AB640E73696C4CBC1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 69C04470 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 69C04476
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 69C04484
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 69C04495
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 69C044A6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 69C044B7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 69C044C8
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 69C044D9
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 69C044EA
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 69C044FB
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 69C0450C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 69C0451D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 69C0452E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 69C0453F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 69C04550
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 69C04561
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 69C04572
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 69C04583
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 69C04594
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 69C045A5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 69C045B6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 69C045C7
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 69C045D8
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 69C045E9
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 69C045FA
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 69C0460B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 69C0461C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 69C0462D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 69C0463E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 69C0464F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 69C04660
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 69C04671
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 69C04682
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 69C04693
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 69C046A4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 69C046B5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 69C046C6
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 69C046D7
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 69C046E8
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 69C046F9
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 69C0470A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 69C0471B

Strings

FlushProcessWriteBuffers, xrefs: 69C04589
CreateSymbolicLinkW, xrefs: 69C045C1
FreeLibraryWhenCallbackReturns, xrefs: 69C0459A
SetFileInformationByHandle, xrefs: 69C04600
GetCurrentPackageId, xrefs: 69C045CD
SleepConditionVariableSRW, xrefs: 69C046AA
CloseThreadpoolWait, xrefs: 69C04578
SetThreadpoolWait, xrefs: 69C04567
AcquireSRWLockExclusive, xrefs: 69C04677
FlsSetValue, xrefs: 69C044AC
CompareStringEx, xrefs: 69C046EE
SubmitThreadpoolWork, xrefs: 69C046CC
CloseThreadpoolWork, xrefs: 69C046DD
GetSystemTimePreciseAsFileTime, xrefs: 69C04611
SleepConditionVariableCS, xrefs: 69C04655
GetTickCount64, xrefs: 69C045DE
CreateSemaphoreExW, xrefs: 69C04501
FlsAlloc, xrefs: 69C0447E
InitializeSRWLock, xrefs: 69C04666
CreateThreadpoolWork, xrefs: 69C046BB
WaitForThreadpoolTimerCallbacks, xrefs: 69C04534
FlsFree, xrefs: 69C0448A
CreateThreadpoolWait, xrefs: 69C04556
CreateEventExW, xrefs: 69C044DF
GetLocaleInfoEx, xrefs: 69C046FF
CloseThreadpoolTimer, xrefs: 69C04545
InitializeCriticalSectionEx, xrefs: 69C044BD
InitOnceExecuteOnce, xrefs: 69C044CE
CreateThreadpoolTimer, xrefs: 69C04512
ReleaseSRWLockExclusive, xrefs: 69C04699
GetCurrentProcessorNumber, xrefs: 69C045AB
InitializeConditionVariable, xrefs: 69C04622
kernel32.dll, xrefs: 69C04471
WakeAllConditionVariable, xrefs: 69C04644
LCMapStringEx, xrefs: 69C04710
WakeConditionVariable, xrefs: 69C04633
TryAcquireSRWLockExclusive, xrefs: 69C04688
GetFileInformationByHandleEx, xrefs: 69C045EF
FlsGetValue, xrefs: 69C0449B
SetThreadpoolTimer, xrefs: 69C04523
CreateSemaphoreW, xrefs: 69C044F0

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: a46b569ad944b885f95f67abfea61f6546143a140c0fb12d91902f660183700d
Instruction ID: f0970d75bb167954e081c782fdb4be12ee24160ca550d20555798933e057a1ed
Opcode Fuzzy Hash: a46b569ad944b885f95f67abfea61f6546143a140c0fb12d91902f660183700d
Instruction Fuzzy Hash: E761FBB1852EB0FBCF11AFB59B4C89D7BB8EA5B2053C18527F612E2105E77441128F93

Uniqueness

Uniqueness Score: -1.00%

Function 69C37526 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 151serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 69C37541
OpenServiceW.ADVAPI32(00000000,CCleanerPerformanceOptimizerService,000F01FF), ref: 69C37563
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 69C37581
CloseServiceHandle.ADVAPI32(00000000), ref: 69C3759E
CloseServiceHandle.ADVAPI32(00000000), ref: 69C376E5

Strings

CCleanerPerformanceOptimizerService, xrefs: 69C3755D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus
String ID: CCleanerPerformanceOptimizerService
API String ID: 2623946379-3211844608
Opcode ID: 9d2dd917d9224f4412284142b31eddb10b47394f30116232179e9722ec0aca78
Instruction ID: 50e1cef31e058ae5421936615e20f8b12c7adcc5d56008e8b3c9ca325dfff471
Opcode Fuzzy Hash: 9d2dd917d9224f4412284142b31eddb10b47394f30116232179e9722ec0aca78
Instruction Fuzzy Hash: 3F517AB4109755EFD620DF259A9896F7BF8FF8A744F804829F565D2100EB30C90ADB63

Uniqueness

Uniqueness Score: -1.00%

Function 69C37700 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 69C37765: GetTickCount64.KERNEL32 ref: 69C3777C
Part of subcall function 69C37765: OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 69C37793

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,69C371EE), ref: 69C37714
OpenServiceW.ADVAPI32(00000000,CCleanerPerformanceOptimizerService,00010000,?,?,?,69C371EE), ref: 69C3772C
DeleteService.ADVAPI32(00000000,?,?,?,69C371EE), ref: 69C37739
CloseServiceHandle.ADVAPI32(00000000,?,?,?,69C371EE), ref: 69C37744
CloseServiceHandle.ADVAPI32(00000000,?,?,?,69C371EE), ref: 69C3774E
CloseServiceHandle.ADVAPI32(00000000,?,?,?,69C371EE), ref: 69C37755

Strings

CCleanerPerformanceOptimizerService, xrefs: 69C37726

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Service$CloseHandleOpen$Manager$Count64DeleteTick
String ID: CCleanerPerformanceOptimizerService
API String ID: 3797081036-3211844608
Opcode ID: 3a9f2ec08b50fca060e80d39e41d7d0205aa3548d2885a336197862ca5c12b92
Instruction ID: 4daee3e7734d02f01885d2f007486155fe300757cf74c6d7c875cf1cb240b1f3
Opcode Fuzzy Hash: 3a9f2ec08b50fca060e80d39e41d7d0205aa3548d2885a336197862ca5c12b92
Instruction Fuzzy Hash: 9AF089B9141975FBCA2317665D98EFE27B86B87A957800010FA2192204AB14C807F576

Uniqueness

Uniqueness Score: -1.00%

Function 69C3099F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

GetACP.KERNEL32 ref: 69C30A60
IsValidCodePage.KERNEL32(00000000), ref: 69C30A8B
_wcschr.LIBVCRUNTIME ref: 69C30B1F
_wcschr.LIBVCRUNTIME ref: 69C30B2D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 69C30BF4

Strings

utf8, xrefs: 69C30B5D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 8a63f86cd06ff605f645f5a7f105504b3b951aa15a01e1906d3f8dafc79716bf
Instruction ID: 6ab38fd44f1799169972135f5c12e423e2830e54e7100f211c2478a9a7895bde
Opcode Fuzzy Hash: 8a63f86cd06ff605f645f5a7f105504b3b951aa15a01e1906d3f8dafc79716bf
Instruction Fuzzy Hash: 4B710337600626ABE714DB39FD41BAB73A8FF45758F90806AE905DB1C0FB70E9008761

Uniqueness

Uniqueness Score: -1.00%

Function 69BECBF0 Relevance: 10.3, Strings: 8, Instructions: 278COMMON

Download Yara Rule

Strings

3333, xrefs: 69BECC76
3333, xrefs: 69BECD8C
3333, xrefs: 69BECDA3
3333, xrefs: 69BECD20
3333, xrefs: 69BECD71
3333, xrefs: 69BECD56
3333, xrefs: 69BECD3B
3333, xrefs: 69BECDB6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID: 3333$3333$3333$3333$3333$3333$3333$3333
API String ID: 0-2146181447
Opcode ID: 5f50e6c4e423deef935561a16f88d4c608f80aa14f7acad701d1f58b56c87654
Instruction ID: 5c67a570e2ad39b68557c241beb8bf1cc5b9dd6d608482f35000e0a785c50399
Opcode Fuzzy Hash: 5f50e6c4e423deef935561a16f88d4c608f80aa14f7acad701d1f58b56c87654
Instruction Fuzzy Hash: 9A81B436B042484FDF18CEADD59136EBBE6EBC8360F29C57ED44AC7B90DA3558019782

Uniqueness

Uniqueness Score: -1.00%

Function 69C31E7F Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 69C3203B

Strings

1#INF, xrefs: 69C33336
1#IND, xrefs: 69C33318
1#SNAN, xrefs: 69C33322
1#QNAN, xrefs: 69C3332C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a4c1a7537e655c5ab9a0608f1505fa35c4e3cf796bacf0a5233ac0f60af2ee34
Instruction ID: 137d65561d0c710ba004ac1fe0e53539827e6d3aac501ba356765432851f8662
Opcode Fuzzy Hash: a4c1a7537e655c5ab9a0608f1505fa35c4e3cf796bacf0a5233ac0f60af2ee34
Instruction Fuzzy Hash: A9D22871E082298BDF65CE28ED507DAB7B5FB49345F9441EAD40DE7240E734AE828F81

Uniqueness

Uniqueness Score: -1.00%

Function 69C31146 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 69C311DF
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 69C31208
GetACP.KERNEL32 ref: 69C3121D

Strings

ACP, xrefs: 69C31164
OCP, xrefs: 69C3119A

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 60fc749e11e94ea15843cce69e69b240c41e7bef531417c44fdf6fb74471d53d
Instruction ID: 6711b1f8d610da332882da1d816f06196d4372b6c94309919cd14b60345fa3e8
Opcode Fuzzy Hash: 60fc749e11e94ea15843cce69e69b240c41e7bef531417c44fdf6fb74471d53d
Instruction Fuzzy Hash: F121C532B44120AEE7208F6DFA01AE772B6FF45B64BC28424E949D7101F732D942C390

Uniqueness

Uniqueness Score: -1.00%

Function 69C3131B Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26AF7
Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26B2D

GetUserDefaultLCID.KERNEL32 ref: 69C31427
IsValidCodePage.KERNEL32(00000000), ref: 69C31470
IsValidLocale.KERNEL32(?,00000001), ref: 69C3147F
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 69C314C7
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 69C314E6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 67441ff70720ceab26fddd430938d360b721655b15927129039201ec0a8d372f
Instruction ID: 6c64c3fd67ba5cb3f648c2ff9eeb4f19461ef74e07e8b8b2dea3574f18fb25c3
Opcode Fuzzy Hash: 67441ff70720ceab26fddd430938d360b721655b15927129039201ec0a8d372f
Instruction Fuzzy Hash: 38516176A00625AFEF10DFA9EC40ABE77B8FF49700F848529E515EB140F7709A418B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A0F58B Relevance: 6.8, Strings: 5, Instructions: 529COMMON

Download Yara Rule

Strings

C:\P, xrefs: 00A0F643
x86, xrefs: 00A0F766
C:\U, xrefs: 00A0F7AB
C:\P, xrefs: 00A0F8C7
C:\U, xrefs: 00A0F93B

Memory Dump Source

Source File: 0000000F.00000003.1536889889.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, Offset: 00A0C000, based on PE: false

Associated: 0000000F.00000003.1539109334.0000000000A0C000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_a0c000_ccsetup621.jbxd

Similarity

API ID:
String ID: C:\P$C:\P$C:\U$C:\U$x86
API String ID: 0-3391335769
Opcode ID: 3efd140938084f393ba515b001d5ca0ccf16b229419187c6eac22c426874ea92
Instruction ID: d4c013c303b5aa7625c31e6ab8e676fe63d7d3db17d4bd2a87afc5ea9bb3d0cc
Opcode Fuzzy Hash: 3efd140938084f393ba515b001d5ca0ccf16b229419187c6eac22c426874ea92
Instruction Fuzzy Hash: 29F1A86500E7C82FD7278B716D695A17F74AE2370470E86EFC4C28B8E3D219991AC367

Uniqueness

Uniqueness Score: -1.00%

Function 69C18699 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 69C186A5
IsDebuggerPresent.KERNEL32 ref: 69C18771
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 69C18791
UnhandledExceptionFilter.KERNEL32(?), ref: 69C1879B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 53a54c57eeda3dbdd8dabb6b31ae983cd169715a7692fe736813163d15f85645
Instruction ID: f5f64d7fede3898d5d44702aeecdcbba1526b087c41c0f309e6d2b04c12027b5
Opcode Fuzzy Hash: 53a54c57eeda3dbdd8dabb6b31ae983cd169715a7692fe736813163d15f85645
Instruction Fuzzy Hash: 01312975D0921CDBDF20DFA4D989BCCBBB8AF08704F1040AAE40DAB250EB705A85DF45

Uniqueness

Uniqueness Score: -1.00%

Function 69BF5DA0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 432COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 69BF632D
___std_exception_destroy.LIBVCRUNTIME ref: 69BF6358

Strings

invalid type specifier, xrefs: 69BF6319

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: invalid type specifier
API String ID: 2970364248-1382033351
Opcode ID: e6b0edaeec7e25a16e9429627f01c00cb7dc7db5ee7b6a5759569f992d4d74fc
Instruction ID: 2b46348ad53b352a076dd1c39ce6928f4cffa4a140c8747f4a6e0238dc0c0575
Opcode Fuzzy Hash: e6b0edaeec7e25a16e9429627f01c00cb7dc7db5ee7b6a5759569f992d4d74fc
Instruction Fuzzy Hash: D9026E75E00248CFCB18CF98C980AAEBBF6FF99310F148569E859A7345D730E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 69BF85B0 Relevance: 5.5, APIs: 3, Instructions: 1000COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 69BF90B6
Concurrency::cancel_current_task.LIBCPMT ref: 69BF91C6
Concurrency::cancel_current_task.LIBCPMT ref: 69BF92D6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 360f52620436a95660f078f26b5c27cec6dea77c64a8dbb173aaa4f51ba7e2fb
Instruction ID: 7f100c62b14aaed679eb5f9ce810b50e4fe771203397828121bb1d66b8cf8f7c
Opcode Fuzzy Hash: 360f52620436a95660f078f26b5c27cec6dea77c64a8dbb173aaa4f51ba7e2fb
Instruction Fuzzy Hash: 7482AD75A012698FDB24CF29CC94B9DB7B5FF45304F1041E9D80AA7291EB319E8ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C30DC0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26AF7
Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26B2D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C30E14
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C30E5E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C30F24

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 0dc9fe57ee03cc3c1a2cf323594cf1f1c5ea051a2fd730f7d55941b4aaae8a2b
Instruction ID: 34e447e48097c323fc8b2c12c570cd4ffe28fc40c79e579fadc54cb184b97005
Opcode Fuzzy Hash: 0dc9fe57ee03cc3c1a2cf323594cf1f1c5ea051a2fd730f7d55941b4aaae8a2b
Instruction Fuzzy Hash: 3461B172654227DFEB18DF28E982BAA73B8FF08344F90807AE855C6580FB74D941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 69C2D87E Relevance: 4.7, APIs: 3, Instructions: 167timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,69C2DA9F,?,?,00000000), ref: 69C2D8F0
_free.LIBCMT ref: 69C2D8DE

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C2DAA8

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: 55ac2f5790f2d6a5f62b5417385d59a32542a0d2a3dd7f514b78ff9bb15cf403
Instruction ID: 815fd519b43f7bfe94633e356fa86c8f3aec9e52d63e841248641a8ab972adb5
Opcode Fuzzy Hash: 55ac2f5790f2d6a5f62b5417385d59a32542a0d2a3dd7f514b78ff9bb15cf403
Instruction Fuzzy Hash: 7E51E5B6C04215EBDB10EF69EC04A8E7BB8EF55364F10C1A7E414A7150FB309A51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C200EE Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 69C201E6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 69C201F0
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 69C201FD

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 468cf2f20d5f2c2bb56e468e5f650f81685f07c09d75acf2e1b5fb38f0bad21c
Instruction ID: 855e2b4ce89db45913ba022c248743d6b12de9ecae43394f5dca8ea0fafe9f68
Opcode Fuzzy Hash: 468cf2f20d5f2c2bb56e468e5f650f81685f07c09d75acf2e1b5fb38f0bad21c
Instruction Fuzzy Hash: B131C37490122CEBCB21DF68D988BDDBBB8BF08310F5051EAE41CA7251E7709B859F55

Uniqueness

Uniqueness Score: -1.00%

Function 69C25780 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,69C2577F,?,00000001,?,?), ref: 69C257A2
TerminateProcess.KERNEL32(00000000,?,69C2577F,?,00000001,?,?), ref: 69C257A9
ExitProcess.KERNEL32 ref: 69C257BB

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 261d5f429bb68bf620c980b8f6d611c2dc8046dbddb20e7d90c09e6affaae381
Instruction ID: 069e702e4f7eb2cbb8031608d9add7b621cb8016d7ba31ba5d8a9a0fe1ca3102
Opcode Fuzzy Hash: 261d5f429bb68bf620c980b8f6d611c2dc8046dbddb20e7d90c09e6affaae381
Instruction Fuzzy Hash: 32E08C3A050588EFCF11AF11DA0CA5A3B79FB82641F104424F80AC6124EB35DC42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 69C1FB90 Relevance: 3.4, APIs: 2, Instructions: 450COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933371160ddaa7fdf22896c798ee132c3b252676d7347017852abcd2e5122003
Instruction ID: df678ae1f2a2ed4010c0e8842768c54ca555badbbf7336cc88cae8a6cc370a4e
Opcode Fuzzy Hash: 933371160ddaa7fdf22896c798ee132c3b252676d7347017852abcd2e5122003
Instruction Fuzzy Hash: C7F18F71E042199FDF14CFA8D99069EFBF1FF88314F14826AD819AB345E730AA01DB94

Uniqueness

Uniqueness Score: -1.00%

Function 69BFC0F0 Relevance: 2.3, APIs: 1, Instructions: 763COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 69BFC9F9

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9fcc20a380f6596b36e4d730ee9a4e686bd4c5d1e3c6111f1e1843f395d5e961
Instruction ID: 101d8e980552e36ccf7f7611372d463656451936638140030b1063aff709b2f9
Opcode Fuzzy Hash: 9fcc20a380f6596b36e4d730ee9a4e686bd4c5d1e3c6111f1e1843f395d5e961
Instruction Fuzzy Hash: E1529371E042898FDF15CFA8C89069DBBB2FF89354F24862DD415EB395E7309986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C2B72C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,69C2B727,?,?,00000008,?,?,69C348FA,00000000), ref: 69C2B959

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4683ebe99b50fdf3177486476186789e09948373788702777c258033289b0c28
Instruction ID: b19b54dd4a689646d00284880b9de958fd55525619be10591347083235c7b0e3
Opcode Fuzzy Hash: 4683ebe99b50fdf3177486476186789e09948373788702777c258033289b0c28
Instruction Fuzzy Hash: C5B15936610609DFD714CF28D486BA47BF0FF46365F258668E8A9CF2A1D335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 69C187BC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 69C187D2

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5d1ac4a581473ada5f3e78cf8ec77625011bc97798e9b7db8974d9503b232c5e
Instruction ID: af22adc9d2d7b902fb3b63433b4b84c7e74e44f424bdab531d3c95e4dd4d3a84
Opcode Fuzzy Hash: 5d1ac4a581473ada5f3e78cf8ec77625011bc97798e9b7db8974d9503b232c5e
Instruction Fuzzy Hash: A551AFB1A19609CFEF05CF55D981BAABBF1FB49350F24852AC404FB244E3B59921CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C2DE76 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529c917f3d3e9d3d203afa32f06660640ae1761212f9d15e486839118dc91eca
Instruction ID: 30d7ef8456e3b10fe542e62118c4a065ab16d08a61d8db3fb40b0143096a825e
Opcode Fuzzy Hash: 529c917f3d3e9d3d203afa32f06660640ae1761212f9d15e486839118dc91eca
Instruction Fuzzy Hash: 8141C4B5804218AFDB10DF69DC89AEABBB8EF55304F1442DEE41DD3200EA349E858F50

Uniqueness

Uniqueness Score: -1.00%

Function 69BF5390 Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

., xrefs: 69BF53C1

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 51eb460fc5b85eba218e3092650e7e69dbec2a8f8f89d88b47dd3a7e7546712a
Instruction ID: ddaebf7f6c6b6861e3e31d3fddf37727146283b3062d127a5e8e50a994985318
Opcode Fuzzy Hash: 51eb460fc5b85eba218e3092650e7e69dbec2a8f8f89d88b47dd3a7e7546712a
Instruction Fuzzy Hash: 82D15975E0025D9FCF05CFA8D9906EEBBB6FF88314F14816AD825E7241E770994A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 69C31020 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26AF7
Part of subcall function 69C26A95: _free.LIBCMT ref: 69C26B2D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 69C31074

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5ee8198b34e98d89a575422eec23a563e56d7ac5d6b483b34d06662538c0fd4a
Instruction ID: 6aa88d56512c42c3684a7294c9e7b7139649c523bd700ed1564c6a8c226630a2
Opcode Fuzzy Hash: 5ee8198b34e98d89a575422eec23a563e56d7ac5d6b483b34d06662538c0fd4a
Instruction Fuzzy Hash: E021C276618256EFEB18CB2EED42AAA73BCEF45314F90907AED05D7140FB34E9008B50

Uniqueness

Uniqueness Score: -1.00%

Function 69C30C92 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

EnumSystemLocalesW.KERNEL32(69C30DC0,00000001), ref: 69C30D04

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 622f89b24b54295b72bb02bea195ec596968d5d4f067734d74095d87166c8518
Instruction ID: 97145b4a862622ba0653e36f2593742efd5feb2d9002bce9c0ac866bb38da522
Opcode Fuzzy Hash: 622f89b24b54295b72bb02bea195ec596968d5d4f067734d74095d87166c8518
Instruction Fuzzy Hash: 0C11253B2047059FEB08DF38E9915AABBA2FF80359B54882CD98787A00E731B902C740

Uniqueness

Uniqueness Score: -1.00%

Function 69C3124C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,69C30FDC,00000000,00000000,?), ref: 69C31278

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b57dd5465cfb4c2fa105c797a703726a1b14a80bd8af96aad5ec7018caa900d9
Instruction ID: 87dd7daa50bd94a3c51cce2649983ede0156adbf3e59c1152bc4b8476dc5a887
Opcode Fuzzy Hash: b57dd5465cfb4c2fa105c797a703726a1b14a80bd8af96aad5ec7018caa900d9
Instruction Fuzzy Hash: 31F0F436A00122AFDF149A2AE846BBB37A8FF40358F418528DC16E3180FE35FA01C790

Uniqueness

Uniqueness Score: -1.00%

Function 69C30D2D Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

EnumSystemLocalesW.KERNEL32(69C31020,00000001), ref: 69C30D77

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0a9321b1695f9eee496526298ff367c4e1b8b23c61de99b987b69a6c500ede21
Instruction ID: d934edba752a4122e3c6ae210b3a3a5a8e895bc00d4bed070b5f86b6ca4f181c
Opcode Fuzzy Hash: 0a9321b1695f9eee496526298ff367c4e1b8b23c61de99b987b69a6c500ede21
Instruction Fuzzy Hash: 04F0F637204318AFE714DF39E881A6B7BE1FF81368B55842DE9458B640E771A802C750

Uniqueness

Uniqueness Score: -1.00%

Function 69C296DD Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 69C21EF1: EnterCriticalSection.KERNEL32(?,?,69C255F8,?,69C52370,00000008,69C2576F,00000001,?,?), ref: 69C21F00

EnumSystemLocalesW.KERNEL32(Function_000496D0,00000001,69C524F0,0000000C,69C29B3B,?), ref: 69C29715

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f07fb1ba2788c40e1dbf70208ae1348662296a023bd9a8e7940019713b4074f5
Instruction ID: f684dfc092e4270144d0450d53050d914588786c36b563c776f127efd79adc43
Opcode Fuzzy Hash: f07fb1ba2788c40e1dbf70208ae1348662296a023bd9a8e7940019713b4074f5
Instruction Fuzzy Hash: 2BF0907AA04208DFDB10DF98E885BAD77F0FB49324F10902AE411EB390EB755951DF61

Uniqueness

Uniqueness Score: -1.00%

Function 69C30C47 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 69C26A95: GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
Part of subcall function 69C26A95: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

EnumSystemLocalesW.KERNEL32(69C30BA0,00000001), ref: 69C30C7E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5a21ef891bf97bf708aa12b73b6b5a8f16472da211f4bf3fc89510c1cb60f136
Instruction ID: 87587648a870a23588cce6b0b6682561e410310292451014913fba555b714793
Opcode Fuzzy Hash: 5a21ef891bf97bf708aa12b73b6b5a8f16472da211f4bf3fc89510c1cb60f136
Instruction Fuzzy Hash: EEF0E53A30021957CB14DF35E95676A7FA4FFC2754F868059EA058B240E6319942C791

Uniqueness

Uniqueness Score: -1.00%

Function 69C1727C Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,69C14FA2,00000000,000000FF,00000004,69C13BBD,000000FF,00000004,69C13FE7,00000000,00000000), ref: 69C17294

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a419e578aec2be120143a5da0dd3c66cbc999785891992f7c82b2e2fdac189d7
Instruction ID: 6ca3893898c1cce2d0786d1fc616d07eea7b7764ebcbe959fd8ca7ed229a72c0
Opcode Fuzzy Hash: a419e578aec2be120143a5da0dd3c66cbc999785891992f7c82b2e2fdac189d7
Instruction Fuzzy Hash: 2EE0D8326A4205F5DB02CF79EE0BFBA76A8F70174AF104151F101E61D2F6A0C601B165

Uniqueness

Uniqueness Score: -1.00%

Function 69C29C96 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,00000000,00000002,?,?,?,69C2AFC6,?,00001004,?,00000002,00000000,?,00000000), ref: 69C29CCA

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6130ae4f21b555cd7a0739f56c90eb77ebcdf36b1deb65bfd5dd349ec8c92b30
Instruction ID: dcdae4fe5482b7d00e731e82693e8f1bb5e4f0dbe4473988f671a8427e47d25d
Opcode Fuzzy Hash: 6130ae4f21b555cd7a0739f56c90eb77ebcdf36b1deb65bfd5dd349ec8c92b30
Instruction Fuzzy Hash: 66E0863554062CBBCF126F61EE08FAE3F65FF45760F004020FC0566220DB329921EAD5

Uniqueness

Uniqueness Score: -1.00%

Function 69C371C0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: c09fe8bdd2860aaa001c97ab40066022ffaf7cde8f661416e33beaaa26c3eac9
Instruction ID: 65280f88e468365474d1fa8b5463a958b863fd2c455d783f371acd197b36881a
Opcode Fuzzy Hash: c09fe8bdd2860aaa001c97ab40066022ffaf7cde8f661416e33beaaa26c3eac9
Instruction Fuzzy Hash: 5AB0118A020232880C00A832330203E22800A820CEFC0A8E0A8E0EA00BFF08800A3030

Uniqueness

Uniqueness Score: -1.00%

Function 69C2EF90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 69C2EF90

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d172b46ea0d6da4f18f91f94a8abcc8a07244643381f3b9d2019d2dad896314d
Instruction ID: b27e279f3fcd7bdf460b944b09947eae525a8ea4485454b32ad0f814433c8f10
Opcode Fuzzy Hash: d172b46ea0d6da4f18f91f94a8abcc8a07244643381f3b9d2019d2dad896314d
Instruction Fuzzy Hash: E7A01270600580CB8B104E35420421C36F8654618038040145104C4000DB2080516602

Uniqueness

Uniqueness Score: -1.00%

Function 69C247BB Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 560e6339dd0ec2bc886de662a130ad99785c5e999ef40c559363222724d4faf7
Instruction ID: 6263ecaab6e9d89defd3fa5f565a04c297f35e2599d81bead4cd7389feb55009
Opcode Fuzzy Hash: 560e6339dd0ec2bc886de662a130ad99785c5e999ef40c559363222724d4faf7
Instruction Fuzzy Hash: 7E32AF74E0021ADFDB14CFA8DAD1AAEBBB5FF45304F144169DC45AB345E732AA06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C2BE69 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deccb4e31cefa01df188c0da1f0cab6e57957d5512853b26f051c9f572d45cd
Instruction ID: e82347eb10b27b492063a7001e368df83c613de59991a7ff42cae0e80f4ea770
Opcode Fuzzy Hash: 1deccb4e31cefa01df188c0da1f0cab6e57957d5512853b26f051c9f572d45cd
Instruction Fuzzy Hash: B6323832EA9F814DDB239534D922335A268AFB77C4F11D737E829B5A99EF29C0834101

Uniqueness

Uniqueness Score: -1.00%

Function 69BF4D30 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70d9686e3464f85fc039e4dc2b7fc4d050b5e802755170752f110d52b3a09a7
Instruction ID: bf3b4911ced1e4f83ad99c9507072666c9015a06b7a663e0214e3d123547a082
Opcode Fuzzy Hash: e70d9686e3464f85fc039e4dc2b7fc4d050b5e802755170752f110d52b3a09a7
Instruction Fuzzy Hash: DB228E72E002588BDF14CFACCD917ADBBB2EF88314F198229E419FB381E77559458B94

Uniqueness

Uniqueness Score: -1.00%

Function 69BF8160 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5231901b850a5574e39688048ab85ed1d89b067351744a0bae40d9380ca326e2
Instruction ID: 30fe8309195bc7d2e33f6d4632dd5392fb2ae9ab93c179788a748babac0c1d5f
Opcode Fuzzy Hash: 5231901b850a5574e39688048ab85ed1d89b067351744a0bae40d9380ca326e2
Instruction Fuzzy Hash: CAD16871F046858BDB18CFAED890AAEF7F2FB89340F14856DE41AA7341D775A8068B50

Uniqueness

Uniqueness Score: -1.00%

Function 69BF44A0 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45db0425fdc6a3c21bb800e4e3619493efb1827a026e6eca7571c2d96526c907
Instruction ID: ff18aa3b96e36ed6c2b2a2f8426921836bd5e0d2aae1341f9d4684d9b08e52a3
Opcode Fuzzy Hash: 45db0425fdc6a3c21bb800e4e3619493efb1827a026e6eca7571c2d96526c907
Instruction Fuzzy Hash: 84C1A435F002598BCF08CFACD9956EDB7F6EB88314F14817AD915E7391EB35990A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 69BF6FC0 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3cee50cf93bd20f901d777202587e5776d8ff50b442efa1bfb41adf0190d55
Instruction ID: e119e592fab0822735f5dcdc9d20f18e7e1d36c0e86f58e0927f45ce4a52bec6
Opcode Fuzzy Hash: cc3cee50cf93bd20f901d777202587e5776d8ff50b442efa1bfb41adf0190d55
Instruction Fuzzy Hash: C1D18275E0025D9FDF05CFA9D8806EEBBF5FF49310F1481AAE815E7241E7709A4A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 69BF4870 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efe9d2806b79a6ae9f8caea15c6628c1d391c17712d38b2d7d7bd8d88468e98
Instruction ID: 40e7eac4ba27bdd123a391e24fbc375c836f224262bdbcecfeb7d5bcd0ac8816
Opcode Fuzzy Hash: 7efe9d2806b79a6ae9f8caea15c6628c1d391c17712d38b2d7d7bd8d88468e98
Instruction Fuzzy Hash: A0D18D75E0025D9FDF05CFA9D9846EEBBF6FF89310F04812AD815E7241E7349A4A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 69C30450 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: 3a98967d08d8be4d738b3dab8fa5b8732502300c7bbe43b46551eb7f777d23eb
Instruction ID: b53c3fd6e1f999eb7a1c00211f5de1498be01d9a00d8ec1f5d1ea4854f2d4434
Opcode Fuzzy Hash: 3a98967d08d8be4d738b3dab8fa5b8732502300c7bbe43b46551eb7f777d23eb
Instruction Fuzzy Hash: E9B1147A5007118BD728DF29ED92BABB3B8FF45308F80856DD983C6980FB70A581CB10

Uniqueness

Uniqueness Score: -1.00%

Function 69C2109F Relevance: .2, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a800732296e7936b64db1eb52253d4ea576c74f629da866e1abf6b554448eb1d
Instruction ID: 5a02c93d3ffdc29de4b21f438ea121ba249c89a484042edbe84a09a75d7b4654
Opcode Fuzzy Hash: a800732296e7936b64db1eb52253d4ea576c74f629da866e1abf6b554448eb1d
Instruction Fuzzy Hash: EE51903464878856DB14C9ADBA917FE77AABF0334CF00842EE952D7282FB23D545C352

Uniqueness

Uniqueness Score: -1.00%

Function 69C1DC29 Relevance: .2, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca80d06dfcc2d941282d96b1b46f8692abe2800c8af3d99e7cfadbb3cec1c0c
Instruction ID: 3cc04012a8cd2418c196b544591ba4dbf0801a7bad74b07640f8feb87734e9cd
Opcode Fuzzy Hash: 5ca80d06dfcc2d941282d96b1b46f8692abe2800c8af3d99e7cfadbb3cec1c0c
Instruction Fuzzy Hash: 5851B271E04219EFDF04CF99D991AEEBBB2FF89304F088099E405AB241D7359A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 69C319EF Relevance: .1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0418f99cfa08ad8fdd59b8bdfa1451addc13c76bdeb2a55a1dda41f7775e88
Instruction ID: b0247877c83f4b38e90eaa36bf8d40ab31c3ea77c18c10beac6af5f9f903b0e3
Opcode Fuzzy Hash: 7e0418f99cfa08ad8fdd59b8bdfa1451addc13c76bdeb2a55a1dda41f7775e88
Instruction Fuzzy Hash: 7021B673F204394B7B0CC47ECC522BDB6E1D68C541745823AF8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 69C318CF Relevance: .1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471c7c91ab4b1b6721ab2a843ed57b7fb8e755452a68faec78bbbdba5956de0b
Instruction ID: 7dbb6c4c70b3a5ecc1f643d36b5b8613cccbf3eae1b3b0e6df2c377e0a66814d
Opcode Fuzzy Hash: 471c7c91ab4b1b6721ab2a843ed57b7fb8e755452a68faec78bbbdba5956de0b
Instruction Fuzzy Hash: B4117323F30C255A675C816D8C172AAA6D2EBD825074F533AD826E7284E9A4DE23D390

Uniqueness

Uniqueness Score: -1.00%

Function 69C19A60 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 957c6f22a3bfd0195b5f5f9a7ea355ef7b92f925300063e8a0b909636bd48497
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A911B97F24804243D204C72DF4F46ABE795FAC62257294379D0524B658F223D349B508

Uniqueness

Uniqueness Score: -1.00%

Function 69C1A997 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2150f4530c9e8ab29d6755d83aa8ff8100b7dc11cd7c03c98b7b9c0a930536
Instruction ID: 01431438e168f8daf367e2bcac0d92efd5774ded18ee27f1d75f4fdf293588d8
Opcode Fuzzy Hash: ae2150f4530c9e8ab29d6755d83aa8ff8100b7dc11cd7c03c98b7b9c0a930536
Instruction Fuzzy Hash: 47213336004F9ACFD77A9F689C4E408B261AE22B7832443DC80B49B2EDD3A78153DE54

Uniqueness

Uniqueness Score: -1.00%

Function 69C29FC7 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40606461861b761d6da631f99a6b6118ec2db9e436fad8824591022f94ef46f5
Instruction ID: 728a591d2738e9a8384f9d6556bfd7651a6633ca05c688390d29f9cc520fda72
Opcode Fuzzy Hash: 40606461861b761d6da631f99a6b6118ec2db9e436fad8824591022f94ef46f5
Instruction Fuzzy Hash: 15F06572A15334EBCB12CB4CEA45B49B3BCEB45B65F518056E502EB290E7B0DE40DBC0

Uniqueness

Uniqueness Score: -1.00%

Function 69C2A00B Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd0c3cc90af3fe034529652887614f0accaff867965658c9fbce0febb3d90b4
Instruction ID: 4e980239141cf198906a7fbfbddc933e9d42b33ccf36f369724b965eb7411e4b
Opcode Fuzzy Hash: bdd0c3cc90af3fe034529652887614f0accaff867965658c9fbce0febb3d90b4
Instruction Fuzzy Hash: 6FE08C32911268EBCB10DB98D980A8AF3ECFB84A60B514096F516D3240E270DE00C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 69C14FD6 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C14FDD
collate.LIBCPMT ref: 69C14FE6

Part of subcall function 69C13CB2: __EH_prolog3_GS.LIBCMT ref: 69C13CB9
Part of subcall function 69C13CB2: __Getcoll.LIBCPMT ref: 69C13D1D

__Getcoll.LIBCPMT ref: 69C1502C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15040
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15055
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15093
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C150A6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C150EC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15120
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C151DB
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C151EE
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C1520B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15228
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15245
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C1517D

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

numpunct.LIBCPMT ref: 69C15284
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15294
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C152D8
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C152EB
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69C15308

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollLockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 1431084647-0
Opcode ID: d93eb5330aaa09a7ca10b6a60fc5b91d55b92ef8e860c30605f9f944edec3a54
Instruction ID: 9b708423237359c5a55d274de2d473657ee0e010b774b0ae7c7873fddb8030d3
Opcode Fuzzy Hash: d93eb5330aaa09a7ca10b6a60fc5b91d55b92ef8e860c30605f9f944edec3a54
Instruction Fuzzy Hash: 0B912975D083556BD715DF756C51B3F3AA8AF023A8F10C42DE819AB2C0FB35491163EA

Uniqueness

Uniqueness Score: -1.00%

Function 69C37765 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 123servicesleepCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 69C3777C
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 69C37793
OpenServiceW.ADVAPI32(00000000,CCleanerPerformanceOptimizerService,0000002C), ref: 69C377AE
CloseServiceHandle.ADVAPI32(00000000), ref: 69C377BB
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 69C377D2
Sleep.KERNEL32(00000000), ref: 69C377F1
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 69C37806
GetTickCount64.KERNEL32 ref: 69C37816
ControlService.ADVAPI32(00000000,00000001,?), ref: 69C37848
CloseServiceHandle.ADVAPI32(00000000), ref: 69C37855
CloseServiceHandle.ADVAPI32(00000000), ref: 69C3785C
Sleep.KERNEL32(?), ref: 69C3787A
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 69C3788F
GetTickCount64.KERNEL32 ref: 69C3789F

Strings

CCleanerPerformanceOptimizerService, xrefs: 69C377A8

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Service$CloseCount64HandleQueryStatusTick$OpenSleep$ControlManager
String ID: CCleanerPerformanceOptimizerService
API String ID: 2451267966-3211844608
Opcode ID: 97a5cc0afebb0c10b4a2bb601ab8f9dd883ef1960e9e2bd12b71bde315c6a463
Instruction ID: afad36cbaa67b1aa4f6c18d1c1cec1051bac402ef186980cb98ab03d4a6c9814
Opcode Fuzzy Hash: 97a5cc0afebb0c10b4a2bb601ab8f9dd883ef1960e9e2bd12b71bde315c6a463
Instruction Fuzzy Hash: 7241A070604751EFEB21CF619884A7F77B8FF86715F80462DF565A2040EB30D50AEAA3

Uniqueness

Uniqueness Score: -1.00%

Function 69BED887 Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 427COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,B3099220,00000001,?), ref: 69BEDA06
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 69BEDA17
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 69BEDA2A
CloseHandle.KERNEL32(?), ref: 69BEDCE2
CloseHandle.KERNEL32(?), ref: 69BEDCF5
CloseHandle.KERNEL32(?), ref: 69BEDD08

Strings

Creating disconnected named pipe client to {}, xrefs: 69BED937
y, xrefs: 69BEDC02
CCleaner.Windows.IPC.NamedPipes, xrefs: 69BED8BB, 69BED979, 69BEDB98, 69BEDC59
jjjj, xrefs: 69BED9FE
Failed to create Win32 events when creating pipe client to {}, xrefs: 69BEDC17
src\NamedPipeClient.cpp, xrefs: 69BED929, 69BEDC09
jjj, xrefs: 69BEDA1D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CloseCreateEventHandle
String ID: CCleaner.Windows.IPC.NamedPipes$Creating disconnected named pipe client to {}$Failed to create Win32 events when creating pipe client to {}$jjj$jjjj$src\NamedPipeClient.cpp$y
API String ID: 3369476804-1281081068
Opcode ID: 7e313d86d3f4b3a7e7d04ce0cb227d81f4ab33f9c03f03be91672960a1f19e2d
Instruction ID: fad50f14e576928bdc37ab7ba87bce62822c390631e11b480d46f3e4eac35f61
Opcode Fuzzy Hash: 7e313d86d3f4b3a7e7d04ce0cb227d81f4ab33f9c03f03be91672960a1f19e2d
Instruction Fuzzy Hash: 7002CD70A00248DFEB04CF68D984B9DBBB5FF85344F148259E815AB395E7B4A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C222A0 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2230F
_free.LIBCMT ref: 69C22325
_free.LIBCMT ref: 69C22338
_free.LIBCMT ref: 69C2234D
_free.LIBCMT ref: 69C22362
GetCPInfo.KERNEL32(?,?), ref: 69C223AC

Part of subcall function 69C2AE44: _free.LIBCMT ref: 69C2AEAF

_free.LIBCMT ref: 69C22617
_free.LIBCMT ref: 69C2262A
_free.LIBCMT ref: 69C22638
_free.LIBCMT ref: 69C22643
_free.LIBCMT ref: 69C22685
_free.LIBCMT ref: 69C2268D
_free.LIBCMT ref: 69C22693
_free.LIBCMT ref: 69C2269B
_free.LIBCMT ref: 69C226A9

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: a6499bba22653dff837237798c0a0835147b3ab17d94df94e2d135ddb901f32c
Instruction ID: 04eb23846855826cce10c988283a38b8e3e7a032309ec1f6803cdec271a6bc25
Opcode Fuzzy Hash: a6499bba22653dff837237798c0a0835147b3ab17d94df94e2d135ddb901f32c
Instruction Fuzzy Hash: 3DD19D75D002059FDB15CFB8D8A0BAEBBF9FF08304F148139E495A7281EB75A946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 69BEF510 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 368filepipeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,B3099220,?,?), ref: 69BEF704
GetLastError.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,B3099220,?,?), ref: 69BEF711
WaitNamedPipeW.KERNEL32(?,?,?,C0000000,00000000,00000000,00000003,40000000,00000000,B3099220,?,?), ref: 69BEF726
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 69BEF747
SetNamedPipeHandleState.KERNEL32(00000000,?,00000000,00000000,?,C0000000,00000000,00000000,00000003,40000000,00000000,B3099220,?,?), ref: 69BEF764
GetLastError.KERNEL32 ref: 69BEF7DD
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,40000000,00000000,B3099220,?,?), ref: 69BEF8A1
GetLastError.KERNEL32 ref: 69BEF919

Strings

Error {}: could not connect named pipe client, xrefs: 69BEF81E, 69BEF95A
CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEF59C, 69BEF667, 69BEF7BE, 69BEF852, 69BEF8FA, 69BEF98E
src\NamedPipeClient.cpp, xrefs: 69BEF617, 69BEF7EF, 69BEF92B
Attempting to connect named pipe client to {}, xrefs: 69BEF625

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast$CreateFileHandleNamedPipe$CloseStateWait
String ID: Attempting to connect named pipe client to {}$CCleaner.Windows.IPC.NamedPipes$Error {}: could not connect named pipe client$src\NamedPipeClient.cpp
API String ID: 522155233-3478576866
Opcode ID: 29b7fbca80083c48f8860dc79eb4b8e6bcb64391d0756f29b8bb3470fe9e0171
Instruction ID: 97798bf16e1e6afb86445fe303ebc105164f4528cea4208efdfc0a4edbc28e08
Opcode Fuzzy Hash: 29b7fbca80083c48f8860dc79eb4b8e6bcb64391d0756f29b8bb3470fe9e0171
Instruction Fuzzy Hash: 74E18CB0E01748DFDB00CFA8DA45B9DBBB4FF89714F118259E824AB391DB70A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C17937 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(69C56B58,00000FA0,?,?,69C17915), ref: 69C17943
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,69C17915), ref: 69C1794E
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,69C17915), ref: 69C1795F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 69C17971
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 69C1797F
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,69C17915), ref: 69C179A2
DeleteCriticalSection.KERNEL32(69C56B58,00000007,?,?,69C17915), ref: 69C179C5
CloseHandle.KERNEL32(00000000,?,?,69C17915), ref: 69C179D5

Strings

kernel32.dll, xrefs: 69C1795A
SleepConditionVariableCS, xrefs: 69C1796B
WakeAllConditionVariable, xrefs: 69C17977
api-ms-win-core-synch-l1-2-0.dll, xrefs: 69C17949

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f49f062f9d5eaeb742cd532cc978809144363271208f6fb21d75611b39cadeda
Instruction ID: 09376a568f5543a43b5e0f7260f39c23ecf3c811f47ae3c71fa5470b6192567a
Opcode Fuzzy Hash: f49f062f9d5eaeb742cd532cc978809144363271208f6fb21d75611b39cadeda
Instruction Fuzzy Hash: 720188B5944E61BBDF205B76EA0CA6E3678AB82741FC00115FD16E3240FB34C406B666

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F12F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 69C2F173

Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F482
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F494
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F4A6
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F4B8
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F4CA
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F4DC
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F4EE
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F500
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F512
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F524
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F536
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F548
Part of subcall function 69C2F465: _free.LIBCMT ref: 69C2F55A

_free.LIBCMT ref: 69C2F168

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C2F18A
_free.LIBCMT ref: 69C2F19F
_free.LIBCMT ref: 69C2F1AA
_free.LIBCMT ref: 69C2F1CC
_free.LIBCMT ref: 69C2F1DF
_free.LIBCMT ref: 69C2F1ED
_free.LIBCMT ref: 69C2F1F8
_free.LIBCMT ref: 69C2F230
_free.LIBCMT ref: 69C2F237
_free.LIBCMT ref: 69C2F254
_free.LIBCMT ref: 69C2F26C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ff8d0e415d9725c863da5c6992652b4ef870968dbe54a9a2d8fbd2ea0af352dc
Instruction ID: 68bb038151723df534989214f7351c5f522d706c67198a5ffea280c6b659fe12
Opcode Fuzzy Hash: ff8d0e415d9725c863da5c6992652b4ef870968dbe54a9a2d8fbd2ea0af352dc
Instruction Fuzzy Hash: 88316D36604609DFEB11DA38F981F4A73E9BF41354FA0942AE469D7161FF70E840DB24

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F570 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2F5B8
_free.LIBCMT ref: 69C2F5DC
_free.LIBCMT ref: 69C2F5E9
_free.LIBCMT ref: 69C2F60E
_free.LIBCMT ref: 69C2F61B
_free.LIBCMT ref: 69C2F624
_free.LIBCMT ref: 69C2F8FE
_free.LIBCMT ref: 69C2F906

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 684941477df031baefcace8b166dbe9912290b980b423c7ed39ff7434a2f9bb8
Instruction ID: 7a3e2a1ca1e621298d17f9844f35027c763237b77f96c26e1bd2b40d86609412
Opcode Fuzzy Hash: 684941477df031baefcace8b166dbe9912290b980b423c7ed39ff7434a2f9bb8
Instruction Fuzzy Hash: 80C16276E40208AFDB10CBA8DD82FDEB7FCAF49754F104165FA04FB281E6B499419B64

Uniqueness

Uniqueness Score: -1.00%

Function 69C372A1 Relevance: 16.6, APIs: 11, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 69C372BD
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,?,?), ref: 69C372DC
GetLastError.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 69C372ED
GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 69C37301
HeapAlloc.KERNEL32(00000000,00000008,?,?,00000001,00000000,00000000,?,?), ref: 69C3730B
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 69C37332

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: DependentEnumHeapServices$AllocCount64ErrorLastProcessTick
String ID:
API String ID: 3373571819-0
Opcode ID: 487aa189f8f8171a47b93e1d0392667b4fe500e0b47079624dbace0e83b0cffb
Instruction ID: 441e808b39160195b82633288bd8395b79c23c89361adcc5ab90517d1fcd3763
Opcode Fuzzy Hash: 487aa189f8f8171a47b93e1d0392667b4fe500e0b47079624dbace0e83b0cffb
Instruction Fuzzy Hash: C0411BB2D00668EFDF21CFA5D984AEDBBB9FB09300F50412AE519A7240E7309A45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 69C1AE67 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 69C1AF64
type_info::operator==.LIBVCRUNTIME ref: 69C1AF86
___TypeMatch.LIBVCRUNTIME ref: 69C1B095
IsInExceptionSpec.LIBVCRUNTIME ref: 69C1B167
_UnwindNestedFrames.LIBCMT ref: 69C1B1EB
CallUnexpected.LIBVCRUNTIME ref: 69C1B206

Strings

csm, xrefs: 69C1AFBD
csm, xrefs: 69C1AF11
csm, xrefs: 69C1AEA4

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7377eeaa1e582af85e1911e429750e6a17d697d47cd019c2f7b3ed85ed71a4a6
Instruction ID: aa2a40e564d534b65134070328ebe68bfca6e585132b97721cfef4a7abaa04ce
Opcode Fuzzy Hash: 7377eeaa1e582af85e1911e429750e6a17d697d47cd019c2f7b3ed85ed71a4a6
Instruction Fuzzy Hash: FBB1CC75808209EFCF08CFA4E98099EB7B5FF44324F10815AE810AB315E331EA55EF99

Uniqueness

Uniqueness Score: -1.00%

Function 69C26951 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C26967

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C26973
_free.LIBCMT ref: 69C2697E
_free.LIBCMT ref: 69C26989
_free.LIBCMT ref: 69C26994
_free.LIBCMT ref: 69C2699F
_free.LIBCMT ref: 69C269AA
_free.LIBCMT ref: 69C269B5
_free.LIBCMT ref: 69C269C0
_free.LIBCMT ref: 69C269CE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c75eec15370c3b37ff78b8390f003519f5d088ebd6872e2d44580dc09d3ea858
Instruction ID: cf77ba8f840ae9484a26cba10dcb9b6f44004b31d314385874c93233066ae6f0
Opcode Fuzzy Hash: c75eec15370c3b37ff78b8390f003519f5d088ebd6872e2d44580dc09d3ea858
Instruction Fuzzy Hash: C121B77A900508BFCB41DFA4E990DDE7BBAFF08244F1095A6F5159B121EB31EA94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 69C15BB0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C15BB7

Part of subcall function 69C00F89: __EH_prolog3.LIBCMT ref: 69C00F90
Part of subcall function 69C00F89: std::_Lockit::_Lockit.LIBCPMT ref: 69C00F9A
Part of subcall function 69C00F89: std::_Lockit::~_Lockit.LIBCPMT ref: 69C0100B

Strings

%b %d %H : %M : %S %Y, xrefs: 69C15E45
%H : %M : %S, xrefs: 69C15D50
%m / %d / %y, xrefs: 69C15CAE
:AM:am:PM:pm, xrefs: 69C15F1D
%d / %m / %y, xrefs: 69C15EED
%I : %M : %S %p, xrefs: 69C15F12
%H : %M, xrefs: 69C15CF6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 9c70440d661644250f6e71ad2f28f6af34eba8ee3e4fcd07dac78c70c42c7212
Instruction ID: 81e964c0661e0a6ccd2c6b2e5edeb8d97deac58b93dbdaca8e8e581072a2c4c9
Opcode Fuzzy Hash: 9c70440d661644250f6e71ad2f28f6af34eba8ee3e4fcd07dac78c70c42c7212
Instruction Fuzzy Hash: B0B1AD7590814AAFDF05DF68EA65EBE3BA9FF09344F004119FA11E2291F731CA10EB18

Uniqueness

Uniqueness Score: -1.00%

Function 69C100C0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C100C7

Part of subcall function 69C05BFB: __EH_prolog3.LIBCMT ref: 69C05C02
Part of subcall function 69C05BFB: std::_Lockit::_Lockit.LIBCPMT ref: 69C05C0C
Part of subcall function 69C05BFB: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05C7D

Strings

%b %d %H : %M : %S %Y, xrefs: 69C10355
%H : %M : %S, xrefs: 69C10260
%m / %d / %y, xrefs: 69C101BE
:AM:am:PM:pm, xrefs: 69C1042D
%d / %m / %y, xrefs: 69C103FD
%I : %M : %S %p, xrefs: 69C10422
%H : %M, xrefs: 69C10206

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 8ac952efd07133020cd68dc659a641fb0eb4d3f06992095c5549c773a693fae1
Instruction ID: 6ccda4d7d3303d141f1edc2abc013c1a09b7b13b050c4a9a75467a20cc32e609
Opcode Fuzzy Hash: 8ac952efd07133020cd68dc659a641fb0eb4d3f06992095c5549c773a693fae1
Instruction Fuzzy Hash: A3B1907554810AEFDF05DF68E995EFE3BB9FB0A304F004119FA15A6251F631CA20EB68

Uniqueness

Uniqueness Score: -1.00%

Function 69C10490 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C10497

Part of subcall function 69C05C90: __EH_prolog3.LIBCMT ref: 69C05C97
Part of subcall function 69C05C90: std::_Lockit::_Lockit.LIBCPMT ref: 69C05CA1
Part of subcall function 69C05C90: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05D12

Strings

%b %d %H : %M : %S %Y, xrefs: 69C10725
%H : %M : %S, xrefs: 69C10630
%m / %d / %y, xrefs: 69C1058E
:AM:am:PM:pm, xrefs: 69C107FD
%d / %m / %y, xrefs: 69C107CD
%I : %M : %S %p, xrefs: 69C107F2
%H : %M, xrefs: 69C105D6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 0d502e3b8305f71d8f6161965cb5d6f9a2f187e9d573c1fbc2df8aa2ab2a320d
Instruction ID: dbb1279158b1a31edcbd615485ba1b2ceb797f14a8b60a4a403746929b95bc83
Opcode Fuzzy Hash: 0d502e3b8305f71d8f6161965cb5d6f9a2f187e9d573c1fbc2df8aa2ab2a320d
Instruction Fuzzy Hash: 51B1AF7550810AEBDF05DF68E965EFE3BB9FB09344F00411AF916A6251F731CA20EB98

Uniqueness

Uniqueness Score: -1.00%

Function 69BED624 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 69BED729
CloseHandle.KERNEL32(?), ref: 69BED732
CloseHandle.KERNEL32(?), ref: 69BED73B
__Mtx_destroy_in_situ.LIBCPMT ref: 69BED76C

Strings

:, xrefs: 69BED6B2
CCleaner.Windows.IPC.NamedPipes, xrefs: 69BED662, 69BED6FF
src\NamedPipeClient.cpp, xrefs: 69BED6AA
__thiscall CCleaner::Windows::IPC::NamedPipes::v0_1::Client::Client(class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,void *,void *,void *,void *,class std::function<void __cdecl(class std::basic_string<char,struc, xrefs: 69BED6BE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CloseHandle$Mtx_destroy_in_situ
String ID: :$CCleaner.Windows.IPC.NamedPipes$__thiscall CCleaner::Windows::IPC::NamedPipes::v0_1::Client::Client(class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,void *,void *,void *,void *,class std::function<void __cdecl(class std::basic_string<char,struc$src\NamedPipeClient.cpp
API String ID: 2095039208-458543398
Opcode ID: 637e8da08b0c901df038fc56442051bb1ea503f437a836b3685b66d36d552fe8
Instruction ID: a527a1d253dd4d218e1ae1de7e078e5cbbfbd3c6d31842f08371d580562951cb
Opcode Fuzzy Hash: 637e8da08b0c901df038fc56442051bb1ea503f437a836b3685b66d36d552fe8
Instruction Fuzzy Hash: DE311A39D002989BCF14EBB4ED54AEDBBB5AF49348F149059E50137290EF716E09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 69C0C549 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C0C550
_Maklocstr.LIBCPMT ref: 69C0C5B9
_Maklocstr.LIBCPMT ref: 69C0C5CB
_Maklocchr.LIBCPMT ref: 69C0C5E3
_Maklocchr.LIBCPMT ref: 69C0C5F3
_Getvals.LIBCPMT ref: 69C0C615

Part of subcall function 69C0526C: _Maklocchr.LIBCPMT ref: 69C0529B
Part of subcall function 69C0526C: _Maklocchr.LIBCPMT ref: 69C052B1

Strings

true, xrefs: 69C0C5C6
false, xrefs: 69C0C5B4

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: d32ce67f97d12354526ec3e041dc27229127428b449df03f4b09692708bada8d
Instruction ID: cb206f3a1e7759a1cfafbf2feca60590eeb31531b03ae240aa8cb82713b9b900
Opcode Fuzzy Hash: d32ce67f97d12354526ec3e041dc27229127428b449df03f4b09692708bada8d
Instruction Fuzzy Hash: A9219CB6D04214ABDF14DFE5E885ACF7BA8AF05710F00901AF809AF241EB718505CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C2EBF4 Relevance: 13.7, APIs: 9, Instructions: 208COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 69C2EC1E
_free.LIBCMT ref: 69C2ED01

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free_wcschr
String ID:
API String ID: 3422831350-0
Opcode ID: 814249824d3bc601570670946a3f76c7a2f3983308b35caa0d87c71245ffd800
Instruction ID: 87c5bb9ae101a2f2c3b833228034e268f2b3c0ce4ba6bced93200f8c46383794
Opcode Fuzzy Hash: 814249824d3bc601570670946a3f76c7a2f3983308b35caa0d87c71245ffd800
Instruction Fuzzy Hash: 4051F375A00711EBEB24DFB8E991A7A77F8BF01354F10857AE915BB280FB3199408791

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F990 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2F9FE
_free.LIBCMT ref: 69C2FA0A
_free.LIBCMT ref: 69C2FB33
_free.LIBCMT ref: 69C2FB3E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7ab8bd7114c9cd4f29a92973cd1eb7584e83de0b055b671179ddf599bb958330
Instruction ID: 99741429ba6d7a6b540c6310af06edc1a5bf079945742e4e5042c0d7256f1082
Opcode Fuzzy Hash: 7ab8bd7114c9cd4f29a92973cd1eb7584e83de0b055b671179ddf599bb958330
Instruction Fuzzy Hash: 4F61E576904709EFDB10CF78E890B9ABBF9BF45350F20852AE955EB280F770D9019B60

Uniqueness

Uniqueness Score: -1.00%

Function 69BFFE9B Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 69BFFEC3
GetCurrentThreadId.KERNEL32 ref: 69BFFEE0
GetCurrentThreadId.KERNEL32 ref: 69BFFEF5
_xtime_get.LIBCPMT ref: 69BFFF7B
GetCurrentThreadId.KERNEL32 ref: 69BFFFA5
__Xtime_diff_to_millis2.LIBCPMT ref: 69BFFFC1
_xtime_get.LIBCPMT ref: 69BFFFE4
GetCurrentThreadId.KERNEL32 ref: 69BFFFEE
GetCurrentThreadId.KERNEL32 ref: 69C00025

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: d953f0fc0bc43779c1b58c506c4f02501ed2ede7eac6cb7d474e47fd1f66a3a4
Instruction ID: 610f2aa6618e3b5378448ee960e2f0aee656d99eeadeb205d121106bd1f69a05
Opcode Fuzzy Hash: d953f0fc0bc43779c1b58c506c4f02501ed2ede7eac6cb7d474e47fd1f66a3a4
Instruction Fuzzy Hash: 6D51DF34901686CFCF10CF64D5C59ADB7B5FF0A310B51809AE806EB291DB30EC8ADB92

Uniqueness

Uniqueness Score: -1.00%

Function 69BEE0CA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 69BEE3E4
SetEvent.KERNEL32(?), ref: 69BEE40F
CloseHandle.KERNEL32(?), ref: 69BEE539
__Mtx_unlock.LIBCPMT ref: 69BEE551

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEE0FF, 69BEE1CE, 69BEE2D6, 69BEE35B, 69BEE468, 69BEE4ED
{}: Attempting to reconnect named pipe client to {}, xrefs: 69BEE17E
src\NamedPipeClient.cpp, xrefs: 69BEE18A, 69BEE30A, 69BEE49C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Mtx_unlock$CloseEventHandle
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp${}: Attempting to reconnect named pipe client to {}
API String ID: 986198054-453163573
Opcode ID: ecb0693b26e4d3a29410a4dff1a31a99e71789e6f87db2678018eb681be6bcf5
Instruction ID: 394f68e5929a04280c921961dad82dfa850aceb74b7bf022d02807b748340786
Opcode Fuzzy Hash: ecb0693b26e4d3a29410a4dff1a31a99e71789e6f87db2678018eb681be6bcf5
Instruction Fuzzy Hash: CBE1AD70E00388DFEB04CFA8D9457ADBBB1FF49314F148259E418AB3A1EB31A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69BFA58A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Facet_Register.LIBCPMT ref: 69BFA67A
std::_Lockit::~_Lockit.LIBCPMT ref: 69BFA694
Concurrency::cancel_current_task.LIBCPMT ref: 69BFA6B6
Concurrency::cancel_current_task.LIBCPMT ref: 69BFA6BB
Concurrency::cancel_current_task.LIBCPMT ref: 69BFA6C0

Strings

true, xrefs: 69BFA64B
false, xrefs: 69BFA625

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Facet_LockitLockit::~_Register
String ID: false$true
API String ID: 4277177899-2658103896
Opcode ID: d4afda9308fce8fbb21624016aa37dc5fa9e808ba54276968390cbe0a817df1d
Instruction ID: d4f5b1c91c9f045bcf8d51dcbf92e97a82ecb4f0e22e694b47cb8342956aa099
Opcode Fuzzy Hash: d4afda9308fce8fbb21624016aa37dc5fa9e808ba54276968390cbe0a817df1d
Instruction Fuzzy Hash: E031BE78A013449BDB14DFA4D95079EBBB4AF05708F10845DD8069B280EBB69A0ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 69C0C622 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C0C629
_Maklocstr.LIBCPMT ref: 69C0C690
_Maklocstr.LIBCPMT ref: 69C0C6A2
_Maklocchr.LIBCPMT ref: 69C0C6BA
_Maklocchr.LIBCPMT ref: 69C0C6CA

Strings

true, xrefs: 69C0C69D
false, xrefs: 69C0C68B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: MaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2404127365-2658103896
Opcode ID: 71187ab06a8a791e2ef30403c8f017ea61ac225421c5c4e0ffeaecc98f42ce38
Instruction ID: deb3ec4a3592cd3651fcece18ef8a5a7a0091d42f3cf06111f76489891ef2002
Opcode Fuzzy Hash: 71187ab06a8a791e2ef30403c8f017ea61ac225421c5c4e0ffeaecc98f42ce38
Instruction Fuzzy Hash: 9E2178B9C04384ABDF14DFA6E880D9EBBB8AF55704F40945AE905AF251FB719900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C37491 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,?,?,69C3722E), ref: 69C374AC
OpenServiceW.ADVAPI32(00000000,CCleanerPerformanceOptimizerService,000F01FF,?,?,?,?,?,?,?,?,?,?,?,?,69C3722E), ref: 69C374C8
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,69C3722E), ref: 69C374D5

Strings

CCleanerPerformanceOptimizerService, xrefs: 69C374C2

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: OpenService$CloseHandleManager
String ID: CCleanerPerformanceOptimizerService
API String ID: 4136619037-3211844608
Opcode ID: cd06936ff5029cbd39cf384a8708f9ac58a1bb29c5d0d3bcae0a44dd22e7134f
Instruction ID: b273b3194ea7232ba296898c84733b90b1d17c9aec0f55ef15abe7d672712b4a
Opcode Fuzzy Hash: cd06936ff5029cbd39cf384a8708f9ac58a1bb29c5d0d3bcae0a44dd22e7134f
Instruction Fuzzy Hash: FF01A175640628FBCF219A759D898FE77BCEB47351B801429E512A3100EA248906AAB5

Uniqueness

Uniqueness Score: -1.00%

Function 69BFCAD0 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 69BFCB2E

Part of subcall function 69C00614: __EH_prolog3.LIBCMT ref: 69C0061B
Part of subcall function 69C00614: std::_Lockit::_Lockit.LIBCPMT ref: 69C00626
Part of subcall function 69C00614: std::locale::_Setgloballocale.LIBCPMT ref: 69C00641
Part of subcall function 69C00614: std::_Lockit::~_Lockit.LIBCPMT ref: 69C00697

std::_Lockit::_Lockit.LIBCPMT ref: 69BFCBC3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 69BFCC0B
std::_Lockit::~_Lockit.LIBCPMT ref: 69BFCCD8
std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 69BFCCFE
std::_Lockit::_Lockit.LIBCPMT ref: 69BFCD16
std::_Lockit::~_Lockit.LIBCPMT ref: 69BFCD37
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 69BFCD45

Part of subcall function 69C1BE43: _free.LIBCMT ref: 69C1BE56

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_$AddfacH_prolog3InitLocimpLocimp_Locinfo::_Locinfo_ctorNew_Setgloballocale_free
String ID:
API String ID: 4012479583-0
Opcode ID: 38f43357f25255e9b3c5313694dc74e468877ab0ea9316848719b13f01fd1bbd
Instruction ID: a7eb6131b78bcf37e1a3245754ecf0da965c41b2a250065777a921a536d6dee4
Opcode Fuzzy Hash: 38f43357f25255e9b3c5313694dc74e468877ab0ea9316848719b13f01fd1bbd
Instruction Fuzzy Hash: 38917DB4D04285DBEF00CFA8D955B9EBBB4FF15304F108129D804E7390EB75AA99CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C27AFB Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 471COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C28066
_free.LIBCMT ref: 69C2807F
_free.LIBCMT ref: 69C280BD
_free.LIBCMT ref: 69C280C6
_free.LIBCMT ref: 69C280D2

Strings

C, xrefs: 69C27ED7

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free
String ID: C
API String ID: 269201875-1037565863
Opcode ID: 6b13d6d5c264249bf4fd82d674a3788ddeff99f3accf92ee5b981534006c8f8b
Instruction ID: 9400df0b706917125e4138a61bdc766aeda4c09f01ef82179cc049b880bbdb9c
Opcode Fuzzy Hash: 6b13d6d5c264249bf4fd82d674a3788ddeff99f3accf92ee5b981534006c8f8b
Instruction Fuzzy Hash: F802A2759052199BDB24DF28EDC4BAEB3B4FF45344F5081AAD809A7280F771AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 69BE38E8 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 318COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE38F2

Strings

: 0x, xrefs: 69BE3C6A
invalid UTF-8 byte at index , xrefs: 69BE3C53
incomplete UTF-8 string; last byte: 0x, xrefs: 69BE3BF8
%.2X, xrefs: 69BE3BE9, 69BE3C3B
\u%04x, xrefs: 69BE3A87

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_
String ID: %.2X$: 0x$\u%04x$incomplete UTF-8 string; last byte: 0x$invalid UTF-8 byte at index
API String ID: 2427045233-50787910
Opcode ID: dd8265d964a623c27903e04410ddc3f82e30006f93eace73b71a087fd4f69d9c
Instruction ID: 9ad8a5c1b58f8e050df9dd64a8a7f9cc9d845fc2a428f62c0d3740221172c3c2
Opcode Fuzzy Hash: dd8265d964a623c27903e04410ddc3f82e30006f93eace73b71a087fd4f69d9c
Instruction Fuzzy Hash: 0EC10234904298CFDB21CFA8C884BAEBBF9FF49344F04815CD146AB396D735A946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 69BE5431 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE543B

Strings

syntax error , xrefs: 69BE546B
; last read: ', xrefs: 69BE5541
while parsing , xrefs: 69BE548C
unexpected , xrefs: 69BE565B
; expected , xrefs: 69BE5710

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 2427045233-4239264347
Opcode ID: ab997dbd5dc6f7dc322d6f2fbe9cc7e6181db8f12757aa6a885bae78b913f241
Instruction ID: 7cc3bbac6bccf151ec801dacb83babce3d4f388f8403c0917af4955d382b6966
Opcode Fuzzy Hash: ab997dbd5dc6f7dc322d6f2fbe9cc7e6181db8f12757aa6a885bae78b913f241
Instruction Fuzzy Hash: 0AB17D75D05289AEDF08CFA4D990AEEBBB9AF08344F20916DE005F7281EB745F05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 69C1800A Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 69C18051
___scrt_uninitialize_crt.LIBCMT ref: 69C1806B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2f4c33e2a45cf1ffa474cdf8448493bc23885056205eb17cb54455651dd2cea1
Instruction ID: 6be1155ab931d70ce0fce48cba775d0f1565f266e5be5e1b7e6d0391a7a96170
Opcode Fuzzy Hash: 2f4c33e2a45cf1ffa474cdf8448493bc23885056205eb17cb54455651dd2cea1
Instruction Fuzzy Hash: 4941A076D0C658EFDB10DF65ED00FAF7AB5EB81B94F108129E81467290E7344941BBA8

Uniqueness

Uniqueness Score: -1.00%

Function 69C298A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 69C298FD
ext-ms-, xrefs: 69C29911

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 59f87db50e9ec93d8c188e0d44f7b901b82f306b5d260d05deeb8c9754b2fa86
Instruction ID: ec8564dbca717b35dec94856e2a7ea2233bc9931775163b7058319b1eb7efa2f
Opcode Fuzzy Hash: 59f87db50e9ec93d8c188e0d44f7b901b82f306b5d260d05deeb8c9754b2fa86
Instruction Fuzzy Hash: 5121B731A49621EBDB11AB66AE45B5F3778BF027B0F150121ED5DA7380F630EC01C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 69C2FE52 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 69C2FB9E: _free.LIBCMT ref: 69C2FBC3

_free.LIBCMT ref: 69C2FEA0

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C2FEAB
_free.LIBCMT ref: 69C2FEB6
_free.LIBCMT ref: 69C2FF0A
_free.LIBCMT ref: 69C2FF15
_free.LIBCMT ref: 69C2FF20
_free.LIBCMT ref: 69C2FF2B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2466284e19b187c3393bf985ec9d5c5c5aae1dfddd339af06ed05fa5ce07fe86
Instruction ID: 8d974f0862a5c7d898faa44546c9a7f11374d6a56ba513624486c284ff086b7f
Opcode Fuzzy Hash: 2466284e19b187c3393bf985ec9d5c5c5aae1dfddd339af06ed05fa5ce07fe86
Instruction Fuzzy Hash: C7113379540F08BED520EBB0EE95FCB7B9DAF04704F40D825A29A66090FB75F5045B60

Uniqueness

Uniqueness Score: -1.00%

Function 69C339AB Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 69C339F3
__fassign.LIBCMT ref: 69C33BD8
__fassign.LIBCMT ref: 69C33BF5
WriteFile.KERNEL32(?,69C2A58F,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 69C33C3D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 69C33C7D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 69C33D25

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 1f507ffe52e899e0c8b82dbe236b38ef906d96e1b8376fc5a76f9e67ca0bcc11
Instruction ID: f307e56bd502e50a24eada5ef6a436396e309518fa24be8656c1a30d863f82cb
Opcode Fuzzy Hash: 1f507ffe52e899e0c8b82dbe236b38ef906d96e1b8376fc5a76f9e67ca0bcc11
Instruction Fuzzy Hash: 2AC1B175D002A89FDF11CFE9D8809EDBBB5BF49314FA8816AE815FB241E6319942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 69C175F4 Relevance: 9.2, APIs: 6, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 69C1767F
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 69C1770D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 69C1777F
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 69C17799
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 69C177FC
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 69C17819

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 0f4ed6c8a85b7facb7e9a77ac2e42ff1f3cc44bd9f48bbdc7511ea8010eb7ea7
Instruction ID: a3ea709bd87bac786c9f89a4cac3fe308f5728ddcaa1ec15ee728c2eb64ae484
Opcode Fuzzy Hash: 0f4ed6c8a85b7facb7e9a77ac2e42ff1f3cc44bd9f48bbdc7511ea8010eb7ea7
Instruction Fuzzy Hash: 7971B371A0824A9BEF118EA9EC54EEE7BB6FF46354F104025E414F6250F731C441FBA9

Uniqueness

Uniqueness Score: -1.00%

Function 69C16FDE Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 69C17027
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 69C17092
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 69C170AF
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 69C170EE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 69C1714D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 69C17170

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 417cc8c074123ec333f6b903fc01b6d97bb5ec140beab00a9c63d26eb945c693
Instruction ID: d8f83a5170a3a8716b99914060d09f76616e7bb76e80b0cda5878af8305fa9e9
Opcode Fuzzy Hash: 417cc8c074123ec333f6b903fc01b6d97bb5ec140beab00a9c63d26eb945c693
Instruction Fuzzy Hash: AD51C17250420ABBEF148FA5EC44FAB3BB9FF45794F208025F92896150E735C911FB68

Uniqueness

Uniqueness Score: -1.00%

Function 69BFDD00 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 69BFE19E

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BFDE50, 69BFDEDD, 69BFE076, 69BFE108

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Mtx_unlock
String ID: CCleaner.Windows.IPC.NamedPipes
API String ID: 1418687624-1350194154
Opcode ID: c71ee768b1a15c302095529b6ec7014611784709293e74afe2c43153d6c8168d
Instruction ID: 03be66e1f5afab2c7b6c821a10e6dc8540c419187ebddd6872fa610e23149a97
Opcode Fuzzy Hash: c71ee768b1a15c302095529b6ec7014611784709293e74afe2c43153d6c8168d
Instruction Fuzzy Hash: 15E19E74A00348DFDB10CF68C945BAEBBF4FF49314F148259E815AB791E731A94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C1AB30 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,69C1AA3D,69C17BD4,69C17EDB,?,69C18113,?,00000001,?,?,00000001,?,69C52190,0000000C,69C1820C), ref: 69C1AB3E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 69C1AB4C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 69C1AB65
SetLastError.KERNEL32(00000000,69C18113,?,00000001,?,?,00000001,?,69C52190,0000000C,69C1820C,?,00000001,?), ref: 69C1ABB7

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 80ef22d25818535f1fe7f106c1e3680321a3439acd91dab1d41e449e8c49d6f9
Instruction ID: 6484e38e4f4af5d7e2ea643eda8e27e9d0a3886405f94385dd6dcd91bff871cd
Opcode Fuzzy Hash: 80ef22d25818535f1fe7f106c1e3680321a3439acd91dab1d41e449e8c49d6f9
Instruction Fuzzy Hash: DD01243620C7919EBA245AB5BC85A272666EF833B83304229F520A32E4FF514C667548

Uniqueness

Uniqueness Score: -1.00%

Function 69C139D5 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C139DC
std::_Lockit::_Lockit.LIBCPMT ref: 69C139E6

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C13A20
std::_Facet_Register.LIBCPMT ref: 69C13A37
std::_Lockit::~_Lockit.LIBCPMT ref: 69C13A57
Concurrency::cancel_current_task.LIBCPMT ref: 69C13A64

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: e6e4d432ba12f3100e5ff9ef9e8c22ea9277c9d94813acb36ebf9915cb2daa83
Instruction ID: 72ce8bc3e3c1e6804def2623a64463e805adb1991fe914f56adce478fa9fec89
Opcode Fuzzy Hash: e6e4d432ba12f3100e5ff9ef9e8c22ea9277c9d94813acb36ebf9915cb2daa83
Instruction Fuzzy Hash: 0701D639908669CBCF05DFA4E414ABDB775BF41318F219008D4117B3C0EF319A01D796

Uniqueness

Uniqueness Score: -1.00%

Function 69C059A7 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C059AE
std::_Lockit::_Lockit.LIBCPMT ref: 69C059B8

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

codecvt.LIBCPMT ref: 69C059F2
std::_Facet_Register.LIBCPMT ref: 69C05A09
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05A29
Concurrency::cancel_current_task.LIBCPMT ref: 69C05A36

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: cf61949e56e105288266a343a313cafcf307e412ef76c83b05e14abd02a02cee
Instruction ID: 788baabcf41b8a130f20c0936816a27b80e50e5a5a26a9272594c13878c86214
Opcode Fuzzy Hash: cf61949e56e105288266a343a313cafcf307e412ef76c83b05e14abd02a02cee
Instruction Fuzzy Hash: BD01D6399049698BCF06DF65E564ABD77B5BF45368F158008D411AB3C0EF359E02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C13940 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C13947
std::_Lockit::_Lockit.LIBCPMT ref: 69C13951

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C1398B
std::_Facet_Register.LIBCPMT ref: 69C139A2
std::_Lockit::~_Lockit.LIBCPMT ref: 69C139C2
Concurrency::cancel_current_task.LIBCPMT ref: 69C139CF

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 0f8def08de9ce33391358b056695339c38f7f4e4dcde070cbefde88b4b01140b
Instruction ID: 59ebe863000fd3dabd8a96849d2d5c8e49ad941dd955531a86503da9497c6bf0
Opcode Fuzzy Hash: 0f8def08de9ce33391358b056695339c38f7f4e4dcde070cbefde88b4b01140b
Instruction Fuzzy Hash: E201D239908A698BCF06DF64E514ABEB7B6BF81358F24810CD8116B3C0FF319A15D796

Uniqueness

Uniqueness Score: -1.00%

Function 69C05BFB Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05C02
std::_Lockit::_Lockit.LIBCPMT ref: 69C05C0C

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

ctype.LIBCPMT ref: 69C05C46
std::_Facet_Register.LIBCPMT ref: 69C05C5D
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05C7D
Concurrency::cancel_current_task.LIBCPMT ref: 69C05C8A

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: 51eaf2f1236e89b5131cb27a5978e3d547d7b0013608cf97fc5aa9ce6621aac8
Instruction ID: ace0f9403a54e975af822d29079114fd3fc1089541ad5697f5dd04c6d80603dd
Opcode Fuzzy Hash: 51eaf2f1236e89b5131cb27a5978e3d547d7b0013608cf97fc5aa9ce6621aac8
Instruction Fuzzy Hash: AA01F9399046A9CFCF05DF65E924ABD7775BF44368F148009D411AB3C0EF359A01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C05B66 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05B6D
std::_Lockit::_Lockit.LIBCPMT ref: 69C05B77

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

collate.LIBCPMT ref: 69C05BB1
std::_Facet_Register.LIBCPMT ref: 69C05BC8
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05BE8
Concurrency::cancel_current_task.LIBCPMT ref: 69C05BF5

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: b31b8855418b8a31cc6bc8be6780214b3a6f108278f1ef3842177393a192b2a1
Instruction ID: e1d51cead07875a2ff9ca3e3d0207d322fc223dff84f933a039579cbff2529af
Opcode Fuzzy Hash: b31b8855418b8a31cc6bc8be6780214b3a6f108278f1ef3842177393a192b2a1
Instruction Fuzzy Hash: C101F5399046A9CBCF06DF68E524ABE7775BF81328F248008D411AB3C0EF31AA01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C05AD1 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05AD8
std::_Lockit::_Lockit.LIBCPMT ref: 69C05AE2

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

collate.LIBCPMT ref: 69C05B1C
std::_Facet_Register.LIBCPMT ref: 69C05B33
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05B53
Concurrency::cancel_current_task.LIBCPMT ref: 69C05B60

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: 76b256655a874f6a4f58ce4a84a09339ae17ee7701ccead71969d257f9928d84
Instruction ID: 05e5fe60044dbcbd0ff15a967749667977f61c44f84af1a49c3ef2c595be9891
Opcode Fuzzy Hash: 76b256655a874f6a4f58ce4a84a09339ae17ee7701ccead71969d257f9928d84
Instruction Fuzzy Hash: 1A01C4399046698BCB06EF65E524BBE7779BF80354F148009D411AB3C0EF35EA01CB96

Uniqueness

Uniqueness Score: -1.00%

Function 69C05A3C Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05A43
std::_Lockit::_Lockit.LIBCPMT ref: 69C05A4D

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

codecvt.LIBCPMT ref: 69C05A87
std::_Facet_Register.LIBCPMT ref: 69C05A9E
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05ABE
Concurrency::cancel_current_task.LIBCPMT ref: 69C05ACB

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 34514a46d6a15daf9854dca15ea014d81dafac8079731e8f7e285f322db65611
Instruction ID: 5eb2926ab387eeab62e37bc3df9e6554b2b1d50fbd513ad85693021028110fac
Opcode Fuzzy Hash: 34514a46d6a15daf9854dca15ea014d81dafac8079731e8f7e285f322db65611
Instruction Fuzzy Hash: 6501D2399046A98BCF06DF64E464ABE7775BF80358F258008D411AB3C0EF319A01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C05DBA Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05DC1
std::_Lockit::_Lockit.LIBCPMT ref: 69C05DCB

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

messages.LIBCPMT ref: 69C05E05
std::_Facet_Register.LIBCPMT ref: 69C05E1C
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05E3C
Concurrency::cancel_current_task.LIBCPMT ref: 69C05E49

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: c9fafe74c13130545bef7fa2b7ab5046a23344aa320b42ff24c54aea67451ae4
Instruction ID: ab5a089427ea9f733ce08f0497a5f28a9090b1d507f8bdff09ecb463bbb6e408
Opcode Fuzzy Hash: c9fafe74c13130545bef7fa2b7ab5046a23344aa320b42ff24c54aea67451ae4
Instruction Fuzzy Hash: 4601D6399046A9CBCF05DF65E524ABE7B75BF40358F10800DD411AB3D0EF759A02DB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C05D25 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05D2C
std::_Lockit::_Lockit.LIBCPMT ref: 69C05D36

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

messages.LIBCPMT ref: 69C05D70
std::_Facet_Register.LIBCPMT ref: 69C05D87
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05DA7
Concurrency::cancel_current_task.LIBCPMT ref: 69C05DB4

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: eeb55e4c90078bf99d20499fa60dabe8b2dce9e5719062d3e76ce6d0be1ebf9e
Instruction ID: 6af7191ea79923456c5b6b9a8037525cce7b6e7c98bb21e00e7727a2a8976d62
Opcode Fuzzy Hash: eeb55e4c90078bf99d20499fa60dabe8b2dce9e5719062d3e76ce6d0be1ebf9e
Instruction Fuzzy Hash: 3A01D6399146AACBDF06DF65E524ABE7775BF44718F148009D411AB3C0EF719A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C05C90 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05C97
std::_Lockit::_Lockit.LIBCPMT ref: 69C05CA1

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

ctype.LIBCPMT ref: 69C05CDB
std::_Facet_Register.LIBCPMT ref: 69C05CF2
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05D12
Concurrency::cancel_current_task.LIBCPMT ref: 69C05D1F

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: 33f4c666960cff3e735f3854c6106a5dcfaafe1553ed18ee52f93fc75ac78942
Instruction ID: 20c7954ca9d47c3687585380e84a795355c3b28d386f8283131f46e1a1035a37
Opcode Fuzzy Hash: 33f4c666960cff3e735f3854c6106a5dcfaafe1553ed18ee52f93fc75ac78942
Instruction Fuzzy Hash: 4701F5399146AADFCF06DF64E524ABE7775BF84368F249009E411AB3C0EF319A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C00F89 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C00F90
std::_Lockit::_Lockit.LIBCPMT ref: 69C00F9A

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

ctype.LIBCPMT ref: 69C00FD4
std::_Facet_Register.LIBCPMT ref: 69C00FEB
std::_Lockit::~_Lockit.LIBCPMT ref: 69C0100B
Concurrency::cancel_current_task.LIBCPMT ref: 69C01018

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: f46f0a891dc0e4b62837f2399cf7f12e89ec2568bc04e6449bcba28fcbd10cea
Instruction ID: 3140fb2d2cf4886085529ca94cef2cec796e718d9678a5d600e672727d7b95d3
Opcode Fuzzy Hash: f46f0a891dc0e4b62837f2399cf7f12e89ec2568bc04e6449bcba28fcbd10cea
Instruction Fuzzy Hash: 870126398045A98FCF02CF64E524ABDB775BF81358F10800DE4116B3C0EF359A05C782

Uniqueness

Uniqueness Score: -1.00%

Function 69C00EF4 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C00EFB
std::_Lockit::_Lockit.LIBCPMT ref: 69C00F05

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

codecvt.LIBCPMT ref: 69C00F3F
std::_Facet_Register.LIBCPMT ref: 69C00F56
std::_Lockit::~_Lockit.LIBCPMT ref: 69C00F76
Concurrency::cancel_current_task.LIBCPMT ref: 69C00F83

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 3f9c4b5c95a6df7f1d81228b7fc9818124260e7cc4b9bd9f9fe9711832ca736e
Instruction ID: c389ebd180faedd316439db598083735914b267a448054786052e49797758ebe
Opcode Fuzzy Hash: 3f9c4b5c95a6df7f1d81228b7fc9818124260e7cc4b9bd9f9fe9711832ca736e
Instruction Fuzzy Hash: E701D2399046699BCF06DFA4E524ABE7775BF81368F258009E4117B3C0EF359A02D792

Uniqueness

Uniqueness Score: -1.00%

Function 69C061CD Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C061D4
std::_Lockit::_Lockit.LIBCPMT ref: 69C061DE

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C06218
std::_Facet_Register.LIBCPMT ref: 69C0622F
std::_Lockit::~_Lockit.LIBCPMT ref: 69C0624F
Concurrency::cancel_current_task.LIBCPMT ref: 69C0625C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 00a2a74ff1543414481fd14cbe40884ccd30213ebb3bc0cf9c45cd36abff7b47
Instruction ID: 5843afedda898b846c699d5ab8610635ae752e895168d3e9703241ec929bc84a
Opcode Fuzzy Hash: 00a2a74ff1543414481fd14cbe40884ccd30213ebb3bc0cf9c45cd36abff7b47
Instruction Fuzzy Hash: 27012639904A698BCF05DF64E524ABE7775BF80318F148108E415AB3C1FF329A01C782

Uniqueness

Uniqueness Score: -1.00%

Function 69C06138 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C0613F
std::_Lockit::_Lockit.LIBCPMT ref: 69C06149

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C06183
std::_Facet_Register.LIBCPMT ref: 69C0619A
std::_Lockit::~_Lockit.LIBCPMT ref: 69C061BA
Concurrency::cancel_current_task.LIBCPMT ref: 69C061C7

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 1f613efcd0659260d7c5e15f03b71aad7cb72c00704ef1c3e929cc27865fd1b6
Instruction ID: 669e537726ad55a3419a7905eb8b836a93dbcd4ce94799a41f38b379f7480b23
Opcode Fuzzy Hash: 1f613efcd0659260d7c5e15f03b71aad7cb72c00704ef1c3e929cc27865fd1b6
Instruction Fuzzy Hash: BE012639900A6A8BCF06DF64E924ABEB775BF80318F209108D4116B3C0EF719A01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C060A3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C060AA
std::_Lockit::_Lockit.LIBCPMT ref: 69C060B4

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C060EE
std::_Facet_Register.LIBCPMT ref: 69C06105
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06125
Concurrency::cancel_current_task.LIBCPMT ref: 69C06132

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: b640af645adfdcead1503e6f16dba587b695b4c99cc23f542a5f15c5f58e0a89
Instruction ID: 0aa23c29a94fc32bee39466f518ac885587593abe6a514a9afe4c02c4218c98f
Opcode Fuzzy Hash: b640af645adfdcead1503e6f16dba587b695b4c99cc23f542a5f15c5f58e0a89
Instruction Fuzzy Hash: 8401D639904A6ACBCF05DF64E524ABD7B75BF84318F208108D4116B3C0EF359E01C796

Uniqueness

Uniqueness Score: -1.00%

Function 69C06262 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06269
std::_Lockit::_Lockit.LIBCPMT ref: 69C06273

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

moneypunct.LIBCPMT ref: 69C062AD
std::_Facet_Register.LIBCPMT ref: 69C062C4
std::_Lockit::~_Lockit.LIBCPMT ref: 69C062E4
Concurrency::cancel_current_task.LIBCPMT ref: 69C062F1

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 9e84fa0bba1cf95a24d55859cdb7e43e24e6a5809f0724e5485beab4e7280b39
Instruction ID: d0c8472a5d5cde5332463509fa7c8c90a6b72abcc4c70c26a2526cf288107e78
Opcode Fuzzy Hash: 9e84fa0bba1cf95a24d55859cdb7e43e24e6a5809f0724e5485beab4e7280b39
Instruction Fuzzy Hash: 3F010439900A69CBCF05DF64E524ABE7B75BF80318F248118E415AB3C1EF319A01C782

Uniqueness

Uniqueness Score: -1.00%

Function 69C065E0 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C065E7
std::_Lockit::_Lockit.LIBCPMT ref: 69C065F1

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

numpunct.LIBCPMT ref: 69C0662B
std::_Facet_Register.LIBCPMT ref: 69C06642
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06662
Concurrency::cancel_current_task.LIBCPMT ref: 69C0666F

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
String ID:
API String ID: 3064348918-0
Opcode ID: 7a384af003a4e1f8b05b6652af0d7660b30d4b1d0fcdc15be776a0a914e41c2d
Instruction ID: 3967c7c0539fafc80a6797709e33f8195adb52eb854cc7f0d228bfe5571cde73
Opcode Fuzzy Hash: 7a384af003a4e1f8b05b6652af0d7660b30d4b1d0fcdc15be776a0a914e41c2d
Instruction Fuzzy Hash: 5801F939904969CBCF05DF64E524ABD77B5BF40318F119108D4116B3D0EF319A01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C0654B Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06552
std::_Lockit::_Lockit.LIBCPMT ref: 69C0655C

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

numpunct.LIBCPMT ref: 69C06596
std::_Facet_Register.LIBCPMT ref: 69C065AD
std::_Lockit::~_Lockit.LIBCPMT ref: 69C065CD
Concurrency::cancel_current_task.LIBCPMT ref: 69C065DA

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
String ID:
API String ID: 3064348918-0
Opcode ID: 7249a0b0e69420a29a0c0011eac42f825bf7a3b6cc1778228441f401d250870d
Instruction ID: fe614105b13068c9fbd14144dbc3e5a2b6dbab97fd6a36921476d35031269646
Opcode Fuzzy Hash: 7249a0b0e69420a29a0c0011eac42f825bf7a3b6cc1778228441f401d250870d
Instruction Fuzzy Hash: 3D01C039D04A698BCF06DF64E528ABE7B75BF84368F208109D4116B3C0EF31DA42C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C13781 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C13788
std::_Lockit::_Lockit.LIBCPMT ref: 69C13792

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

messages.LIBCPMT ref: 69C137CC
std::_Facet_Register.LIBCPMT ref: 69C137E3
std::_Lockit::~_Lockit.LIBCPMT ref: 69C13803
Concurrency::cancel_current_task.LIBCPMT ref: 69C13810

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: 99332a077a77983d4cd4231676fc1b3a72e3ac24ff25c9a75ca49c405d771f44
Instruction ID: 4b7f76cc587814a42f161fe029db0972da070ae78e766538e245206a1f36435e
Opcode Fuzzy Hash: 99332a077a77983d4cd4231676fc1b3a72e3ac24ff25c9a75ca49c405d771f44
Instruction Fuzzy Hash: 5401C079A08A69CBCB06DF64E914ABE7B75BF81318F258109D4116B2C0EF349A02D796

Uniqueness

Uniqueness Score: -1.00%

Function 69C136EC Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C136F3
std::_Lockit::_Lockit.LIBCPMT ref: 69C136FD

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

collate.LIBCPMT ref: 69C13737
std::_Facet_Register.LIBCPMT ref: 69C1374E
std::_Lockit::~_Lockit.LIBCPMT ref: 69C1376E
Concurrency::cancel_current_task.LIBCPMT ref: 69C1377B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: 0f58566bc0f12897bccd1260d2bb3963587e7fa5c176f870f574595fd28b6563
Instruction ID: bbc70343e9de0765b44aee531aaaa091a1affdc29644214f92720494c7583c2e
Opcode Fuzzy Hash: 0f58566bc0f12897bccd1260d2bb3963587e7fa5c176f870f574595fd28b6563
Instruction Fuzzy Hash: 7201C479A04A698BCF06DB64E664ABE7775BF41358F108508D4116B3C0FF309902D796

Uniqueness

Uniqueness Score: -1.00%

Function 69BEE7AC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 69BEE948
__Mtx_unlock.LIBCPMT ref: 69BEE94F

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEE7DD, 69BEE87B
{}: Scheduling message to be sent, xrefs: 69BEE82F
src\NamedPipeClient.cpp, xrefs: 69BEE834

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: EventMtx_unlock
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp${}: Scheduling message to be sent
API String ID: 390321462-1387862242
Opcode ID: 571c52a0e5a56ccc4f738af760b48598533a428815a270ff46c134f25053aef1
Instruction ID: 73345f771c4c2bafea6207637fa74c9e43e36ade59219c3506fa79a55d24d195
Opcode Fuzzy Hash: 571c52a0e5a56ccc4f738af760b48598533a428815a270ff46c134f25053aef1
Instruction Fuzzy Hash: AC519B70A002888FEB04CF68C985B9DBBB1FF45314F14C299D814AF392D775AA99CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 69BE227E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE2285

Part of subcall function 69BE2606: __EH_prolog3_catch.LIBCMT ref: 69BE2610

Part of subcall function 69BEAA6B: __EH_prolog3.LIBCMT ref: 69BEAA72

Strings

command, xrefs: 69BE229F
ignore, xrefs: 69BE2385
programID, xrefs: 69BE230F
type must be boolean, but is , xrefs: 69BE2407

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3H_prolog3_H_prolog3_catch
String ID: command$ignore$programID$type must be boolean, but is
API String ID: 237414032-1071730312
Opcode ID: 5a0fe224e86f46b7f12bc135591a86794cefe7f823687406f7c79c27d8d33829
Instruction ID: 4303ff85e00880124f3e0b1d748e7635922b844ecf2d275f23a1b2ac1e329f63
Opcode Fuzzy Hash: 5a0fe224e86f46b7f12bc135591a86794cefe7f823687406f7c79c27d8d33829
Instruction Fuzzy Hash: 5E517C75D0424AAFDB09DFE4E880AEEBBB9FF04354F204519E155E72C0EB34AA45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 69BFABB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 69BFACE6
Concurrency::cancel_current_task.LIBCPMT ref: 69BFACEB
Concurrency::cancel_current_task.LIBCPMT ref: 69BFACF0

Part of subcall function 69C1BE43: _free.LIBCMT ref: 69C1BE56

Strings

true, xrefs: 69BFACA3
false, xrefs: 69BFAC79

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_free
String ID: false$true
API String ID: 149343396-2658103896
Opcode ID: 4df9dcdcdebc0de01fbb3e68ab413164d0b3988f987b3dbb9754b0258bdb2400
Instruction ID: 119e83de9dbd42a037ac30ff56770633fc15edb4c4315f551d44b64cb80c2ed3
Opcode Fuzzy Hash: 4df9dcdcdebc0de01fbb3e68ab413164d0b3988f987b3dbb9754b0258bdb2400
Instruction Fuzzy Hash: 3A4122799043809FCB14DF64E840B5ABBF8EF06718F04856DE8558B780E7769A0ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C0C445 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C0C44C
_Getvals.LIBCPMT ref: 69C0C49E
_Mpunct.LIBCPMT ref: 69C0C4D9
_Mpunct.LIBCPMT ref: 69C0C4F3

Strings

$+xv, xrefs: 69C0C4FE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 88ba5faf24f179794d7100fb480053fa4854eeef1248cb78c40d39a0a6c2d3cd
Instruction ID: 272224fa2e11e4aa4284ff81a75467810f4bb3d00c2a975cdc2f6bfdb3f6647a
Opcode Fuzzy Hash: 88ba5faf24f179794d7100fb480053fa4854eeef1248cb78c40d39a0a6c2d3cd
Instruction Fuzzy Hash: 1721A4B5904B526EDB21CF7494A0B3BBEF8BB09314F045A1AE499C7A41E735E601CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 69C1BBA2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,69C1BC63,00000000,?,00000001,00000000,?,69C1BCDA,00000001,FlsFree,69C3E254,69C3E25C,00000000), ref: 69C1BC32

Strings

api-ms-, xrefs: 69C1BBF2

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 1943b4e2fa372d785137a3751f364f3d38d5aed6412a0bdcdcf283f8efeeab63
Instruction ID: b0e5fac3f54c892abe4c29e5544e41d4aba60922a7f75999dd12cbf7f30e81ed
Opcode Fuzzy Hash: 1943b4e2fa372d785137a3751f364f3d38d5aed6412a0bdcdcf283f8efeeab63
Instruction Fuzzy Hash: 3F110631A49A24ABDF228A69AC1575E77B4AF03760F100120E914F73C8FB70ED009ED9

Uniqueness

Uniqueness Score: -1.00%

Function 69BE2606 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 69BE2610

Strings

' not found, xrefs: 69BE26B2
cannot use at() with , xrefs: 69BE265A
key ', xrefs: 69BE269C
invalid map<K, T> key, xrefs: 69BE268F

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_catch
String ID: ' not found$cannot use at() with $invalid map<K, T> key$key '
API String ID: 3886170330-2846808603
Opcode ID: 6bb5c9c72d0cd109fc6c957ae3dbdbc11c35ab5e7bac31c8943e727ea903ac97
Instruction ID: a0454957b3e00169a8b5cd7701f6768f6931e98da085ad4d41639d95100bfab7
Opcode Fuzzy Hash: 6bb5c9c72d0cd109fc6c957ae3dbdbc11c35ab5e7bac31c8943e727ea903ac97
Instruction Fuzzy Hash: FD21DF79904288AFDB05DBA0D800FED7BBEAF11388F609068D004A71D1EB349F4ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 69C25805 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,69C257B7,?,?,69C2577F,?,00000001,?), ref: 69C2581A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 69C2582D
FreeLibrary.KERNEL32(00000000,?,?,69C257B7,?,?,69C2577F,?,00000001,?), ref: 69C25850

Strings

mscoree.dll, xrefs: 69C25813
CorExitProcess, xrefs: 69C25825

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 79a8920393086d3a2e48c845b3cdf631a65db36328d0b87c5e14080da0b92288
Instruction ID: 57c25da7d209874d0f8cce5ae9b229230e969dacf5c582f9e6f3f197ae760445
Opcode Fuzzy Hash: 79a8920393086d3a2e48c845b3cdf631a65db36328d0b87c5e14080da0b92288
Instruction Fuzzy Hash: B2F0A930A40A58FBDF229B91DD0DBAE7BB9FF41796F400064F901E2150EBB08E02DB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C2D5DD Relevance: 7.8, APIs: 5, Instructions: 330timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2D69A
_free.LIBCMT ref: 69C2D866
_free.LIBCMT ref: 69C2D8DE
GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,69C2DA9F,?,?,00000000), ref: 69C2D8F0

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 517cb273b86524c7f549362988b8634b3ff7660542c7abb87e08a591dcd5c08e
Instruction ID: 4326290774598a21f0bea281e2904da009b1d3f50d5d6c4ddf62e8056c27a9ed
Opcode Fuzzy Hash: 517cb273b86524c7f549362988b8634b3ff7660542c7abb87e08a591dcd5c08e
Instruction Fuzzy Hash: 7EA124B6D00215ABDB00EF68FD41AAE7BB8EF55754F10817BE914E7290FB309A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C27969 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C279FF
_free.LIBCMT ref: 69C27A16
_free.LIBCMT ref: 69C27A33
_free.LIBCMT ref: 69C27A4E
_free.LIBCMT ref: 69C27A65

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c67485b4087ea09cf4144a3647139dea323ad9e8fc94f198dc8f4a8f9b6a49a7
Instruction ID: dd778cc5441ec2a7bf8d643d4379454c922a23d7a03df5fd88df2125ec06c93b
Opcode Fuzzy Hash: c67485b4087ea09cf4144a3647139dea323ad9e8fc94f198dc8f4a8f9b6a49a7
Instruction Fuzzy Hash: DC418B31A04B00DFEB11DF29E9C1B5AB3F1FF08724B10AA69D44ADA2A0F731E641DB44

Uniqueness

Uniqueness Score: -1.00%

Function 69C180BA Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 69C180F7
dllmain_crt_dispatch.LIBCMT ref: 69C1810E
dllmain_raw.LIBCMT ref: 69C18156
dllmain_crt_dispatch.LIBCMT ref: 69C18169
dllmain_raw.LIBCMT ref: 69C1817C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: d269702e7891000e04fb6c08fe2ff6a647d98991037b87f184c3060cf54b700b
Instruction ID: e059f796da570909aa55cafda834594f3a17f410b3388d18d9c1db44ab2cbe3a
Opcode Fuzzy Hash: d269702e7891000e04fb6c08fe2ff6a647d98991037b87f184c3060cf54b700b
Instruction Fuzzy Hash: 4F21A173D0C658EFDB259E15EC40E6F3E79FB81B94B108125F8146B250E7348D41ABE4

Uniqueness

Uniqueness Score: -1.00%

Function 69C051DA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 69C051FA
_Maklocstr.LIBCPMT ref: 69C05217
_Maklocstr.LIBCPMT ref: 69C05234
_Maklocchr.LIBCPMT ref: 69C05246
_Maklocchr.LIBCPMT ref: 69C05259

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: ec62f94584e2aae63d11a0bd717a605954c8ea83d31bd56c32b38c3995e366f6
Instruction ID: 7b62d847e29f2492c5e2fde725d04616139e54fd3e551a241303dbce7a226ce6
Opcode Fuzzy Hash: ec62f94584e2aae63d11a0bd717a605954c8ea83d31bd56c32b38c3995e366f6
Instruction Fuzzy Hash: D2118CB1908784BBE310CBE6E890F53B7ACBF04654F04491AF148CB641E376F85187A8

Uniqueness

Uniqueness Score: -1.00%

Function 69C138AB Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C138B2
std::_Lockit::_Lockit.LIBCPMT ref: 69C138BC

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C1390D
std::_Lockit::~_Lockit.LIBCPMT ref: 69C1392D
Concurrency::cancel_current_task.LIBCPMT ref: 69C1393A

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 62a9b5affa8bc83adeaa3cbf5c823d3c192b995538c03ead9e0970b1bf6fb7da
Instruction ID: a2327624e13c3960a87964cdbc8600e387f11e9edfebc5a2e70260959bc3e06c
Opcode Fuzzy Hash: 62a9b5affa8bc83adeaa3cbf5c823d3c192b995538c03ead9e0970b1bf6fb7da
Instruction Fuzzy Hash: 1E012639904A698BCF02DF64E414ABE7775BF44318F248009D4016B3C0FF359A01DB86

Uniqueness

Uniqueness Score: -1.00%

Function 69C13816 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C1381D
std::_Lockit::_Lockit.LIBCPMT ref: 69C13827

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C13878
std::_Lockit::~_Lockit.LIBCPMT ref: 69C13898
Concurrency::cancel_current_task.LIBCPMT ref: 69C138A5

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: d6357af40dfeaadd0533e8f599cb490fed0f021c9f02a7664bc9a1cbb4d5849a
Instruction ID: 4f40a5c74f51ab6c6cc941b4e6dd773732d5719b056a24b8ebb4bdf5408a7da5
Opcode Fuzzy Hash: d6357af40dfeaadd0533e8f599cb490fed0f021c9f02a7664bc9a1cbb4d5849a
Instruction Fuzzy Hash: 4801D279E08A69CBDF06DF64E454ABE7775BF81328F24800AE4116B3C0EF349A01D796

Uniqueness

Uniqueness Score: -1.00%

Function 69C06834 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C0683B
std::_Lockit::_Lockit.LIBCPMT ref: 69C06845

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06896
std::_Lockit::~_Lockit.LIBCPMT ref: 69C068B6
Concurrency::cancel_current_task.LIBCPMT ref: 69C068C3

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 43019f59dc5fbd9a76b10ec06955e48b451db05296135e152da3dcbb17b76616
Instruction ID: b0d368cc879b25f8741496f1e69b4446688af3e0ec41fac6d4ddc0d5ea8b0e79
Opcode Fuzzy Hash: 43019f59dc5fbd9a76b10ec06955e48b451db05296135e152da3dcbb17b76616
Instruction Fuzzy Hash: 3401D639D049698BCF05DFA4E624ABD7775BF41358F249208D4116B3C0EF31DA05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C13AFF Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C13B06
std::_Lockit::_Lockit.LIBCPMT ref: 69C13B10

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C13B61
std::_Lockit::~_Lockit.LIBCPMT ref: 69C13B81
Concurrency::cancel_current_task.LIBCPMT ref: 69C13B8E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: b5ffa5e98c7fb735162bd3e6e50cdade75102d1a350c26f48da776408a039624
Instruction ID: 2a4016f13940cdb44d36c74160f35390e43152151a3764f42e3cc7fe1d7f68a9
Opcode Fuzzy Hash: b5ffa5e98c7fb735162bd3e6e50cdade75102d1a350c26f48da776408a039624
Instruction Fuzzy Hash: B90126398086698BCF01CF64E414ABDB775BF40718F208008E8056B3C0FF319A01D786

Uniqueness

Uniqueness Score: -1.00%

Function 69C13A6A Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C13A71
std::_Lockit::_Lockit.LIBCPMT ref: 69C13A7B

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C13ACC
std::_Lockit::~_Lockit.LIBCPMT ref: 69C13AEC
Concurrency::cancel_current_task.LIBCPMT ref: 69C13AF9

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 2ddca94ffb01f8ae0b795b60ac43cd5005eba2e4cad3d92050ebcb40bd214de1
Instruction ID: e12d6e667975355be4742d836a13bfd46cc72fc5bb3df00463a9f699358e8ab9
Opcode Fuzzy Hash: 2ddca94ffb01f8ae0b795b60ac43cd5005eba2e4cad3d92050ebcb40bd214de1
Instruction Fuzzy Hash: C101C439908669CBCB05DBA4E414ABE7775BF80318F254008D4116B3C0EF359A01D796

Uniqueness

Uniqueness Score: -1.00%

Function 69C05F79 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05F80
std::_Lockit::_Lockit.LIBCPMT ref: 69C05F8A

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C05FDB
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05FFB
Concurrency::cancel_current_task.LIBCPMT ref: 69C06008

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: db2fd566288663eb523efacfc84b4bc03d7429e67102d6b3d1ea4072271e291f
Instruction ID: e4728fb290202e5b81bd1ac707a9b2713ded259399f91713e0969c6f6ce3fe0a
Opcode Fuzzy Hash: db2fd566288663eb523efacfc84b4bc03d7429e67102d6b3d1ea4072271e291f
Instruction Fuzzy Hash: EB01F93990466ACBCF05DF64E524ABD7775BF45358F21800CD421AB3C0EF759A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C05EE4 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05EEB
std::_Lockit::_Lockit.LIBCPMT ref: 69C05EF5

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C05F46
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05F66
Concurrency::cancel_current_task.LIBCPMT ref: 69C05F73

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 9733069e18d98382e14e2f4b69a90e76d8e471f708520e430468d34dc901e4a9
Instruction ID: b3c47b0f639a2fbbec0dfd0675c05ba9142a9903189d96da04b05885a5a4b415
Opcode Fuzzy Hash: 9733069e18d98382e14e2f4b69a90e76d8e471f708520e430468d34dc901e4a9
Instruction Fuzzy Hash: F101D6399046699BCF05DF64E464ABD7779BF41358F148408E411AB3C0EF359A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C05E4F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C05E56
std::_Lockit::_Lockit.LIBCPMT ref: 69C05E60

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C05EB1
std::_Lockit::~_Lockit.LIBCPMT ref: 69C05ED1
Concurrency::cancel_current_task.LIBCPMT ref: 69C05EDE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 414f9004c9f5489061b1890f1362b24398d0741ddb67322acdba468e31017eb9
Instruction ID: 737345ebc6581d2f339a9621d936dad0d6ff6b9f9ff3a1384635b358d04c5537
Opcode Fuzzy Hash: 414f9004c9f5489061b1890f1362b24398d0741ddb67322acdba468e31017eb9
Instruction Fuzzy Hash: B801D63990466A8BCF06DF64E524ABE7B79BF44354F208418E411AB3C0EF75DA01D792

Uniqueness

Uniqueness Score: -1.00%

Function 69C010B3 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C010BA
std::_Lockit::_Lockit.LIBCPMT ref: 69C010C4

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C01115
std::_Lockit::~_Lockit.LIBCPMT ref: 69C01135
Concurrency::cancel_current_task.LIBCPMT ref: 69C01142

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 893742e40858c948b7f724cf3c013a2f6293878d6db5062d3152c7dca8c3eee2
Instruction ID: d49ef240a25e5001b48ddd84cec92618fe4d90c0eca1c28a920c2e780f7b49ed
Opcode Fuzzy Hash: 893742e40858c948b7f724cf3c013a2f6293878d6db5062d3152c7dca8c3eee2
Instruction Fuzzy Hash: 5A01D6399046A9CBCF05DF68E524ABEB775BF85318F11800CD4116B3C0EF329901C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C0600E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06015
std::_Lockit::_Lockit.LIBCPMT ref: 69C0601F

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06070
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06090
Concurrency::cancel_current_task.LIBCPMT ref: 69C0609D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 2dcb738391d8a348add757fe760b5de3e9ad554a65d091541f846e1ae1020a20
Instruction ID: b346540738f0b91a928b5f258e3148c962f2ab0d6fd036ba321c6df710ccffbe
Opcode Fuzzy Hash: 2dcb738391d8a348add757fe760b5de3e9ad554a65d091541f846e1ae1020a20
Instruction Fuzzy Hash: 3201D6399449698BCF05DF64E624ABE7775BF44358F148608E411AB3C0EF319A05C796

Uniqueness

Uniqueness Score: -1.00%

Function 69C0101E Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C01025
std::_Lockit::_Lockit.LIBCPMT ref: 69C0102F

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C01080
std::_Lockit::~_Lockit.LIBCPMT ref: 69C010A0
Concurrency::cancel_current_task.LIBCPMT ref: 69C010AD

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 609029042e88391f2b4bd411f52a10dd99bc56b26fe39210a51322ecc906660c
Instruction ID: ad28425961522d72f484a2ec911a808bcef480cc890ff9737058667c5783cdda
Opcode Fuzzy Hash: 609029042e88391f2b4bd411f52a10dd99bc56b26fe39210a51322ecc906660c
Instruction Fuzzy Hash: FD01D6399046A9CBCF05DFA8E524ABDB775BF8031CF648008D4516B3C0EF319901C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C0638C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06393
std::_Lockit::_Lockit.LIBCPMT ref: 69C0639D

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C063EE
std::_Lockit::~_Lockit.LIBCPMT ref: 69C0640E
Concurrency::cancel_current_task.LIBCPMT ref: 69C0641B

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 2d44df01f8ee75a8225b97a8983c64340e18da923a7e13050f4202812cba3853
Instruction ID: c6119e39393aa836df168a0edff927c90fa159b3066aa611db3d79b754a1abed
Opcode Fuzzy Hash: 2d44df01f8ee75a8225b97a8983c64340e18da923a7e13050f4202812cba3853
Instruction Fuzzy Hash: 3F01D239904A698BCF06DFA4E524ABE7775BF84318F248109D4116B3C0EF729A02CB96

Uniqueness

Uniqueness Score: -1.00%

Function 69C062F7 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C062FE
std::_Lockit::_Lockit.LIBCPMT ref: 69C06308

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06359
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06379
Concurrency::cancel_current_task.LIBCPMT ref: 69C06386

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 67f074c01649348584df3e86a0c1e198de76d34b9de6da33ed7568ef9f60e94a
Instruction ID: 5526bfc46099af9988e23f67075a39197ca5c4c3293f1db9e164532c61fabf46
Opcode Fuzzy Hash: 67f074c01649348584df3e86a0c1e198de76d34b9de6da33ed7568ef9f60e94a
Instruction Fuzzy Hash: 3E01C439904A699BCB05DF64E624ABEB775BF45354F108108D4116B3C0EF31DA01C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 69C064B6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C064BD
std::_Lockit::_Lockit.LIBCPMT ref: 69C064C7

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06518
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06538
Concurrency::cancel_current_task.LIBCPMT ref: 69C06545

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: f387ba2a52a77e73186b067cb03b25b1cdb3d45dfcadeb75e93c0b126c7b99af
Instruction ID: 55d90c2ad9c2c5375f590b1ceb98b1f3703261721279238479eedc4c759875ca
Opcode Fuzzy Hash: f387ba2a52a77e73186b067cb03b25b1cdb3d45dfcadeb75e93c0b126c7b99af
Instruction Fuzzy Hash: 9501C039904AA9CBCF06DF64E528ABE7776BF84318F209108D4116B2C0FF319A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C06421 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06428
std::_Lockit::_Lockit.LIBCPMT ref: 69C06432

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06483
std::_Lockit::~_Lockit.LIBCPMT ref: 69C064A3
Concurrency::cancel_current_task.LIBCPMT ref: 69C064B0

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 5431db59209113799338b43167763f1f016ca486f483c454b65456a2ad1bd2a0
Instruction ID: 403699370c35995a5be9296c73ebe2c5c5c39ee90fb468f469a6957cb9fb55be
Opcode Fuzzy Hash: 5431db59209113799338b43167763f1f016ca486f483c454b65456a2ad1bd2a0
Instruction Fuzzy Hash: 9F01D6399049699BCF05DFA4E524ABE7779BF40728F208109E411AB3C0EF35DA01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C0679F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C067A6
std::_Lockit::_Lockit.LIBCPMT ref: 69C067B0

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C06801
std::_Lockit::~_Lockit.LIBCPMT ref: 69C06821
Concurrency::cancel_current_task.LIBCPMT ref: 69C0682E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 7a840cd662b2b748c88d3b2ac40ee202652a27ca479ee52983af82c7c3b6d62a
Instruction ID: b8707de34dc7c0b56233c81e3b3a84f971f33512f7e525e2c9da92ab2106f31b
Opcode Fuzzy Hash: 7a840cd662b2b748c88d3b2ac40ee202652a27ca479ee52983af82c7c3b6d62a
Instruction Fuzzy Hash: B501D639D04A698BCF05DF64E524ABD7B75BF45728F208108D4116B3C1EF319E41C796

Uniqueness

Uniqueness Score: -1.00%

Function 69C0670A Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C06711
std::_Lockit::_Lockit.LIBCPMT ref: 69C0671B

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C0676C
std::_Lockit::~_Lockit.LIBCPMT ref: 69C0678C
Concurrency::cancel_current_task.LIBCPMT ref: 69C06799

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: e8f88169e985a320edf0d436b8e25ba4dbef01dfcf86857741984a0f195241a2
Instruction ID: 8d6bb7fd9572d70620f54a93323ad777daecc5013f38a39d1bf679c63fedc981
Opcode Fuzzy Hash: e8f88169e985a320edf0d436b8e25ba4dbef01dfcf86857741984a0f195241a2
Instruction Fuzzy Hash: 7A01D239904A69CBCF06DF68E924ABE7775BF80368F24810CD411AB3C0EF319A01C792

Uniqueness

Uniqueness Score: -1.00%

Function 69C06675 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C0667C
std::_Lockit::_Lockit.LIBCPMT ref: 69C06686

Part of subcall function 69BEB400: std::_Lockit::_Lockit.LIBCPMT ref: 69BEB41D
Part of subcall function 69BEB400: std::_Lockit::~_Lockit.LIBCPMT ref: 69BEB439

std::_Facet_Register.LIBCPMT ref: 69C066D7
std::_Lockit::~_Lockit.LIBCPMT ref: 69C066F7
Concurrency::cancel_current_task.LIBCPMT ref: 69C06704

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: a871745d92362e4e50a1dbef5a68b57aa3a4a7472697a3b16a67f271c8821e84
Instruction ID: bb483de712fe82b31d379958c0b9bcd6f4bd382fa74bf4fe88aa04ff569be62d
Opcode Fuzzy Hash: a871745d92362e4e50a1dbef5a68b57aa3a4a7472697a3b16a67f271c8821e84
Instruction Fuzzy Hash: 5B01F939904969CBCF05DF64E524ABE77B5BF85368F108109D4516B3C1EF319E01C796

Uniqueness

Uniqueness Score: -1.00%

Function 69C2F926 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2F93E

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C2F950
_free.LIBCMT ref: 69C2F962
_free.LIBCMT ref: 69C2F974
_free.LIBCMT ref: 69C2F986

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6342bc075df2a80f8fe2ca63ba167f378d5b16792e0a3b328ce032a8b720ac2b
Instruction ID: d5a129e557cd609a3e86db48dfe266cd2f5b03dd7761aba0eafaf4699206cecb
Opcode Fuzzy Hash: 6342bc075df2a80f8fe2ca63ba167f378d5b16792e0a3b328ce032a8b720ac2b
Instruction Fuzzy Hash: 41F03631509648EFCA10EA6CF5C1C2B73FEBB457247B09816F059E7500E730F8919AB9

Uniqueness

Uniqueness Score: -1.00%

Function 69C17A00 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(69C56B58,?,?,69BFBCAB,69C576E0), ref: 69C17A0A
LeaveCriticalSection.KERNEL32(69C56B58,?,?,69BFBCAB,69C576E0), ref: 69C17A3D
WakeAllConditionVariable.KERNEL32(?,69BFBCAB,69C576E0), ref: 69C17AB4
SetEvent.KERNEL32(?,69BFBCAB,69C576E0), ref: 69C17ABE
ResetEvent.KERNEL32(?,69BFBCAB,69C576E0), ref: 69C17ACA

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 06e33a64b65e98924b7ff37e458af9471bde19cd12e579acef44fce881e963b5
Instruction ID: 3579d0d9ebd96ac24a9fa52bcff11a5add9b245dc4c9d2f5d534122afcbeb5aa
Opcode Fuzzy Hash: 06e33a64b65e98924b7ff37e458af9471bde19cd12e579acef44fce881e963b5
Instruction Fuzzy Hash: BD018171504EA0DFCF109F18EA08AA93B74FB4B3117400019F816A3351DB301922EF96

Uniqueness

Uniqueness Score: -1.00%

Function 69BFD760 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 390fileCOMMON

Download Yara Rule

APIs

WriteFileEx.KERNEL32(?,00000000,?,?,69BFDDB0), ref: 69BFDA66
GetLastError.KERNEL32 ref: 69BFDB47

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BFD986, 69BFD9FF, 69BFDB25, 69BFDBAF
5, xrefs: 69BFDB55

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 5$CCleaner.Windows.IPC.NamedPipes
API String ID: 442123175-1411634055
Opcode ID: b670575fab0f3ead5c218c278e331584c6f00456e3f07ad79e0c7ec44a12286a
Instruction ID: 2373ffd75319ec81e887bbe9ba9c2cb033760d65803bb0fb894060263e7905e1
Opcode Fuzzy Hash: b670575fab0f3ead5c218c278e331584c6f00456e3f07ad79e0c7ec44a12286a
Instruction Fuzzy Hash: E4029F70E01289CFEB04CF68D94579DBBF1FF85304F108259E818AB391E774AA89DB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C240B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 375COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 69C2423D
__freea.LIBCMT ref: 69C24259

Strings

a/p, xrefs: 69C24321
am/pm, xrefs: 69C242BD

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: a35dfb0c9a5c9ab6974aeae851943d81817419cf84b28163a2421a0000a16c41
Instruction ID: 3e1d1588368e386424cf4e86d463a4439da7c6d20c34449325dd66a480221c5f
Opcode Fuzzy Hash: a35dfb0c9a5c9ab6974aeae851943d81817419cf84b28163a2421a0000a16c41
Instruction Fuzzy Hash: 9FC12339D44216CBDB00CFA9E994BAAB7B0FF4A704F10816AE914AB754F3359941CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 69BECF10 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 69BECF59
___std_exception_destroy.LIBVCRUNTIME ref: 69BECF84

Strings

argument not found, xrefs: 69BED0E4

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: argument not found
API String ID: 2970364248-3524968529
Opcode ID: 7d271e7d05749c82220de499a143f5b398d55ebb3e83c79d8f2ab37a04dcd662
Instruction ID: f08710fd41b8fa3b6fe99b21b50be54a07000552ab84879c3a0b3b08d6033b15
Opcode Fuzzy Hash: 7d271e7d05749c82220de499a143f5b398d55ebb3e83c79d8f2ab37a04dcd662
Instruction Fuzzy Hash: 8DB1C871D042589FDB10CF64EC847AEB7F9FF99354F10429AD819A7280E7749A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C2DC87 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C2DE21

Strings

*?, xrefs: 69C2DCCA

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9e3094b589503f71015ed71fc30e6cb2b9df23ef43c29e2c122c99d494e9d566
Instruction ID: 823e9c9422b03c99beae3c30ec1a475ec3729b2afdfe8a66ced14bfe0af45c87
Opcode Fuzzy Hash: 9e3094b589503f71015ed71fc30e6cb2b9df23ef43c29e2c122c99d494e9d566
Instruction Fuzzy Hash: 60617CB5E002199FDB14CFA8D9819EDFBF5EF58354F25816AD815E7300E731AE418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 69BEF2C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 69BEF4D8
__Mtx_unlock.LIBCPMT ref: 69BEF4DF

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEF413, 69BEF48E
src\NamedPipeClient.cpp, xrefs: 69BEF438

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: EventMtx_unlock
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp
API String ID: 390321462-2992322939
Opcode ID: 6a2ac0d1f8ce95fb159862a2d6a72ad0be8521126aa8b5c088aef31ac292d1a8
Instruction ID: 0edcd46e30657a31a7ffaec0dd6c608c4deb942ae43b13da00539fd64ed44d74
Opcode Fuzzy Hash: 6a2ac0d1f8ce95fb159862a2d6a72ad0be8521126aa8b5c088aef31ac292d1a8
Instruction Fuzzy Hash: 2D71AB70D00388CFEB01CFA8D94579DBBB4FF9A314F158299D818AB351EB71A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69BF23A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 69BF2491
___std_exception_destroy.LIBVCRUNTIME ref: 69BF24BC

Strings

{, xrefs: 69BF2447
invalid fill character '{', xrefs: 69BF244C

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: invalid fill character '{'${
API String ID: 2970364248-1959790581
Opcode ID: 514652842ff8e0b9102b71cfc82cc53fda7253c67d755a9048f51de5ca3cbfc2
Instruction ID: 2290a853b26cc256fd319a27ec3ce0ca906a63f077abb3fddfd158e183dd493e
Opcode Fuzzy Hash: 514652842ff8e0b9102b71cfc82cc53fda7253c67d755a9048f51de5ca3cbfc2
Instruction Fuzzy Hash: 5D41E071D052D88BDB01CFA8D8807EEBBF4FF49310F54425AE514A3244E775AA4A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 69BE9523 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE952D

Strings

cannot use erase() with , xrefs: 69BE966C
iterator out of range, xrefs: 69BE9576
iterator does not fit current value, xrefs: 69BE96A2

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_
String ID: cannot use erase() with $iterator does not fit current value$iterator out of range
API String ID: 2427045233-3306149458
Opcode ID: 7df2bbb42100301b81154f1981d3b69e1ea0eeb7a4599a9db29f5358ba0f6ca5
Instruction ID: aa4be0940038c4e692503ab3eb26e054dc0e377c33c2a00f77bacebab7a08a80
Opcode Fuzzy Hash: 7df2bbb42100301b81154f1981d3b69e1ea0eeb7a4599a9db29f5358ba0f6ca5
Instruction Fuzzy Hash: 9951F474A04248DFDF14DFA4D890BADB7B9EF05394F609069D401AB2D1EB349E49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69BEDE7B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 69BEDFA3
__Mtx_destroy_in_situ.LIBCPMT ref: 69BEDFAF

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEDEAA, 69BEDF32
src\NamedPipeClient.cpp, xrefs: 69BEDED3

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Mtx_destroy_in_situ
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp
API String ID: 3543493169-2992322939
Opcode ID: 41e7b1a869be63fac736315f488adcf27a18a026c8c254f80adc6a914d411438
Instruction ID: 1b0b6a88a8996411844a5fbd7b591c449adf6b93ca158e722a5e4def8e0ce5c1
Opcode Fuzzy Hash: 41e7b1a869be63fac736315f488adcf27a18a026c8c254f80adc6a914d411438
Instruction Fuzzy Hash: FC41E270E102848FDB00CFACD945B9DBBF0FF89318F108269E455AB791E7B5A958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C11A00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C11A07

Part of subcall function 69C05BFB: __EH_prolog3.LIBCMT ref: 69C05C02
Part of subcall function 69C05BFB: std::_Lockit::_Lockit.LIBCPMT ref: 69C05C0C
Part of subcall function 69C05BFB: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05C7D

_Find_elem.LIBCPMT ref: 69C11AA3

Strings

%.0Lf, xrefs: 69C11A4E
0123456789-, xrefs: 69C11A53

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 288897641c82323c06828ce24c7025ef70e485e57607d637753cabc7dbb21b44
Instruction ID: c325b5a3e4581d16795f9f8c2a05284ada80bb986fe14b53aaed3130184c4a2e
Opcode Fuzzy Hash: 288897641c82323c06828ce24c7025ef70e485e57607d637753cabc7dbb21b44
Instruction Fuzzy Hash: 8C41AD31904218DFCF05CFA8E980ADE7FB5FF18318F00415AE811AB250EB35DA56DB95

Uniqueness

Uniqueness Score: -1.00%

Function 69C11CB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C11CB7

Part of subcall function 69C05C90: __EH_prolog3.LIBCMT ref: 69C05C97
Part of subcall function 69C05C90: std::_Lockit::_Lockit.LIBCPMT ref: 69C05CA1
Part of subcall function 69C05C90: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05D12

_Find_elem.LIBCPMT ref: 69C11D53

Strings

0123456789-, xrefs: 69C11D03
0123456789-, xrefs: 69C11CFE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789-$0123456789-
API String ID: 2544715827-2494171821
Opcode ID: 7e35d957d9a43619c82784667c9e247b5495d83f40b1d74729abf815e9144d60
Instruction ID: b9baae738512f92c3996d7f555746c5bf08df3b6c1539ce5dd57ce80b72e8323
Opcode Fuzzy Hash: 7e35d957d9a43619c82784667c9e247b5495d83f40b1d74729abf815e9144d60
Instruction Fuzzy Hash: 98410035900218DFCF16DFE8E880ADEBBB5FF18314F40415AE810AB251EB34D956DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 69C166E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C166E7

Part of subcall function 69C00F89: __EH_prolog3.LIBCMT ref: 69C00F90
Part of subcall function 69C00F89: std::_Lockit::_Lockit.LIBCPMT ref: 69C00F9A
Part of subcall function 69C00F89: std::_Lockit::~_Lockit.LIBCPMT ref: 69C0100B

_Find_elem.LIBCPMT ref: 69C16781

Strings

0123456789-, xrefs: 69C16733
0123456789-, xrefs: 69C1672E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789-$0123456789-
API String ID: 2544715827-2494171821
Opcode ID: 9cc1f4a07645b2e5b5c7e31899b96d17bff59b91a642154dd037fed2122c49a1
Instruction ID: eb53a4e9b71c1a9eaca25f5e8063e04edb6dcba5c8937015259cfa82b7d5af63
Opcode Fuzzy Hash: 9cc1f4a07645b2e5b5c7e31899b96d17bff59b91a642154dd037fed2122c49a1
Instruction Fuzzy Hash: 4241C035D04259DFCF05CFA4E990AEEBBB9FF04314F10415AE821AB251EB30DA02DB95

Uniqueness

Uniqueness Score: -1.00%

Function 69BEE5EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 69BEE711
__Mtx_unlock.LIBCPMT ref: 69BEE718

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEE63F, 69BEE6C4
src\NamedPipeClient.cpp, xrefs: 69BEE668

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: EventMtx_unlock
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp
API String ID: 390321462-2992322939
Opcode ID: 316dd05cc904aba1443f342cd6b912063f18d3fdb28b9ea09fa9a999db922685
Instruction ID: fdc6bccec82086ce27a32d2ef75ad57eb026a22ca3f4fd9e2e4f7c985513eb33
Opcode Fuzzy Hash: 316dd05cc904aba1443f342cd6b912063f18d3fdb28b9ea09fa9a999db922685
Instruction Fuzzy Hash: 52416874A01248CFEB00CFA8C545AACBBB0FF99314F1582A9D814AB350EB71AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C14EAA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C14EB1
_Mpunct.LIBCPMT ref: 69C14F3E
_Mpunct.LIBCPMT ref: 69C14F58

Strings

$+xv, xrefs: 69C14F63

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: d457b767eaf60a45afa615e0c79e5a337db63635721ebad094b942251a008e27
Instruction ID: d4b72604c04f921628a6941413ec8e9da2e9f0567c76013339c476ad35851ef2
Opcode Fuzzy Hash: d457b767eaf60a45afa615e0c79e5a337db63635721ebad094b942251a008e27
Instruction Fuzzy Hash: D42192B5908B526FD721CF74D490B7BBEF8BB09604F045A1AE499C7A41F734E602CB94

Uniqueness

Uniqueness Score: -1.00%

Function 69C0C37A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69C0C381

Part of subcall function 69C051DA: _Maklocstr.LIBCPMT ref: 69C051FA
Part of subcall function 69C051DA: _Maklocstr.LIBCPMT ref: 69C05217
Part of subcall function 69C051DA: _Maklocstr.LIBCPMT ref: 69C05234
Part of subcall function 69C051DA: _Maklocchr.LIBCPMT ref: 69C05246
Part of subcall function 69C051DA: _Maklocchr.LIBCPMT ref: 69C05259

_Mpunct.LIBCPMT ref: 69C0C40E
_Mpunct.LIBCPMT ref: 69C0C428

Strings

$+xv, xrefs: 69C0C433

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: b533e12b5fb98710510f16ce51140a954eff0ac43c6911e9df63451c7b689014
Instruction ID: 990ba669f82da1ed472a80532cbc33327c6c2ad6e11f445dc9a5219e30018e8b
Opcode Fuzzy Hash: b533e12b5fb98710510f16ce51140a954eff0ac43c6911e9df63451c7b689014
Instruction Fuzzy Hash: FF2192B5904B526FDB21CF7494A0B7BBEF8BB0D204F045A1AE499C7A41F735E605CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 69BE21AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69BE21B1

Part of subcall function 69BE411A: __EH_prolog3_GS.LIBCMT ref: 69BE4121

Part of subcall function 69BE369F: __EH_prolog3_GS.LIBCMT ref: 69BE36A6

Strings

command, xrefs: 69BE21DD
ignore, xrefs: 69BE225E
programID, xrefs: 69BE221D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_$H_prolog3
String ID: command$ignore$programID
API String ID: 3952504126-3079906491
Opcode ID: a1cb648925422a4477a936fb7974df16c7209dca3a7d5f81bedcdfe48f0bfc2e
Instruction ID: fa5b593a4ac2a7a4a6070a74e948446b2d428b20c3662e12da7371b8ba12d147
Opcode Fuzzy Hash: a1cb648925422a4477a936fb7974df16c7209dca3a7d5f81bedcdfe48f0bfc2e
Instruction Fuzzy Hash: 7D2169B4E047868FDB04DFA8C04266EFFF1AF09214F10C96D905997381EB349940CB92

Uniqueness

Uniqueness Score: -1.00%

Function 69C28967 Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 69C289F1

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 88df5a8ddf6828f42da55ca98e8852ae00a8aa1deb196130a54f996a17260a90
Instruction ID: 75c7b8d71f6593d9c2c4a17df1797fbe94a4fca5f0171755c8f1984be798255c
Opcode Fuzzy Hash: 88df5a8ddf6828f42da55ca98e8852ae00a8aa1deb196130a54f996a17260a90
Instruction Fuzzy Hash: 1CB169729056459FEB01CF68E881FEEBBF5FF46344F14856AD844AB281F7348A42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 69C1AC10 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 69C1ACD7
___AdjustPointer.LIBCMT ref: 69C1ACFA
___AdjustPointer.LIBCMT ref: 69C1AD96

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6278a84ca4f9ec995434c65a9f0be31a585bd89b716f241f75072280dd0a9586
Instruction ID: b510d87680de86a670c7f8e8b72ea2e78c7c5ad46f240ea36e8221a4952b160c
Opcode Fuzzy Hash: 6278a84ca4f9ec995434c65a9f0be31a585bd89b716f241f75072280dd0a9586
Instruction Fuzzy Hash: 5B51137660CA029FEB159F15F840BAA73B8FF84366F10842DE811872A0F731E849E758

Uniqueness

Uniqueness Score: -1.00%

Function 69C2DBB8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 69C23076: _free.LIBCMT ref: 69C23084

Part of subcall function 69C2D23F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000001,69C2A58F,69C34333,0000FDE9,00000000,?,?,?,69C340AC,0000FDE9,00000000,?), ref: 69C2D2EB

GetLastError.KERNEL32 ref: 69C2DC20
__dosmaperr.LIBCMT ref: 69C2DC27
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 69C2DC66
__dosmaperr.LIBCMT ref: 69C2DC6D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 7ca656122feac2df43b9f9c68a23ad47c50a11854db39255c8c8afdc86081c07
Instruction ID: ee61811bb81c5a215f886ed2d0da84d62561e18cb416cd67cdaacf6e381c9cb5
Opcode Fuzzy Hash: 7ca656122feac2df43b9f9c68a23ad47c50a11854db39255c8c8afdc86081c07
Instruction Fuzzy Hash: BD21D375608609AFD7108F66BD81D1BB7ACFF113A8B00C52AE964D7240FB70EC408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C22F75 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6422f3666e36d600444fa7a630674d982f18aae11c4201ec5ab68927e0479f
Instruction ID: 251f2330e3f31dfeb309d32a0d5770a8994d5c7ef62b0fcde8e3ff645827eb27
Opcode Fuzzy Hash: 2a6422f3666e36d600444fa7a630674d982f18aae11c4201ec5ab68927e0479f
Instruction Fuzzy Hash: 0021BB71208249BFD724DF76AC81D1FB7ACAF517A87408624FA249A240FB30EC418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 69C04811 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(000000FF,?,69C007E9,69C00830,?,69C00646,00000000,00000000,00000000,00000004,69BF93D9,00000001,B3099220,000000FF,?), ref: 69C04824
IsProcessorFeaturePresent.KERNEL32(00000017,69C26B51,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600,?), ref: 69C21D31
_free.LIBCMT ref: 69C21D8E
_free.LIBCMT ref: 69C21DB4

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 3062152442-0
Opcode ID: 54b629fd2e49c44b84d38de46c6467a850b118920855f8a8415d4c2e93f7f3f5
Instruction ID: 4d132f3112efe12f9fcc1ac42a49b167333ca56341aec46f9b191bfd64d7cd20
Opcode Fuzzy Hash: 54b629fd2e49c44b84d38de46c6467a850b118920855f8a8415d4c2e93f7f3f5
Instruction Fuzzy Hash: 4711EB74944B44DFFF019B69FD16B553BB4E70276CF408126F619AA1C0F7B68062CB52

Uniqueness

Uniqueness Score: -1.00%

Function 69C26A95 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,69C33DF3,?,00000001,69C2A600,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000), ref: 69C26A9A
_free.LIBCMT ref: 69C26AF7
_free.LIBCMT ref: 69C26B2D
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,69C342AD,00000001,?,?,?,69C2A58F,?,00000000,00000000,69C52590,0000002C,69C2A600), ref: 69C26B38

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d13a506d8dd2a717efbb5d9f1b4cbd42ac414c5bfa40c0c391c539f153f78c0b
Instruction ID: e8c7988ac497cfb9111dff421967738d165ab32b9b7007482754d5d411075ab3
Opcode Fuzzy Hash: d13a506d8dd2a717efbb5d9f1b4cbd42ac414c5bfa40c0c391c539f153f78c0b
Instruction Fuzzy Hash: 2A11C276208E49FBDB119779BE84D2B396DABC2778B259236F521931D0FF6188224231

Uniqueness

Uniqueness Score: -1.00%

Function 69C26BEC Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,69C1BEDC,69C26708,?,?,69C26252), ref: 69C26BF1
_free.LIBCMT ref: 69C26C4E
_free.LIBCMT ref: 69C26C84
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000001,69C1BEDC,69C26708,?,?,69C26252), ref: 69C26C8F

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c308eb9fe83db5646c0931e1f27e911f57ab79cd11a23a7df786e833e0975601
Instruction ID: 1592ecafa10047c3675713a25ce5ad7eeb0e14d0573a91446cddec40c1c1f225
Opcode Fuzzy Hash: c308eb9fe83db5646c0931e1f27e911f57ab79cd11a23a7df786e833e0975601
Instruction Fuzzy Hash: 6B11A975208909BBD7216779BFC4D5B366DEBC6378B214236F525D31D0FF6288214171

Uniqueness

Uniqueness Score: -1.00%

Function 69BEDDE0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,B3099220,?,00000000), ref: 69BEDE3B

Part of subcall function 69BEB540: GetCurrentThreadId.KERNEL32 ref: 69BEB550

CloseHandle.KERNEL32(?), ref: 69BEDE4F
CloseHandle.KERNEL32(?), ref: 69BEDE58
CloseHandle.KERNEL32(?), ref: 69BEDE61

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CloseHandle$CurrentEventThread
String ID:
API String ID: 2050395969-0
Opcode ID: bfc5a3105bf15b827134e3da9b7e33c5649c03365bff58ede461d23d4cbbe50f
Instruction ID: 220d860313c55379f50fc9e50237a1cbfdac01e4e6e7516ddcbd76fc76e4879d
Opcode Fuzzy Hash: bfc5a3105bf15b827134e3da9b7e33c5649c03365bff58ede461d23d4cbbe50f
Instruction Fuzzy Hash: 6A218EB0C01799EBCB05CF69D9447AEFBB8FF49710F50821AE821A3240D7706915CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 69C366A7 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,69C35C81,?,00000001,?,00000001,?,69C33D82,?,?,00000001), ref: 69C366BE
GetLastError.KERNEL32(?,69C35C81,?,00000001,?,00000001,?,69C33D82,?,?,00000001,?,00000001,?,69C342CE,69C2A58F), ref: 69C366CA

Part of subcall function 69C36690: CloseHandle.KERNEL32(FFFFFFFE,69C366DA,?,69C35C81,?,00000001,?,00000001,?,69C33D82,?,?,00000001,?,00000001), ref: 69C366A0

___initconout.LIBCMT ref: 69C366DA

Part of subcall function 69C36645: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,69C36674,69C35C6E,00000001,?,69C33D82,?,?,00000001,?), ref: 69C36658

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,69C35C81,?,00000001,?,00000001,?,69C33D82,?,?,00000001,?), ref: 69C366EF

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c660c220190a74c69e11ab6979bbb327a8ec90a54f0c450dddb298e774643362
Instruction ID: e1a582d1abc32e7ef51a86c9c1277357a13c937b195e7462ef10647e6a5bb58e
Opcode Fuzzy Hash: c660c220190a74c69e11ab6979bbb327a8ec90a54f0c450dddb298e774643362
Instruction Fuzzy Hash: AAF03036010968BBCF222F91ED0999D3F36FF097A0B408010FA1996120E73299719F91

Uniqueness

Uniqueness Score: -1.00%

Function 69C17AD2 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNEL32(?,69C17A6F,00000064,?,?,?,69BFBC7C,69C576E0,B3099220,?,69C392D1,000000FF), ref: 69C17AF5
LeaveCriticalSection.KERNEL32(69C56B58,?,?,69C17A6F,00000064,?,?,?,69BFBC7C,69C576E0,B3099220,?,69C392D1,000000FF), ref: 69C17AFF
WaitForSingleObjectEx.KERNEL32(?,00000000,?,69C17A6F,00000064,?,?,?,69BFBC7C,69C576E0,B3099220,?,69C392D1,000000FF), ref: 69C17B10
EnterCriticalSection.KERNEL32(69C56B58,?,69C17A6F,00000064,?,?,?,69BFBC7C,69C576E0,B3099220,?,69C392D1,000000FF), ref: 69C17B17

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: b09514a6e88de32d8c9a2103accc17a0ce1f14f3792ce37ca09d1f7daa745b61
Instruction ID: eb410b3b75263606c86a4113a6e003567853b3e36c39cb41ca292355c757091d
Opcode Fuzzy Hash: b09514a6e88de32d8c9a2103accc17a0ce1f14f3792ce37ca09d1f7daa745b61
Instruction Fuzzy Hash: 9AE09231540D64F7CE111B51ED089DD3F34BB17751B400010F90963191E7200962BFEA

Uniqueness

Uniqueness Score: -1.00%

Function 69C263C0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 69C263C9

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

_free.LIBCMT ref: 69C263DC
_free.LIBCMT ref: 69C263ED
_free.LIBCMT ref: 69C263FE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1a10870e7a831e92572d3bdb57a148017b6d7fbee1e6c848daa2edbc580af390
Instruction ID: 1bae5af4625d738f96a73a9e3fc60055cb2ab5e62930ace341e959b3df90edcb
Opcode Fuzzy Hash: 1a10870e7a831e92572d3bdb57a148017b6d7fbee1e6c848daa2edbc580af390
Instruction Fuzzy Hash: A6E04F744015A0DB8E119F28AEC08053F37B796704750E097F00076212EB3544B3FB97

Uniqueness

Uniqueness Score: -1.00%

Function 69BFE290 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 378fileCOMMON

Download Yara Rule

APIs

ReadFileEx.KERNEL32(?,?,?,?,69BFE8D0), ref: 69BFE579
GetLastError.KERNEL32 ref: 69BFE639

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BFE4A5, 69BFE51A, 69BFE617, 69BFE6A1, 69BFE976, 69BFEA09, 69BFECF6, 69BFED85, 69BFF003, 69BFF095

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: CCleaner.Windows.IPC.NamedPipes
API String ID: 1948546556-1350194154
Opcode ID: 6dc03257fe8b1e5f567dfa93a50329cb1826a3932a6d013f2dff166ba0849132
Instruction ID: b414c0074dfb6a8571ab88e665f7fabe68cef53d31f99098a5fb953f9e2128da
Opcode Fuzzy Hash: 6dc03257fe8b1e5f567dfa93a50329cb1826a3932a6d013f2dff166ba0849132
Instruction Fuzzy Hash: FFF18D70A01288DFEF00CFA8C945BADBBB1FF45704F108199E815AB391E774AA49CF91

Uniqueness

Uniqueness Score: -1.00%

Function 69C024E6 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C024ED
_Find_elem.LIBCPMT ref: 69C026E9

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 69C02555

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3557906463-2799312399
Opcode ID: d5b2a569495b85f769b38e0ee88b3d4f846277bd4128a5d650b95873f5b30c58
Instruction ID: 33b1f8b806bb037d22928094d7f22ab663077f71f8290d5d3d27b37bbf130067
Opcode Fuzzy Hash: d5b2a569495b85f769b38e0ee88b3d4f846277bd4128a5d650b95873f5b30c58
Instruction Fuzzy Hash: 67C1B234E082988FDF06CFA8E6707DCBBB1AF46304F645169C8956B282F7329947CB51

Uniqueness

Uniqueness Score: -1.00%

Function 69C0A2B1 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C0A2BB

Part of subcall function 69C0654B: __EH_prolog3.LIBCMT ref: 69C06552
Part of subcall function 69C0654B: std::_Lockit::_Lockit.LIBCPMT ref: 69C0655C
Part of subcall function 69C0654B: std::_Lockit::~_Lockit.LIBCPMT ref: 69C065CD

_Find_elem.LIBCPMT ref: 69C0A4F5

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 69C0A332

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 35e74fab9e162c3bb474783507590c60d5f04abf631d5737e018b821fd484743
Instruction ID: c80c28d1b1b201f3b34e81da2770e5ed91e522bda534a8a8876504c44999b590
Opcode Fuzzy Hash: 35e74fab9e162c3bb474783507590c60d5f04abf631d5737e018b821fd484743
Instruction Fuzzy Hash: D1C1B674E08268CFDF15CF64E5687ECBB72BF85314F449099D8856B282EB368D85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 69C0A687 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C0A691

Part of subcall function 69C065E0: __EH_prolog3.LIBCMT ref: 69C065E7
Part of subcall function 69C065E0: std::_Lockit::_Lockit.LIBCPMT ref: 69C065F1
Part of subcall function 69C065E0: std::_Lockit::~_Lockit.LIBCPMT ref: 69C06662

_Find_elem.LIBCPMT ref: 69C0A8CB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 69C0A708

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 9e874089325f39a20fe7cd203873da376223e0bb93214cf1a8bb50214439a812
Instruction ID: 9ceae8a0fbfad9a68de286dcd3e40fbd018936945c1a4e2c0f70dcd683252a67
Opcode Fuzzy Hash: 9e874089325f39a20fe7cd203873da376223e0bb93214cf1a8bb50214439a812
Instruction Fuzzy Hash: 29C1D934E082588FDF11CF68E5697ECBB72BF85314F448199D8856B282FB328D85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 69C22ACD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 69C22B5D

Strings

pow, xrefs: 69C22B35, 69C22B52

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 78c0853919f495e656baa688971001ca60f19fe5ce744bc250d2a0c94b941d63
Instruction ID: d6a71fd0e891e0710d7f421d84a5c3d6d0b6496ba798b415e4daf6490badd648
Opcode Fuzzy Hash: 78c0853919f495e656baa688971001ca60f19fe5ce744bc250d2a0c94b941d63
Instruction Fuzzy Hash: 95519071A9824186DF05BF18E96136A7BB4FB41B90F208DE8E0E5461E8FB34C497DB43

Uniqueness

Uniqueness Score: -1.00%

Function 69BF3BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 69BF4142
___std_exception_destroy.LIBVCRUNTIME ref: 69BF416D

Strings

invalid type specifier, xrefs: 69BF412E

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: invalid type specifier
API String ID: 2970364248-1382033351
Opcode ID: 9f3e0d82a1f16b79371db2716529657cdff474b19fe2d83eb89136d2949db869
Instruction ID: 3445dc51a4b034365384819c9e1b2cb425cb6338786ee6aa1bf93cec9e8d6be8
Opcode Fuzzy Hash: 9f3e0d82a1f16b79371db2716529657cdff474b19fe2d83eb89136d2949db869
Instruction Fuzzy Hash: B971BE75A042489FCB04CF98D981AAEBBF5FF58700F14816DE855AB345E730E916CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 69C16E07 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 69C16F68

Strings

-, xrefs: 69C16F96
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 69C16EC6, 69C16EFD, 69C16F02

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 51d23848da559f5da06a6be1ae792978a233b44b4878cce45c9acf3eab2a2dcd
Instruction ID: fb7435c74419048b1a93f90ca52d771ae9456a834575f924bf19191eeb9de868
Opcode Fuzzy Hash: 51d23848da559f5da06a6be1ae792978a233b44b4878cce45c9acf3eab2a2dcd
Instruction Fuzzy Hash: B2511370A4CA989BDF10CEBDE6817BEBBB5BF46380F00456AE491D7240E3709542DB58

Uniqueness

Uniqueness Score: -1.00%

Function 69BEE9C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

CCleaner.Windows.IPC.NamedPipes, xrefs: 69BEF192
src\NamedPipeClient.cpp, xrefs: 69BEF1B6

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID: CCleaner.Windows.IPC.NamedPipes$src\NamedPipeClient.cpp
API String ID: 0-2992322939
Opcode ID: 6b591f8edd8b13498953ebfac23c5cd68802a281d5aee3323a3a15db658d0213
Instruction ID: 4ca4f445a26f82a5e9fb40266e4793bd4ec9d3cf1aa4f3bdc19d46e614d3ed0d
Opcode Fuzzy Hash: 6b591f8edd8b13498953ebfac23c5cd68802a281d5aee3323a3a15db658d0213
Instruction Fuzzy Hash: B6519E74E01248CFDB00CFA8D981BAEBBB4FF49714F24825EE815AB380D770A945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 69C11B30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C11B37
swprintf.LIBCMT ref: 69C11BA9

Part of subcall function 69C05BFB: __EH_prolog3.LIBCMT ref: 69C05C02
Part of subcall function 69C05BFB: std::_Lockit::_Lockit.LIBCPMT ref: 69C05C0C
Part of subcall function 69C05BFB: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05C7D

Part of subcall function 69C068C9: __EH_prolog3.LIBCMT ref: 69C068D0

Strings

%.0Lf, xrefs: 69C11BA1

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~_swprintf
String ID: %.0Lf
API String ID: 3990453159-1402515088
Opcode ID: f581918e5d6244b619c5daa82645af38632fb440eab65ef8ee9b0c7e59e2d51c
Instruction ID: 3c6fb26d9c2277645ec5dacc2de9726a8adf92c75bc3af66bdf49b0548186c0d
Opcode Fuzzy Hash: f581918e5d6244b619c5daa82645af38632fb440eab65ef8ee9b0c7e59e2d51c
Instruction Fuzzy Hash: 334187B5D00319AFCF05DFD4E894AED7BB4BF09304F108559E805AB290EB359955CF94

Uniqueness

Uniqueness Score: -1.00%

Function 69C11DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C11DE7
swprintf.LIBCMT ref: 69C11E59

Part of subcall function 69C05C90: __EH_prolog3.LIBCMT ref: 69C05C97
Part of subcall function 69C05C90: std::_Lockit::_Lockit.LIBCPMT ref: 69C05CA1
Part of subcall function 69C05C90: std::_Lockit::~_Lockit.LIBCPMT ref: 69C05D12

Part of subcall function 69C06974: __EH_prolog3.LIBCMT ref: 69C0697B

Strings

%.0Lf, xrefs: 69C11E51

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~_swprintf
String ID: %.0Lf
API String ID: 3990453159-1402515088
Opcode ID: 244e99c588e1acc3353b69094322bf9688bfecb360b37e8dc9f2567e3a7d9203
Instruction ID: 9e3790695ab7313c04510a4a1f12c6a902c49745ff1636d4550a408244f74dd5
Opcode Fuzzy Hash: 244e99c588e1acc3353b69094322bf9688bfecb360b37e8dc9f2567e3a7d9203
Instruction Fuzzy Hash: 5641DD75D00309ABCF06DFE4E858ADEBBB4FF09340F108459E805AB290EB35A919DF94

Uniqueness

Uniqueness Score: -1.00%

Function 69C16810 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C16817
swprintf.LIBCMT ref: 69C16889

Part of subcall function 69C00F89: __EH_prolog3.LIBCMT ref: 69C00F90
Part of subcall function 69C00F89: std::_Lockit::_Lockit.LIBCPMT ref: 69C00F9A
Part of subcall function 69C00F89: std::_Lockit::~_Lockit.LIBCPMT ref: 69C0100B

Strings

%.0Lf, xrefs: 69C16881

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_swprintf
String ID: %.0Lf
API String ID: 2994408256-1402515088
Opcode ID: 575ced1dbae9e087f55d7480fb4bb831878b39eea2a97d1104a85563f6e89b53
Instruction ID: 9591edcf111495e6cb3f592e19393cbc23ddd783e9f29a8605381e4159754f1a
Opcode Fuzzy Hash: 575ced1dbae9e087f55d7480fb4bb831878b39eea2a97d1104a85563f6e89b53
Instruction Fuzzy Hash: 5A41B8B5D04309ABCF06DFD0E944ADDBBB5FF08304F108419E801AB290EB319915DF94

Uniqueness

Uniqueness Score: -1.00%

Function 69C25893 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ccsetup621.exe, xrefs: 69C258D6, 69C258DD, 69C25913

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\ccsetup621.exe
API String ID: 0-196768976
Opcode ID: fe48cfb0309005d968fd8d4da0bb906be3ffc1919d6180949714826ae21900f5
Instruction ID: 866e463967edf0c516bd9afb5e245174f90788847c34be18aa570838be3c47d3
Opcode Fuzzy Hash: fe48cfb0309005d968fd8d4da0bb906be3ffc1919d6180949714826ae21900f5
Instruction Fuzzy Hash: 9B4184B5E08794AFDB11DF9DE88099FBBB8EF85350F108066E504E7244F7B09A42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 69C191B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 69C191EF
__IsNonwritableInCurrentImage.LIBCMT ref: 69C192A3

Strings

csm, xrefs: 69C1928D

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 775c2218c1b4bd415b0d1a02e30c55d8e3019734caa69c797cb6f8e56c597efe
Instruction ID: 9355319de20b30885311915f0931d02ee854b8137b3db5aa127ee0be05007eef
Opcode Fuzzy Hash: 775c2218c1b4bd415b0d1a02e30c55d8e3019734caa69c797cb6f8e56c597efe
Instruction Fuzzy Hash: 0241E538A04209DBCF14CF68E880A9EBBB5FF46328F10C165E8159B356E731EA51DF95

Uniqueness

Uniqueness Score: -1.00%

Function 69C1B211 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 69C1B236

Strings

RCC, xrefs: 69C1B250
MOC, xrefs: 69C1B248

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0dd274099f6ecbf1b6b6fd4e8cb90afec840d310105c319be83356fd3dfc3eb9
Instruction ID: a01699cb37ac8d5f35151020fbd03321a1b249cfa96949722e5c7850191d4324
Opcode Fuzzy Hash: 0dd274099f6ecbf1b6b6fd4e8cb90afec840d310105c319be83356fd3dfc3eb9
Instruction Fuzzy Hash: 0F418C71904209EFCF02CF94ED81AEE7BB5FF48304F148099F914A6215E7359960EF54

Uniqueness

Uniqueness Score: -1.00%

Function 69C12CC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69C12CC7
__cftoe.LIBCMT ref: 69C12D4B

Strings

!%x, xrefs: 69C12CD8

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 67f20ea73c2b631db3d7d78240beba39ddb4f1aa72039e6a761e7d18644a728f
Instruction ID: 1e5ef8ad7de3794ec550a9994eac98621cf558a4ad2ef62bafb84b48b2de34e1
Opcode Fuzzy Hash: 67f20ea73c2b631db3d7d78240beba39ddb4f1aa72039e6a761e7d18644a728f
Instruction Fuzzy Hash: 37314775D0820DEBDF04EF94E990ADEB7B6FF09308F108519E804A7251EB35AA56CB64

Uniqueness

Uniqueness Score: -1.00%

Function 69BE1FE2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE1FE9

Part of subcall function 69BE2606: __EH_prolog3_catch.LIBCMT ref: 69BE2610

Part of subcall function 69BEAA6B: __EH_prolog3.LIBCMT ref: 69BEAA72

Strings

details, xrefs: 69BE2073
messageType, xrefs: 69BE2003

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3H_prolog3_H_prolog3_catch
String ID: details$messageType
API String ID: 237414032-1980785668
Opcode ID: 0ac26d040b93a5b3f3acd42de5154078421ddd9d0de818d53aca8db9613aed42
Instruction ID: aa45fa55ca3a9349edf4e37e185db6491b31b09d5142a675e05bb646aa5d3679
Opcode Fuzzy Hash: 0ac26d040b93a5b3f3acd42de5154078421ddd9d0de818d53aca8db9613aed42
Instruction Fuzzy Hash: 6D316F75D0424AAFDB08DFE4D480AEEBBB9FF04754F604519E105E72C0EB34AA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 69BE4361 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 69BE43B5

Strings

d, xrefs: 69BE43AA
d, xrefs: 69BE43DE

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: __aulldvrm
String ID: d$d
API String ID: 1302938615-195624457
Opcode ID: 434925784724d7e0169718a4874af24bf174f7d019fb6b8681ccf8cb50edf7e7
Instruction ID: 6f09355ac5561e46eb849f0fdd6edfb1c10c2e2c8966f24be2f25b56951dc147
Opcode Fuzzy Hash: 434925784724d7e0169718a4874af24bf174f7d019fb6b8681ccf8cb50edf7e7
Instruction Fuzzy Hash: CB219A397083C04FDB12CF185850A6EBFBAEFC6780B08006DE9D507342CB31990AC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 69C22161 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 69C29669: HeapAlloc.KERNEL32(00000008,?,00000000,?,69C26C37,00000001,00000364,FFFFFFFF,000000FF,?,00000001,69C1BEDC,69C26708,?,?,69C26252), ref: 69C296AA

__cftoe.LIBCMT ref: 69C22187

Part of subcall function 69C266E2: HeapFree.KERNEL32(00000000,00000000,?,69C26252), ref: 69C266F8
Part of subcall function 69C266E2: GetLastError.KERNEL32(?,?,69C26252), ref: 69C2670A

Strings

I}, xrefs: 69C221CC
V0E, xrefs: 69C221AC

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: Heap$AllocErrorFreeLast__cftoe
String ID: V0E$I}
API String ID: 3811864353-4166470995
Opcode ID: 9315e38de998a87ac98e2d913958ab5c4d32d84b27ffc0d99bb37cf5db97e587
Instruction ID: 2a700d6573bcb78e7862282e15274d61856e74bb15dcd9ae270c60f420d5ff1b
Opcode Fuzzy Hash: 9315e38de998a87ac98e2d913958ab5c4d32d84b27ffc0d99bb37cf5db97e587
Instruction Fuzzy Hash: 1801FE7BD04208BADF15DBD8E851DDE77B8AF45224F208167E621E2150FB30CB058B91

Uniqueness

Uniqueness Score: -1.00%

Function 69BE20EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 69BE20F3

Part of subcall function 69BE2830: __EH_prolog3_GS.LIBCMT ref: 69BE2837

Part of subcall function 69BE411A: __EH_prolog3_GS.LIBCMT ref: 69BE4121

Part of subcall function 69BE26E1: __EH_prolog3_GS.LIBCMT ref: 69BE26EB

Strings

details, xrefs: 69BE2162
messageType, xrefs: 69BE2136

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3_
String ID: details$messageType
API String ID: 2427045233-1980785668
Opcode ID: 5ae8693bfba4710b35c712c6c3601facb5fca758e5675efc41822d7c86a95453
Instruction ID: c7beb2a31391442991e1f2b7ee3b9b51b95758c143fd36d122c061ee38d255dd
Opcode Fuzzy Hash: 5ae8693bfba4710b35c712c6c3601facb5fca758e5675efc41822d7c86a95453
Instruction Fuzzy Hash: EE116A78D052889ECF04EFE8C1516DCBFB8AF19248FA4909DD404A3281DB755E4ADBA6

Uniqueness

Uniqueness Score: -1.00%

Function 69BE1520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 69BE1527

Strings

, column , xrefs: 69BE156E
at line , xrefs: 69BE1552

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: H_prolog3
String ID: at line $, column
API String ID: 431132790-191570568
Opcode ID: c023cbafc1a88e58ad92cebc3b92829827b5c6b0c95d079351957da3fab2ff1a
Instruction ID: 651a87d0b3db245a61c27887f87fcab30e3204096469fa56f9ecf71c5b7ac01d
Opcode Fuzzy Hash: c023cbafc1a88e58ad92cebc3b92829827b5c6b0c95d079351957da3fab2ff1a
Instruction Fuzzy Hash: 4511A93CA04298DACB14DBA5DC90EDDB7B8AF15748F50A12DD006731D2EF745E0ADA61

Uniqueness

Uniqueness Score: -1.00%

Function 69BFF63C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 69BE10A0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,69BFF66B,?,?,?,?,B3099220,?), ref: 69BE10A6
Part of subcall function 69BE10A0: GetLastError.KERNEL32(?,69BFF66B,?,?,?,?,B3099220,?), ref: 69BE10B0

IsDebuggerPresent.KERNEL32(?,?,?,?,B3099220,?), ref: 69BFF66F
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,B3099220,?), ref: 69BFF67E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 69BFF679

Memory Dump Source

Source File: 0000000F.00000002.1917530800.0000000069BE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 69BE0000, based on PE: true

Associated: 0000000F.00000002.1917465279.0000000069BE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1919572483.0000000069C3B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920460876.0000000069C54000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920523789.0000000069C55000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920620574.0000000069C56000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1920706611.0000000069C58000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_69be0000_ccsetup621.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: af731a8b190d611ad47dbf2289edee56eaac7b8f0b53352f86b46d7263139ece
Instruction ID: 433bb079398823d8b4f4dfb5e73e6e994ee4dbee481e98d3674248417ab3ec1d
Opcode Fuzzy Hash: af731a8b190d611ad47dbf2289edee56eaac7b8f0b53352f86b46d7263139ece
Instruction Fuzzy Hash: 36E06D70100B909BD7209F75D10436A7BF4AF19744F41891CD49AC2250EB74D449CB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ccsetup621.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\CCleaner\CCUpdate.exe

C:\Program Files\CCleaner\CCleaner.exe

C:\Program Files\CCleaner\CCleaner64.exe

C:\Program Files\CCleaner\CCleanerBugReport.exe

C:\Program Files\CCleaner\CCleanerDU.dll

C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll

C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe

C:\Program Files\CCleaner\CCleanerReactivator.dll

C:\Program Files\CCleaner\CCleanerReactivator.exe

C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF

C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a755d00f-9c7c-43f1-9c4d-4a5ce0a5a18e

C:\Program Files\CCleaner\Data\usercfg.ini

C:\Program Files\CCleaner\LOG\DriverUpdEng.log

C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log

C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log

C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF

C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\642aa3dc-ecae-4987-b7a1-5b5e44f3bbaa

Windows Analysis Report
ccsetup621.zip

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.This may deny access to available backups and recovery options.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Deletion, Command: Command Execution, File: File Deletion, Process: Process Creation, Service: Service Metadata, Snapshot: Snapshot Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre