Edit tour

Windows Analysis Report
SecuriteInfo.com.FileRepPup.14974.19067.exe

Overview

General Information

Sample name:	SecuriteInfo.com.FileRepPup.14974.19067.exe
Analysis ID:	1431659
MD5:	c27c3107bb20803c3f5d8eab7258bb48
SHA1:	9e8384e96c6542eaf091cec68c351b8bde8d1b96
SHA256:	42e35e59355e78dc581115d24babd4424422efacfdb6710395c27e84243959df
Tags:	exe
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Drops password protected ZIP file

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

SecuriteInfo.com.FileRepPup.14974.19067.exe (PID: 6908 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe" MD5: C27C3107BB20803C3F5D8EAB7258BB48)

SecuriteInfo.com.FileRepPup.14974.19067.tmp (PID: 6980 cmdline: "C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp" /SL5="$1045C,19204712,857088,C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe" MD5: A7F5051B66AD0D9965C6DC9DF8955ED4)

schtasks.exe (PID: 4364 cmdline: "schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1076,i,16708299124163291726,5417237086903671621,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WiseCare365.exe (PID: 5640 cmdline: "C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe" MD5: A020B60C4DD43183E92322EBBD984622)

WiseTray.exe (PID: 4812 cmdline: "C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe" MD5: 4E793E5FBA64A9EDCDDB922E1AA9DAC4)

svchost.exe (PID: 2992 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

BootTime.exe (PID: 7944 cmdline: "C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe" MD5: 29887FFC5D12948658902E66BDAA09AD)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wise\Wise Care 365\is-LTPNS.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
0000000C.00000000.2045282560.0000000000401000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000E.00000000.2133553791.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author
12.0.BootTime.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
14.0.WiseTray.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
9.0.WiseCare365.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2992, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe (copy)	Virustotal: Detection: 14%	Perma Link
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (copy)	Virustotal: Detection: 8%	Perma Link
Source: C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp	Virustotal: Detection: 14%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	Virustotal: Detection: 12%			Perma Link

Source: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fwisecleanersoft&send=false&layout=button_count&width=110&show_faces=false&font&colorscheme=light&action=like&height=21	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.wisecleaner.com	HTTP Parser: No favicon
Source: https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__#_methods=onPlusOne%2C_ready%2C_close%2C_open%2C_resizeMe%2C_renderstart%2Concircled%2Cdrefresh%2Cerefresh%2Conload&id=I0_1714051839396&_gfid=I0_1714051839396&parent=https%3A%2F%2Fwww.wisecleaner.com&pfname=&rpctoken=22571271	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=WiseCleaner&show_count=false&show_screen_name=false&size=m&time=1714051841571	HTTP Parser: No favicon
Source: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.wisecleaner.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__#rpctoken=1872338475&forcesecure=1	HTTP Parser: No favicon
Source: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__#id=I0_1714051842536&_gfid=I0_1714051842536&parent=https%3A%2F%2Fwww.wisecleaner.com&pfname=&rpctoken=24310883	HTTP Parser: No favicon

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File created: C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\license.txt

Jump to behavior

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49914 version: TLS 1.2

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\workspace\windows\NewToolsProject\SQLite3Encrypt\Release\SQLite3Encrypt.pdb source: WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: G:\workspace\windows\WiseCare365_V4\Bootlancher\Release\Bootlauncher.pdb source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: global traffic

HTTP traffic detected: GET /wisecleaner_feedback/index.php?to=fetch-unread-message&guid={00280FF0-8444-4589-ABB1-07A5B9247E0B} HTTP/1.1Accept-Charset: utf-8Host: www.wisecleaner.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.244.42.72 104.244.42.72
Source: Joe Sandbox View	IP Address: 104.244.42.136 104.244.42.136
Source: Joe Sandbox View	IP Address: 104.244.42.8 104.244.42.8
Source: Joe Sandbox View	IP Address: 192.229.163.25 192.229.163.25

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.97.148
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 34.202.12.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.202.12.236
Source: unknown	TCP traffic detected without corresponding DNS query: 13.32.230.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.32.230.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PwDlxXseu3VEHbh&MD=lcm7x2Bz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /thanks-for-choosing-WiseCare365.html HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/reset.css HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/layout.css?v=1.24 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/layout-mobile.css?v=1.08 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/roboto.css?v=1.07 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/page/product/update/update.css HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/page/product/thanks-download/thanks-download.css HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fwisecleanersoft&send=false&layout=button_count&width=110&show_faces=false&font&colorscheme=light&action=like&height=21 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/svg/logo/pdf_logo.svg HTTP/1.1Host: pdf.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_america.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_1f2238_12.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_french.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_germany.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_japan.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_russia.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iEpO4/yv/l/en_US/tQNtwFBP_EQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.facebook.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/font/roboto/v29/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.wisecleaner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.wisecleaner.com/static/css/roboto.css?v=1.07Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/font/roboto/v29/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.wisecleaner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.wisecleaner.com/static/css/roboto.css?v=1.07Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/update/icon.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/card.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/logo/logo.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/clean.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/norton.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/bbb.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/macfee.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/sign.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/day_50.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/drw-win-icon_77.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/page/product/update/update.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_french.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_1f2238_12.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_germany.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/svg/logo/pdf_logo.svg HTTP/1.1Host: pdf.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_japan.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_russia.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_america.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_1f2238_18.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_china.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_wdf.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_365.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_wfh.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/special_offer_box.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iEpO4/yv/l/en_US/tQNtwFBP_EQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/clean.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/logo/logo.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/update/icon.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/card.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/norton.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/bbb.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wfh-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wrc-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/index-menu.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/static/css/layout.css?v=1.24Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wdc-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wu-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/was-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/macfee.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/sign.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/drw-win-icon_77.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/day_50.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_1f2238_18.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_china.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/whk-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/softpedia-wfh.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/softonic_w365_4.5stars.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/si-award-epick5.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_twitter.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_facebook.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_wdf.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_wfh.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/thanks_box_365.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/thanks-for-choosing/special_offer_box.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_youtube.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_wordpress.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_newsletter.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_eff0f2_12.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/page/product/choose-product-discount/choose-product-discount.js HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/page/layout/layout.js?v=1.80 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/utils/utils.js?v=1.14 HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/common/sprint.min.js HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.wisecleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wfh-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wrc-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/index-menu.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wdc-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/wu-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/was-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/product/products_icon/whk-60.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/softpedia-wfh.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/softonic_w365_4.5stars.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_facebook.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_twitter.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/awards/si-award-epick5.png HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/platform.js HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cse/static/element/8435450f13508ca1/default+en.css HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cse/static/style/look/v4/default.css HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cse/static/element/8435450f13508ca1/cse_element__en.js?usqp=CAI%3D HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_youtube.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_follow_wordpress.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/common/icon_newsletter.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/icon/icon_arrow_eff0f2_12.svg HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.wisecleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_1?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.wisecleaner.com HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/js/www-subscribe-embed_v0.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /settings?session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://platform.twitter.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://platform.twitter.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /js/rpc:shindig_random.js?onload=init HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /settings?session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_2?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-17835040-1&cid=1842655186.1714051839&jid=1016391291&gjid=194722105&_gid=672239341.1714051841&_u=YADAAUAAAAAAACAAI~&z=1130479592 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/css/www-subscribe-embed-card_v0.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /s/subscriptions/subscribe_embed/js/www-subscribe-embed-card_v0.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /messages/index.php?to=checknews&pid=3 HTTP/1.1Connection: Keep-AliveAccept-Charset: utf-8User-Agent: Embarcadero URI Client/1.0Host: info.wisecleaner.com
Source: global traffic	HTTP traffic detected: GET /toolbox/toolsv6.ini HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.wisecleaner.com
Source: global traffic	HTTP traffic detected: GET /software_update/getinfo_v6.php?p_id=31&s_build=636 HTTP/1.1Connection: Keep-AliveAccept-Charset: utf-8User-Agent: Embarcadero URI Client/1.0Host: www.wisecleaner.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PwDlxXseu3VEHbh&MD=lcm7x2Bz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCEG1SGHCH6CNNhWAA0ICPk1Y%3D HTTP/1.1Cache-Control: max-age = 86400Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Nov 2023 17:37:40 GMTIf-None-Match: "be34871fa05e0a45e7d6f78f5d8828db47b667ba"User-Agent: Microsoft-CryptoAPI/10.0Host: ocsps.ssl.com
Source: global traffic	HTTP traffic detected: GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D HTTP/1.1Cache-Control: max-age = 86400Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Nov 2023 17:37:47 GMTIf-None-Match: "4ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267"User-Agent: Microsoft-CryptoAPI/10.0Host: ocsps.ssl.com
Source: global traffic	HTTP traffic detected: GET /info_group/index.php?to=getinfonew&pid=15 HTTP/1.1Connection: Keep-AliveAccept-Charset: utf-8User-Agent: Embarcadero URI Client/1.0Host: info.wisecleaner.com
Source: global traffic	HTTP traffic detected: GET /info_group/images/2024/04/12/012055670.png HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: info.wisecleaner.com
Source: global traffic	HTTP traffic detected: GET /wisecleaner_feedback/index.php?to=fetch-unread-message&guid={00280FF0-8444-4589-ABB1-07A5B9247E0B} HTTP/1.1Accept-Charset: utf-8Host: www.wisecleaner.netCache-Control: no-cache

Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: Mhttps://www.facebook.com/sharer/sharer.php?u=wisecleaner.com/wisecare365.html equals www.facebook.com (Facebook)
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://twitter.com/share?original_referer=http://www.wisecleaner.com/&source=tweetbutton&text=Fast and easy to clean junk files and traces.&url=http://www.wisecleaner.com/&via=wisecleaner equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: www.wisecleaner.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: pdf.wisecleaner.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cse.google.com
Source: global traffic	DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: www.adsensecustomsearchads.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: www.wisecleaner.net
Source: global traffic	DNS traffic detected: DNS query: info.wisecleaner.com

Source: unknown

HTTP traffic detected: POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-17835040-1&cid=1842655186.1714051839&jid=1016391291&gjid=194722105&_gid=672239341.1714051841&_u=YADAAUAAAAAAACAAI~&z=1130479592 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://www.wisecleaner.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.wisecleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2052358843.000000000461F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2017922213.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://counter-strike.com.ua/
Source: WiseCare365.exe, 00000009.00000003.2724199825.000000000A781000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 0000000A.00000002.2937097262.000001A0D8000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: WiseCare365.exe, 00000009.00000003.2015758565.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://damnedovycestiny.webnode.cz/
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WASSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WDFSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WDRSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WFDSetup.exe
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WFDSetup.exe_
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WGBSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WJSSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WMOSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WPUSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/soft/WRMSetup.exe
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/AutoUpdate_6.0.3.593.zip
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/BootLauncher_6.0.3.593.zip
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/BootPack_6.0.3.593.zipsvg
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/BootTime_6.0.3.593.zipsvg
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/DManager_6.1.4.601.zip
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/DefragOptions_6.0.3.593.zip
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Arabic.lanA
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Azerbaijani(Latin).lanUU
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Bulgarian.lan.4153
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Catalan.lan2
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Chinese(Simplified).lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Chinese(Traditional).lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Croatian.lan98
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Czech.lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Danish.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Dutch(Belgium).lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Dutch(Nederlands).lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/English.lan2351
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Finnish.lan0773337a
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/French.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Georgian.lan.25891
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/German.lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Greek.lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Hebrew.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Hungarian.lanC20.8
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Indonesian.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Italian.lan931334
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Japanese.lan.6
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Korean.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Kurdish.lan51
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Lithuanian.lan2
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Nepali.lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Norwegian(Bokmal).lanb
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Norwegian(Nynorsk).lanUU
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Persian.lan.964558
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Polish.lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Portuguese(Portugal).lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Romanian.lantion
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Russian.lanA
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Serbian(Cyrillic).lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Slovak.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Slovenian.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Spanish(Spain).lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Swedish(Sweden).lan
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Thai.lanA
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Turkish.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Ukrainian.lan
Source: WiseCare365.exe, 00000009.00000002.2961151274.0000000005418000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Languages/Vietnamese.laneCare365
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/Rate_6.6.6.636.zip)
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/WJSLib_6.0.3.593.zipa
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/WiseBootBooster_6.5.2.624.zip
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/WiseCare365_6.6.6.636.zipm
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/WiseDefrag_6.0.3.593.zipp4L
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/WiseEraser_6.0.3.593.zipsoft
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/fileshredder_6.0.3.593.zipq4L
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/libeay32_6.0.3.593.zipH
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/sqlite3_6.0.3.593.zip
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/ssleay32_6.0.3.593.zipH
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downloads.wisecleaner.com/update/care365_v6/tools/toolsv6.zip
Source: svchost.exe, 0000000A.00000002.2938109224.000001A0D80FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000A.00000002.2937750277.000001A0D80CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2935036390.000001A0D3302000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.2598184419.000001A0D7EF2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2937232866.000001A0D8042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2937232866.000001A0D802C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2937500417.000001A0D8061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/an2dmhqv5igncgwzelkqyugk5q_2024.4.19.0/go
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D824D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000A.00000002.2937500417.000001A0D808F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 0000000A.00000002.2937500417.000001A0D8061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/an2dmhqv5igncgwzelkqyugk5q_2024.4.19.0
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A754000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000199D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://info.wisecleaner.com/
Source: WiseCare365.exe, 00000009.00000002.2940777387.000000000197C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.0000000001978000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2722553412.0000000001992000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.0000000001992000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.00000000033D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://info.wisecleaner.com/info_group/images/2024/04/12/012055670.png
Source: WiseCare365.exe, 00000009.00000000.1965205495.0000000001368000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://info.wisecleaner.com/info_group/index.php?to=getinfonew&pid=15
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://info.wisecleaner.com/info_group/index.php?to=getinfonew&pid=15i
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://info.wisecleaner.com:80/info_group/images/2024/04/12/012055670.png
Source: WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://info.wisecleaner.com:80/info_group/index.php?to=getinfonew&pid=15-message&guid=
Source: WiseCare365.exe, 00000009.00000003.2000308909.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://karadzha.weebly.com/
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://madExcept.comU
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://service.weibo.com/share/share.php?url=https%3A%2F%2Fwww.wisecleaner.com.cn
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://sslcom.crl.certum.pl/ctnca.crl0s
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://sslcom.ocsp-certum.com08
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://sslcom.repository.certum.pl/ctnca.cer0:
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://tieba.baidu.com/f/commit/share/openShareApi?url=https://www.wisecleaner.com.cnU
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.addthis.com/bookmark.php?v=300&winname=addthis&pub=ra-4f87d17a70e638da&source=tbx32-300&l
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2052358843.000000000461F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2017922213.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.0000000002195000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.haysoft.org%1-k
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000D7C000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FBC0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000000.1677136447.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FBC0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000000.1677136447.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: WiseCare365.exe, 00000009.00000002.2956134333.00000000053E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.com/&via=wisecleaner
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/AutoShutdown.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/AutoShutdown.svgll
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svgll
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/FastSearch.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svgll
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/MemoryOptimizer.svg
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/ProgramUninstaller.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/ProgramUninstaller.svgP
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.com/toolbox/imagesv6/Reminder.svg
Source: WiseCare365.exe	String found in binary or memory: http://www.wisecleaner.net/install_statistics/index.php?p=install_statistics
Source: WiseCare365.exe, 00000009.00000002.2930766031.0000000000D32000.00000020.00000001.01000000.00000008.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/install_statistics/index.php?p=install_statisticsl(
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/software_statistics/index.php?p=comment_status
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/software_statistics/index.php?p=post_ad
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/software_statistics/v6.php?p=insertstart
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2930766031.0000000000A6F000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wiseclean
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=fetch-unread-message
Source: WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=fetch-unread-message&guid=
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=home
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=my-feedback
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=my-feedbackSV
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=question
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=upload-fileU
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=write-questionhttp://www.wisecleaner.ne
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WASSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WDFSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WDRSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WFDSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WFHSetup_5.0.2.232.exe
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WFHSetup_5.0.2.232.exel
Source: WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WFHSetup_5.0.5.235.exe
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WFHSetup_5.0.5.235.exel
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WGBSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WJSSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WMOSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WPUSetup.exe
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://downloads.wisecleaner.com/soft/WRMSetup.exe
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://feedback.wisecleaner.net/index.php?to=addSV
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://forum.wisecleaner.com/U
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://forum.wisecleaner.com/index.php?/topic/18165-how-to-fix-the-issue-of-you-are-possibly-a-vict
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://info.wisecleaner.com/eK
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://info.wisecleaner.com/messages/index.php?to=checknews&pid=%dU
Source: WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://info.wisecleaner.com/messages/index.php?to=checknews&pid=3
Source: WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://info.wisecleaner.com/messages/index.php?to=checknews&pid=3L
Source: WiseCare365.exe, 00000009.00000002.2969270730.000000000A6E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://info.wisecleaner.com/messages/index.php?to=checknews&pid=3y
Source: WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://info.wisecleaner.com:443/messages/index.php?to=checknews&pid=3
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D82C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000A.00000003.1977067538.000001A0D8256000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003438000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pdf.wisecleaner.com:52:00
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://reg.wisecleaner.com/order/checkregtime.php?email=%s&itemid=%d&code=%s&ver=%d
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://reg.wisecleaner.com/order/regchecker.php?email=%s&fname=%s&lname=%s&itemid=%d&code=%s&ver=6
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?url=https%3A%2F%2Fwww.wisecleaner.com.cn
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://twitter.com/share?original_referer=http://www.wisecleaner.com/&source=tweetbutton&text=Fast
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://wisecleaner.com/help/wisecare365/
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://wisecleaner.net/software_statistics/wiserate.txtU
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://wisecleaner.wordpress.com/2017/05/08/solution-for-compatibility-issue-between-wisecleaner-an
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: WiseCare365.exe, 00000009.00000003.2021079787.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.geogeo.gr
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=JL84FKE78HWB4
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.00000000022BA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002371000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942037803.00000000019A8000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000199D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/8https://www.wisecleaner.com/8https://www.wisecleaner.com/
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.00000000022BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/a
Source: WiseCare365.exe, 00000009.00000002.2942769828.00000000033F6000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/blog_sort_8.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/disc/?day=%d&pix=%.2f
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2015147366.0000000003509000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.00000000022E3000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/eula.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/eula.htmlSV
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/feedback.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/how-to-uninstall-wisecleaner-product.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/language.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/news/w365info.htmU
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2015147366.0000000003509000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.00000000022E3000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/privacy.html
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.00000000022BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/q
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/renew-license.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/software_update/getinfo_v6.php?p_id=31
Source: WiseCare365.exe, 00000009.00000002.2969532020.000000000A6FF000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A709000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A709000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000199D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/software_update/getinfo_v6.php?p_id=31&s_build=636
Source: WiseCare365.exe, 00000009.00000003.2165276598.000000000199D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/software_update/getinfo_v6.php?p_id=31&s_build=636O
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.00000000022F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2047624216.0000000000918000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html0O:
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2047624216.000000000091E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html3
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2047624216.000000000091E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html56-
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2047624216.0000000000918000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlM
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2047624216.000000000091E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlY
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2029584048.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmli
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1990302833.0000000000931000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2048171058.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.htmlz
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/theme/themesv6U
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/AutoShutdown.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/AutoShutdown.svgl
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svgl
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svgP
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/FastSearch.svg
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svgl
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svgll
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/MemoryOptimizer.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/MemoryOptimizer.svggP
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/ProgramUninstaller.svg
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/imagesv6/Reminder.svg
Source: WiseCare365.exe, 00000009.00000002.2942769828.00000000033F6000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2941939880.00000000019A1000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000199D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/toolsv6.ini
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/toolbox/toolsv6.ini3
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/upgrade-wisecare365.html
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.com/wise-care-365.html
Source: WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com:443/software_update/getinfo_v6.php?p_id=31&s_build=636
Source: WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.com:443/toolbox/toolsv6.ini
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/software_statistics/index.php?p=comment_status
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/software_statistics/index.php?p=post_ad
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/software_statistics/index.php?p=post_imageU
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/software_statistics/v6.php?p=insertstart
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/software_statistics/v6.php?p=post_product_infoU
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/start_mgr/index.php?to=add
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/start_mgr/index.php?to=query
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.0000000002248000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2015147366.00000000034D5000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2017922213.0000000005410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wisecleaner.net/uninstallfeedback/index.php?product=w365&ver=6.66
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/webnotify_mgr/index.php?to=add
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.wisecleaner.net/webnotify_mgr/index.php?to=query

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.143:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49914 version: TLS 1.2

System Summary

Drops password protected ZIP file

Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted
Source: is-UR7HO.tmp.1.dr	Zip Entry: encrypted

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C1786E0: DeviceIoControl,ReadFile,__aulldiv,ReadFile,__aulldiv,

9_2_6C1786E0

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C185D2B	9_2_6C185D2B
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C18A778	9_2_6C18A778
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C17F0AB	9_2_6C17F0AB
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C17FA50	9_2_6C17FA50
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1D1C00	9_2_6C1D1C00
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22EC40	9_2_6C22EC40
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C225C50	9_2_6C225C50
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1A7C60	9_2_6C1A7C60
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1BCD00	9_2_6C1BCD00
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23CDB0	9_2_6C23CDB0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C248E0C	9_2_6C248E0C
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23BE90	9_2_6C23BE90
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1F3EA0	9_2_6C1F3EA0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1BDEC0	9_2_6C1BDEC0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C21DF70	9_2_6C21DF70
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23DFE0	9_2_6C23DFE0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C21B830	9_2_6C21B830
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1A4930	9_2_6C1A4930
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C212970	9_2_6C212970
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23DA20	9_2_6C23DA20
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1B8A30	9_2_6C1B8A30
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C24EAEB	9_2_6C24EAEB
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1A7B00	9_2_6C1A7B00
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C234B00	9_2_6C234B00
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C231B60	9_2_6C231B60
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23AB50	9_2_6C23AB50
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22BBE0	9_2_6C22BBE0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C252409	9_2_6C252409
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C214490	9_2_6C214490
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23C510	9_2_6C23C510
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23D570	9_2_6C23D570
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C20F540	9_2_6C20F540
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1A65A0	9_2_6C1A65A0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C24E59A	9_2_6C24E59A
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1FD5F0	9_2_6C1FD5F0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1BE604	9_2_6C1BE604
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23D660	9_2_6C23D660
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C21F770	9_2_6C21F770
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1FB790	9_2_6C1FB790
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C234020	9_2_6C234020
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C25004E	9_2_6C25004E
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C24E049	9_2_6C24E049
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23D0B0	9_2_6C23D0B0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1AC0D0	9_2_6C1AC0D0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1AB0D0	9_2_6C1AB0D0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1EE0C0	9_2_6C1EE0C0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C2020C5	9_2_6C2020C5
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22F110	9_2_6C22F110
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1FA1B0	9_2_6C1FA1B0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C24F1C7	9_2_6C24F1C7
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1F11E0	9_2_6C1F11E0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1C1250	9_2_6C1C1250
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C25424E	9_2_6C25424E
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1F7310	9_2_6C1F7310
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C20B350	9_2_6C20B350
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23D3A0	9_2_6C23D3A0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C20D3B0	9_2_6C20D3B0

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C1A6E10 appears 151 times
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C1A61C0 appears 187 times
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C1A5F90 appears 61 times
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C1C40B0 appears 95 times
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C17AEA0 appears 32 times
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: String function: 6C1A6040 appears 37 times

Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-0KH1K.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-0KH1K.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-5N4PF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-5N4PF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (native) x86-64, for MS Windows
Source: is-5N4PF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-5N4PF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (native) x86-64, for MS Windows

Source: is-06S8G.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-0OCO8.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-HBE50.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-LTPNS.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-NN1JK.tmp.1.dr	Static PE information: Number of sections : 11 > 10

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000000.1671113651.00000000004B8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.FileRepPup.14974.19067.exe
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.FileRepPup.14974.19067.exe
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.FileRepPup.14974.19067.exe
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.0000000002278000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.FileRepPup.14974.19067.exe
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	Binary or memory string: OriginalFileName vs SecuriteInfo.com.FileRepPup.14974.19067.exe

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus32.evad.winEXE@30/516@53/22

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File created: C:\Program Files (x86)\Wise

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1608
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1608
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$12cc
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$12cc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Mutant created: \Sessions\1\BaseNamedObjects\Wise365Mutex2018

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe

File created: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp

Jump to behavior

Source: Yara match	File source: 12.0.BootTime.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.WiseTray.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WiseCare365.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.2045282560.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2133553791.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-LTPNS.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: WiseCare365.exe	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zerobl
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	Virustotal: Detection: 12%

Source: WiseCare365.exe	String found in binary or memory: http://www.wisecleaner.net/install_statistics/index.php?p=install_statistics
Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp "C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp" /SL5="$1045C,19204712,857088,C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1076,i,16708299124163291726,5417237086903671621,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe "C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe"
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp "C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp" /SL5="$1045C,19204712,857088,C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1076,i,16708299124163291726,5417237086903671621,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wjslib.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Wise Care 365.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
Source: Uninstall Wise Care 365.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Wise\Wise Care 365\unins000.exe
Source: Wise Care 365.lnk0.1.dr	LNK file: ..\..\..\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

File written: C:\Users\user\AppData\Roaming\Wise Care 365\config.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Automated click: Install

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: certificate valid

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static file information: File size 20168536 > 1048576

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\workspace\windows\NewToolsProject\SQLite3Encrypt\Release\SQLite3Encrypt.pdb source: WiseCare365.exe, 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: G:\workspace\windows\WiseCare365_V4\Bootlancher\Release\Bootlauncher.pdb source: SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C244D98 DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

9_2_6C244D98

Source: SecuriteInfo.com.FileRepPup.14974.19067.exe	Static PE information: section name: .didata
Source: SecuriteInfo.com.FileRepPup.14974.19067.tmp.0.dr	Static PE information: section name: .didata
Source: is-0KH1K.tmp.1.dr	Static PE information: section name: .didata
Source: is-06S8G.tmp.1.dr	Static PE information: section name: .didata
Source: is-NN1JK.tmp.1.dr	Static PE information: section name: .didata
Source: is-HBE50.tmp.1.dr	Static PE information: section name: .didata
Source: is-VM9DB.tmp.1.dr	Static PE information: section name: .didata
Source: is-5N4PF.tmp.1.dr	Static PE information: section name: .didata
Source: is-LTPNS.tmp.1.dr	Static PE information: section name: .didata
Source: is-0OCO8.tmp.1.dr	Static PE information: section name: .didata

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C17AEE6 push ecx; ret		9_2_6C17AEF9
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C247575 push ecx; ret		9_2_6C247588

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-Q90PB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-VM9DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-2137K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WJSLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-0KH1K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-TBFAC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-5N4PF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\AutoUpdate.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseEraser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-RHK8R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-KVUKP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	File created: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-ML9G6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-LTPNS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseDefrag.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\Program Files (x86)\Wise\Wise Care 365\WiseBootBooster.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

File created: C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\license.txt

Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WiseBootAssistant

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Care 365.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Uninstall Wise Care 365.lnk	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\WiseEraser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-Q90PB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-VM9DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-2137K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-RHK8R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-KVUKP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-TBFAC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-5N4PF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-ML9G6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\AutoUpdate.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\WiseDefrag.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\WiseBootBooster.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

API coverage: 0.5 %

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Registry key enumerated: More than 497 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\System32\svchost.exe TID: 7428

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%LOCAL_APPDATA%\\Temp\\vmware-11"],
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: WiseCare365.exe, 00000009.00000003.2023586128.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=Client VMware Horizon
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%LOCAL_APPDATA%\\VMware\\VDM\\logs",
Source: WiseCare365.exe, 00000009.00000003.1988728149.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon Client (
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Datacenter without Hyper-V Core
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Standard without Hyper-V Full
Source: WiseTray.exe, 0000000E.00000002.2945131329.00000000047F9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: )VMwareHorizonClient=VMware Horizon Client\
Source: WiseCare365.exe, 00000009.00000000.1965205495.0000000000E38000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: [vmicheartbeat]
Source: WiseCare365.exe, 00000009.00000003.2014804518.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon(u6b
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Enterprise without Hyper-V Core
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%PROGRAM_FILES%\\Common Files\\VMware\\InstallerCache"
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "paths": ["%PROGRAM_FILES%\\VMware\\VMware Workstation\\ico"
Source: WiseCare365.exe, 00000009.00000000.1965205495.0000000000E38000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: [vmicvss]
Source: WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2932451581.000001A0D2A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2937332047.000001A0D8054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "defaultname": "VMware Workstation",
Source: WiseCare365.exe, 00000009.00000003.2018419880.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon asiakas tiedot
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%common_appdata%\\VMware\\VDM\\logs",
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "paths": ["%LOCAL_APPDATA%\\VMware"
Source: WiseTray.exe, 0000000E.00000002.2937712728.0000000001243000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: )VMwareHorizonClient=VMware Horizon Client
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%programfiles%\\VMware\\VMware Horizon View Client"],
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "exclude": ["VMwareDnD"]
Source: WiseCare365.exe, 00000009.00000003.2026034506.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon-klient
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "paths": ["%common_appdata%\\VMware\\logs",
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: WiseCare365.exe, 00000009.00000002.2942769828.0000000003438000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: )VMwareHorizonClient=VMware Horizon ClientA
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: )VMwareHorizonClient=VMware Horizon ClientoSp]K
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "VMwareHorizonClient": {
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "VMwareWorkstationPro": {
Source: WiseCare365.exe, 00000009.00000003.2035963945.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon 0
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%common_appdata%\\VMware\\vmwetlm\\logs",
Source: WiseCare365.exe, 00000009.00000000.1965205495.0000000000E38000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: [vmicshutdown]
Source: WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: )VMwareHorizonClient=VMware Horizon Clientnn
Source: WiseCare365.exe, 00000009.00000003.2032856067.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHorizonClient=VMware Horizon Client
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Standard without Hyper-V Core
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%PROGRAM_FILES%\\VMware\\VMware Workstation"],
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "%common_appdata%\\VMware\\logs",
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Datacenter without Hyper-V Full
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "exists": ["HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\vmware-view(Reg)",
Source: WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, WiseTray.exe, 0000000E.00000000.2133553791.0000000000449000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Enterprise without Hyper-V Full
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "pathmatch": ["vmware-.*"],
Source: WiseCare365.exe, 00000009.00000000.1965205495.00000000015DC000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: "defaultname": "VMware Horizon Client",

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C17B22B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_6C17B22B

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C244D98 DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

9_2_6C244D98

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C181191 mov eax, dword ptr fs:[00000030h]

9_2_6C181191

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C18511F GetProcessHeap,

9_2_6C18511F

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C17AC52 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6C17AC52
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C17B22B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6C17B22B
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C180285 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6C180285
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C245984 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6C245984
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C243AA6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6C243AA6

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"	Jump to behavior
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Process created: C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe "C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"	Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C17B47B cpuid

9_2_6C17B47B

Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C17B34E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_6C17B34E

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Code function: 9_2_6C24601B __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

9_2_6C24601B

Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22DCF0 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_free,sqlite3_step,sqlite3_reset,	9_2_6C22DCF0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22FD70 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C22FD70
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C230D40 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C230D40
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAD60 sqlite3_bind_blob,	9_2_6C1CAD60
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAD90 sqlite3_bind_blob64,	9_2_6C1CAD90
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22DDE0 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,_memset,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	9_2_6C22DDE0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CADE0 sqlite3_bind_double,	9_2_6C1CADE0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C230E10 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,	9_2_6C230E10
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22FE70 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C22FE70
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAE90 sqlite3_bind_int,sqlite3_bind_int64,	9_2_6C1CAE90
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAEB0 sqlite3_bind_int64,	9_2_6C1CAEB0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAF30 sqlite3_bind_null,	9_2_6C1CAF30
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C229F70 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	9_2_6C229F70
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAF60 sqlite3_bind_text,	9_2_6C1CAF60
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAF90 sqlite3_bind_text64,	9_2_6C1CAF90
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CAFF0 sqlite3_bind_text16,	9_2_6C1CAFF0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C238820 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C238820
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C231810 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C231810
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C238870 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C238870
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C221840 sqlite3_finalize,sqlite3_free,sqlite3_free,_memset,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_blob_close,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	9_2_6C221840
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C239A00 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C239A00
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22DA70 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_reset,	9_2_6C22DA70
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C237A80 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,	9_2_6C237A80
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C231B60 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_finalize,sqlite3_free,sqlite3_step,sqlite3_column_text,sqlite3_column_bytes,	9_2_6C231B60
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23AB50 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C23AB50
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB470 sqlite3_transfer_bindings,	9_2_6C1CB470
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C2364B0 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_initialize,sqlite3_reset,sqlite3_free,__allrem,	9_2_6C2364B0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22B500 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_free,sqlite3_step,sqlite3_reset,	9_2_6C22B500
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C2295A0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,	9_2_6C2295A0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C229630 sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,	9_2_6C229630
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C23A6F0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,__allrem,sqlite3_free,__allrem,sqlite3_free,	9_2_6C23A6F0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22E720 _memset,sqlite3_initialize,_memset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,	9_2_6C22E720
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C230710 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	9_2_6C230710
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C236760 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,__allrem,	9_2_6C236760
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C229770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,	9_2_6C229770
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22F790 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C22F790
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22F7F0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_free,sqlite3_free,sqlite3_initialize,_memset,sqlite3_initialize,sqlite3_initialize,sqlite3_free,sqlite3_reset,sqlite3_reset,	9_2_6C22F7F0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB020 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	9_2_6C1CB020
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22E070 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_step,sqlite3_reset,sqlite3_blob_close,	9_2_6C22E070
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C230040 sqlite3_bind_int64,sqlite3_step,sqlite3_initialize,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C230040
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22C0E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	9_2_6C22C0E0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22C1B0 sqlite3_bind_int64,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,	9_2_6C22C1B0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB1A0 sqlite3_bind_zeroblob,	9_2_6C1CB1A0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C21F230 sqlite3_mprintf,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	9_2_6C21F230
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB230 sqlite3_bind_zeroblob64,sqlite3_bind_zeroblob,	9_2_6C1CB230
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22C250 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C22C250
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1C9260 sqlite3_clear_bindings,	9_2_6C1C9260
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB2B0 sqlite3_bind_parameter_count,	9_2_6C1CB2B0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB2D0 sqlite3_bind_parameter_name,	9_2_6C1CB2D0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22D2C0 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,sqlite3_step,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_step,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,	9_2_6C22D2C0
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C229310 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	9_2_6C229310
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22A370 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	9_2_6C22A370
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C1CB360 sqlite3_bind_parameter_index,	9_2_6C1CB360
Source: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe	Code function: 9_2_6C22B3F0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	9_2_6C22B3F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	12 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	2 Obfuscated Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	42 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.FileRepPup.14974.19067.exe	16%	ReversingLabs
SecuriteInfo.com.FileRepPup.14974.19067.exe	13%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Wise\Wise Care 365\AutoUpdate.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\AutoUpdate.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WJSLib.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WJSLib.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseBootBooster.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WiseBootBooster.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe (copy)	17%	ReversingLabs	Win32.PUA.Lodi
C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe (copy)	14%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseDefrag.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WiseDefrag.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseEraser.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WiseEraser.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (copy)	8%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-0KH1K.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-0KH1K.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-2137K.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-2137K.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-5N4PF.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-5N4PF.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp	17%	ReversingLabs	Win32.PUA.Lodi
C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp	14%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://ocsps.ssl.com0?	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://sslcom.ocsp-certum.com08	0%	Avira URL Cloud	safe
http://www.haysoft.org%1-k	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	31.13.65.36	true	false	high
twitter.com	104.244.42.193	true	false	high
plus.l.google.com	142.250.105.101	true	false	high
cs491.wac.edgecastcdn.net	192.229.163.25	true	false	high
platform.twitter.map.fastly.net	151.101.12.157	true	false	unknown
syndication.twitter.com	104.244.42.136	true	false	high
stats.g.doubleclick.net	108.177.122.154	true	false	high
scontent.xx.fbcdn.net	31.13.88.13	true	false	high
youtube-ui.l.google.com	64.233.176.93	true	false	high
mailserver.wisecleaner.net	23.224.25.138	true	false	high
www.wisecleaner.com	172.67.68.11	true	false	high
www3.l.google.com	64.233.176.101	true	false	high
cse.google.com	142.250.9.101	true	false	high
www.google.com	64.233.177.104	true	false	high
info.wisecleaner.com	104.26.2.143	true	false	high
pdf.wisecleaner.com	172.67.68.11	true	false	high
www.facebook.com	unknown	unknown	false	high
www.adsensecustomsearchads.com	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high
www.wisecleaner.net	unknown	unknown	false	high
platform.twitter.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://info.wisecleaner.com/info_group/images/2024/04/12/012055670.png	false		high
https://www.wisecleaner.com/static/img/icon/icon_arrow_1f2238_12.svg	false		high
https://www.wisecleaner.com/static/img/product/thanks-for-choosing/thanks_box_wdf.png	false		high
https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.wisecleaner.com	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_2?le=scs	false		high
https://www.wisecleaner.com/static/img/product/update/icon.png	false		high
https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690	false		high
https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__	false		high
https://www.wisecleaner.com/static/font/roboto/v29/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_1?le=scs	false		high
about:blank	false	Avira URL Cloud: safe	low
https://pdf.wisecleaner.com/static/svg/logo/pdf_logo.svg	false		high
https://www.wisecleaner.com/static/page/product/update/update.css	false		high
https://www.wisecleaner.com/static/img/product/thanks-for-choosing/clean.png	false		high
https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__#_methods=onPlusOne%2C_ready%2C_close%2C_open%2C_resizeMe%2C_renderstart%2Concircled%2Cdrefresh%2Cerefresh%2Conload&id=I0_1714051839396&_gfid=I0_1714051839396&parent=https%3A%2F%2Fwww.wisecleaner.com&pfname=&rpctoken=22571271	false		high
https://www.google.com/cse/static/element/8435450f13508ca1/default+en.css	false		high
https://www.wisecleaner.com/static/img/product/products_icon/was-60.png	false		high
https://www.youtube.com/s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png	false		high
https://www.wisecleaner.com/images/awards/si-award-epick5.png	false		high
https://www.wisecleaner.com/static/img/product/products_icon/wdc-60.png	false		high
https://www.wisecleaner.com/static/img/common/icon_french.svg	false		high
https://www.wisecleaner.com/static/js/common/sprint.min.js	false		high
https://platform.twitter.com/widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=WiseCleaner&show_count=false&show_screen_name=false&size=m&time=1714051841571	false		high
https://apis.google.com/js/rpc:shindig_random.js?onload=init	false		high
https://www.wisecleaner.com/static/img/common/icon_germany.svg	false		high
https://www.wisecleaner.com/software_update/getinfo_v6.php?p_id=31&s_build=636	false		high
https://www.wisecleaner.com/static/img/common/icon_follow_youtube.svg	false		high
https://www.wisecleaner.com/static/img/product/thanks-for-choosing/bbb.png	false		high
https://www.wisecleaner.com/static/js/utils/utils.js?v=1.14	false		high
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fwisecleanersoft&send=false&layout=button_count&width=110&show_faces=false&font&colorscheme=light&action=like&height=21	false		high
https://www.wisecleaner.com/static/img/product/thanks-for-choosing/sign.png	false		high
https://www.wisecleaner.com/static/img/common/icon_follow_facebook.svg	false		high
https://www.youtube.com/s/subscriptions/subscribe_embed/js/www-subscribe-embed-card_v0.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://downloads.wisecleaner.com/update/care365_v6/AutoUpdate_6.0.3.593.zip	WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wisecleaner.net/software_statistics/wiserate.txtU	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.wisecleaner.net/software_statistics/v6.php?p=insertstart	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://downloads.wisecleaner.com/soft/WJSSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
https://info.wisecleaner.com/messages/index.php?to=checknews&pid=3L	WiseCare365.exe, 00000009.00000003.2725090030.000000000194E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsps.ssl.com0?	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/disc/?day=%d&pix=%.2f	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://www.wisecleaner.com/a	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.00000000022BA000.00000004.00001000.00020000.00000000.sdmp	false		high
https://downloads.wisecleaner.com/soft/WFDSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sslcom.crl.certum.pl/ctnca.crl0s	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000D7C000.00000020.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svg	WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Norwegian(Bokmal).lanb	WiseCare365.exe, 00000009.00000002.2942769828.0000000003404000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/how-to-uninstall-wisecleaner-product.html	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://downloads.wisecleaner.com/soft/WDFSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Dutch(Belgium).lan	WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wisecleaner.wordpress.com/2017/05/08/solution-for-compatibility-issue-between-wisecleaner-an	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://www.wisecleaner.com:443/toolbox/toolsv6.ini	WiseCare365.exe, 00000009.00000002.2937181357.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000000A.00000003.1977067538.000001A0D82FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/renew-license.html	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Ukrainian.lan	WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/soft/WASSetup.exe	WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/eula.html	SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2015147366.0000000003509000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.00000000022E3000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/libeay32_6.0.3.593.zipH	WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://service.weibo.com/share/share.php?url=https%3A%2F%2Fwww.wisecleaner.com.cn	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Bulgarian.lan.4153	WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	false		high
https://downloads.wisecleaner.com/soft/WRMSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
https://forum.wisecleaner.com/index.php?/topic/18165-how-to-fix-the-issue-of-you-are-possibly-a-vict	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000A.00000003.1977067538.000001A0D82C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://info.wisecleaner.com/messages/index.php?to=checknews&pid=3y	WiseCare365.exe, 00000009.00000002.2969270730.000000000A6E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.wisecleaner.net/wiseclean	WiseCare365.exe, WiseCare365.exe, 00000009.00000002.2930766031.0000000000A6F000.00000020.00000001.01000000.00000008.sdmp	false		high
https://downloads.wisecleaner.com/soft/WDRSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
https://downloads.wisecleaner.com/soft/WFHSetup_5.0.2.232.exel	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FBC0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000000.1677136447.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/Reminder.svg	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/BootTime_6.0.3.593.zipsvg	WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/ForceDeleter.svgl	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svgll	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Greek.lan	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/news/w365info.htmU	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/German.lan	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=fetch-unread-message	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Portuguese(Portugal).lan	WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2937097262.000001A0D8000000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.wisecleaner.com/eula.htmlSV	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.wisecleaner.net/wisecleaner_feedback/index.php?to=upload-fileU	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://downloads.wisecleaner.com/soft/WMOSetup.exe	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000002.2942769828.0000000003371000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.haysoft.org%1-k	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.2057537991.0000000002195000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.2021818558.0000000002240000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.wisecleaner.com/toolbox/imagesv6/MemoryOptimizer.svg	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2040735203.00000000073A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Italian.lan931334	WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/Languages/Russian.lanA	WiseCare365.exe, 00000009.00000002.2961151274.0000000005400000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195640841.000000000A783000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2193642376.000000000A77C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svg	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2165276598.000000000196C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downloads.wisecleaner.com/update/care365_v6/DManager_6.1.4.601.zip	WiseCare365.exe, 00000009.00000002.2961151274.000000000541F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://info.wisecleaner.com/messages/index.php?to=checknews&pid=%dU	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://sslcom.ocsp-certum.com08	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1675565955.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1673743740.000000000277D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000002.2037855665.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.wisecleaner.com/8https://www.wisecleaner.com/8https://www.wisecleaner.com/	SecuriteInfo.com.FileRepPup.14974.19067.exe, 00000000.00000003.1671935264.0000000002510000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepPup.14974.19067.tmp, 00000001.00000003.1679146180.0000000003410000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.net/software_statistics/index.php?p=comment_status	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.wisecleaner.com/&via=wisecleaner	WiseCare365.exe, 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svgl	WiseCare365.exe, 00000009.00000002.2942769828.0000000003398000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wisecleaner.com/toolbox/imagesv6/DataRecovery.svg	WiseCare365.exe, 00000009.00000003.2193642376.000000000A727000.00000004.00000020.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2195684775.0000000009EE0000.00000004.00000800.00020000.00000000.sdmp, WiseCare365.exe, 00000009.00000003.2723424617.000000000A72C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.13.65.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
142.250.9.91	unknown	United States	15169	GOOGLEUS	false
23.224.25.138	mailserver.wisecleaner.net	United States	40065	CNSERVERSUS	false
64.233.176.93	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.105.157	unknown	United States	15169	GOOGLEUS	false
173.194.219.113	unknown	United States	15169	GOOGLEUS	false
104.244.42.72	unknown	United States	13414	TWITTERUS	false
172.67.68.11	www.wisecleaner.com	United States	13335	CLOUDFLARENETUS	false
108.177.122.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.26.2.143	info.wisecleaner.com	United States	13335	CLOUDFLARENETUS	false
31.13.88.13	scontent.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
104.26.3.143	unknown	United States	13335	CLOUDFLARENETUS	false
104.244.42.136	syndication.twitter.com	United States	13414	TWITTERUS	false
142.250.105.101	plus.l.google.com	United States	15169	GOOGLEUS	false
104.244.42.8	unknown	United States	13414	TWITTERUS	false
192.229.163.25	cs491.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
142.250.105.147	unknown	United States	15169	GOOGLEUS	false
64.233.177.104	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.12.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431659
Start date and time:	2024-04-25 15:29:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.FileRepPup.14974.19067.exe
Detection:	SUS
Classification:	sus32.evad.winEXE@30/516@53/22
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.40.205.26, 192.229.211.108, 74.125.138.94, 74.125.136.100, 74.125.136.139, 74.125.136.113, 74.125.136.102, 74.125.136.138, 74.125.136.101, 74.125.136.84, 34.104.35.123, 142.250.9.97, 64.233.177.95, 74.125.138.95, 172.217.215.95, 74.125.136.95, 64.233.176.95, 173.194.219.95, 108.177.122.95, 172.253.124.95, 142.251.15.95, 142.250.9.95, 64.233.185.95, 142.250.105.95, 184.31.62.93, 64.233.176.100, 64.233.176.102, 64.233.176.138, 64.233.176.139, 64.233.176.101, 64.233.176.113, 142.251.15.138, 142.251.15.139, 142.251.15.101, 142.251.15.102, 142.251.15.113, 142.251.15.100, 173.194.219.94, 108.177.122.139, 108.177.122.138, 108.177.122.113, 108.177.122.101, 108.177.122.100, 108.177.122.102, 142.250.9.101, 142.250.9.100, 142.250.9.102, 142.250.9.139, 142.250.9.138, 142.250.9.113
Excluded domains from analysis (whitelisted): clients1.google.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, ocsps.ssl.com, www.googletagmanager.com, e16604.g.akamaiedge.net, update.googleapis.com, wac.apr-8315.edgecastdns.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net, www.google-analytics.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:30:30	API Interceptor	2x Sleep call for process: svchost.exe modified
15:30:49	API Interceptor	72x Sleep call for process: WiseTray.exe modified
15:31:45	API Interceptor	1x Sleep call for process: WiseCare365.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.244.42.136	http://keeper.com	Get hash	malicious	Unknown	Browse
	https://yachtchartermarket.com/p/what-to-expect-at-the-tyba-yacht-charter-show-2024	Get hash	malicious	Unknown	Browse
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse
	https://brownfieldagnews.com	Get hash	malicious	Unknown	Browse
	https://j6gm8xcab.cc.rs6.net/tn.jsp?f=001CvtcUGS75y5dIb6DHFKIA-Xw_ZC-cG1fR4qxTNglzfjSAMsfj8wrtKD4giBiJVdgZLr_prPZMFm_BI7i8-G7X52zZlohEjfr7OkdIohPcSzRbAZql_HDMd4_qYX7Iu575AWKR33mHsTx04_xd-xaQbWngyN8QMTW&c=b8lkFJebNXBc4IKIUMudSVwh7zoEl9am6tSgacM1o8K4GBHlSCoRIg==&ch=RFramF8X9P47VxyjOpbOQRDW8VQHBI88R3Ut0bkny5cPWhoqPAR6VQ==	Get hash	malicious	HTMLPhisher	Browse
	http://mebankingai.com	Get hash	malicious	Unknown	Browse
	https://t.co/u22xTfEkyp	Get hash	malicious	HTMLPhisher	Browse
	http://egpp.pl	Get hash	malicious	Unknown	Browse
	https://dzesite.co/	Get hash	malicious	Unknown	Browse
	http://iet.polymtl.ca	Get hash	malicious	Unknown	Browse
104.244.42.8	http://divbracket.com	Get hash	malicious	Unknown	Browse
	http://cli.re	Get hash	malicious	Unknown	Browse
	https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/	Get hash	malicious	Unknown	Browse
	http://www.nonprofithr.com	Get hash	malicious	Unknown	Browse
	https://www.msn.com/en-us/news/us/4-8-magnitude-earthquake-rocks-northeast-live-updates/ar-BB1l86QX?ocid=winp2fptaskbar&cvid=8188dbd6d83d4c53de2c79e22605f3bd&ei=8	Get hash	malicious	Unknown	Browse
	http://www.thetech.buzz	Get hash	malicious	Unknown	Browse
	http://mebankingai.com	Get hash	malicious	Unknown	Browse
	https://t.co/duebeiismM&c=E,1,SyWn5QH58y5kp4KWdMbuwxmBqNAyxGh_50QoOX6_2bjjg95v2W5kCK0x9nNZksOcZgNVlrlEI8bf5q4IfMcLLQ7bwPJpHzBGsB5MeWIt-dDI19V3KA,,&typo=1	Get hash	malicious	Unknown	Browse
	https://t.co/duebeiismM&c=E,1,SyWn5QH58y5kp4KWdMbuwxmBqNAyxGh_50QoOX6_2bjjg95v2W5kCK0x9nNZksOcZgNVlrlEI8bf5q4IfMcLLQ7bwPJpHzBGsB5MeWIt-dDI19V3KA,,&typo=1	Get hash	malicious	Unknown	Browse
	https://t.co/duebeiismM&c=E,1,SyWn5QH58y5kp4KWdMbuwxmBqNAyxGh_50QoOX6_2bjjg95v2W5kCK0x9nNZksOcZgNVlrlEI8bf5q4IfMcLLQ7bwPJpHzBGsB5MeWIt-dDI19V3KA,,&typo=1	Get hash	malicious	Unknown	Browse
192.229.163.25	http://keeper.com	Get hash	malicious	Unknown	Browse
	http://divbracket.com	Get hash	malicious	Unknown	Browse
	http://cli.re	Get hash	malicious	Unknown	Browse
	https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/	Get hash	malicious	Unknown	Browse
	https://www.msn.com/en-us/news/us/4-8-magnitude-earthquake-rocks-northeast-live-updates/ar-BB1l86QX?ocid=winp2fptaskbar&cvid=8188dbd6d83d4c53de2c79e22605f3bd&ei=8	Get hash	malicious	Unknown	Browse
	https://t.co/hJi2Nzs1Sr	Get hash	malicious	Unknown	Browse
	http://german.china.org.cn/txt/2021-05/14/content_77498229_3.htm	Get hash	malicious	Unknown	Browse
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse
	https://brownfieldagnews.com	Get hash	malicious	Unknown	Browse
	https://yakoowood.com/	Get hash	malicious	Unknown	Browse
104.244.42.72	http://cli.re	Get hash	malicious	Unknown	Browse
	https://oaxmdkipuzdavy5y.umso.co	Get hash	malicious	Unknown	Browse
	https://t.co/hJi2Nzs1Sr	Get hash	malicious	Unknown	Browse
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse
	https://t.co/bYGV9e97zg	Get hash	malicious	Unknown	Browse
	https://t.co/duebeiismM&c=E,1,SyWn5QH58y5kp4KWdMbuwxmBqNAyxGh_50QoOX6_2bjjg95v2W5kCK0x9nNZksOcZgNVlrlEI8bf5q4IfMcLLQ7bwPJpHzBGsB5MeWIt-dDI19V3KA,,&typo=1	Get hash	malicious	Unknown	Browse
	https://www.theviolenceproject.org/mass-shooter-database/	Get hash	malicious	Unknown	Browse
	https://winscp.net/eng/download.php	Get hash	malicious	Unknown	Browse
	http://proposaldocument.xyz/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cs491.wac.edgecastcdn.net	http://keeper.com	Get hash	malicious	Unknown	Browse	192.229.163.25
	http://divbracket.com	Get hash	malicious	Unknown	Browse	192.229.163.25
	http://cli.re	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://www.msn.com/en-us/news/us/4-8-magnitude-earthquake-rocks-northeast-live-updates/ar-BB1l86QX?ocid=winp2fptaskbar&cvid=8188dbd6d83d4c53de2c79e22605f3bd&ei=8	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://t.co/hJi2Nzs1Sr	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse	192.229.163.25
	https://brownfieldagnews.com	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://yakoowood.com/	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://concertationspe.atlassian.net/wiki/external/OWRlOTc1NTMxM2MxNDBmZjhhNGUwNWQzYzdmOWJkZWU	Get hash	malicious	Unknown	Browse	192.229.163.25
twitter.com	http://94.156.79.129/x86_64	Get hash	malicious	Unknown	Browse	104.244.42.65
twitter.com	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse	104.244.42.1
syndication.twitter.com	http://keeper.com	Get hash	malicious	Unknown	Browse	104.244.42.136
	http://divbracket.com	Get hash	malicious	Unknown	Browse	104.244.42.8
	https://yachtchartermarket.com/p/what-to-expect-at-the-tyba-yacht-charter-show-2024	Get hash	malicious	Unknown	Browse	104.244.42.136
	http://cli.re	Get hash	malicious	Unknown	Browse	104.244.42.8
	https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/	Get hash	malicious	Unknown	Browse	104.244.42.200
	https://oaxmdkipuzdavy5y.umso.co	Get hash	malicious	Unknown	Browse	104.244.42.72
	http://www.nonprofithr.com	Get hash	malicious	Unknown	Browse	104.244.42.8
	https://www.msn.com/en-us/news/us/4-8-magnitude-earthquake-rocks-northeast-live-updates/ar-BB1l86QX?ocid=winp2fptaskbar&cvid=8188dbd6d83d4c53de2c79e22605f3bd&ei=8	Get hash	malicious	Unknown	Browse	104.244.42.200
	http://www.thetech.buzz	Get hash	malicious	Unknown	Browse	104.244.42.8
	https://t.co/hJi2Nzs1Sr	Get hash	malicious	Unknown	Browse	104.244.42.72
platform.twitter.map.fastly.net	https://cos-aliyun8789.towqzg.cn/	Get hash	malicious	Unknown	Browse	151.101.12.157
	https://jiujiuwanka.cn/	Get hash	malicious	Unknown	Browse	151.101.20.157
	https://goxdgdb.cn/	Get hash	malicious	Unknown	Browse	151.101.12.157
	https://x9mihc.cn/	Get hash	malicious	Unknown	Browse	151.101.12.157
	https://zgmskjr.cn/	Get hash	malicious	Unknown	Browse	146.75.40.157
	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	146.75.92.157
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	146.75.92.157
	https://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	146.75.92.157
	http://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	146.75.92.157
	http://clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	146.75.92.157

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNSERVERSUS	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	103.94.185.195
	b3astmode.x86.elf	Get hash	malicious	Unknown	Browse	154.208.6.177
	arm.elf	Get hash	malicious	Mirai	Browse	23.224.58.114
	v7csrY4yGl.exe	Get hash	malicious	BlackMoon	Browse	104.218.234.94
	v7csrY4yGl.exe	Get hash	malicious	BlackMoon	Browse	104.218.234.94
	Purchase Order#44231.exe	Get hash	malicious	FormBook	Browse	23.224.176.218
	gCQUPlU854.elf	Get hash	malicious	Mirai	Browse	23.225.113.56
	GQVUENt6FZ.exe	Get hash	malicious	FormBook	Browse	198.16.55.227
	z3LCu8rCpN.elf	Get hash	malicious	Mirai	Browse	23.224.11.120
	3RIodZx5Hr.elf	Get hash	malicious	Mirai, Okiru	Browse	154.202.46.236
TWITTERUS	https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	Get hash	malicious	Unknown	Browse	104.244.42.195
	https://cos-aliyun8789.towqzg.cn/	Get hash	malicious	Unknown	Browse	104.244.42.67
	http://confirmartucuentamsnaquimx.hstn.me/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	HTMLPhisher	Browse	104.244.42.131
	https://jiujiuwanka.cn/	Get hash	malicious	Unknown	Browse	104.244.42.3
	https://goxdgdb.cn/	Get hash	malicious	Unknown	Browse	104.244.42.195
	https://x9mihc.cn/	Get hash	malicious	Unknown	Browse	104.244.42.3
	https://zgmskjr.cn/	Get hash	malicious	Unknown	Browse	104.244.42.67
	http://keeper.com	Get hash	malicious	Unknown	Browse	104.244.42.136
	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	104.244.42.5
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	104.244.42.3
CLOUDFLARENETUS	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/o76fri/enpmZG9tbF9zdXBlcnZpc29yMXN0X2Fzc2lzdGFudEBmZC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	104.21.17.5
	Air Transport Services Group Open Benefits Enrollment.eml	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://us-west-2.protection.sophos.com/?d=google.co.za&u=aHR0cHM6Ly9nb29nbGUuY28uemEvYW1wL3Mvd3d3Lmdvb2dsZS5jb20lMkZ1cmwlM0ZzYSUzREQlMjZxJTNEaHR0cHMlM0ElMkYlMkZlbWFpbGluZy5taXJhYmF1ZC1hbS5jb20lMkZ0bC5waHAlMjUzRnAlMjUzRDVwMCUyRnQyJTJGcnMlMkYxZTYlMkZyeSUyRnJzJTJGJTJGaHR0cHMlM0ElMkYlMkZmaXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20lMjUyNTJGdjAlMjUyNTJGYiUyNTI1MkZteS1hd2Vzb21lLXByb2plY3QtaWQtMzU4ODkuYXBwc3BvdC5jb20lMjUyNTJGbyUyNTI1MkZzb3NmcmUuaHRtbCUyNTI1M0ZhbHQlMjUyNTNEbWVkaWElMjUyNTI2dG9rZW4lMjUyNTNENzBmZDlmZWMtZWM4Mi00YjQ1LTkwMmQtMmFhM2Q3NTgwYzNiJTI2dXN0JTNEMTcxNDEyMzE0MDAwMDAwMCUyNnVzZyUzREFPdlZhdzJ5SzhVRkpvWmVuUkRWdUJMLXNmY20lMjZobCUzRGVuJTI2c291cmNlJTNEZ21haWwjYTJ4MVkyRnpRR04wYlhOdmFHbHZMbU52YlE9PQ==&p=m&i=NjFjOWM1NjJmM2YxNmYxMDA2OTJjYWZj&t=THJkcUUxZW9PQzAvNFZ0aWxoalJFOStYQ0dWVXgvYjJ6aS82eTZoUDhJcz0=&h=276fada438bf49c2be0403c28d11d4f4&s=AVNPUEhUT0NFTkNSWVBUSVZ-gOCnEu8L0hbaTxie_PLqb02g0uIV3TDGiGYGiGwGbDIPB11limBksw9z8tTzOiKEbBHGOtpfybJD4FbJxpna6swSu6rycA6MG9n6CTc4aMLN4lGfbapv3cHB_2jaSF4	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://1drv.ms/o/s!AmFI0faGJpjZhESzK-ltQ-Z_UHmf?e=0OfhLS	Get hash	malicious	Unknown	Browse	172.67.205.14
	https://pub-02d879d6055b4f31b3db7cbbb1499011.r2.dev/%60%60~~~%5D%5D%5D%5D%5D.html#theunis@khk.co.za	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://www.mavengroupglobal.uk/DYuPhO4h/v?url=qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1#qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1EFEEZ2FicmllbC5wYXJ2dWxlc2N1QGRldXRzY2hlYmFobi5jb20=	Get hash	malicious	Unknown	Browse	104.27.195.88
CLOUDFLARENETUS	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/o76fri/enpmZG9tbF9zdXBlcnZpc29yMXN0X2Fzc2lzdGFudEBmZC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	104.21.17.5
	Air Transport Services Group Open Benefits Enrollment.eml	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://us-west-2.protection.sophos.com/?d=google.co.za&u=aHR0cHM6Ly9nb29nbGUuY28uemEvYW1wL3Mvd3d3Lmdvb2dsZS5jb20lMkZ1cmwlM0ZzYSUzREQlMjZxJTNEaHR0cHMlM0ElMkYlMkZlbWFpbGluZy5taXJhYmF1ZC1hbS5jb20lMkZ0bC5waHAlMjUzRnAlMjUzRDVwMCUyRnQyJTJGcnMlMkYxZTYlMkZyeSUyRnJzJTJGJTJGaHR0cHMlM0ElMkYlMkZmaXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20lMjUyNTJGdjAlMjUyNTJGYiUyNTI1MkZteS1hd2Vzb21lLXByb2plY3QtaWQtMzU4ODkuYXBwc3BvdC5jb20lMjUyNTJGbyUyNTI1MkZzb3NmcmUuaHRtbCUyNTI1M0ZhbHQlMjUyNTNEbWVkaWElMjUyNTI2dG9rZW4lMjUyNTNENzBmZDlmZWMtZWM4Mi00YjQ1LTkwMmQtMmFhM2Q3NTgwYzNiJTI2dXN0JTNEMTcxNDEyMzE0MDAwMDAwMCUyNnVzZyUzREFPdlZhdzJ5SzhVRkpvWmVuUkRWdUJMLXNmY20lMjZobCUzRGVuJTI2c291cmNlJTNEZ21haWwjYTJ4MVkyRnpRR04wYlhOdmFHbHZMbU52YlE9PQ==&p=m&i=NjFjOWM1NjJmM2YxNmYxMDA2OTJjYWZj&t=THJkcUUxZW9PQzAvNFZ0aWxoalJFOStYQ0dWVXgvYjJ6aS82eTZoUDhJcz0=&h=276fada438bf49c2be0403c28d11d4f4&s=AVNPUEhUT0NFTkNSWVBUSVZ-gOCnEu8L0hbaTxie_PLqb02g0uIV3TDGiGYGiGwGbDIPB11limBksw9z8tTzOiKEbBHGOtpfybJD4FbJxpna6swSu6rycA6MG9n6CTc4aMLN4lGfbapv3cHB_2jaSF4	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://1drv.ms/o/s!AmFI0faGJpjZhESzK-ltQ-Z_UHmf?e=0OfhLS	Get hash	malicious	Unknown	Browse	172.67.205.14
	https://pub-02d879d6055b4f31b3db7cbbb1499011.r2.dev/%60%60~~~%5D%5D%5D%5D%5D.html#theunis@khk.co.za	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://www.mavengroupglobal.uk/DYuPhO4h/v?url=qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1#qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1EFEEZ2FicmllbC5wYXJ2dWxlc2N1QGRldXRzY2hlYmFobi5jb20=	Get hash	malicious	Unknown	Browse	104.27.195.88

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86
	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.85.23.86
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86
	http://seattlend.com	Get hash	malicious	Unknown	Browse	13.85.23.86
	Air Transport Services Group Open Benefits Enrollment.eml	Get hash	malicious	Unknown	Browse	13.85.23.86
	Isass.exe	Get hash	malicious	Unknown	Browse	13.85.23.86
	Isass.exe	Get hash	malicious	Unknown	Browse	13.85.23.86
	https://1drv.ms/o/s!AmFI0faGJpjZhESzK-ltQ-Z_UHmf?e=0OfhLS	Get hash	malicious	Unknown	Browse	13.85.23.86
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.85.23.86
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	13.85.23.86
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.26.2.143
	Iu4csQ2rwX.msi	Get hash	malicious	AsyncRAT	Browse	104.26.2.143
	o7b91j8vnJ.exe	Get hash	malicious	LummaC	Browse	104.26.2.143
	SHEOrder-10524.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.2.143
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.2.143
	https://56hytuti5.weebly.com/	Get hash	malicious	Unknown	Browse	104.26.2.143
	udVh4Ist4Z.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.2.143
	samradapps_datepicker_221114.xlam	Get hash	malicious	Unknown	Browse	104.26.2.143
	Enquiry 230424.bat	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.2.143
	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.2.143

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3035056
Entropy (8bit):	6.570980510330125
Encrypted:	false
SSDEEP:	49152:C1gSCl49+WxhtZDEJWSgBasmfNQvSRfLXUF7dWTOTAvNDA1jl:C1R9NtZ28yLXUFJmEB
MD5:	EB91F2CD1AA06B56E8A5413A306136FA
SHA1:	C6E05CBAF792EEC2F810D4F7BFB82CC216152077
SHA-256:	9EAAD670832782C294F8701E3D79AC6EC039072ADB4533B40B8155147C6453D1
SHA-512:	AB1F48308454D1EA3EBD25F3A676AD9A2C9FAA0F995EA0B8DDEA61821C1A1AFDC5FC458512AA4FBDC872E8C754C734F7C95CD3C5AC84D713C62DDEA4C01D043A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....)#a.................d'..........'.......'...@.........................../.....N............@...................@).......(.(5...@-..............,...#...p).0............................`).....................l.(......0)......................text....@'......B'................. ..`.itext..\|!...`'.."...F'............. ..`.data.........'......h'.............@....bss.....j....(..........................idata..(5....(..6...X(.............@....didata......0).......(.............@....edata.......@).......(.............@..@.tls....L....P)..........................rdata..]....`).......(.............@..@.reloc..0....p).......(.............@..B.rsrc........@-......n,.............@..@............../......,..............@..@................

C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45488
Entropy (8bit):	6.373366644054221
Encrypted:	false
SSDEEP:	768:ZB4UyqMIbQuN8hzebTP97pEDMXn8EdEQQVoF5iTZKV:nyq1cu+qPHnFQVoF2KV
MD5:	9DFE36B32427445A2A312D788523F85E
SHA1:	BFC5DA4B0C02342B56387DB5FFF8AF22265608F6
SHA-256:	D36647C7E7CB95F048597468F79AD8915CCBB64F7A01BD42FD1BEB11BBAD5D96
SHA-512:	973A7BE8B754C2F0A60D9E34A55B59606C89B20F1E84B8623D584D68B3ADF94B5DED1996C6672A7DE7C5B4589FB33019F01565D1699C548030C958E7BE7B0AC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..ft.p5t.p5t.p5oQ.5g.p5oQ.5z.p5oQ.57.p5}..5q.p5t.q50.p5oQ.5v.p5oQ.5u.p5oQ.5u.p5Richt.p5........PE..L......W.................L...>...............`....@.......................................@.................................<{..<........................#.......... a...............................x..@............`...............................text...(J.......L.................. ..`.rdata... ...`..."...P..............@..@.data................r..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\BootPack.wpk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	422529
Entropy (8bit):	7.9967259675992395
Encrypted:	true
SSDEEP:	12288:Z42OHRnArC3OT5bd1Ny6hTAYX0lCaq1p9QamI65k:+2OH3Ih11TAquCaq1pCafL
MD5:	4F001D0E372BAEF55838F46888E460E4
SHA1:	50450528413983B274823B87214CE6B92AACE3AD
SHA-256:	BD4C6E3FCA00C524FFDF8B1F4B491A78041F9F7E871AA1DA506B341C509CEA5F
SHA-512:	F4D01C4F9F13DAD555083F04994B64408B8A705BDDC28E608368D71FB0B39A79F472A0A46AEB943C4C317177E4F61FDEF613C194B75E19AA0F77E216190FD0A8
Malicious:	false
Reputation:	low
Preview:	PK.........:A@.&Z...P.......1.png:.kQb.d.y{.....S.'V.`..,....=P.a..."........nl....G..C....\|....m.......i......[+...{..u.\w&.@S..5..VP.i.C.E.3....U<.8BY...&Mj.(...Vpc.N.....b.J.U.?l..p,0.\8x.......b.F....9...y....y^.3....@B.#.<\....b.a..P.%q......YK.~.z...Z..Z{.$:..t..8.,../`..j.8.9.K^.W.E-q......?j.......b....lhU..o].Ao.......q....+()]r.....g..u.t.Bf.2..b....-+.T......I.\|. b..c'.;. ...\|...H.`t"...}>.t..NQ....W.^...{WG.Jq.....!0m...1..dy.t}O{...p..j.j.0..~B...\.['.?.J.>.:..o.:8..K...A.\|.p.L.T..+}......Wd.8.."K.J....Ny.TMl$w.p..ng....t&.......K...f...2......j..L..&..{......"T).p..3.......zG.=h'..kL.x.L.~."...v#.g.@.Rm...H..e#.1....TN.y4.......#*&.n7.zY....%jr....9......6.... /...r.!R...&..I.P]..E..N...XCQ.y..z......o..) 1.d#.-....Cc....n.....j...Id.D.`..J...e...E#r..K.%.R. .yR>.?..w...g`I.`U.......t.\|.0.._;N.\|_..9\|..q....?.C....tR.O}...v....d...#[ZK....#9..[..J....n[.1...~.X.B ..$S....8%b....n...T`.l..5..#=O.._J..p.52.....wb.

C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	651216
Entropy (8bit):	6.521013546809996
Encrypted:	false
SSDEEP:	12288:gGgO5VMTJY0KQa6fln7STwqm2bV5Gky9c+CqJ888888888888W88888888888s:XPVMTWTQa6f1STw8Kky9TU
MD5:	29887FFC5D12948658902E66BDAA09AD
SHA1:	58029F4FBCCAF1C548D35C213AA8E79088EEDCEC
SHA-256:	03627A4D7FFB6B2424C234C82071701B691DD8DEDC066BC8D3B4937049755808
SHA-512:	0A915FAE7634875041AA88AE3EA74903E52B28935036DB00349489AD48D0953BFCBCEE6040E924442AF194F64D16CFFC356FCECFC29952CA6F3326B870CB390A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...g.YY............................`.............@..............................................@..............................L1..................................................................................0...x............................text...`........................... ..`.itext.............................. ..`.data...x!......."..................@....bss.....R...0...........................idata..L1.......2..................@....tls....<............@...................rdata...............@..............@..@.reloc...............B..............@..B.rsrc...............................@..@....................................@..@................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2555312
Entropy (8bit):	6.68571100927552
Encrypted:	false
SSDEEP:	24576:p4raF6K6ZXYELYotABBfWMKW059h6J8PwT1B+SdAIM1JhhTzEWo9JkVzmC9Bfu10:pL0dYE4J4G1sSdAIMgWo9VC9J80
MD5:	5EFBAED4F9A193752FBE806660BAB062
SHA1:	EC9B61F279B87D303898E441710DD10D6B89335C
SHA-256:	E3BB799F3B63B19EAF0D465A32A86AF1FA7B9EB2A72F30754B6FD274CCADD46D
SHA-512:	1C4850B286BFF9977DB747061190A0500929B02B70FA626AF110686A6BB46D04FBBAE6F98258531AE472BBE4C6857D2C1032A401C0A530283A15C7A8EFBB1B75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...f/.a.................l ..j.......y ....... ...@...........................'.....4/'...............................!.5....P!.V3....$...............&..#....!......................................................Y!.......!.<....................text...LO ......P ................. ..`.itext.......` ......T ............. ..`.data....R.... ..T...p .............@....bss....0h.... ..........................idata..V3...P!..4.... .............@....didata.<.....!....... .............@....edata..5.....!.......!.............@..@.rdata..E.....!.......!.............@..@.reloc........!.......!.............@..B.rsrc.........$.......#.............@..@..............'.......&.............@..@........................................................

C:\Program Files (x86)\Wise\Wise Care 365\DefragOptions.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Microsoft HTML Help Project
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.941091908061598
Encrypted:	false
SSDEEP:	6:O1MSif6609FXTb2eMScrT7cMrQYvsOJPd4MKoQXgGgqzofeove9LMJn:O1M3PqFX/2eM3rFrF7JP2TXgnqzo2/L8
MD5:	A0EAC4D8F4EE86740825896D8165532F
SHA1:	0788F2DA879B57ED54D77BC179A4858A35B3DF61
SHA-256:	C0D303506CB38836309D910D2D4131D9C161C9C19387DB375EAEE3812524A1EA
SHA-512:	64A62416C65AEDE86A2402569E00ECE1FDA6EEBC35F6B6E25DAD0DC7033DF46BBA938E74CFB0405C47662D8A457A11F569D4B90013CAB911440EB268707A5381
Malicious:	false
Reputation:	low
Preview:	[Options]..FileSizeLimit = 100..;If you don't want to defragment your large file (e.g. no less than 100MB), please set FileSizeLimit=the size of your file (i.e. 100)...FragmentsLimit = 0..ExcludeFilter = system volume information;temp;tmp;recycle;.zip;.7z;.rar;.mkv;.avi;.rmvb;.mp4;.iso;..;IncludeFilter =

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Abkhazian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	185874
Entropy (8bit):	4.3677708418770465
Encrypted:	false
SSDEEP:	3072:Hr9fPjxWyrhokwCS0TcyUrjWMoXGsG3dkeQE3TjMebX0+sgb:L9fPjxWhkwCS0TYvWEh9sa
MD5:	96016297354C26E4C37BC8CB353D43E0
SHA1:	37F84AB3CFDCF0C8E52B1B5C215CFBC55412D007
SHA-256:	96269630BB90765C4B7F350A0195F389849EFF8159F6B990AD71E2B11E9C3FAC
SHA-512:	FF391CB285E01FDC4E9ADC1DDE6A643304BCA06326C48C0B6F2EEB817A1BE8A5012707FBBC4B3D54FAD3250C6B46A6BEA75406547C5ECDA13AB3B72376FFE2FD
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .W.i.s.e. .C.a.r.e. .3.6.5.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .A.b.u.k.h.b.a. .A.n.d.r.e.i.,. .G.i.n.d.i.a. .S.e.g.e.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.a.b.u.c.h.b.a.@.m.a.i.l...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...1...2.....;. .U.p.d.a.t.e.:. .N.o.v... .2.2.,. .2.0.2.1.....;.............[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...%.A.C.0.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.8.....B.u.t.t.o.n.N.o.=...0.?.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...8.:...0.@.....B...C.?.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...8...K.E.B...C.?.....B.u.t.t.o.n.C.l.o.s.e.=...0.@.:.B...C.?.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...8...0.H.L.0.....K.@.3.K.;.0.B...C.?.....B.u.t.t.o.n.M.e.n.u.=...<.5.=.8.C.....B.u.t.t.o.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Arabic.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	194486
Entropy (8bit):	4.303496040935877
Encrypted:	false
SSDEEP:	3072:33+nqG1u3qBeOtub6AvN0XWyQMC0Ki4AuAM6suEJ3K8hNYgs271Vn6vwlpAFm0D4:GqG15ub64AiBmsgo
MD5:	D5DFE4F85A192BF151551AB58141831A
SHA1:	1DE8E24F0E8B7CBC95BC8812272FA298B3067FFD
SHA-256:	3AFE3F78EC6379FCF58067BCFAFFCB46687E49BFD35139356523025339179F61
SHA-512:	F7FD1BCCA40AABC27895F2AE165F8CD5A4E9BE8F0DDF012DE663AAD5059F2B05E19B11DC24562594276EE25F0A7AC739382094D4A516BEAE2AE11C66E56F8F93
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r. .:. .A.l.i. .A.l.n.a.j.a.f.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l. .:. .a.l.i.a.l.n.a.j.a.f.i.7.@.h.o.t.m.a.i.l...c.o.m.....;. .6...6...3...6.3.3. .:. .%.5./.'.1. .'.D.(.1.F.'.E.,.....;. .2.1.-.1.1.-.2.0.2.3. .:. ..'.1.J... .'.D..-./.J.+.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.'.D.9.1.(.J.).....C.h.a.n.g.e.L.a.n.g.=.D.*.A.9.J.D. .'.D.D.:.). .'.D.E...

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Azerbaijani(Latin).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	179898
Entropy (8bit):	3.8917323449598125
Encrypted:	false
SSDEEP:	3072:55rPAGyMQyhTXK/Hy6xnyvCwW9VuEh48sgv3k21xedK0UsuhCvRIB:bAGyCXK/hy6puMZsQ
MD5:	FEACB1FC644F947E69B9286DB1F486C3
SHA1:	BF5C00BE0753B5B94C9C5D93000F5D2D1C1CACD6
SHA-256:	5982AE68CDE547DBDE027B9FAE189758877709BC42A5F266F580DFE0BBC4C236
SHA-512:	FDB9CC4A64A018ECE27E0C7AE894B42AE1B1FE7C1694EE253EB0520B8C65A5B28FCE202278D07899DF32B5B2C5298C354051D19A1F8C4E562CAB93F52FE94A8A
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;. . .....;.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r.:. .Q...d.r.Y.t. .Q.a.s.1.m.o.v.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r. .E.m.a.i.l.:. .q.a.s.i.m.o.v.@.y.a.h.o.o...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...8...4...5.7.8.....;. .U.p.d.a.t.e.:. .3.1. .A.v.q.u.s.t. .2.0.2.1.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.A.z.Y.r.b.a.y.c.a.n.c.a.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.B.Y.l.i.....B.u.t.t.o.n.N.o.=.X.e.y.r.....B.u.t.t.o.n.O.K.=.O.L.D.U.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.K.i...i.l.t.m.Y.k.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.B...y...t.m.Y.k.....B.u.t.t.o.n.C.l.o.s.e.=.B.a...l.a.m.a.q.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.Y.1...c.a.m.....

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Belarusian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	160832
Entropy (8bit):	4.375936548919877
Encrypted:	false
SSDEEP:	1536:un9EJffitKAzlcEvrxzyNnyGCmo5Le/6TZzvkrpyI8rt1s/hgNuRA:WCitKAzlVxzylyGCPLePt8r/s/hl6
MD5:	2BB8C96C5947BF56961A77301BF8ABD7
SHA1:	B279B072A9F90D7DDCAA9B9D100BE0DF8406D703
SHA-256:	F6B767F35B3BB389950A993737FDCAE26E722373F0F8C20D0300B8CD267A324F
SHA-512:	26C488F53DDA7D03DA8BD6DDB085C5A0247AB0879D139A467E568CFE3093E7AAAF9E3953028AA067C45B13022625B8F36888428B9B151C17CDE3D72559ADE355
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .K.o.z.e.l. .M.i.k.a.l.a.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.o.z.e.l...m.i.k.a.l.a.i.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...8.2...4.6.4.....;. .U.p.d.a.t.e.:. .M.a.r.c.h. .1.2.,. .2.0.1.8.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...5.;.0.@.C.A.:.0.O.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.".0.:.....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=...>.1.@.0.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...V.=.V.<.V.7.0.2.0.F.L.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=. .0.A.:.@.K.F.L.....B.u.t.t.o.n.C.l.o.s.e.=...0.G.K.=.V.F.L.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...4.=.0.2.V.F.L.....B.u.t.t.o.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Bulgarian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	170184
Entropy (8bit):	4.315936575189069
Encrypted:	false
SSDEEP:	3072:gxnchUjUksq7EsaBGSysRhWMgWhR2S2syhOD:7UjU4aBGcmsh
MD5:	E4DC1B86B3661FEA7258D100B8ADE7CE
SHA1:	E14C695C7898B9DFC3AF1D8652F1B2B9ECBE7745
SHA-256:	46E76156B175D81666EB7F2E62C018DC11C9992FC3E956AEEF3BEA2F11CABDAE
SHA-512:	5D51A47E8F3BA0F8369798FF217477D495CF4334A796128C9AC8BF068181FADFD550D2D34340D40488DDC53B1B4EE8336A6819905F51C17F22799D0A52C37E00
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ...2.0.=. ...0.@.0.4.6.>.2.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.k.o.t.@.a.b.v...b.g.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.:././.k.a.r.a.d.z.h.a...w.e.e.b.l.y...c.o.m./.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...9.1...4.7.2.....;. .U.p.d.a.t.e.:. .J.u.l.y. .1.7.,. .2.0.1.8.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...J.;.3.0.@.A.:.8.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...0.<.0.;.8.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.#.2.5.;.8.G.8.....B.u.t.t.o.n.C.l.o.s.e.=...0.B.2.>.@.8.....B.u.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Catalan.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197514
Entropy (8bit):	3.5449422520463316
Encrypted:	false
SSDEEP:	3072:G3rD4vERlaG28NA2zmruMVyHLISwYbOTAIqpFl+PaT8H4z/HwH+xe0hsdBfm:hvERVNnmruMsIEsusa
MD5:	6B5456078E9C427E5BDF4D134BEF4064
SHA1:	2D11ECEC4CFC9462018222BDBBAEDEDE10267567
SHA-256:	1F4BDCE8D7D124CAAE785F35FE9D9F8941E7D0BF8D4100AB1FCA0139A8B38B1B
SHA-512:	6B1DA28A13314909E7B21B580C6724B0526D9D13029409DF8E5C52C9BF65912EF9BAD6D78AEE96EF3D054858CC1A8940AD6848A324A9BF32ACF55882F1647AF5
Malicious:	false
Preview:	......;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .J.o.a.n. .Q.u.e.r.a.l.t.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...5...1.....;. .U.p.d.a.t.e.:. .F.e.b... .2.3.,. .2.0.2.3.........[.T.r.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Chinese(Simplified).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	131938
Entropy (8bit):	4.831914908340532
Encrypted:	false
SSDEEP:	3072:ZtSVUGaZ4yxVlndPyOrYKg5zsOKpMH+3lMJyjuqC252EpOY0hswhq82y:uVUGSlndTD/X8swhF
MD5:	73C71B06375D15C7429CF641FEF6730A
SHA1:	356D2B092D7C683BA88E7B3F1BFD9C9A077FE672
SHA-256:	500F00C5E793BA3D288FCBC50A23205B808F5F929E75FFB0B01EB64C0F4314A2
SHA-512:	02E46530E0ACCB4B3C9F44CEF7463F418D74B47F6054215A28AFA390BCC9FBF505ADDB637FC6D2004DC8374CADE9884C22E32AF2CFF010DD54492141B6891971
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.0.4.\|.1.0.0.4.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.C.H.S.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.z.h.-.c.n.....D.e.f.a.u.l.t.F.o.n.t.=.._o.......D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.G.B.2.3.1.2._.C.H.A.R.S.E.T.....B.y.t.e.s.=.W[......K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=........I.n.f.o.r.m.a.t.i.o.n.=.nx......W.a.r.n.i.n.g.=.f.JT..

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Chinese(Traditional).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	data
Category:	dropped
Size (bytes):	128098
Entropy (8bit):	4.908815839690814
Encrypted:	false
SSDEEP:	3072:ozeddx2aq7q4N9T7yQoS/vaCrscX0MCn9Pqu6x9aduDdnOspxLsRWrDp:8eddx2g4N9/jsFni1sR49
MD5:	C97BB0747D1736EFBE825D70B856912A
SHA1:	A98AD2B85F79B0C192D2751FDCDC1F5F5B552430
SHA-256:	B9FE20321407DE13953150E79BBF20A1F94F5F62184BDB9F09ECF66C11A8C8C2
SHA-512:	CA5F310A0D987B012D62B875AE1C3357A1114B46FA223996BFE9451BC7F6B60208B4244AB7730319AF1862BE1928BA715E63879777BB477C3DD01C23EB1BBDAE
Malicious:	false
Preview:	;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.4.\|.0.C.0.4.\|.1.4.0.4.....R.e.a.d.H.a.b.i.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Croatian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	189128
Entropy (8bit):	3.611264892431967
Encrypted:	false
SSDEEP:	3072:XUAp2xsYUK5J4Q/ply9HMnand+s4O0gss0ZV5D:kO2xsqJ4Q/ApjsD
MD5:	4CBAD66305AD232F96B5725350FF4D55
SHA1:	42F3A680AE26C003D53E99FA591EC3A5A87AE20D
SHA-256:	F099655CDAB65A2BD39CE2EFB296C05E484B53CA9146DBDD99D0A7DB4593F8D8
SHA-512:	04C6E9EF19D2DCB4CF87FACFA99C914625B23F021AFF07C6686E378AB8E9BC4EBABDF99DE9C66D608FF283EE42688B04BCEA4D693C5FCF18B67339661803B7CB
Malicious:	false
Preview:	..;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .D.o.m.i.n.k.o. .A.~.d.a.j.i.......;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .d.o.m.a.z.d.@.m.a.i.l...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...4...7...5.4.3.....;. .U.p.d.a.t.e.:. .F.e.b.r.u.a.r.y. .1.0.,. .2.0.2.0.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.H.r.v.a.t.s.k.i.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.D.a.....B.u.t.t.o.n.N.o.=.N.e.....B.u.t.t.o.n.O.K.=.U. .r.e.d.u.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.S.m.a.n.j.i.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.P.o.v.e...a.j.....B.u.t.t.o.n.C.l.o.s.e.=.Z.a.t.v.o.r.i.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.V.r.a.t.i.....B.u.t.t.o.n.M.e.n.u.=.I.z.b.o.r.n.i.k.....B.u.t.t.o.n.S.k.i.n.=.T.e.m.a.....a.p.p.l.y.=.P.r.i.m.i.j.e.n.i.....N.o.t.h.a.n.k.s.=.N.e.,. .h.v.a.l.a.....B.u.t.t.o.n.C.a.n.c.e.l.=.O.d.u.s.t.a.n.i.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.0.1.A.\|.0.4.1.A.\|.1.0.1.A.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.H.R.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Czech.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	159800
Entropy (8bit):	3.7306594670562867
Encrypted:	false
SSDEEP:	3072:gPczb+j4BE1JjCfMRqyF5hL6nbqawLS1vM0VKNtM/5aW2nwc9+OWU2vS/uf0WKFf:bzb+7jCfMQnbqawPsYT
MD5:	FCAEF23E20DA0067A90796853F511E40
SHA1:	D8BDF749E6A136801A8C1F89DF26F1D9A700AC83
SHA-256:	6FD2A57D180F80F1396772D30A74252ED716DEB4E960A1CE03E56FCC8234989A
SHA-512:	6240DC01FD7F0584DD544F3BD6732FCE6F5DA700628DD519A376DBFD646A8F12433DF84811EE78C1C4D67185E2CB8B0CE983CAB8858A0BA5E5E612EA160BF507
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .D.a.m.n.e.d.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .b.a.r.t.o.s.f.r.@.s.e.z.n.a.m...c.z.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.:././.d.a.m.n.e.d.o.v.y.c.e.s.t.i.n.y...w.e.b.n.o.d.e...c.z./.....;. . .S.o.f.t. .V.e.r.s.i.o.n.:. .4...7.4...4.5.7.....;. . .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .3.1.,. .2.0.1.7.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...e.s.k.y.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.A.n.o.....B.u.t.t.o.n.N.o.=.N.e.....B.u.t.t.o.n.O.K.=.O.k.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.a.l.i.z.o.v.a.t.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.a.l.i.z.o.v.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Danish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	143950
Entropy (8bit):	3.5196159945482064
Encrypted:	false
SSDEEP:	3072:P5LjdNmDSEadcfynOJ7z19l9S5vsLvkG1CZyRWZ:9jdNigoC
MD5:	987278E1926115FB34817FD94857A4CC
SHA1:	D32CAEA78D9B14E5DD6E1C9B932E8E68E8A1AC6B
SHA-256:	58B2A68F2E382EB5A7D36427DBF0CB43BDE5CF63745210118D8D7019CE9D6975
SHA-512:	797CB2C2D478F43D8CDE97A9BEE87E426F7D9ECC33155E3722A4DA3E57CD4BF93A871478343F56725FE09C9E04AF1F1BE5611A132FF03ADB49E48BE7BEAD3A1F
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.e.t.e.r. .R.o.t.h.e. .L.u.n.d.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .p.e.t.e.r.@.r.o.t.h.e.l.u.n.d...d.k.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.6.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.D.A.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.d.a.-.d.k.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.b.....M.B.=.M.b.....G.B.=.G.b.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.r.d.....I.n.f.o.r.m.a.t.i.o.n.=.I.n.f.o.r.m.a.t.i.o.n.....W.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Dutch(Belgium).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	168826
Entropy (8bit):	3.493486899256745
Encrypted:	false
SSDEEP:	3072:Vk6OZePquSZPQUrJZ058+DAopAGACBPcPQhsIofwXf35ye3F5reF6uozrTZrBm2k:+lPQUmjACBthY123sf
MD5:	91AA6F0E76B13CDDEC7B7E9F30F009CB
SHA1:	DF2D8925B2E707CBC605FB5A48663758D0038BFA
SHA-256:	34D910C75FFE79A352DCE6ED0140DCF395A8F052DBB433A42838B7850C9E8513
SHA-512:	DCE3324B1541350114DB7583E168041E167A46B6134FD0E7D55AEC24BDFC2011A0E1F03EB45B0751B8C87047F4448F811A64CECED398EADCBBD7B2268AF6DA3C
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .E.d.d.y. .V.e.r.f.a.i.l.l.i.e.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.d.d.y._.v.e.r.f.a.i.l.l.i.e.@.t.e.l.e.n.e.t...b.e.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.1.3.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.D.u.t.c.h.(.B.e.l.g.i.u.m.).....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.l.-.b.e.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.a.r.d.o.p.t.i.m.a.l.i.s.a.t.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Dutch(Nederlands).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	195136
Entropy (8bit):	3.537734536477552
Encrypted:	false
SSDEEP:	3072:5f6qfvSzwi8xQUvkh9MP6IqWbwqCntD8ug5yWkgMgdVGW396H/3J3tC2uwYnhEJT:DxQUeqCntDADWKsZKm
MD5:	846B5698B0A34E399D7D41F9E5CD11E5
SHA1:	998269D8D0D5DA58611B193E803F603DC4F702E0
SHA-256:	DF0FC37735B0AAD791496F9047D7840E2680507E7F744462B3BB04D9740B02E3
SHA-512:	DFE102E5764BBDD7179EED364CEE8A611470475A97A48EE4AF65254A3B4CF1F7FAFA6FF8698CC0089E5756EC480B757C0B272792300F658B10468FA79F02EE82
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .e.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g... .D.u.t.c.h...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.m. .M.e.i.j.d.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.......;. .U.p.d.a.t.e.:. .2.1. .N.o.v. .2.0.2.3.....;.....[.L.a.n.g.].....N.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\English.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190212
Entropy (8bit):	3.550988971870915
Encrypted:	false
SSDEEP:	3072:lQSrXQx7MIuZHStLrCC6LjGMbyKCpnmbwzhCjN1iqJ6zrpw9rwBYE0c+YtyL2pJn:8x7M/C6L/mLcEfZrscim
MD5:	2227967558A259FC1981A9B729717F91
SHA1:	56F231B7E330A3FEABBDC5158421D8F38B7368EF
SHA-256:	32F18CE8CE8D7A6AC6B5B3EEA61084235899AFE4C2B4C63427F0BC975DD51D54
SHA-512:	EE317B8D3FDD6AF069378B14BA1B368575F27F8B813DD84ED0F03DCA526B90E597201EB22EA673FD026298D31729AB94F9919C1E20DA1D3E2CE646B3D3856F2F
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...6.....;. .U.p.d.a.t.e.:. .M.a.r... .2.0.,. .2.0.2.4.....;.....[.L.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Finnish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	211308
Entropy (8bit):	3.528482941742127
Encrypted:	false
SSDEEP:	3072:oYlZfFS3QwHVKh1QZPywtqY6rKHkuv2LxW1+hpe4tezZgoRGi0PIy2mxcHj5vtVd:3lZfFQVKhP1TasHA
MD5:	5F894BB9DE5369E2D9BD328156C6C74A
SHA1:	B28D3CA4056821869568FEDA4C7FF4D088502631
SHA-256:	9FC6235CE5102528286046A4EE3DAD7EC3BBC52BAD376C1F2242262C93F198D6
SHA-512:	1CA15130FA01DDEC49ED97F60895C4B8853C41FCA15DEEBA576A72D9BD9E603666D435D928F256E74650DF2CC3EDE65535AC4FD61CBBF7C685345FEF7328D6B8
Malicious:	false
Preview:	..;.....;. .M.u.u.t.a.m.a. .s.....n.t... .k.....n.t...j...l.l.e.:.....;. .K.u.n. .a.l.o.i.t.a.t. .k.....n.n...s.t.y...n. .-. .k.o.p.i.o.i. .e.n.g.l.i.s.h...i.n.i. .o.m.a.l.l.e. .k.i.e.l.e.l.l.e.s.i. .(.e.s.i.m... .f.i.n.n.i.s.h...i.n.i.).....;. .K.....n.n... .v.a.i.n. .t.e.k.s.t.i. .'. .=. .'. .m.e.r.k.i.n. .j...l.k.e.e.n.....;. ...l... .m.u.o.k.k.a.a. .r.i.v.i...:. .R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....;. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .o.r.i.g.i.n.a.l.;. .p.e.n.a.V.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .p.e.n.a.v.@.o.u.t.l.o.o.k...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3...6.3.3.....;. .L.a.n.g... .U.p.d.a.t.e.:. .2.0.2.3.-.N.o.v.-.2.2.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.F.i.n.n.i.s.h.-.S.u.o.m.i.....C.h.a.n.g.e.L.a.n.g.=.O.t.a. .m.u.u.t.o.s. .k...y.t.t.....n. .k...y.n.n.i.s.t...m...l.l... .o.h.j.e.l.m.i.s.t.o. .u.u.d.e.l.l.e.e.n.......[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.K.y.l.l.......

C:\Program Files (x86)\Wise\Wise Care 365\Languages\French.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	209536
Entropy (8bit):	3.554510610854616
Encrypted:	false
SSDEEP:	3072:D6o54cRuVsWa2P9JDb4GTSQey/VRuE7KE0cet6G03+I0HdIkQW+PuFds08sCLmVo:VRuVz4GTNJkSmcsCr
MD5:	7D7D1D78E0A0E11E8B2C72DF0C033753
SHA1:	8E86E1BAF9522587E61947118C8D4C0F7E024C42
SHA-256:	3B5115FAB32C55FF869E29827A5E295FE392692E417D5E8B3B0B729FE7473550
SHA-512:	DE41D265535C77F7A5716FE7040A7909D5DCDD8A5B237089B8A322A780D66E023EE24410DFFA4EDFCF2FDCF7286B05CCD57654750D9160A16F96D4D89B757819
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.i.e.r.r.e. .l.e. .L.i.d.g.e.u.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...6...6.3.6.....;. .U.p.d.a.t.e.:. .M.a.r... .2.0.,. .2.0.2.4.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.F.r.a.n...a.i.s.....C.h.a.n.g.e.L.a.n.g.=. .P.o.u.r. .e.f.f.e.c.t.u.e.r. .l.e. .c.h.a.n.g.e.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Georgian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	173762
Entropy (8bit):	4.3968233682053794
Encrypted:	false
SSDEEP:	3072:U6H2hBoIXRwmO4nO87zC4J9pdyJduteXoI98tiodSHDN2LgAB0ksHt7a8o+:Ua2hBoIXRZVO87zC4JlHRtLsN79n
MD5:	AEAD043775DE8D9264BD0C9D0F760A49
SHA1:	633BDAD33D805E447059A713B1FC27589B5513C9
SHA-256:	864E149B47991BB9844D058FB036A4F9FD874A69CA2752816C75F5970E36B3B9
SHA-512:	3B1A3DFC9BA485F69779637954AF5613B51145ACF529C10E376965C2285C023B694C0B18C237D017AED38FC508D8B53523E1BB2889DC0B7F53D4F6EE6BBA7E77
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ............. .......................;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .g.i.d.i.a.s.a.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.3.7.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.G.E.O.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.g.e.-.k.a.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.U.T.F.-.8.....B.y.t.e.s.=...............K.B.=.........M.B.=.........G.B.=.........p.m.D.e.f.a.u.l.t.=.............................I.n.f.o.r.m.a.t.i.o.n.=.........................W.a.r.n.i.n.g.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\German.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	215824
Entropy (8bit):	3.5648803009987104
Encrypted:	false
SSDEEP:	3072:P/jJ6tHxEgOjLGRsHntgdn2OzrB7L1+dsUXM04FmLn2zOHw8vwY3pT0mEXrtQEti:aOHwDV9Fj8Irs/z
MD5:	4258ED10BA7D8CED0FC93F044649FF5F
SHA1:	1CFCB8BE1AA11FF6C45A58DAE352B3659C63A12F
SHA-256:	1382EE7F4C70761E25AE0700AC8894C6FEB2A5BCCA63D1D893A04C78A0432DCE
SHA-512:	4697551A55E1564F35DCFF43816FE3332C9A15C96D1185DB352C8E1C9C73288F095E96D700C5D986199A16BEE43A920BE499A273942FEEC8E30B4692D347F3AD
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H.a.r.t.m.u.t. .H.o.y.e.r. .(.4...1.5.).,. .M.o.n.i.k.a.,. .A.n.d.y. .K.l.e.i.n.e.r.t.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .H.u.C.-.H.o.y.e.r.@.o.n.l.i.n.e...d.e.;.a.n.d.y...k.l.e.i.n.e.r.t.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .N.o.v... .2.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.D.e.u.t.s.c.h.....C.h.a.n.g.e.L.a.n.g.=.D.i.e. ...n.d.e.r.u.n.g. .w.i.r.d. .e.r.s.t. .n.a.c.h. .e.i.n.e.m. .N.e.u.s.t.a.r.t. .d.e.r. .S.o.f.t.w.a.r.e. .w.i.r.k.s.a.m.......[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.J.a.....B.u.t.t.o.n.N.o.=.N.e.i.n.....

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Greek.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183994
Entropy (8bit):	4.448425738661401
Encrypted:	false
SSDEEP:	3072:mGq1T9/RcOqp7HyBQVBZsRMlU6syxfh/5zKDZ//z2gmptcdCIgKvoDQYjB83HeUu:uRcObwBZsRCU6H5eu7zt
MD5:	DDF806595B80FB23A81B1BE514D273B2
SHA1:	6FB3E50569E889CC37D9382BDF4D9A814FAF14F6
SHA-256:	75AA252ADF64F17203D7B7F8BC6FF10D22FCCAD186CF10C191FD50D711F0A5D5
SHA-512:	DCDA4C3D2B06BF7E2676531459F9011D2B13689A8FBB566A2DC93F11B8EA8021EC57C24C239B0F6A685CCFFD5C444ABBFA86864329D382FABD9A3A7F3890C064
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .g.e.o.g.e.o...g.r.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .g.e.o.g.e.o...g.r.@.g.m.a.i.l...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.s.:././.w.w.w...g.e.o.g.e.o...g.r.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...6...4...5.6.1.....;. .U.p.d.a.t.e.:. .M.a.r.c.h. .4.,. .2.0.2.1.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.........................[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...........B.u.t.t.o.n.N.o.=...........B.u.t.t.o.n.O.K.=...................B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.................................B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...............................B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Hebrew.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	165424
Entropy (8bit):	4.372679012082705
Encrypted:	false
SSDEEP:	3072:cGX4Hsp8R5DDCtACte4QyYwglz2bcUsGA/QtZfotG07s4Zp+n8K:yHsp8rvCte4Pg9sdn8K
MD5:	056A7E88D49779DE4809F26F8867EC9D
SHA1:	6E1BD6349599B21D0A16E9B8DB6D2ABB37AF8539
SHA-256:	4087F0AADF7F189F04572B7702A629188806E54D3F244F917E7AD21FE4CD5D7E
SHA-512:	A1503BA91F94B2DF3B5D7993E8FB47AB73BE37FB4EE7DAD9580E2A9AFA0EF4D76C2309B9C5A7429F72FB2AB08EDD5AF54B331A4E6CCDF0C07D57A25EE70E5A54
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.a.r.o.n.'.S. .T.e.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.D.....R.e.a.d.H.a.b.i.t.=.r.i.g.h.t.-.t.o.-.L.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.H.E.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.h.e.-.i.l.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=...............K.B.=...'.......M.B.=...'.......G.B.=...'.......p.m.D.e.f.a.u.l.t.=........... .............I.n.f.o.r.m.a.t.i.o.n.=.............W.a.r.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Hungarian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	207010
Entropy (8bit):	3.672419240069379
Encrypted:	false
SSDEEP:	3072:fh5+ne2FA4p6xmYJTdUBtVR3/S7bnUTiVf23Xmllxz+UVod8vKt0FLSPWtsyeu5b:zmYJPllxhfvKexZsXm
MD5:	E17D24F672A27425B05EF4E2124E8AA6
SHA1:	0764C1E3E4A9703DBA335CFE8B8E4F8191012134
SHA-256:	DA032CB20C4A5CC984ED3777E52F3D289E85A7E43D67C8B9707202FEAF784F05
SHA-512:	5D60C9221BE1752BBD848DE32B1558FE0C87DD6DBE2C701B107BB1CEA3B3D1324A13C117C8A9ACB8CB871BFBC058ACA00F7FFFE93312A7DBF99E3F83507E8C50
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Z.i.t.y.i.'.s. .T.r.a.n.s.l.a.t.o.r. .T.e.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .z.i.t.y.i.s.o.f.t.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...1.....;. .U.p.d.a.t.e.:. .S.e.p... .1.1.,. .2.0.2.3.....;.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Indonesian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	156598
Entropy (8bit):	3.5026144092869407
Encrypted:	false
SSDEEP:	3072:/C5/KPKDlX7fd5GLy47kyoGrRBE7tiQ67Iu9bOy6hXCw33unIXBLaLH:ZKDlrjGLy42b2Iy
MD5:	B4C12BBE4DE6C3883BBB980236E0B011
SHA1:	A1AF06BECCB560093D0367D105B73F6E107EDFF3
SHA-256:	81E06A5F1E7364E5DE7C587701CB5A5DA7052149E5575E20889F0A58400334D4
SHA-512:	EA8B5DFB84E7830E026B182CD95570865A4A0EF90DFE2F0F6A93D205155C3766CEBD36C8077AA31AE5C1D542D9A3A8FCDB4E8536890C070D7E243958E65044C4
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H.i.M...Z.e.R.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .t.h.e.m.h.m.d.o.u.b.l.e.m.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.I.n.d.o.n.e.s.i.a.n.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.I.d.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.B.a.w.a.a.n.....I.n.f.o.r.m.a.t.i.o.n.=.I.n.f.o.r.m.a.s.i.....W.a.r.n.i.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Italian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	203156
Entropy (8bit):	3.5025814950708116
Encrypted:	false
SSDEEP:	3072:bu7S8D2oiKVtI4BlvUXmUufkq2EmYFwkryY/OmlbxTpAj8+ApNVM1w8dMNKMiZ3p:+KoiKVtiXmUufkq2E3FwkZOmlu9Bsbo
MD5:	B6DF8AE891B79844B73D35575C9B7CA9
SHA1:	CEB824CA6F30C6F5B2D1A51C124DE20500FCF489
SHA-256:	1233826F4FABD2EA646DD5BB23F99EB84443FAB8AA15CA9E956D1DCB94633688
SHA-512:	65B591EF523A7CA7A25817AF92F2BD4943F75446CAB82A7248803F0C426937A6CCEEBD329DBECB063FADCB0AF79F52D61649619AE0CED221E66FF8C1FAD64DA6
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. . . . . . .A.l.e.s.s.a.n.d.r.o. .V.i.s.e.n.t.i.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.l.e.x.v.i.s.2.0.1.5.@.o.u.t.l.o.o.k...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. . . . . . . . . . . .6...6...1.....;. .U.p.d.a.t.e.:. . .

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Japanese.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	143696
Entropy (8bit):	4.80982954334959
Encrypted:	false
SSDEEP:	3072:sy9Yk23lVo5wIZX67pyywu40D9caW0vNL4VMbrDi6mBVcvGGSsCJj4:R6k23UZX6bZTisT
MD5:	CF86E45A33896D9772A500BE49995F54
SHA1:	E557E101BBAF05E20A6D48C2EB23D1E1ACCC2442
SHA-256:	0893AF7BA38C94D03AC2674125354D5E8E9FC0E63CB5ADC5D73DCEE41DD0E22F
SHA-512:	E5F8562CAFBFD81E36DA1C21A40E552433A7BA6F9FC47BC501C9115188A552CAE6C04F95404AA8927C18631F6CD66A564EC5D21D54D1644E02B06D97929BCFEB
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.J.P.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.j.a.-.j.p.....D.e.f.a.u.l.t.F.o.n.t.=.M.S. .U.I. .G.o.t.h.i.c.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.S.H.I.F.T.J.I.S._.C.H.A.R.S.E.T.....B.y.t.e.s.=..0.0.0....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=..e.[$P....I.n.f.o.r.m.a.t.i.o.n.=..`1X....W.a.r.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Korean.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	144884
Entropy (8bit):	4.857599715577026
Encrypted:	false
SSDEEP:	3072:eaPUV4CgGAxPLHy53z49whleBQgKOhWTSk5Mq0yir2S6Oue02so+qDK:jPUV49xPLD9TUcsolm
MD5:	5DCD5F4AB5B4F59A35EDABE9F3E7AC76
SHA1:	C23D909C561867653ED7FC2BB2B6807B360547EC
SHA-256:	4EA4CB02ABB676A2B07B7F225823ED14BD82C40E4EDBFA7E8CFBFABEDACC9E95
SHA-512:	E2D0553D7980703BFBA54A72BC5691DD2503ADAEBE8A86727569694C25E98933CF6FF29E93611035241AE5412179E322D34AD24ED099AACAADE1D0B479A437FB
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .w.w.w...k.o.l.a.n.p...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.o.l.a.n.p.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...5...7.....;. .U.p.d.a.t.e.:. .A.u.g... .1.0.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Kurdish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	161920
Entropy (8bit):	3.6462156491884277
Encrypted:	false
SSDEEP:	3072:4WxM4TYDAIAyKypNePPJvQpy2YaO06os+:JxM4zIAyVehM
MD5:	318CE206932C7A37516BF78D00B5BC22
SHA1:	8C352F223950A492013BA40F5992B1DD6702D729
SHA-256:	38E180F9431281F28780727497B7904FDFC1063DEFEBD0C0BDADED337477FD84
SHA-512:	AEFA5EE88D44E6524BCD9C1E2EE2FBB516ADE33FEF856FB6F1AC6C150D1F960D87BF55848FA5A47EE593E0A5C80003E9A86D3724A38C8E252E1A0294208184BF
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H...j.a. .t.o.b.a.l. .h.a.m.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .h.e.j.a.1.2.3.@.h.o.t.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.K.u.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.K.u.-.k.u.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.T.U.R.K.I.S.H._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.R.a.w...j.....I.n.f.o.r.m.a.t.i.o.n.=.A.g.a.h.......W.a.r.n.i.n.g.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Lithuanian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183988
Entropy (8bit):	3.636848046213731
Encrypted:	false
SSDEEP:	3072:4w0EgqA5jyzNzVoaHu3RM3KQSFZyeVHQtJG8097brPEexAhgYXkJIWEe7mZqV0IQ:YjyzVKQSFrPsB
MD5:	D4DEACAAACE10E243F3C689B2C75190E
SHA1:	65A8E8D0A81F8916CB269F801ED2966C3BE709EE
SHA-256:	29463E1FE8E16310DB1F35BF8AAAD23C11C27C92D8B30AB6ABA335E792C7EFBD
SHA-512:	AA018A4A8F4D58EE8FFDBB6FB0570E3FF1D7391AC85AF6D4F1427F6C50401D6A8F924A8CA2F0E38585B5CFFF65899FA821164120EC005EDBFB6CAC2CD458081C
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .R.i.m.g.a.u.d.a.s. .V.y.a.n.i.a.u.s.k.a.s.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.r.e.m.k.u.s.@.i.n.b.o.x...l.t.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.7.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.8.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.B.A.L.T.I.C._.C.H.A.R.S.E.T.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.B.A.L.T.I.C._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.i.t.a.i.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.P.a.g.a.l. .n.u.t.y.l...j.i.m.......I.n.f.o.r.m.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Nepali.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	163612
Entropy (8bit):	4.423974317636969
Encrypted:	false
SSDEEP:	3072:Cw4KeLw2LVMAgO3s4thTwsTbp5xr1Snvyqei7/DZyaZSAMsz2Te1vMDsO35W1MJe:J4KeLRMtO3s4thTwsTbxxi7/DZyaZSJq
MD5:	F1FDDDA8F5F8F6FC59692DCD9797A838
SHA1:	4861919B97E500900512B99CDDA3204B0607D3A6
SHA-256:	1DCBD5BC18720F3DC4175256AB26BC537402B9E84FEDEC60581B85C7FE946D81
SHA-512:	505532BEA964485BB23EB2FC93F5355C13CAB3E76EA9198E6692A16F1C3DB4242A892ABBE53961BEE9BA0A81B1BBA58ED2A5D5D6009DE28D8FE4573EE145D290
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.6.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.E.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.e.-.n.p.....D.e.f.a.u.l.t.F.o.n.t.=.M.a.n.g.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.,.>.........K.B.=...G...,.?.......M.B.=.......,.?.......G.B.=...?...,.?.......p.m.D.e.f.a.u.l.t.=.*.B.0.M.5.(.?.0.M.'.>.0.?.$.....I.n.f.o.r.m.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Norwegian(Bokmal).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	192248
Entropy (8bit):	3.549337495830829
Encrypted:	false
SSDEEP:	3072:MxuWqs9i5EN4iLOz4p9quxy5LmEByIqU1Go5WZW2iQLfs0t9F/XOuaW048CSmicg:fs9iR4p9M6/Esto
MD5:	F684E0491103575D2D18ACFFCF58044E
SHA1:	4E94B717ED5F068258DAF7193FC93CD0747D91C0
SHA-256:	045318C2477572F8353D5EF1FF6A69327A940AF4D85902CC2C8483C0F0D0605F
SHA-512:	9B8CEEC4159D40E8065742C595AA1D336DB416E1E690EE6274B4D5C1CB4B636088F246C718EA96A79A6D630775A564564757BB388FDA2169B95C44EEFD1CA203
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .A.d.r.i.a.n. .T.h.o.m.a.s.s.e.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.d.r.i.a.n...t.h.o.m.a.s.s.e.n.9.2.@.g.m.a.i.l...c.o.m.....;. .F.o.r. .v.e.r.s.i.o.n.:. .6...5...7...6.3.0.....;. .L.a.s.t. .u.p.d.a.t.e.:. .1.1...0.8...2.0.2.3.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.4.....R.e.a.d.H.a.b.i.t.=.R.i.g.h.t.-.t.o.-.l.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.O.B.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.o.-.n.b.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Norwegian(Nynorsk).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	170564
Entropy (8bit):	3.5539102364923365
Encrypted:	false
SSDEEP:	3072:MTPn0O/Cq1ZkCOCN9THI6q8NWVGwtysR0gwlvSeVi34BJDMw7kMdpMD0OsKP05AR:+ZkC5I6q80s2
MD5:	DC82D14F05B1BC2DB6B88B405583EA66
SHA1:	AD5BF79024C14F0F2DF5F782A68FCB62E2C34FA9
SHA-256:	2DC8F11A8F5744AEE78C40F7FAEE8BA0057F4F2B807690A1C8D47CE7DC9A5632
SHA-512:	FB9A932198E19470C764BE7D7CEFB3762A1445024C11A79B3CE95A6C8469762D42122FC3AD3CC265A3B6F3B80130A8956A1064519B8E15F7C438DF17C51B8B20
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.1.4.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.o.r.w.e.g.i.a.n. .n.y.n.o.r.s.k.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.n.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.r.d.....I.n.f.o.r.m.a.t.i.o.n.=.I.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Persian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	159016
Entropy (8bit):	4.2709616074248355
Encrypted:	false
SSDEEP:	3072:4nZu5eVg7BHoQSLEvy5AweuWKME/9JsS0csDgd:8Zu5eVnQSLMwtLsUd
MD5:	9BC326E267CD4FE166FE07FFD29EE4DA
SHA1:	E1747C4264A0EE73718575525AED075A5F890762
SHA-256:	F2E08FDCFFE13C1FB46E2BA510E56A504B8226E24476909AFBFE3414A73B7ADB
SHA-512:	F1BA6C5C2855AD36E0828583CD06E4AD51E98EE4FE1BA4FD0D05E1A6A7CB3974CC613C415DC8D517162EB78280B3CB277C42A99BDF11AC36E63ED5E6C1B4DB37
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.a.v.a.r.-.A.s.g.a.r.y.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .Y.a.v.a.r.a.s.g.a.r.y.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.9.....R.e.a.d.H.a.b.i.t.=.R.i.g.h.t.-.t.o.-.l.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.A.'.1.3.......L.a.n.g.S.h.o.r.t.N.a.m.e.=.I.R.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.R.A.B.I.C._.C.H.A.R.S.E.T.....B.y.t.e.s.=.(.'........K.B.=.....D.H.(.'........M.B.=.E...'.(.'........G.B.=.......'.(.'........p.m.D.e.f.a.u.l.t.=.'.H.D...G.....I.n.f.o.r.m.a.t.i.o.n.=.'.7.D.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Polish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	188652
Entropy (8bit):	3.713329333825878
Encrypted:	false
SSDEEP:	3072:gf5q/NFoLzrupyOD2y1/rGIr0lJ+KQGhTZ0usRGz:uq/N+rupqrrsRa
MD5:	C152777BA323C1778D8EE52B964B437A
SHA1:	F1EE3B54A35767526FE53FE7FF95FE65B0011336
SHA-256:	0EB1B9C20677C401847E4864015E7E5689815022AD7D97FE83D52FEAFCFFE113
SHA-512:	FD7509913C007150B5A4546C16C473FC1D9E6237E9D593BC8CF332CB4334F6C809D18659D7AC201975F5D26E4DA386BBB241205EECBAD7393DAF7261F2890C56
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .F.r.e.s.t.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.k.s.a.f.r.e.s.t.@.w.p...p.l.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...2...2.....;. .U.p.d.a.t.e.:. .A.p.r.i.l. .1.3.,. .2.0.2.2.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.5.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.P.L.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.p.l.-.P.L.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.j.t...w.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Portuguese(Brazil).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	179326
Entropy (8bit):	3.562217111481494
Encrypted:	false
SSDEEP:	3072:rRVV9btYsFwoQud1jkyeZNcMU/Di+s7MbFOmc0bsNK:HbtYTud162sk
MD5:	10403ABF5F76D57CBC42B7CDA162CCF3
SHA1:	3E649F426AB22767E69F595343EDFB3711643325
SHA-256:	AC58818FE66B6F40BC2267419C6A0AE17D773C69462EF5AE926CB6BC350BF59F
SHA-512:	C50A30AA7CC203EB18D04923ED9AD4DBF342E4C42CDFB58D4152FF6D3013C20FABA95203248D08AE5153885CFBA55B8CA3F6548460DAEE4D35CE4E088D0C5B68
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H...l.i.o. .d.e. .S.o.u.z.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .h.d.s.t.e.c.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...4...2...5.3.8.....;. .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .1.3.,. .2.0.1.9.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.6.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.B.R.A.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.p.t.-.b.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B...

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Portuguese(Portugal).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	210314
Entropy (8bit):	3.5450295007157346
Encrypted:	false
SSDEEP:	3072:O0VsOJbiY5lroo/duD1+moW4MyoF6JSHiZOtpLFWlGLGUmV1sykD1uUkfjdGy0tF:jbiY9uD1yxsyzx8
MD5:	84EEE762F1F5C5A43C7EDD13EE6B0712
SHA1:	6A837E2A0A50FE949DCC4EB700DAEA2E46DEC74B
SHA-256:	E9E9BD58CC343D15C840F2AE50D86A7E3CA6C2C69F07755FFA5C3F3E51EFE39A
SHA-512:	6D9E02E6ACD463298BD107CE3DD511E590CD6B7CC482BC03AA05BC1F154E262623052EDEEE880B0FE5C3B4B8CDEAADB20DBEAA052AA25D2A95CB3A60B67B7C81
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .L.u.i.s. .N.e.v.e.s.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .l.u.i.s...a...n.e.v.e.s.@.s.a.p.o...p.t.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .2.2./.1.2./.2.0.2.3.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.P.o.r.t.u.g.u...s.....C.h.a.n.g.e.L.a.n.g.=.P.o.r. .f.a.v.o.r.,. .r.e.i.n.i.c.i.e. .o. .p.r.o.g.r.a.m.a. .p.a.r.a. .a.p.l.i.c.a.r. .a.s. .a.l.t.e.r.a.....e.s...........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.S.i.m.....B.u.t.t.o.n.N.o.=.N...o.....B.u.t.t.o.n.O.K.=.O.K.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Romanian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	211944
Entropy (8bit):	3.63574497427422
Encrypted:	false
SSDEEP:	3072:WCVDaqQi34HFWFACdg9lAcoyZ9YBjT+y0nkRH0U7SoNWdgg65myxcnQ1nT9tJizB:LaqQi3Usg9lDPY7ys0Dn
MD5:	00CEEC40D9631C3BC5297D2BE4A5F184
SHA1:	70DBF3280C7920245837DE6C9ACB6EE4E5547945
SHA-256:	2F0BF590DB93A179A09CED1D1906BCE64EE4BFE2E3A1774180DA7D12A412E2DB
SHA-512:	9B9F7BE81CD9DCBDAAFBB11E823E2D026AA00D463DC58A312CDC2E3B3A585369DC5F1245C2912BC054E4B3A9C23D9E5CDA22DF130429218F2454905ED9F1847F
Malicious:	false
Preview:	..;.....;. .P.u...i.n.e. .r.e.g.u.l.i. .p.e.n.t.r.u. .t.r.a.d.u.c...t.o.r.:.....;. .P.e.n.t.r.u. ...n.c.e.p.u.t. .d.e. .t.r.a.d.u.c.e.r.e. .-. .c.o.p.i.a...i. .e.n.g.l.i.s.h...i.n.i. ...n. .l.i.m.b.a. .d.v.s...i.n.i.....;. .T.r.a.d.u.c.e...i. .t.e.x.t.u.l. .n.u.m.a.i. .d.u.p... .s.i.m.b.o.l.u.l. .'.=.'.....;. .....;. .P.r.o.d.u.c.t. .N.a.m.e.:. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .C.o.m.a.n. .G.e.l.u. .D...n.u.......;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .c.o.m.a.n...w.i.n.d.o.w.s.@.y.a.h.o.o...c.o.m.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.R.o.m...n... .(.R.o.m.a.n.i.a.n.).....C.h.a.n.g.e.L.a.n.g.=.P.e.n.t.r.u. .a. .a.v.e.a. .e.f.e.c.t. .m.o.d.i.f.i.c.a.r.e.a.,. .r.e.p.o.r.n.i...i. .s.o.f.t.u.l.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.D.a.....B.u.t.t.o.n.N.o.=.N.u.....B.u.t.t.o.n.O.K.=.B.i.n.e.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.e.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.i.z.a.r.e.....B.u.t.t.o.n.C.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Russian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	186112
Entropy (8bit):	4.368809252964312
Encrypted:	false
SSDEEP:	3072:Hk8t+ZTzzd0rAUiIyemAGF0K/ihBF5dHumD+BC0KsFlG:Pt+ZsAUife0YsG
MD5:	4D1DAC632B021C60096E9861C150287E
SHA1:	D56A98798C11350B90BBC96E73A244031DD8D8FA
SHA-256:	14C5B587122C9EF2A21E8C6B002DC1F12395DAA8B91AF13085DABD1373DF1323
SHA-512:	F36673C6F57427900C68EF37D36B3D446FFC1738E3DA2B2A47611A68CBC1A5F2E1E0B8D449C767433D2EC632DDDE3E710D92E90C7E7EC27F66FDD5F65AADD987
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .W.i.s.e. .C.a.r.e. .3.6.5.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r.:. .K.r.a.v.t.s.o.v. .A.l.e.k.s.a.n.d.r.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .l.o.c.a.l.i.z.@.r.a.m.b.l.e.r...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...3...2.....;. .U.p.d.a.t.e.:. .J.u.n.e. .2.0.,. .2.0.2.2.....;.............[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=. .C.A.A.:.8.9.............[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.....B.u.t.t.o.n.N.o.=...5.B.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.!.2.5.@.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Serbian(Cyrillic).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	168590
Entropy (8bit):	4.296413368578278
Encrypted:	false
SSDEEP:	3072:cPJhIKw+L2laLIhAywMqiPcZegx54JsuhyUVG2Fah:cJhIdaLIhvPfsKah
MD5:	93B189A428AFD5673180630E28E414F0
SHA1:	4DDD7E00D480FFA70BF15C4026C72E340CD15418
SHA-256:	3381AE9EA468495D9DDA9082A220C9B7183E366616311D6BB0E66AC54F48F777
SHA-512:	F077BC96F0092E424B3BBFE62D4FB36A14F2508E04F20D9BBEF2A163FA673CF204F574DF08B3EBBC4343556BFC0430B6D0D4B82817C377C2CE7B4E6AD17BD2C2
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ...@.5.4.@.0.3. ...1.@.5.=.>.2.8.[.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.m.o.t.i.o.n.@.m.t.s...r.s.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...5.5. .4.2.8. .....;. .U.p.d.a.t.e.:. .F.e.b.r.u.a.r.y. .1.0.,. .2.0.1.7.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.!.@.?.A.:.8.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0. .....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=.#. .@.5.4.C.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.#.<.0.Z.8.B.5.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.#.2.5.[.0.X.B.5.....B.u.t.t.o.n.C.l.o.s.e.=...0.B.2.>.@.8.B.5.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...1.=.0.2.Y.0.Z.5.....B.u.t.t.o.n.M.e.n.u.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Slovak.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197432
Entropy (8bit):	3.7124016259671415
Encrypted:	false
SSDEEP:	3072:w/AKXzLaI4zYoPuKfuOXyZ7F8zDdpMUmDLaeUz/sJYV1mgAL4fAOgyxGQA6YHna/:VKXzLasKfupWAOfs8aCF
MD5:	D522B5844611D8193EF248F6224611A4
SHA1:	F6C3B22450CD27E90549E8260E1BF08BB6F91FE1
SHA-256:	14BEEB5E32DBCEA8842A3A818F4C8157180C6FD96BAEE8CBA20E33ED8F5EC51C
SHA-512:	DCCB6BD3C34C557962C74702C3A06BE808B04BD81AB76EBD682DCBC85C1A00709774A56052814AE710044193609CDECF63BE771D2A84846CA0ED11E2A59387F6
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .F.r.a.n.t.i.a.e.k. .F.i.c.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .f.e.r.o.f.i.c.o.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .W.i.s.e. .C.a.r.e. .3.6.5. .P.R.O. .6...6.3...6.3.3.....;. .U.p.d.a.t.e.:. .N.o.v.e.m.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Slovenian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197324
Entropy (8bit):	3.5956880012491856
Encrypted:	false
SSDEEP:	3072:3ZcT92pw8lEcjt3zsfyV+05KtXu3hjtQXtCOWDMFCQdyYvRf0OsARmriFhCu3:G2pwQjt3jYns2
MD5:	E3C886BF083FBD36C07B67D512C30BA3
SHA1:	5097F0430BA45B461B38112D5831455A0E0B51EE
SHA-256:	B5DD72550E83675F21716D064C985D5C49F970D6CEA7708F84F06BE9F8288D58
SHA-512:	3FA8D0081814E433CD14B28B780C1ADD5215E98B4FE236C1B7482679EFFD9CA7D29C329F0F170F1F32361EFFC99F293DD2AC2019ABE1293FEDA5EED9E5197555
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .J.a.d.r.a.n. .R.u.d.e.c.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .j.r.u.d.e.c.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .W.i.s.e. .C.a.r.e. .3.6.5. .P.r.o. .5._.6...3...7...6.1.5.....;. .U.p.d.a.t.e.:. .S.e.p.t... .2.9.,. .2.0.2.2.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.S.l.o.v.e.n.a...i.n.a.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Spanish(Spain).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	202350
Entropy (8bit):	3.515284888303497
Encrypted:	false
SSDEEP:	3072:bwU+v6MQRsIoU1nAKsOygddSgviGkeAwPPfV2tx9Yf9pfuJkwPlslaK09VVV:Gv6Mm9nAKsoNMXslk
MD5:	06EF94E939646BE84660D556457AA83F
SHA1:	C584BDF5281662F8E265939188CFF756D8B68D36
SHA-256:	41B8CADC0A8A2FE20B3D9316A0C49E0DF0E755133B9C4658A2674061F9E15F7F
SHA-512:	EBBC99914AA1724B611A7A53B9680FD7B0235A79411D48FD55D58D405B6E272AB0A9174B6312E4392909BC59903872F8CABC270C2FC81FD3FBC9B45129AAB25E
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'.=.'.....;.....;. .....;. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .C.a.n.n.i.e.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...1.....;. .U.p.d.a.t.e.:. .S.e.p.t... .1.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.E.s.p.a...o.l.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.S.i.....B.u.t.t.o.n.N.o.=.N.o.....B.u.t.t.o.n.O.K.=.O.K.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.i.z.a.r.....B.u.t.t.o.n.C.l.o.s.e.=.C.e.r.r.a.r.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.R.e.s.t.a.u.r.a.r.....B.u.t.t.o.n.M.e.n.u.=.M.e.n.......B.u.t.t.o.n.S.k.i.n.=.T.e.m.a.....a.p.p.l.y.=.A.p.l.i.c.a.r.....N.o.t.h.a.n.k.s.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Swedish(Sweden).ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	195334
Entropy (8bit):	3.5656404948319897
Encrypted:	false
SSDEEP:	3072:q0HzeDLZ+nXVV26UWr4bbyraDeWd6U1gEsqfEQyi8bOGwjNnDFtgjMD3EyvsW6h5:neDLZQ26UEuiWdCRi8MJDFYs7H03
MD5:	68384CCD192503DB3B90A7EF754B0C86
SHA1:	45212337774A7B15E2DA9962F40739810C9C7897
SHA-256:	01B6897229D66816964460AF1C89A11862406B81A870F793992CE7A8F23968EA
SHA-512:	2771091E6EBFF577D3423DF4F737BDD20CF86F6333D28FE954E3919139F73449D0314D79E55E9E0E2849D8CF34790BFF8E56BE689B7EA855B8F260B5E845A964
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .I...K...L.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .q.c.4.8.@.p.m...m.e.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .N.o.v... .2.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.S.v.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Thai.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	138654
Entropy (8bit):	4.544841499214181
Encrypted:	false
SSDEEP:	1536:Xp++KuaedNlZUgS6vk32B0AN9SeFBQjqd4VpH5dvlygXb/J/PELbdrAqgCP8uqZQ:XBDCgS6820eIlysqgYXXMUiA2eCC
MD5:	B59A60BD8CD1AC8C82C5ABFD992755A9
SHA1:	164DFA21EB511683692CA461BD3C4E3F6E8567BF
SHA-256:	B919FF7A0E25D812C9D4E87EBFC028CD5BECCC4FC8F48EA7EF274C1F17A8472C
SHA-512:	0B0561C5B973FC3DB1F4D85908E4ACA64DBE23DC0EF02E5CAF588517E84AF5E708530C660FFE4305B64FE658C0DBA5E9C86BD21AF1A4F6968E65ADED70CE71AC
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.u.t.t.h.a.p.h.o.n. .I.n.c.h.a.i.y.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .y.u.t.t.h.a.p.h.o.n.3.0.6.6.7.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...1.1...3.9.5.....;. .U.p.d.a.t.e.:. . .0.4. .!.5...2...!. .2.0.1.6.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=. .2.).2.D...".....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.C...H.....B.u.t.t.o.n.N.o.=.D.!.H.....B.u.t.t.o.n.O.K.=.....%.......B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.".H.-.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...".2.".....B.u.t.t.o.n.C.l.o.s.e.=...4.......B.u.t.t.o.n.R.e.s.t.o.r.e.=...9.I...7.......B.u.t.t.o.n.M.e.n.u.=.@.!...9.....B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Turkish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	data
Category:	dropped
Size (bytes):	200078
Entropy (8bit):	3.725770713178982
Encrypted:	false
SSDEEP:	6144:V7/HZ1JXCu0qDfslyufq4X0700IBY5qxAu5xWuBwthLw2CsRYtPs8IrwLtzgjDnj:3XCuQsss
MD5:	6D637A166009BA4277AB756125378399
SHA1:	BB09F3B2F4887EC8838F90A9C158211C7399625F
SHA-256:	027547C123ADAE7887C3560433195BA795B27BB118532E8FC0316EA8A6123050
SHA-512:	E93867C4CEAEA4CDEC5B843F7ADD98495CF823794044CF0CCA6A263B31E010CB590AE4FE8FC8BD4247643178234E433ABBD7D125C17DFA11EFE8E9E992A3E804
Malicious:	false
Preview:	;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.F.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.T.R.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.t.r.-.t.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.y.t.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.V.a.r.s.a.y.1.l.a.n.....I.n.f.o.r.m.a.t.i.o.n.=.B.i.l.g.i.....W.a.r.n.i.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Ukrainian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	152954
Entropy (8bit):	4.372742713217779
Encrypted:	false
SSDEEP:	3072:v8t/6mOUHiFL5IOqyAnS12CNmBM/7saoC9s3S3:Ut/6/FL5Nxs0si3
MD5:	D112D0529D59A27987C25B3290C65679
SHA1:	9CC8F4F2BEF72D54E14CB3D3E9367182FB130234
SHA-256:	9906912F0C2820667FC44334CD1D66DF3523E64F7BAA6E832DF8E41EBA52B620
SHA-512:	9E08C7FE9E74BD1CBB8AFA3846CF2E1517A7550FA9E658C441E532A831905A25BBFF7453C401E1740F77437955A8C43C52881C21964AB3487E56FD2BB448925E
Malicious:	false
Preview:	..;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .E.r.i.c.k.U.A.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.r.i.c.k.e.r.i.c.k.c.k.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...1.9...5.1.0.....;. .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .1.6.,. .2.0.1.8.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.#.:.@.0.W.=.A.L.:.0.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.".0.:.....B.u.t.t.o.n.N.o.=...V.....B.u.t.t.o.n.O.K.=...:.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.!.E.>.2.0.B.8.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=. .>.7.3.>.@.=.C.B.8.....B.u.t.t.o.n.C.l.o.s.e.=...0.:.@.8.B.8.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...V.4.=.>.2.8.B.8.....B.u.t.t.o.n.M.e.n.u.=...5.=.N.....B.u.t.t.o.n.S.k.i.n.=.".5.<.0.....a.p.p.l.y.=...0.A.B.>.A.C.2.0.B.8.....N.o.t.h.a.n.k.s.=...V.,. ...O.:.C.N.....B.u.t.t.o.n.C.a.n.c.e.l.=.!.:.0.A.C.2.0.B.8.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.2.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.U.K.R.....L.a.n.g.S.h.o.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Vietnamese.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	187056
Entropy (8bit):	4.042793844735925
Encrypted:	false
SSDEEP:	3072:4whJWT5yZwCNIsTDvxGAPhm4yeemkxXOln+32HLwjLsWfF60IsRnQQFkauiP4:JJWTkLIsTDRkOnXsGQW
MD5:	9909CB62969F4C239A80275D2004401E
SHA1:	6BFE7A104032DC4F634B1FE62DF3083E7A29998A
SHA-256:	439D463293A0538499E262234D8138EA14543AA6C0436C9E4735F67C1FE37A41
SHA-512:	DA514E212A709B005D1AE2F4BE431A7E5B329D78373E2EEA02F0C2FC2691BA771D58E2A05FB0628FC359E5EA39FC05D1F6673910889C883CD45C2F6145E43FE9
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.h.a.m. .M.i.n.h. .K.i.e.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .m.i.n.h.k.i.e.n.t.r.t.0.0.9.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...1...4.....;. .U.p.d.a.t.e.:. .D.e.c... .6.,. .2.0.2.1.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.a.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.V.I.E.....L.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-0K4D0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	203156
Entropy (8bit):	3.5025814950708116
Encrypted:	false
SSDEEP:	3072:bu7S8D2oiKVtI4BlvUXmUufkq2EmYFwkryY/OmlbxTpAj8+ApNVM1w8dMNKMiZ3p:+KoiKVtiXmUufkq2E3FwkZOmlu9Bsbo
MD5:	B6DF8AE891B79844B73D35575C9B7CA9
SHA1:	CEB824CA6F30C6F5B2D1A51C124DE20500FCF489
SHA-256:	1233826F4FABD2EA646DD5BB23F99EB84443FAB8AA15CA9E956D1DCB94633688
SHA-512:	65B591EF523A7CA7A25817AF92F2BD4943F75446CAB82A7248803F0C426937A6CCEEBD329DBECB063FADCB0AF79F52D61649619AE0CED221E66FF8C1FAD64DA6
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. . . . . . .A.l.e.s.s.a.n.d.r.o. .V.i.s.e.n.t.i.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.l.e.x.v.i.s.2.0.1.5.@.o.u.t.l.o.o.k...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. . . . . . . . . . . .6...6...1.....;. .U.p.d.a.t.e.:. . .

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-0KV3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197514
Entropy (8bit):	3.5449422520463316
Encrypted:	false
SSDEEP:	3072:G3rD4vERlaG28NA2zmruMVyHLISwYbOTAIqpFl+PaT8H4z/HwH+xe0hsdBfm:hvERVNnmruMsIEsusa
MD5:	6B5456078E9C427E5BDF4D134BEF4064
SHA1:	2D11ECEC4CFC9462018222BDBBAEDEDE10267567
SHA-256:	1F4BDCE8D7D124CAAE785F35FE9D9F8941E7D0BF8D4100AB1FCA0139A8B38B1B
SHA-512:	6B1DA28A13314909E7B21B580C6724B0526D9D13029409DF8E5C52C9BF65912EF9BAD6D78AEE96EF3D054858CC1A8940AD6848A324A9BF32ACF55882F1647AF5
Malicious:	false
Preview:	......;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .J.o.a.n. .Q.u.e.r.a.l.t.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...5...1.....;. .U.p.d.a.t.e.:. .F.e.b... .2.3.,. .2.0.2.3.........[.T.r.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-0U498.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	138654
Entropy (8bit):	4.544841499214181
Encrypted:	false
SSDEEP:	1536:Xp++KuaedNlZUgS6vk32B0AN9SeFBQjqd4VpH5dvlygXb/J/PELbdrAqgCP8uqZQ:XBDCgS6820eIlysqgYXXMUiA2eCC
MD5:	B59A60BD8CD1AC8C82C5ABFD992755A9
SHA1:	164DFA21EB511683692CA461BD3C4E3F6E8567BF
SHA-256:	B919FF7A0E25D812C9D4E87EBFC028CD5BECCC4FC8F48EA7EF274C1F17A8472C
SHA-512:	0B0561C5B973FC3DB1F4D85908E4ACA64DBE23DC0EF02E5CAF588517E84AF5E708530C660FFE4305B64FE658C0DBA5E9C86BD21AF1A4F6968E65ADED70CE71AC
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.u.t.t.h.a.p.h.o.n. .I.n.c.h.a.i.y.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .y.u.t.t.h.a.p.h.o.n.3.0.6.6.7.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...1.1...3.9.5.....;. .U.p.d.a.t.e.:. . .0.4. .!.5...2...!. .2.0.1.6.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=. .2.).2.D...".....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.C...H.....B.u.t.t.o.n.N.o.=.D.!.H.....B.u.t.t.o.n.O.K.=.....%.......B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.".H.-.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...".2.".....B.u.t.t.o.n.C.l.o.s.e.=...4.......B.u.t.t.o.n.R.e.s.t.o.r.e.=...9.I...7.......B.u.t.t.o.n.M.e.n.u.=.@.!...9.....B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-1HG9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	168590
Entropy (8bit):	4.296413368578278
Encrypted:	false
SSDEEP:	3072:cPJhIKw+L2laLIhAywMqiPcZegx54JsuhyUVG2Fah:cJhIdaLIhvPfsKah
MD5:	93B189A428AFD5673180630E28E414F0
SHA1:	4DDD7E00D480FFA70BF15C4026C72E340CD15418
SHA-256:	3381AE9EA468495D9DDA9082A220C9B7183E366616311D6BB0E66AC54F48F777
SHA-512:	F077BC96F0092E424B3BBFE62D4FB36A14F2508E04F20D9BBEF2A163FA673CF204F574DF08B3EBBC4343556BFC0430B6D0D4B82817C377C2CE7B4E6AD17BD2C2
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ...@.5.4.@.0.3. ...1.@.5.=.>.2.8.[.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.m.o.t.i.o.n.@.m.t.s...r.s.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...5.5. .4.2.8. .....;. .U.p.d.a.t.e.:. .F.e.b.r.u.a.r.y. .1.0.,. .2.0.1.7.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.!.@.?.A.:.8.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0. .....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=.#. .@.5.4.C.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.#.<.0.Z.8.B.5.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.#.2.5.[.0.X.B.5.....B.u.t.t.o.n.C.l.o.s.e.=...0.B.2.>.@.8.B.5.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...1.=.0.2.Y.0.Z.5.....B.u.t.t.o.n.M.e.n.u.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-1HMQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	160832
Entropy (8bit):	4.375936548919877
Encrypted:	false
SSDEEP:	1536:un9EJffitKAzlcEvrxzyNnyGCmo5Le/6TZzvkrpyI8rt1s/hgNuRA:WCitKAzlVxzylyGCPLePt8r/s/hl6
MD5:	2BB8C96C5947BF56961A77301BF8ABD7
SHA1:	B279B072A9F90D7DDCAA9B9D100BE0DF8406D703
SHA-256:	F6B767F35B3BB389950A993737FDCAE26E722373F0F8C20D0300B8CD267A324F
SHA-512:	26C488F53DDA7D03DA8BD6DDB085C5A0247AB0879D139A467E568CFE3093E7AAAF9E3953028AA067C45B13022625B8F36888428B9B151C17CDE3D72559ADE355
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .K.o.z.e.l. .M.i.k.a.l.a.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.o.z.e.l...m.i.k.a.l.a.i.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...8.2...4.6.4.....;. .U.p.d.a.t.e.:. .M.a.r.c.h. .1.2.,. .2.0.1.8.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...5.;.0.@.C.A.:.0.O.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.".0.:.....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=...>.1.@.0.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...V.=.V.<.V.7.0.2.0.F.L.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=. .0.A.:.@.K.F.L.....B.u.t.t.o.n.C.l.o.s.e.=...0.G.K.=.V.F.L.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...4.=.0.2.V.F.L.....B.u.t.t.o.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-2R9T4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183994
Entropy (8bit):	4.448425738661401
Encrypted:	false
SSDEEP:	3072:mGq1T9/RcOqp7HyBQVBZsRMlU6syxfh/5zKDZ//z2gmptcdCIgKvoDQYjB83HeUu:uRcObwBZsRCU6H5eu7zt
MD5:	DDF806595B80FB23A81B1BE514D273B2
SHA1:	6FB3E50569E889CC37D9382BDF4D9A814FAF14F6
SHA-256:	75AA252ADF64F17203D7B7F8BC6FF10D22FCCAD186CF10C191FD50D711F0A5D5
SHA-512:	DCDA4C3D2B06BF7E2676531459F9011D2B13689A8FBB566A2DC93F11B8EA8021EC57C24C239B0F6A685CCFFD5C444ABBFA86864329D382FABD9A3A7F3890C064
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .g.e.o.g.e.o...g.r.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .g.e.o.g.e.o...g.r.@.g.m.a.i.l...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.s.:././.w.w.w...g.e.o.g.e.o...g.r.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...6...4...5.6.1.....;. .U.p.d.a.t.e.:. .M.a.r.c.h. .4.,. .2.0.2.1.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.........................[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...........B.u.t.t.o.n.N.o.=...........B.u.t.t.o.n.O.K.=...................B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.................................B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...............................B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-4UGBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	144884
Entropy (8bit):	4.857599715577026
Encrypted:	false
SSDEEP:	3072:eaPUV4CgGAxPLHy53z49whleBQgKOhWTSk5Mq0yir2S6Oue02so+qDK:jPUV49xPLD9TUcsolm
MD5:	5DCD5F4AB5B4F59A35EDABE9F3E7AC76
SHA1:	C23D909C561867653ED7FC2BB2B6807B360547EC
SHA-256:	4EA4CB02ABB676A2B07B7F225823ED14BD82C40E4EDBFA7E8CFBFABEDACC9E95
SHA-512:	E2D0553D7980703BFBA54A72BC5691DD2503ADAEBE8A86727569694C25E98933CF6FF29E93611035241AE5412179E322D34AD24ED099AACAADE1D0B479A437FB
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .w.w.w...k.o.l.a.n.p...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.o.l.a.n.p.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...5...7.....;. .U.p.d.a.t.e.:. .A.u.g... .1.0.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-4V222.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	211308
Entropy (8bit):	3.528482941742127
Encrypted:	false
SSDEEP:	3072:oYlZfFS3QwHVKh1QZPywtqY6rKHkuv2LxW1+hpe4tezZgoRGi0PIy2mxcHj5vtVd:3lZfFQVKhP1TasHA
MD5:	5F894BB9DE5369E2D9BD328156C6C74A
SHA1:	B28D3CA4056821869568FEDA4C7FF4D088502631
SHA-256:	9FC6235CE5102528286046A4EE3DAD7EC3BBC52BAD376C1F2242262C93F198D6
SHA-512:	1CA15130FA01DDEC49ED97F60895C4B8853C41FCA15DEEBA576A72D9BD9E603666D435D928F256E74650DF2CC3EDE65535AC4FD61CBBF7C685345FEF7328D6B8
Malicious:	false
Preview:	..;.....;. .M.u.u.t.a.m.a. .s.....n.t... .k.....n.t...j...l.l.e.:.....;. .K.u.n. .a.l.o.i.t.a.t. .k.....n.n...s.t.y...n. .-. .k.o.p.i.o.i. .e.n.g.l.i.s.h...i.n.i. .o.m.a.l.l.e. .k.i.e.l.e.l.l.e.s.i. .(.e.s.i.m... .f.i.n.n.i.s.h...i.n.i.).....;. .K.....n.n... .v.a.i.n. .t.e.k.s.t.i. .'. .=. .'. .m.e.r.k.i.n. .j...l.k.e.e.n.....;. ...l... .m.u.o.k.k.a.a. .r.i.v.i...:. .R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....;. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .o.r.i.g.i.n.a.l.;. .p.e.n.a.V.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .p.e.n.a.v.@.o.u.t.l.o.o.k...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3...6.3.3.....;. .L.a.n.g... .U.p.d.a.t.e.:. .2.0.2.3.-.N.o.v.-.2.2.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.F.i.n.n.i.s.h.-.S.u.o.m.i.....C.h.a.n.g.e.L.a.n.g.=.O.t.a. .m.u.u.t.o.s. .k...y.t.t.....n. .k...y.n.n.i.s.t...m...l.l... .o.h.j.e.l.m.i.s.t.o. .u.u.d.e.l.l.e.e.n.......[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.K.y.l.l.......

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-5CI8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	152954
Entropy (8bit):	4.372742713217779
Encrypted:	false
SSDEEP:	3072:v8t/6mOUHiFL5IOqyAnS12CNmBM/7saoC9s3S3:Ut/6/FL5Nxs0si3
MD5:	D112D0529D59A27987C25B3290C65679
SHA1:	9CC8F4F2BEF72D54E14CB3D3E9367182FB130234
SHA-256:	9906912F0C2820667FC44334CD1D66DF3523E64F7BAA6E832DF8E41EBA52B620
SHA-512:	9E08C7FE9E74BD1CBB8AFA3846CF2E1517A7550FA9E658C441E532A831905A25BBFF7453C401E1740F77437955A8C43C52881C21964AB3487E56FD2BB448925E
Malicious:	false
Preview:	..;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .E.r.i.c.k.U.A.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.r.i.c.k.e.r.i.c.k.c.k.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...1.9...5.1.0.....;. .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .1.6.,. .2.0.1.8.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.#.:.@.0.W.=.A.L.:.0.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.".0.:.....B.u.t.t.o.n.N.o.=...V.....B.u.t.t.o.n.O.K.=...:.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.!.E.>.2.0.B.8.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=. .>.7.3.>.@.=.C.B.8.....B.u.t.t.o.n.C.l.o.s.e.=...0.:.@.8.B.8.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...V.4.=.>.2.8.B.8.....B.u.t.t.o.n.M.e.n.u.=...5.=.N.....B.u.t.t.o.n.S.k.i.n.=.".5.<.0.....a.p.p.l.y.=...0.A.B.>.A.C.2.0.B.8.....N.o.t.h.a.n.k.s.=...V.,. ...O.:.C.N.....B.u.t.t.o.n.C.a.n.c.e.l.=.!.:.0.A.C.2.0.B.8.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.2.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.U.K.R.....L.a.n.g.S.h.o.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-5GKRD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	131938
Entropy (8bit):	4.831914908340532
Encrypted:	false
SSDEEP:	3072:ZtSVUGaZ4yxVlndPyOrYKg5zsOKpMH+3lMJyjuqC252EpOY0hswhq82y:uVUGSlndTD/X8swhF
MD5:	73C71B06375D15C7429CF641FEF6730A
SHA1:	356D2B092D7C683BA88E7B3F1BFD9C9A077FE672
SHA-256:	500F00C5E793BA3D288FCBC50A23205B808F5F929E75FFB0B01EB64C0F4314A2
SHA-512:	02E46530E0ACCB4B3C9F44CEF7463F418D74B47F6054215A28AFA390BCC9FBF505ADDB637FC6D2004DC8374CADE9884C22E32AF2CFF010DD54492141B6891971
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.0.4.\|.1.0.0.4.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.C.H.S.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.z.h.-.c.n.....D.e.f.a.u.l.t.F.o.n.t.=.._o.......D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.G.B.2.3.1.2._.C.H.A.R.S.E.T.....B.y.t.e.s.=.W[......K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=........I.n.f.o.r.m.a.t.i.o.n.=.nx......W.a.r.n.i.n.g.=.f.JT..

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-6O8KK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	156598
Entropy (8bit):	3.5026144092869407
Encrypted:	false
SSDEEP:	3072:/C5/KPKDlX7fd5GLy47kyoGrRBE7tiQ67Iu9bOy6hXCw33unIXBLaLH:ZKDlrjGLy42b2Iy
MD5:	B4C12BBE4DE6C3883BBB980236E0B011
SHA1:	A1AF06BECCB560093D0367D105B73F6E107EDFF3
SHA-256:	81E06A5F1E7364E5DE7C587701CB5A5DA7052149E5575E20889F0A58400334D4
SHA-512:	EA8B5DFB84E7830E026B182CD95570865A4A0EF90DFE2F0F6A93D205155C3766CEBD36C8077AA31AE5C1D542D9A3A8FCDB4E8536890C070D7E243958E65044C4
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H.i.M...Z.e.R.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .t.h.e.m.h.m.d.o.u.b.l.e.m.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.I.n.d.o.n.e.s.i.a.n.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.I.d.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.B.a.w.a.a.n.....I.n.f.o.r.m.a.t.i.o.n.=.I.n.f.o.r.m.a.s.i.....W.a.r.n.i.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-75Q8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	161920
Entropy (8bit):	3.6462156491884277
Encrypted:	false
SSDEEP:	3072:4WxM4TYDAIAyKypNePPJvQpy2YaO06os+:JxM4zIAyVehM
MD5:	318CE206932C7A37516BF78D00B5BC22
SHA1:	8C352F223950A492013BA40F5992B1DD6702D729
SHA-256:	38E180F9431281F28780727497B7904FDFC1063DEFEBD0C0BDADED337477FD84
SHA-512:	AEFA5EE88D44E6524BCD9C1E2EE2FBB516ADE33FEF856FB6F1AC6C150D1F960D87BF55848FA5A47EE593E0A5C80003E9A86D3724A38C8E252E1A0294208184BF
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H...j.a. .t.o.b.a.l. .h.a.m.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .h.e.j.a.1.2.3.@.h.o.t.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.K.u.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.K.u.-.k.u.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.T.U.R.K.I.S.H._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.R.a.w...j.....I.n.f.o.r.m.a.t.i.o.n.=.A.g.a.h.......W.a.r.n.i.n.g.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-7DHRJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	189128
Entropy (8bit):	3.611264892431967
Encrypted:	false
SSDEEP:	3072:XUAp2xsYUK5J4Q/ply9HMnand+s4O0gss0ZV5D:kO2xsqJ4Q/ApjsD
MD5:	4CBAD66305AD232F96B5725350FF4D55
SHA1:	42F3A680AE26C003D53E99FA591EC3A5A87AE20D
SHA-256:	F099655CDAB65A2BD39CE2EFB296C05E484B53CA9146DBDD99D0A7DB4593F8D8
SHA-512:	04C6E9EF19D2DCB4CF87FACFA99C914625B23F021AFF07C6686E378AB8E9BC4EBABDF99DE9C66D608FF283EE42688B04BCEA4D693C5FCF18B67339661803B7CB
Malicious:	false
Preview:	..;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .D.o.m.i.n.k.o. .A.~.d.a.j.i.......;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .d.o.m.a.z.d.@.m.a.i.l...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...4...7...5.4.3.....;. .U.p.d.a.t.e.:. .F.e.b.r.u.a.r.y. .1.0.,. .2.0.2.0.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.H.r.v.a.t.s.k.i.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.D.a.....B.u.t.t.o.n.N.o.=.N.e.....B.u.t.t.o.n.O.K.=.U. .r.e.d.u.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.S.m.a.n.j.i.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.P.o.v.e...a.j.....B.u.t.t.o.n.C.l.o.s.e.=.Z.a.t.v.o.r.i.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.V.r.a.t.i.....B.u.t.t.o.n.M.e.n.u.=.I.z.b.o.r.n.i.k.....B.u.t.t.o.n.S.k.i.n.=.T.e.m.a.....a.p.p.l.y.=.P.r.i.m.i.j.e.n.i.....N.o.t.h.a.n.k.s.=.N.e.,. .h.v.a.l.a.....B.u.t.t.o.n.C.a.n.c.e.l.=.O.d.u.s.t.a.n.i.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.0.1.A.\|.0.4.1.A.\|.1.0.1.A.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.H.R.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-7RBI1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190212
Entropy (8bit):	3.550988971870915
Encrypted:	false
SSDEEP:	3072:lQSrXQx7MIuZHStLrCC6LjGMbyKCpnmbwzhCjN1iqJ6zrpw9rwBYE0c+YtyL2pJn:8x7M/C6L/mLcEfZrscim
MD5:	2227967558A259FC1981A9B729717F91
SHA1:	56F231B7E330A3FEABBDC5158421D8F38B7368EF
SHA-256:	32F18CE8CE8D7A6AC6B5B3EEA61084235899AFE4C2B4C63427F0BC975DD51D54
SHA-512:	EE317B8D3FDD6AF069378B14BA1B368575F27F8B813DD84ED0F03DCA526B90E597201EB22EA673FD026298D31729AB94F9919C1E20DA1D3E2CE646B3D3856F2F
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...6.....;. .U.p.d.a.t.e.:. .M.a.r... .2.0.,. .2.0.2.4.....;.....[.L.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-8GKPK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	163612
Entropy (8bit):	4.423974317636969
Encrypted:	false
SSDEEP:	3072:Cw4KeLw2LVMAgO3s4thTwsTbp5xr1Snvyqei7/DZyaZSAMsz2Te1vMDsO35W1MJe:J4KeLRMtO3s4thTwsTbxxi7/DZyaZSJq
MD5:	F1FDDDA8F5F8F6FC59692DCD9797A838
SHA1:	4861919B97E500900512B99CDDA3204B0607D3A6
SHA-256:	1DCBD5BC18720F3DC4175256AB26BC537402B9E84FEDEC60581B85C7FE946D81
SHA-512:	505532BEA964485BB23EB2FC93F5355C13CAB3E76EA9198E6692A16F1C3DB4242A892ABBE53961BEE9BA0A81B1BBA58ED2A5D5D6009DE28D8FE4573EE145D290
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.6.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.E.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.e.-.n.p.....D.e.f.a.u.l.t.F.o.n.t.=.M.a.n.g.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.,.>.........K.B.=...G...,.?.......M.B.=.......,.?.......G.B.=...?...,.?.......p.m.D.e.f.a.u.l.t.=.*.B.0.M.5.(.?.0.M.'.>.0.?.$.....I.n.f.o.r.m.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-9QT7S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197324
Entropy (8bit):	3.5956880012491856
Encrypted:	false
SSDEEP:	3072:3ZcT92pw8lEcjt3zsfyV+05KtXu3hjtQXtCOWDMFCQdyYvRf0OsARmriFhCu3:G2pwQjt3jYns2
MD5:	E3C886BF083FBD36C07B67D512C30BA3
SHA1:	5097F0430BA45B461B38112D5831455A0E0B51EE
SHA-256:	B5DD72550E83675F21716D064C985D5C49F970D6CEA7708F84F06BE9F8288D58
SHA-512:	3FA8D0081814E433CD14B28B780C1ADD5215E98B4FE236C1B7482679EFFD9CA7D29C329F0F170F1F32361EFFC99F293DD2AC2019ABE1293FEDA5EED9E5197555
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .J.a.d.r.a.n. .R.u.d.e.c.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .j.r.u.d.e.c.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .W.i.s.e. .C.a.r.e. .3.6.5. .P.r.o. .5._.6...3...7...6.1.5.....;. .U.p.d.a.t.e.:. .S.e.p.t... .2.9.,. .2.0.2.2.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.S.l.o.v.e.n.a...i.n.a.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-9RLN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	data
Category:	dropped
Size (bytes):	200078
Entropy (8bit):	3.725770713178982
Encrypted:	false
SSDEEP:	6144:V7/HZ1JXCu0qDfslyufq4X0700IBY5qxAu5xWuBwthLw2CsRYtPs8IrwLtzgjDnj:3XCuQsss
MD5:	6D637A166009BA4277AB756125378399
SHA1:	BB09F3B2F4887EC8838F90A9C158211C7399625F
SHA-256:	027547C123ADAE7887C3560433195BA795B27BB118532E8FC0316EA8A6123050
SHA-512:	E93867C4CEAEA4CDEC5B843F7ADD98495CF823794044CF0CCA6A263B31E010CB590AE4FE8FC8BD4247643178234E433ABBD7D125C17DFA11EFE8E9E992A3E804
Malicious:	false
Preview:	;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.F.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.T.R.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.t.r.-.t.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.y.t.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.V.a.r.s.a.y.1.l.a.n.....I.n.f.o.r.m.a.t.i.o.n.=.B.i.l.g.i.....W.a.r.n.i.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-A7D99.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	170564
Entropy (8bit):	3.5539102364923365
Encrypted:	false
SSDEEP:	3072:MTPn0O/Cq1ZkCOCN9THI6q8NWVGwtysR0gwlvSeVi34BJDMw7kMdpMD0OsKP05AR:+ZkC5I6q80s2
MD5:	DC82D14F05B1BC2DB6B88B405583EA66
SHA1:	AD5BF79024C14F0F2DF5F782A68FCB62E2C34FA9
SHA-256:	2DC8F11A8F5744AEE78C40F7FAEE8BA0057F4F2B807690A1C8D47CE7DC9A5632
SHA-512:	FB9A932198E19470C764BE7D7CEFB3762A1445024C11A79B3CE95A6C8469762D42122FC3AD3CC265A3B6F3B80130A8956A1064519B8E15F7C438DF17C51B8B20
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.1.4.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.o.r.w.e.g.i.a.n. .n.y.n.o.r.s.k.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.n.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.r.d.....I.n.f.o.r.m.a.t.i.o.n.=.I.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-ARED8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	210314
Entropy (8bit):	3.5450295007157346
Encrypted:	false
SSDEEP:	3072:O0VsOJbiY5lroo/duD1+moW4MyoF6JSHiZOtpLFWlGLGUmV1sykD1uUkfjdGy0tF:jbiY9uD1yxsyzx8
MD5:	84EEE762F1F5C5A43C7EDD13EE6B0712
SHA1:	6A837E2A0A50FE949DCC4EB700DAEA2E46DEC74B
SHA-256:	E9E9BD58CC343D15C840F2AE50D86A7E3CA6C2C69F07755FFA5C3F3E51EFE39A
SHA-512:	6D9E02E6ACD463298BD107CE3DD511E590CD6B7CC482BC03AA05BC1F154E262623052EDEEE880B0FE5C3B4B8CDEAADB20DBEAA052AA25D2A95CB3A60B67B7C81
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .L.u.i.s. .N.e.v.e.s.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .l.u.i.s...a...n.e.v.e.s.@.s.a.p.o...p.t.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .2.2./.1.2./.2.0.2.3.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.P.o.r.t.u.g.u...s.....C.h.a.n.g.e.L.a.n.g.=.P.o.r. .f.a.v.o.r.,. .r.e.i.n.i.c.i.e. .o. .p.r.o.g.r.a.m.a. .p.a.r.a. .a.p.l.i.c.a.r. .a.s. .a.l.t.e.r.a.....e.s...........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.S.i.m.....B.u.t.t.o.n.N.o.=.N...o.....B.u.t.t.o.n.O.K.=.O.K.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-B2U0C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	207010
Entropy (8bit):	3.672419240069379
Encrypted:	false
SSDEEP:	3072:fh5+ne2FA4p6xmYJTdUBtVR3/S7bnUTiVf23Xmllxz+UVod8vKt0FLSPWtsyeu5b:zmYJPllxhfvKexZsXm
MD5:	E17D24F672A27425B05EF4E2124E8AA6
SHA1:	0764C1E3E4A9703DBA335CFE8B8E4F8191012134
SHA-256:	DA032CB20C4A5CC984ED3777E52F3D289E85A7E43D67C8B9707202FEAF784F05
SHA-512:	5D60C9221BE1752BBD848DE32B1558FE0C87DD6DBE2C701B107BB1CEA3B3D1324A13C117C8A9ACB8CB871BFBC058ACA00F7FFFE93312A7DBF99E3F83507E8C50
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Z.i.t.y.i.'.s. .T.r.a.n.s.l.a.t.o.r. .T.e.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .z.i.t.y.i.s.o.f.t.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...1.....;. .U.p.d.a.t.e.:. .S.e.p... .1.1.,. .2.0.2.3.....;.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-B4B37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	data
Category:	dropped
Size (bytes):	128098
Entropy (8bit):	4.908815839690814
Encrypted:	false
SSDEEP:	3072:ozeddx2aq7q4N9T7yQoS/vaCrscX0MCn9Pqu6x9aduDdnOspxLsRWrDp:8eddx2g4N9/jsFni1sR49
MD5:	C97BB0747D1736EFBE825D70B856912A
SHA1:	A98AD2B85F79B0C192D2751FDCDC1F5F5B552430
SHA-256:	B9FE20321407DE13953150E79BBF20A1F94F5F62184BDB9F09ECF66C11A8C8C2
SHA-512:	CA5F310A0D987B012D62B875AE1C3357A1114B46FA223996BFE9451BC7F6B60208B4244AB7730319AF1862BE1928BA715E63879777BB477C3DD01C23EB1BBDAE
Malicious:	false
Preview:	;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.4.\|.0.C.0.4.\|.1.4.0.4.....R.e.a.d.H.a.b.i.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-CE734.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	195334
Entropy (8bit):	3.5656404948319897
Encrypted:	false
SSDEEP:	3072:q0HzeDLZ+nXVV26UWr4bbyraDeWd6U1gEsqfEQyi8bOGwjNnDFtgjMD3EyvsW6h5:neDLZQ26UEuiWdCRi8MJDFYs7H03
MD5:	68384CCD192503DB3B90A7EF754B0C86
SHA1:	45212337774A7B15E2DA9962F40739810C9C7897
SHA-256:	01B6897229D66816964460AF1C89A11862406B81A870F793992CE7A8F23968EA
SHA-512:	2771091E6EBFF577D3423DF4F737BDD20CF86F6333D28FE954E3919139F73449D0314D79E55E9E0E2849D8CF34790BFF8E56BE689B7EA855B8F260B5E845A964
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .I...K...L.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .q.c.4.8.@.p.m...m.e.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .N.o.v... .2.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.S.v.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-CJ9MH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	192248
Entropy (8bit):	3.549337495830829
Encrypted:	false
SSDEEP:	3072:MxuWqs9i5EN4iLOz4p9quxy5LmEByIqU1Go5WZW2iQLfs0t9F/XOuaW048CSmicg:fs9iR4p9M6/Esto
MD5:	F684E0491103575D2D18ACFFCF58044E
SHA1:	4E94B717ED5F068258DAF7193FC93CD0747D91C0
SHA-256:	045318C2477572F8353D5EF1FF6A69327A940AF4D85902CC2C8483C0F0D0605F
SHA-512:	9B8CEEC4159D40E8065742C595AA1D336DB416E1E690EE6274B4D5C1CB4B636088F246C718EA96A79A6D630775A564564757BB388FDA2169B95C44EEFD1CA203
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .A.d.r.i.a.n. .T.h.o.m.a.s.s.e.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.d.r.i.a.n...t.h.o.m.a.s.s.e.n.9.2.@.g.m.a.i.l...c.o.m.....;. .F.o.r. .v.e.r.s.i.o.n.:. .6...5...7...6.3.0.....;. .L.a.s.t. .u.p.d.a.t.e.:. .1.1...0.8...2.0.2.3.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.4.....R.e.a.d.H.a.b.i.t.=.R.i.g.h.t.-.t.o.-.l.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.N.O.B.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.o.-.n.b.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-DOEI9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	159016
Entropy (8bit):	4.2709616074248355
Encrypted:	false
SSDEEP:	3072:4nZu5eVg7BHoQSLEvy5AweuWKME/9JsS0csDgd:8Zu5eVnQSLMwtLsUd
MD5:	9BC326E267CD4FE166FE07FFD29EE4DA
SHA1:	E1747C4264A0EE73718575525AED075A5F890762
SHA-256:	F2E08FDCFFE13C1FB46E2BA510E56A504B8226E24476909AFBFE3414A73B7ADB
SHA-512:	F1BA6C5C2855AD36E0828583CD06E4AD51E98EE4FE1BA4FD0D05E1A6A7CB3974CC613C415DC8D517162EB78280B3CB277C42A99BDF11AC36E63ED5E6C1B4DB37
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.a.v.a.r.-.A.s.g.a.r.y.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .Y.a.v.a.r.a.s.g.a.r.y.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.9.....R.e.a.d.H.a.b.i.t.=.R.i.g.h.t.-.t.o.-.l.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.A.'.1.3.......L.a.n.g.S.h.o.r.t.N.a.m.e.=.I.R.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.R.A.B.I.C._.C.H.A.R.S.E.T.....B.y.t.e.s.=.(.'........K.B.=.....D.H.(.'........M.B.=.E...'.(.'........G.B.=.......'.(.'........p.m.D.e.f.a.u.l.t.=.'.H.D...G.....I.n.f.o.r.m.a.t.i.o.n.=.'.7.D.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-F73V7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	187056
Entropy (8bit):	4.042793844735925
Encrypted:	false
SSDEEP:	3072:4whJWT5yZwCNIsTDvxGAPhm4yeemkxXOln+32HLwjLsWfF60IsRnQQFkauiP4:JJWTkLIsTDRkOnXsGQW
MD5:	9909CB62969F4C239A80275D2004401E
SHA1:	6BFE7A104032DC4F634B1FE62DF3083E7A29998A
SHA-256:	439D463293A0538499E262234D8138EA14543AA6C0436C9E4735F67C1FE37A41
SHA-512:	DA514E212A709B005D1AE2F4BE431A7E5B329D78373E2EEA02F0C2FC2691BA771D58E2A05FB0628FC359E5EA39FC05D1F6673910889C883CD45C2F6145E43FE9
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.h.a.m. .M.i.n.h. .K.i.e.n.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .m.i.n.h.k.i.e.n.t.r.t.0.0.9.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...1...4.....;. .U.p.d.a.t.e.:. .D.e.c... .6.,. .2.0.2.1.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.a.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.V.I.E.....L.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-GDUNS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	194486
Entropy (8bit):	4.303496040935877
Encrypted:	false
SSDEEP:	3072:33+nqG1u3qBeOtub6AvN0XWyQMC0Ki4AuAM6suEJ3K8hNYgs271Vn6vwlpAFm0D4:GqG15ub64AiBmsgo
MD5:	D5DFE4F85A192BF151551AB58141831A
SHA1:	1DE8E24F0E8B7CBC95BC8812272FA298B3067FFD
SHA-256:	3AFE3F78EC6379FCF58067BCFAFFCB46687E49BFD35139356523025339179F61
SHA-512:	F7FD1BCCA40AABC27895F2AE165F8CD5A4E9BE8F0DDF012DE663AAD5059F2B05E19B11DC24562594276EE25F0A7AC739382094D4A516BEAE2AE11C66E56F8F93
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r. .:. .A.l.i. .A.l.n.a.j.a.f.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l. .:. .a.l.i.a.l.n.a.j.a.f.i.7.@.h.o.t.m.a.i.l...c.o.m.....;. .6...6...3...6.3.3. .:. .%.5./.'.1. .'.D.(.1.F.'.E.,.....;. .2.1.-.1.1.-.2.0.2.3. .:. ..'.1.J... .'.D..-./.J.+.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.'.D.9.1.(.J.).....C.h.a.n.g.e.L.a.n.g.=.D.*.A.9.J.D. .'.D.D.:.). .'.D.E...

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-HANV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	185874
Entropy (8bit):	4.3677708418770465
Encrypted:	false
SSDEEP:	3072:Hr9fPjxWyrhokwCS0TcyUrjWMoXGsG3dkeQE3TjMebX0+sgb:L9fPjxWhkwCS0TYvWEh9sa
MD5:	96016297354C26E4C37BC8CB353D43E0
SHA1:	37F84AB3CFDCF0C8E52B1B5C215CFBC55412D007
SHA-256:	96269630BB90765C4B7F350A0195F389849EFF8159F6B990AD71E2B11E9C3FAC
SHA-512:	FF391CB285E01FDC4E9ADC1DDE6A643304BCA06326C48C0B6F2EEB817A1BE8A5012707FBBC4B3D54FAD3250C6B46A6BEA75406547C5ECDA13AB3B72376FFE2FD
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .W.i.s.e. .C.a.r.e. .3.6.5.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .A.b.u.k.h.b.a. .A.n.d.r.e.i.,. .G.i.n.d.i.a. .S.e.g.e.i.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.a.b.u.c.h.b.a.@.m.a.i.l...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...1...2.....;. .U.p.d.a.t.e.:. .N.o.v... .2.2.,. .2.0.2.1.....;.............[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...%.A.C.0.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.8.....B.u.t.t.o.n.N.o.=...0.?.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...8.:...0.@.....B...C.?.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=...8...K.E.B...C.?.....B.u.t.t.o.n.C.l.o.s.e.=...0.@.:.B...C.?.....B.u.t.t.o.n.R.e.s.t.o.r.e.=...8...0.H.L.0.....K.@.3.K.;.0.B...C.?.....B.u.t.t.o.n.M.e.n.u.=...<.5.=.8.C.....B.u.t.t.o.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-HJAD5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	211944
Entropy (8bit):	3.63574497427422
Encrypted:	false
SSDEEP:	3072:WCVDaqQi34HFWFACdg9lAcoyZ9YBjT+y0nkRH0U7SoNWdgg65myxcnQ1nT9tJizB:LaqQi3Usg9lDPY7ys0Dn
MD5:	00CEEC40D9631C3BC5297D2BE4A5F184
SHA1:	70DBF3280C7920245837DE6C9ACB6EE4E5547945
SHA-256:	2F0BF590DB93A179A09CED1D1906BCE64EE4BFE2E3A1774180DA7D12A412E2DB
SHA-512:	9B9F7BE81CD9DCBDAAFBB11E823E2D026AA00D463DC58A312CDC2E3B3A585369DC5F1245C2912BC054E4B3A9C23D9E5CDA22DF130429218F2454905ED9F1847F
Malicious:	false
Preview:	..;.....;. .P.u...i.n.e. .r.e.g.u.l.i. .p.e.n.t.r.u. .t.r.a.d.u.c...t.o.r.:.....;. .P.e.n.t.r.u. ...n.c.e.p.u.t. .d.e. .t.r.a.d.u.c.e.r.e. .-. .c.o.p.i.a...i. .e.n.g.l.i.s.h...i.n.i. ...n. .l.i.m.b.a. .d.v.s...i.n.i.....;. .T.r.a.d.u.c.e...i. .t.e.x.t.u.l. .n.u.m.a.i. .d.u.p... .s.i.m.b.o.l.u.l. .'.=.'.....;. .....;. .P.r.o.d.u.c.t. .N.a.m.e.:. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .C.o.m.a.n. .G.e.l.u. .D...n.u.......;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .c.o.m.a.n...w.i.n.d.o.w.s.@.y.a.h.o.o...c.o.m.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.R.o.m...n... .(.R.o.m.a.n.i.a.n.).....C.h.a.n.g.e.L.a.n.g.=.P.e.n.t.r.u. .a. .a.v.e.a. .e.f.e.c.t. .m.o.d.i.f.i.c.a.r.e.a.,. .r.e.p.o.r.n.i...i. .s.o.f.t.u.l.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.D.a.....B.u.t.t.o.n.N.o.=.N.u.....B.u.t.t.o.n.O.K.=.B.i.n.e.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.e.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.i.z.a.r.e.....B.u.t.t.o.n.C.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-IIOAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	179898
Entropy (8bit):	3.8917323449598125
Encrypted:	false
SSDEEP:	3072:55rPAGyMQyhTXK/Hy6xnyvCwW9VuEh48sgv3k21xedK0UsuhCvRIB:bAGyCXK/hy6puMZsQ
MD5:	FEACB1FC644F947E69B9286DB1F486C3
SHA1:	BF5C00BE0753B5B94C9C5D93000F5D2D1C1CACD6
SHA-256:	5982AE68CDE547DBDE027B9FAE189758877709BC42A5F266F580DFE0BBC4C236
SHA-512:	FDB9CC4A64A018ECE27E0C7AE894B42AE1B1FE7C1694EE253EB0520B8C65A5B28FCE202278D07899DF32B5B2C5298C354051D19A1F8C4E562CAB93F52FE94A8A
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.....;. . .....;.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r.:. .Q...d.r.Y.t. .Q.a.s.1.m.o.v.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r. .E.m.a.i.l.:. .q.a.s.i.m.o.v.@.y.a.h.o.o...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...8...4...5.7.8.....;. .U.p.d.a.t.e.:. .3.1. .A.v.q.u.s.t. .2.0.2.1.....;.........[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.A.z.Y.r.b.a.y.c.a.n.c.a.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.B.Y.l.i.....B.u.t.t.o.n.N.o.=.X.e.y.r.....B.u.t.t.o.n.O.K.=.O.L.D.U.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.K.i...i.l.t.m.Y.k.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.B...y...t.m.Y.k.....B.u.t.t.o.n.C.l.o.s.e.=.B.a...l.a.m.a.q.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.Y.1...c.a.m.....

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-IMHBK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	159800
Entropy (8bit):	3.7306594670562867
Encrypted:	false
SSDEEP:	3072:gPczb+j4BE1JjCfMRqyF5hL6nbqawLS1vM0VKNtM/5aW2nwc9+OWU2vS/uf0WKFf:bzb+7jCfMQnbqawPsYT
MD5:	FCAEF23E20DA0067A90796853F511E40
SHA1:	D8BDF749E6A136801A8C1F89DF26F1D9A700AC83
SHA-256:	6FD2A57D180F80F1396772D30A74252ED716DEB4E960A1CE03E56FCC8234989A
SHA-512:	6240DC01FD7F0584DD544F3BD6732FCE6F5DA700628DD519A376DBFD646A8F12433DF84811EE78C1C4D67185E2CB8B0CE983CAB8858A0BA5E5E612EA160BF507
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .D.a.m.n.e.d.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .b.a.r.t.o.s.f.r.@.s.e.z.n.a.m...c.z.....;. . .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.:././.d.a.m.n.e.d.o.v.y.c.e.s.t.i.n.y...w.e.b.n.o.d.e...c.z./.....;. . .S.o.f.t. .V.e.r.s.i.o.n.:. .4...7.4...4.5.7.....;. . .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .3.1.,. .2.0.1.7.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...e.s.k.y.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.A.n.o.....B.u.t.t.o.n.N.o.=.N.e.....B.u.t.t.o.n.O.K.=.O.k.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.a.l.i.z.o.v.a.t.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.a.l.i.z.o.v.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-JIIE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	197432
Entropy (8bit):	3.7124016259671415
Encrypted:	false
SSDEEP:	3072:w/AKXzLaI4zYoPuKfuOXyZ7F8zDdpMUmDLaeUz/sJYV1mgAL4fAOgyxGQA6YHna/:VKXzLasKfupWAOfs8aCF
MD5:	D522B5844611D8193EF248F6224611A4
SHA1:	F6C3B22450CD27E90549E8260E1BF08BB6F91FE1
SHA-256:	14BEEB5E32DBCEA8842A3A818F4C8157180C6FD96BAEE8CBA20E33ED8F5EC51C
SHA-512:	DCCB6BD3C34C557962C74702C3A06BE808B04BD81AB76EBD682DCBC85C1A00709774A56052814AE710044193609CDECF63BE771D2A84846CA0ED11E2A59387F6
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .E.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g...,. .G.e.r.m.a.n...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .F.r.a.n.t.i.a.e.k. .F.i.c.o.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .f.e.r.o.f.i.c.o.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .W.i.s.e. .C.a.r.e. .3.6.5. .P.R.O. .6...6.3...6.3.3.....;. .U.p.d.a.t.e.:. .N.o.v.e.m.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-JUK4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	165424
Entropy (8bit):	4.372679012082705
Encrypted:	false
SSDEEP:	3072:cGX4Hsp8R5DDCtACte4QyYwglz2bcUsGA/QtZfotG07s4Zp+n8K:yHsp8rvCte4Pg9sdn8K
MD5:	056A7E88D49779DE4809F26F8867EC9D
SHA1:	6E1BD6349599B21D0A16E9B8DB6D2ABB37AF8539
SHA-256:	4087F0AADF7F189F04572B7702A629188806E54D3F244F917E7AD21FE4CD5D7E
SHA-512:	A1503BA91F94B2DF3B5D7993E8FB47AB73BE37FB4EE7DAD9580E2A9AFA0EF4D76C2309B9C5A7429F72FB2AB08EDD5AF54B331A4E6CCDF0C07D57A25EE70E5A54
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .Y.a.r.o.n.'.S. .T.e.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.D.....R.e.a.d.H.a.b.i.t.=.r.i.g.h.t.-.t.o.-.L.e.f.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.H.E.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.h.e.-.i.l.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=...............K.B.=...'.......M.B.=...'.......G.B.=...'.......p.m.D.e.f.a.u.l.t.=........... .............I.n.f.o.r.m.a.t.i.o.n.=.............W.a.r.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-LH3KH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	168826
Entropy (8bit):	3.493486899256745
Encrypted:	false
SSDEEP:	3072:Vk6OZePquSZPQUrJZ058+DAopAGACBPcPQhsIofwXf35ye3F5reF6uozrTZrBm2k:+lPQUmjACBthY123sf
MD5:	91AA6F0E76B13CDDEC7B7E9F30F009CB
SHA1:	DF2D8925B2E707CBC605FB5A48663758D0038BFA
SHA-256:	34D910C75FFE79A352DCE6ED0140DCF395A8F052DBB433A42838B7850C9E8513
SHA-512:	DCE3324B1541350114DB7583E168041E167A46B6134FD0E7D55AEC24BDFC2011A0E1F03EB45B0751B8C87047F4448F811A64CECED398EADCBBD7B2268AF6DA3C
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .E.d.d.y. .V.e.r.f.a.i.l.l.i.e.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.d.d.y._.v.e.r.f.a.i.l.l.i.e.@.t.e.l.e.n.e.t...b.e.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.8.1.3.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.D.u.t.c.h.(.B.e.l.g.i.u.m.).....L.a.n.g.S.h.o.r.t.N.a.m.e.=.n.l.-.b.e.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.a.r.d.o.p.t.i.m.a.l.i.s.a.t.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-LVL12.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	195136
Entropy (8bit):	3.537734536477552
Encrypted:	false
SSDEEP:	3072:5f6qfvSzwi8xQUvkh9MP6IqWbwqCntD8ug5yWkgMgdVGW396H/3J3tC2uwYnhEJT:DxQUeqCntDADWKsZKm
MD5:	846B5698B0A34E399D7D41F9E5CD11E5
SHA1:	998269D8D0D5DA58611B193E803F603DC4F702E0
SHA-256:	DF0FC37735B0AAD791496F9047D7840E2680507E7F744462B3BB04D9740B02E3
SHA-512:	DFE102E5764BBDD7179EED364CEE8A611470475A97A48EE4AF65254A3B4CF1F7FAFA6FF8698CC0089E5756EC480B757C0B272792300F658B10468FA79F02EE82
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.i.n.g.:.....;. . .B.e.f.o.r.e. .t.h.e. .b.e.g.i.n.n.i.n.g. .o.f. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .-. .p.l.e.a.s.e. .m.a.k.e. .a. .c.o.p.y. .o.f. .t.h.e. .f.i.l.e. .e.n.g.l.i.s.h...i.n.i. .a.n.d. .r.e.n.a.m.e. .i.t. .t.o. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.,. .e...g... .D.u.t.c.h...i.n.i.;.....;. . .P.l.e.a.s.e.,. .o.n.l.y. .t.r.a.n.s.l.a.t.e. .t.h.e. .t.e.x.t. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.m. .M.e.i.j.d.a.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.......;. .U.p.d.a.t.e.:. .2.1. .N.o.v. .2.0.2.3.....;.....[.L.a.n.g.].....N.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-NQ1BG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	179326
Entropy (8bit):	3.562217111481494
Encrypted:	false
SSDEEP:	3072:rRVV9btYsFwoQud1jkyeZNcMU/Di+s7MbFOmc0bsNK:HbtYTud162sk
MD5:	10403ABF5F76D57CBC42B7CDA162CCF3
SHA1:	3E649F426AB22767E69F595343EDFB3711643325
SHA-256:	AC58818FE66B6F40BC2267419C6A0AE17D773C69462EF5AE926CB6BC350BF59F
SHA-512:	C50A30AA7CC203EB18D04923ED9AD4DBF342E4C42CDFB58D4152FF6D3013C20FABA95203248D08AE5153885CFBA55B8CA3F6548460DAEE4D35CE4E088D0C5B68
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H...l.i.o. .d.e. .S.o.u.z.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .h.d.s.t.e.c.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .5...4...2...5.3.8.....;. .U.p.d.a.t.e.:. .O.c.t.o.b.e.r. .1.3.,. .2.0.1.9.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.6.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.B.R.A.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.p.t.-.b.r.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B...

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-O8BB2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	143950
Entropy (8bit):	3.5196159945482064
Encrypted:	false
SSDEEP:	3072:P5LjdNmDSEadcfynOJ7z19l9S5vsLvkG1CZyRWZ:9jdNigoC
MD5:	987278E1926115FB34817FD94857A4CC
SHA1:	D32CAEA78D9B14E5DD6E1C9B932E8E68E8A1AC6B
SHA-256:	58B2A68F2E382EB5A7D36427DBF0CB43BDE5CF63745210118D8D7019CE9D6975
SHA-512:	797CB2C2D478F43D8CDE97A9BEE87E426F7D9ECC33155E3722A4DA3E57CD4BF93A871478343F56725FE09C9E04AF1F1BE5611A132FF03ADB49E48BE7BEAD3A1F
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.e.t.e.r. .R.o.t.h.e. .L.u.n.d.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .p.e.t.e.r.@.r.o.t.h.e.l.u.n.d...d.k.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.0.6.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.D.A.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.d.a.-.d.k.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.y.t.e.s.....K.B.=.K.b.....M.B.=.M.b.....G.B.=.G.b.....p.m.D.e.f.a.u.l.t.=.S.t.a.n.d.a.r.d.....I.n.f.o.r.m.a.t.i.o.n.=.I.n.f.o.r.m.a.t.i.o.n.....W.a.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-OB6TO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	173762
Entropy (8bit):	4.3968233682053794
Encrypted:	false
SSDEEP:	3072:U6H2hBoIXRwmO4nO87zC4J9pdyJduteXoI98tiodSHDN2LgAB0ksHt7a8o+:Ua2hBoIXRZVO87zC4JlHRtLsN79n
MD5:	AEAD043775DE8D9264BD0C9D0F760A49
SHA1:	633BDAD33D805E447059A713B1FC27589B5513C9
SHA-256:	864E149B47991BB9844D058FB036A4F9FD874A69CA2752816C75F5970E36B3B9
SHA-512:	3B1A3DFC9BA485F69779637954AF5613B51145ACF529C10E376965C2285C023B694C0B18C237D017AED38FC508D8B53523E1BB2889DC0B7F53D4F6EE6BBA7E77
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ............. .......................;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .g.i.d.i.a.s.a.@.g.m.a.i.l...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.3.7.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.G.E.O.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.g.e.-.k.a.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.U.T.F.-.8.....B.y.t.e.s.=...............K.B.=.........M.B.=.........G.B.=.........p.m.D.e.f.a.u.l.t.=.............................I.n.f.o.r.m.a.t.i.o.n.=.........................W.a.r.n.i.n.g.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-OBGII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	170184
Entropy (8bit):	4.315936575189069
Encrypted:	false
SSDEEP:	3072:gxnchUjUksq7EsaBGSysRhWMgWhR2S2syhOD:7UjU4aBGcmsh
MD5:	E4DC1B86B3661FEA7258D100B8ADE7CE
SHA1:	E14C695C7898B9DFC3AF1D8652F1B2B9ECBE7745
SHA-256:	46E76156B175D81666EB7F2E62C018DC11C9992FC3E956AEEF3BEA2F11CABDAE
SHA-512:	5D51A47E8F3BA0F8369798FF217477D495CF4334A796128C9AC8BF068181FADFD550D2D34340D40488DDC53B1B4EE8336A6819905F51C17F22799D0A52C37E00
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. ...2.0.=. ...0.@.0.4.6.>.2.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .e.k.o.t.@.a.b.v...b.g.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.W.e.b.:. .h.t.t.p.:././.k.a.r.a.d.z.h.a...w.e.e.b.l.y...c.o.m./.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .4...9.1...4.7.2.....;. .U.p.d.a.t.e.:. .J.u.l.y. .1.7.,. .2.0.1.8.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=...J.;.3.0.@.A.:.8.....[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.....B.u.t.t.o.n.N.o.=...5.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=...0.<.0.;.8.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.#.2.5.;.8.G.8.....B.u.t.t.o.n.C.l.o.s.e.=...0.B.2.>.@.8.....B.u.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-P55SE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	215824
Entropy (8bit):	3.5648803009987104
Encrypted:	false
SSDEEP:	3072:P/jJ6tHxEgOjLGRsHntgdn2OzrB7L1+dsUXM04FmLn2zOHw8vwY3pT0mEXrtQEti:aOHwDV9Fj8Irs/z
MD5:	4258ED10BA7D8CED0FC93F044649FF5F
SHA1:	1CFCB8BE1AA11FF6C45A58DAE352B3659C63A12F
SHA-256:	1382EE7F4C70761E25AE0700AC8894C6FEB2A5BCCA63D1D893A04C78A0432DCE
SHA-512:	4697551A55E1564F35DCFF43816FE3332C9A15C96D1185DB352C8E1C9C73288F095E96D700C5D986199A16BEE43A920BE499A273942FEEC8E30B4692D347F3AD
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .H.a.r.t.m.u.t. .H.o.y.e.r. .(.4...1.5.).,. .M.o.n.i.k.a.,. .A.n.d.y. .K.l.e.i.n.e.r.t.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .H.u.C.-.H.o.y.e.r.@.o.n.l.i.n.e...d.e.;.a.n.d.y...k.l.e.i.n.e.r.t.@.g.m.a.i.l...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...3.....;. .U.p.d.a.t.e.:. .N.o.v... .2.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.D.e.u.t.s.c.h.....C.h.a.n.g.e.L.a.n.g.=.D.i.e. ...n.d.e.r.u.n.g. .w.i.r.d. .e.r.s.t. .n.a.c.h. .e.i.n.e.m. .N.e.u.s.t.a.r.t. .d.e.r. .S.o.f.t.w.a.r.e. .w.i.r.k.s.a.m.......[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.J.a.....B.u.t.t.o.n.N.o.=.N.e.i.n.....

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-QV9NK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	188652
Entropy (8bit):	3.713329333825878
Encrypted:	false
SSDEEP:	3072:gf5q/NFoLzrupyOD2y1/rGIr0lJ+KQGhTZ0usRGz:uq/N+rupqrrsRa
MD5:	C152777BA323C1778D8EE52B964B437A
SHA1:	F1EE3B54A35767526FE53FE7FF95FE65B0011336
SHA-256:	0EB1B9C20677C401847E4864015E7E5689815022AD7D97FE83D52FEAFCFFE113
SHA-512:	FD7509913C007150B5A4546C16C473FC1D9E6237E9D593BC8CF332CB4334F6C809D18659D7AC201975F5D26E4DA386BBB241205EECBAD7393DAF7261F2890C56
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .F.r.e.s.t.a.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .a.k.s.a.f.r.e.s.t.@.w.p...p.l.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...2...2.....;. .U.p.d.a.t.e.:. .A.p.r.i.l. .1.3.,. .2.0.2.2.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.5.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.P.L.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.p.l.-.P.L.....D.e.f.a.u.l.t.F.o.n.t.=.T.a.h.o.m.a.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.A.N.S.I._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.j.t...w.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-SURPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	202350
Entropy (8bit):	3.515284888303497
Encrypted:	false
SSDEEP:	3072:bwU+v6MQRsIoU1nAKsOygddSgviGkeAwPPfV2tx9Yf9pfuJkwPlslaK09VVV:Gv6Mm9nAKsoNMXslk
MD5:	06EF94E939646BE84660D556457AA83F
SHA1:	C584BDF5281662F8E265939188CFF756D8B68D36
SHA-256:	41B8CADC0A8A2FE20B3D9316A0C49E0DF0E755133B9C4658A2674061F9E15F7F
SHA-512:	EBBC99914AA1724B611A7A53B9680FD7B0235A79411D48FD55D58D405B6E272AB0A9174B6312E4392909BC59903872F8CABC270C2FC81FD3FBC9B45129AAB25E
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'.=.'.....;.....;. .....;. .W.i.s.e. .C.a.r.e. .3.6.5.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .C.a.n.n.i.e.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...1.....;. .U.p.d.a.t.e.:. .S.e.p.t... .1.1.,. .2.0.2.3.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.E.s.p.a...o.l.........[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=.S.i.....B.u.t.t.o.n.N.o.=.N.o.....B.u.t.t.o.n.O.K.=.O.K.....B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.M.i.n.i.m.i.z.a.r.....B.u.t.t.o.n.M.a.x.i.m.i.z.e.=.M.a.x.i.m.i.z.a.r.....B.u.t.t.o.n.C.l.o.s.e.=.C.e.r.r.a.r.....B.u.t.t.o.n.R.e.s.t.o.r.e.=.R.e.s.t.a.u.r.a.r.....B.u.t.t.o.n.M.e.n.u.=.M.e.n.......B.u.t.t.o.n.S.k.i.n.=.T.e.m.a.....a.p.p.l.y.=.A.p.l.i.c.a.r.....N.o.t.h.a.n.k.s.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-TGO78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	143696
Entropy (8bit):	4.80982954334959
Encrypted:	false
SSDEEP:	3072:sy9Yk23lVo5wIZX67pyywu40D9caW0vNL4VMbrDi6mBVcvGGSsCJj4:R6k23UZX6bZTisT
MD5:	CF86E45A33896D9772A500BE49995F54
SHA1:	E557E101BBAF05E20A6D48C2EB23D1E1ACCC2442
SHA-256:	0893AF7BA38C94D03AC2674125354D5E8E9FC0E63CB5ADC5D73DCEE41DD0E22F
SHA-512:	E5F8562CAFBFD81E36DA1C21A40E552433A7BA6F9FC47BC501C9115188A552CAE6C04F95404AA8927C18631F6CD66A564EC5D21D54D1644E02B06D97929BCFEB
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .W.i.s.e.C.l.e.a.n.e.r...c.o.m.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.1.1.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.J.P.N.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.j.a.-.j.p.....D.e.f.a.u.l.t.F.o.n.t.=.M.S. .U.I. .G.o.t.h.i.c.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.9.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.S.H.I.F.T.J.I.S._.C.H.A.R.S.E.T.....B.y.t.e.s.=..0.0.0....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=..e.[$P....I.n.f.o.r.m.a.t.i.o.n.=..`1X....W.a.r.n.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-UINQF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	209536
Entropy (8bit):	3.554510610854616
Encrypted:	false
SSDEEP:	3072:D6o54cRuVsWa2P9JDb4GTSQey/VRuE7KE0cet6G03+I0HdIkQW+PuFds08sCLmVo:VRuVz4GTNJkSmcsCr
MD5:	7D7D1D78E0A0E11E8B2C72DF0C033753
SHA1:	8E86E1BAF9522587E61947118C8D4C0F7E024C42
SHA-256:	3B5115FAB32C55FF869E29827A5E295FE392692E417D5E8B3B0B729FE7473550
SHA-512:	DE41D265535C77F7A5716FE7040A7909D5DCDD8A5B237089B8A322A780D66E023EE24410DFFA4EDFCF2FDCF7286B05CCD57654750D9160A16F96D4D89B757819
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.y.m.b.o.l. .'. .=. .'.;.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .P.i.e.r.r.e. .l.e. .L.i.d.g.e.u.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .s.u.p.p.o.r.t.@.w.i.s.e.c.l.e.a.n.e.r...c.o.m.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...6...6...6.3.6.....;. .U.p.d.a.t.e.:. .M.a.r... .2.0.,. .2.0.2.4.....;.....[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=.F.r.a.n...a.i.s.....C.h.a.n.g.e.L.a.n.g.=. .P.o.u.r. .e.f.f.e.c.t.u.e.r. .l.e. .c.h.a.n.g.e.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-UU410.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	186112
Entropy (8bit):	4.368809252964312
Encrypted:	false
SSDEEP:	3072:Hk8t+ZTzzd0rAUiIyemAGF0K/ihBF5dHumD+BC0KsFlG:Pt+ZsAUife0YsG
MD5:	4D1DAC632B021C60096E9861C150287E
SHA1:	D56A98798C11350B90BBC96E73A244031DD8D8FA
SHA-256:	14C5B587122C9EF2A21E8C6B002DC1F12395DAA8B91AF13085DABD1373DF1323
SHA-512:	F36673C6F57427900C68EF37D36B3D446FFC1738E3DA2B2A47611A68CBC1A5F2E1E0B8D449C767433D2EC632DDDE3E710D92E90C7E7EC27F66FDD5F65AADD987
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r. .l.a.n.g.u.a.g.e...i.n.i.;.....;. . .W.i.s.e. .C.a.r.e. .3.6.5.....;. . .P.l.e.a.s.e.,. .D.O. .N.O.T. .t.r.a.n.s.l.a.t.e. .'.R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.'. .b.u.t. .y.o.u. .c.a.n. .u.p.d.a.t.e. .i.t. .i.f. .y.o.u.r. .n.a.t.i.v.e. .l.a.n.g.u.a.g.e. .i.s. .'.R.i.g.h.t.-.t.o.-.l.e.f.t.'.......;.....;. .T.r.a.n.s.l.a.t.i.o.n. .A.u.t.h.o.r.:. .K.r.a.v.t.s.o.v. .A.l.e.k.s.a.n.d.r.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .l.o.c.a.l.i.z.@.r.a.m.b.l.e.r...r.u.....;. .S.o.f.t. .V.e.r.s.i.o.n.:. .6...3...2.....;. .U.p.d.a.t.e.:. .J.u.n.e. .2.0.,. .2.0.2.2.....;.............[.L.a.n.g.].....N.a.t.i.v.e.L.a.n.g.u.a.g.e.=. .C.A.A.:.8.9.............[.G.U.I.].....B.u.t.t.o.n.Y.e.s.=...0.....B.u.t.t.o.n.N.o.=...5.B.....B.u.t.t.o.n.O.K.=.........B.u.t.t.o.n.M.i.n.i.m.i.z.e.=.!.2.5.@.

C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-V59MG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	183988
Entropy (8bit):	3.636848046213731
Encrypted:	false
SSDEEP:	3072:4w0EgqA5jyzNzVoaHu3RM3KQSFZyeVHQtJG8097brPEexAhgYXkJIWEe7mZqV0IQ:YjyzVKQSFrPsB
MD5:	D4DEACAAACE10E243F3C689B2C75190E
SHA1:	65A8E8D0A81F8916CB269F801ED2966C3BE709EE
SHA-256:	29463E1FE8E16310DB1F35BF8AAAD23C11C27C92D8B30AB6ABA335E792C7EFBD
SHA-512:	AA018A4A8F4D58EE8FFDBB6FB0570E3FF1D7391AC85AF6D4F1427F6C50401D6A8F924A8CA2F0E38585B5CFFF65899FA821164120EC005EDBFB6CAC2CD458081C
Malicious:	false
Preview:	..;.....;. . .F.e.w. .r.u.l.e.s. .f.o.r. .t.r.a.n.s.l.a.t.o.r.:.....;. . .F.o.r. .b.e.g.i.n.n.i.n.g. .o.f. .t.r.a.n.s.l.a.t.e. .-. .c.o.p.y. .e.n.g.l.i.s.h...i.n.i. .i.n.t.o. .t.h.e. .y.o.u.r.l.a.n.g.u.a.g.e...i.n.i.....;. . .P.l.e.a.s.e.,. .t.r.a.n.s.l.a.t.e. .t.e.x.t. .o.n.l.y. .a.f.t.e.r. .s.i.m.b.o.l. .'. .=. .'.....;.....;.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.:. .R.i.m.g.a.u.d.a.s. .V.y.a.n.i.a.u.s.k.a.s.....;. .T.r.a.n.s.l.a.t.i.o.n.A.u.t.h.o.r.E.m.a.i.l.:. .k.r.e.m.k.u.s.@.i.n.b.o.x...l.t.....;.........[.T.r.a.n.s.l.a.t.i.o.n.].....L.a.n.g.C.o.d.e.=.0.4.2.7.....R.e.a.d.H.a.b.i.t.=.L.e.f.t.-.t.o.-.r.i.g.h.t.....L.a.n.g.u.a.g.e.N.a.m.e.=.8.....L.a.n.g.S.h.o.r.t.N.a.m.e.=.B.A.L.T.I.C._.C.H.A.R.S.E.T.....D.e.f.a.u.l.t.F.o.n.t.=.A.r.i.a.l.....D.e.f.a.u.l.t.F.o.n.t.S.i.z.e.=.8.....D.e.f.a.u.l.t.C.h.a.r.s.e.t.=.B.A.L.T.I.C._.C.H.A.R.S.E.T.....B.y.t.e.s.=.B.a.i.t.a.i.....K.B.=.K.B.....M.B.=.M.B.....G.B.=.G.B.....p.m.D.e.f.a.u.l.t.=.P.a.g.a.l. .n.u.t.y.l...j.i.m.......I.n.f.o.r.m.a.

C:\Program Files (x86)\Wise\Wise Care 365\License.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	ASCII text, with very long lines (870), with CRLF line terminators
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	4.9997611182520005
Encrypted:	false
SSDEEP:	96:mE1rDYW2e5gb+/mGQez/m82F21zZDo9qTXx33YK7woCwKnXKm/IAc6orxinI:R9Zf5g24o1zZ092NU1nXHQhL2I
MD5:	4A0F1A666912E64F1BA811FC24D7135F
SHA1:	DCBADD9698E306F0CD6E80737FC44F53336CF36C
SHA-256:	D6B418C619BA7456B594DFF10C3FACE4AC28609A64F2BF5E635292D7FF4F57E5
SHA-512:	36EBA1CC1C0AC8D5FEE7E88FD90B01EE800945EBED45EF92ADF64E4AA356A2AFE9ACC6B07CAE478CC467CA62B4A7895CECC3AF9BBDF93C2A9C2271253ED00342
Malicious:	false
Preview:	END-USER LICENSE AGREEMENT FOR WiseCleaner Products..=========================================================================..IMPORTANT PLEASE READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE CONTINUING WITH THIS PROGRAM INSTALL: ....WISECLEANER.COM End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and WISECLEANER.COM. for the WISECLEANER.COM software product(s) identified above which may include associated software components, media, printed materials, and "online" or electronic documentation. By installing, copying, or otherwise using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. This license agreement represents the entire agreement concerning the program between you and WISECLEANER.COM, (referred to as "licenser"), and it supersedes any prior proposal, representation, or understanding between the parties. If you do not agree to the terms of this EULA, do not install or us

C:\Program Files (x86)\Wise\Wise Care 365\Rate.info (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1108722
Entropy (8bit):	4.165873403563338
Encrypted:	false
SSDEEP:	24576:BnxJ22jqHYaRWb7hffD+mw2c1+LZsolYkdowdlnH:D
MD5:	1761BE75F77A56AAE7C206432523C87B
SHA1:	B373518A60A2F8373FDD78CC2EA365F5CCB97A04
SHA-256:	AC79928C5802F4D65EF1E4A3079D09E86A30B90F67DE4D0F205DDB6DBF3A42D6
SHA-512:	3B7E8444489354E1A98D18B94133E27FEB2F567AC2B6F9E3D19DA90B5224AE8C982018354AF832F80AC8DE5CE21444BE50CDCA44B53D73D8C6875D097C92EA9E
Malicious:	false
Preview:	[softinfo].e62aba971f3a96a3bfc458f7c976538d=4.3.7b30081e8c8a96de130bc0f28d0dd377=4.3.cc242e2a787df48fa6b0d4759b198247=4.7.e35a6d56f5933c0f3905be43f540d700=4.7.18cc6d39014e39ac60806d71c9e052aa=4.7.fabc24aafe772aef3e98ad185d168ad5=4.6.ed9ab2660d6531acb71d7b154a20ce5f=3.5a1df7c99792e94757ae02f0b999a97d=4.8.a07c7d7bd8bce92a901ec3fe6bad7741=4.7.01fadbf1d1dca9b1a4681a417198b098=4.7.3b90f49891049c3be9c1cb6ac6dff45e=4.3.264f24b21119fc66061f1e0b904c8a4b=3.8.69d51bb3a904da00d322462232f50ae0=3.3.ddb0e9cc2d2c9575ad95a5bbca52e1ae=4.3.2f27245f1f93d30c67f3635c89413445=4.7.9601f5d62a68876f8e635ef5f23aa61f=3.9.76ab5bb19eef12f936152f9bcbf0faaa=3.6.7526ddeadff0fc805ee64626e4765d14=4.7.e065445a3b3ae0ec9d2a850fe08b866f=4.6.eb0f529034a6b15b503034f55a5ab8ed=2.4.d389c1d3714a569b35e1d170fad735b2=4.4.d41d8cd98f00b204e9800998ecf8427e=4.7.76868ae832f6c6bd26cadc7d7c269986=4.4.214b80ae10dbe21f2a2747277bf8564e=4.7.37a25c74b081993d1a122d4f0ebeb963=4.4.570bfb8bbc141986d034a1841f9346d2=3.9.5b84104a0f2974228e031c953d335

C:\Program Files (x86)\Wise\Wise Care 365\Themes_v6.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	4.854821110610751
Encrypted:	false
SSDEEP:	192:OK/Lqhx9COywG4jGsPwq0owIwOs0Y1VtQVRuVEMcKaY5kIwfcD4cjmj6xsQAV8tF:OK/Lqhx9COywG4jGYwq0owIwOs0Y1Vtb
MD5:	95D94AB71FF2D1D22401AD824FF67B0C
SHA1:	C26C2061C256E9FFBE413CEA4F41153422DC9DEB
SHA-256:	42F9DE7641098FF03B904D2981209BC085064560EFD03BE68A08F3D552EA2B63
SHA-512:	D8DC7CF66183C84482116C0DF60C330C0BF6090C1C4D45A7AD1E77D1FD7CBDCDE803E5B3186D916F06D6A1F032878D811F2E54547BF4327B79D52AE526AB9D13
Malicious:	false
Preview:	{"skins":[.....{"skinname":"Christmas-2021","skinurl":"http://www.wisecleaner.com/theme/v6/Christmas-2021.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Christmas-2021.png","vip":false},.....{"skinname":"Air","skinurl":"http://www.wisecleaner.com/theme/v6/Air.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Air.png","vip":false},.....{"skinname":"Blue-abstract","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-abstract.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Blue-abstract.png","vip":true},.....{"skinname":"Blue-light","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-light.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Blue-light.png","vip":false},.....{"skinname":"Bridge","skinurl":"http://www.wisecleaner.com/theme/v6/Bridge.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Bridge.png","vip":true},.....{"skinname":"Blue-texture","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-texture.wskn","previewurl":"http://www.wisecleaner.com/

C:\Program Files (x86)\Wise\Wise Care 365\WJSLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170416
Entropy (8bit):	6.617746620907792
Encrypted:	false
SSDEEP:	3072:Q6aBKvKQg+RXSqxk6hOh87P6v/QgtZhbxAbN4KgbGC5lhjzWanS7htfUrkOVIB:Q98CQg+RXSqxk6hW87CvRRYN4KPC5WaQ
MD5:	47A72FF4AA7DF3BB5B29ADA4B6A5EAED
SHA1:	134F00B03C38F9AC2E2549B39B31F62A1C871B9D
SHA-256:	18B7F367D8EC6BDAA6618744051E5FF25BA317D2731C2706DC7B5DFDE296E37F
SHA-512:	6A5036A9205D6EC1B493CDACAD78FBD86E4B7F1319776EA64867C1208DAF2C0F103B20C1F0FDC511AB7B999393AA87B66ACE8D529E95A95A5958117FC2D18054
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..n2fn=2fn=2fn=...=8fn=...=.fn=...=+fn=..=4fn=.8m<$fn=.8k<.fn=.8j< fn=;..=?fn=2fo=.fn=.8g<'fn=.8n<3fn=.8.=3fn=2f.=3fn=.8l<3fn=Rich2fn=................PE..L...OE.\...........!................/................................................r....@..........................9..0...@F..P....................v...#..........0...8...........................h...@............................................text.............................. ..`.rdata..z...........................@..@.data...D....P.......D..............@....gfids.......p.......R..............@..@.tls.................T..............@....rsrc................V..............@..@.reloc...............\..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\WiseBootBooster.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8659376
Entropy (8bit):	6.623622938298373
Encrypted:	false
SSDEEP:	98304:1jNjSYr3BGhxgboHTIbnqG2y/MqdM3zyfkCracXHHV+QIIeWRrCa:ftmAjDOjgBHXVLkWb
MD5:	8AA997E56D11675D3D49DFCE26DB57AE
SHA1:	A17F6BA830F7BB16745EA2D45363B3D5629963E7
SHA-256:	18561CFAAA52C6EF2C94C1BB1639A36074C007657E14D9CB3E6B7A10772F3A95
SHA-512:	EAFA6054B028D307D974FEDEFC0E9C549365C2A1937A41A95D3D3A62C1A490F3DC7485F9E5A3C95C1BCE4E1963543CFCC19FC61C2611787946561E339F25C7D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...0..d................."u..........;u......@u...@.............................................@....................z......Pz.>A.......<...............#....z..............................z......................[z.......z.z....................text...L.t.......t................. ..`.itext...;....u..<....t............. ..`.data...X....@u......&u.............@....bss....0\|....v..........................idata..>A...Pz..B....v.............@....didata.z.....z.......v.............@....edata........z.......w.............@..@.tls....P.....z..........................rdata..].....z.......w.............@..@.reloc.......z.......w.............@..B.rsrc....<.......<.................@..@....................................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18762136
Entropy (8bit):	7.024245223668832
Encrypted:	false
SSDEEP:	196608:w/oJ7Fuozdzah0AvrByJgAUPMiEFC/SA8x5Q1BNZsjEwN1v:w/aFah3tagAUIC/G4HZo73
MD5:	A020B60C4DD43183E92322EBBD984622
SHA1:	0B57DEE576B4C46EA5E022D83392F1B596943E27
SHA-256:	3EA7A31F54953BF9F5B999FE57C11740D3B62BB6194C1925D967568D8414BC58
SHA-512:	E524F27DD070F918193F6D69C08D584C6966283A0CCD6AA1F059A1F93496ADD680DD32F4DDF053D97E8D8D2BE388275F333AFFD53C51F72DFA6691DA0E8891BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...W..e.................<.........LH.......P....@..........................@'.................@...................`.........XX.......%w..........,..........lr..................................................P..H....@..l....................text............................. ..`.itext...\......^................. ..`.data........P.......@..............@....bss.........@...........................idata..XX......Z..."..............@....didata.l....@.......\|..............@....edata.......`......................@..@.tls....X....p...........................rdata..]...........................@..@.reloc..lr.......t..................@..B.rsrc....%w......&w.................@..@....................................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\WiseDefrag.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393648
Entropy (8bit):	2.9786284394853872
Encrypted:	false
SSDEEP:	3072:xozZiaeJ1/tZg9a4hKbs2dVyZVlT05jXvVIN:xoz8R7/tZJVQf05eN
MD5:	F8E1ED1B455716402A50AA9DA2C105B1
SHA1:	FA8E08EF16AF64255259A6D4D8AE61B82396E178
SHA-256:	138D2F3CFF88404660701E5936F0C3FA389622D1987A63514BFF22524C975E2B
SHA-512:	CA46B3FB918614AB4F1AEC2BCD6FA0EB7F69D1E2E4D6192700443C22C8044B532FB5AFF8E910F2811F1FF3D45B871E5A4A042D6D4973409A063745DA4F9285E4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..{..(..(..(v..(..(v.9(..(v..(/.(..4(..(..(..(...(..(...(..(..(..(v..(:.(v.<(..(v.=(..(v.:(..(Rich..(........PE..L.....G[...........!.....L...................`......................................y.....@.........................`.......,...<........................#...........b..................................@............`...............................text....J.......L.................. ..`.rdata..._...`...`...P..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\WiseEraser.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1456048
Entropy (8bit):	6.5930859039642336
Encrypted:	false
SSDEEP:	24576:J5OX+5nxz7z+YV8yNPGCcFs2DhrsbBqSNv450hL+3HSDM1XaE7b1hGG3:J54qRzzxKrsbsSNC0+3HOM1X3v1hG6
MD5:	967CA4A63CCB65C547ACD3BE7631D0AC
SHA1:	1014384A33CB8B9E5859263467EBD9702873F314
SHA-256:	18DAFD7D8F3DBA61F99C233C3A7E2360EAEE4F5255820C6A046042CA99F0DD4D
SHA-512:	1D24E4CE725AEE4DEB43685549A89BD04FF3C05FF77D9F16B80C81F2F945DE025581E6B75835C7EA52FFD53651D6CA7229714E9F9E9E3C3B7AF05A190F5E3DB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......[.................n..........8.............@..................................w.......................................@...;...@...l...............#......d....................................................J...............................text....R.......T.................. ..`.itext..X....p.......X.............. ..`.data....M.......N...r..............@....bss....XT...............................idata...;...@...<..................@....didata.............................@....edata..............................@..@.reloc..d...........................@..B.rsrc....l...@...l..................@..@....................................@..@................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8538008
Entropy (8bit):	6.8673233030027925
Encrypted:	false
SSDEEP:	98304:LFavEJUTMF+lQNtZu9SgJp2iGnl4GKCRzfU/nDthDhO4P83WOXgbue3X1:LovEg7lQoNp2BnlswziDtp6fiueV
MD5:	4E793E5FBA64A9EDCDDB922E1AA9DAC4
SHA1:	E16CAC5CD505A67754F5EA21B28ECAFBB66F8B1B
SHA-256:	FC9CA77981DDD0E810C2E88FE8CFC27DC94258D888A08083EC5CEB0E0A6A7D72
SHA-512:	82912430DEB3AB40658F15FADEA2860C7190010211773E8F17A40CAE0176A997B1AE8BFDEC71D75EFD8E5AF6EF3E364ADCA040A0A1419C129552E09ED2F2C7CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 8%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...o.[e.................:c.........8Sc......`c...@.......................... ......z............@....................h...... h.rH....q..............*........h.\|_............................h.....................t,h......ph......................text.....c.......c................. ..`.itext...5... c..6....c............. ..`.data.... ...`c.."...>c.............@....bss..........d..........................idata..rH... h..J...`d.............@....didata......ph.......d.............@....edata........h.......d.............@..@.tls....X.....h..........................rdata..].....h.......d.............@..@.reloc..\|_....h..`....d.............@..B.rsrc.........q.......m.............@..@......................\|.............@..@................

C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9148336
Entropy (8bit):	6.780757366155507
Encrypted:	false
SSDEEP:	98304:jlO2duwJ/p3HHkUB9ew76CXmFrV60gOncO5x7TiHqYg94P:BOyb9r7evCgr+OnTlYhP
MD5:	1F166F5C76EB155D44DD1BF160F37A6A
SHA1:	CD6F7AA931D3193023F2E23A1F2716516CA3708C
SHA-256:	2D13424B09BA004135A26CCD60B64CDD6917D80CE43070CBC114569EAE608588
SHA-512:	38AD8F1308FE1AAE3DDF7DBC3B1C5442663571137390B3E31E2527B8FEC70E7266B06DF295DF0C411FCC500424022F274FD467D36040DEF2E1A4FEFF88C749B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................\b...)......xb.......b...@.................................;............@....................l......Pl..O...pu..............t...#....l.H.............................l......................]l.......l......................text....!b......"b................. ..`.itext..,9...@b..:...&b............. ..`.data...x#....b..$...`b.............@....bss..........c..........................idata...O...Pl..P....c.............@....didata.......l.......c.............@....edata........l.......c.............@..@.tls....X.....l..........................rdata..].....l.......c.............@..@.reloc..H.....l.......c.............@..B.rsrc........pu......jl.............@..@............. ......................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\fileshredder.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.046858124219736
Encrypted:	false
SSDEEP:	96:YrrrrP+mmmmCIIIIFQXqHcGmix2kPeASkM:TmmmmVabmiJSx
MD5:	D8E48DE3E5710FABD066C2BC02445C02
SHA1:	D5B86BFF4CD388659633AC3D6969FEE82AED3BDC
SHA-256:	1D1E9558EDEF4CE724F93F80DC96FA5D7306D341F89BCBE61694900A409A2E9B
SHA-512:	BAF61410094AD50EA8DE5918D1688C902EE8366CB6C26CA3FC23FC6C2207001ADBEF05D2C58A1355AD80B9CE790618CCD98580A6E23364A6E3C850CC1ADBE8ED
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... .........................................................................................................................................................................\\\tkkkz444g.......4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4....222fkkkzYYYs...............................'...............B...Y...........Y...........Y...........Y...........Y...........Y...>...............%...............................\........iii\|...Y...........Y...........Y...........Y...........Y...........Yaaax...........\...................................-...............Y...........Y...........Y...........Y...........Y...........Y...............+...................................3\\\............o...........o...........o...........o...........o...........o........TTT....1..........................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\headers\a1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6147
Entropy (8bit):	7.927412347943324
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xx6S/sGLGHjhCUUDKlu+Pl6htvOO72DQmp:DSHIIHUCD4waZ/sGc5U6N6htdSDQf2EA
MD5:	65D419890C0B4AD328A1130442B0318B
SHA1:	061A02B66D5A591E747F7952812C52A36738A5B4
SHA-256:	E45C5AD392B5088C5F5D287176669E376BB5DA0FF8B66EA2A4B43627DE6CB470
SHA-512:	CD7593F8227F2A28A7262DB23642EA86D3C10B1D4AC7642FE8BC02CC9A282C4002093C1CBF3E98D5F2D6EC4138FF0A37A79B9F26F312FD4FB0F21672C6CC7875
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\a2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6012
Entropy (8bit):	7.947044769035183
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlHbtd0z2I64FIsxVrGz1IinZBV4Q21cp:eSHIIHUCD4waXtd82T4WsidnZBV4N4
MD5:	A7C9A5D6010B920F37FA6B3FE5B3BEEC
SHA1:	4986C4417C535D12D6D5FB5DD563D31C9E4F1C3F
SHA-256:	F9A36D9C9728012B9DE006163F757838B443ADDBE62F61C2725C60026C2C9694
SHA-512:	83D9CC4C85A17E24450CC7CC10C0F7E4E7A9A97BA5EFCF3CFBE0CC51FD5A967FC27AEBC5ADCF09A9902B1A0AC61104CDEF2DF6E11AAC3749B57E58D6024FDC30
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\a6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5767
Entropy (8bit):	7.928577083510704
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x4re+jpy/MybfICJSIuxquinR9j/e/h0S5:DSHIIHUCD4was0/M2buxyRyDme
MD5:	B7A1392B10C1574EF771DF7B3EBB952F
SHA1:	7999424F5174AE3181AC105F61E9A75B260E48B5
SHA-256:	2397605C65AEE9EE2DBC64CF563A2F3DBFB81C015627D6532ABBE72C714FFB0E
SHA-512:	12CFEC8D493E1FB24872408294276B4BA1353BA06502189CF6041FE6BFCAC881149C85E6776470DD35E8ABDA5AD2571D6657352F026F4E6F6E591A0DF1B58596
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\a7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5983
Entropy (8bit):	7.919999789716348
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xld7cvp37jBeKLFc5wrxa1oltBgaD:DSHIIHUCD4waJ7cx37jtLFc52a1obBge
MD5:	B063588928A10B0389B1851F728037AD
SHA1:	A7FE773A622C2143EC491442817D8B1807024AA5
SHA-256:	A2BD5DC0228BC049682E1B2DA5C833298238168DB6A772B9C7965A0582524C94
SHA-512:	D424E42332FD3409FEFC538FFFCC330C506276C515E770F04FBFDD84011ADAD2C5DB8DA7A70010C73D2573F1033F8E40BB8E8734B61F3746278D6D9E107846AC
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\a9.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6446
Entropy (8bit):	7.940208381343962
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x87kftvWPyJZ4ojpmdUnPUEd9BBmfsylsQ:eSHIIHUCD4wamCKe3IduP38fsylgfk
MD5:	2681655EE3B9C8502F1DDDCE3E19F7E1
SHA1:	1C864FDD374AC5E370591F85E2AC38810D4E16F8
SHA-256:	D4EAAA8A40876720F624F888F5D7A151262A198E0B2C59553AC76BEC84144F65
SHA-512:	D670D4DBC40B502C5D33024C0687264484C378C2778FF3EFF0C585F7449BAD143D9243A631939E47406F93D8145AEF34B52991BC1715E3B7CFC76C5D98877323
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\b5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6382
Entropy (8bit):	7.925088192084649
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wadQvj0e6GMZvZ9O3LoV0Vw6NGD5:250wI4j0lj9i86VwkG9
MD5:	BDE942DFE1395CEE629207AA51D19EAC
SHA1:	ACE5EE5A02AB789BAB074B987FAC405E772E5643
SHA-256:	0F914422B94FF7C2C090C2DE41A2D90837584731618A277FA8261CB1D3F4DE7F
SHA-512:	52136C8E094E91F98829C27AA2E207612F314FF050056A4B2F4741F685959A6EFE6682C0795F27D0ACDCF193A5F6E0C1D3063996A3C22975D6A3637F9D09BA0B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\c4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	7.923131523093608
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xfRhEH/Ml7MV/mvQh/Hbx1LKXrLOA5b:DSHIIHUCD4waflG/+ivfKP35b
MD5:	3082AF499D589F26D28E064267409B2B
SHA1:	8B5421A5B08F7673086B4EBCDEDB75988CE58867
SHA-256:	87B858A4F68FF1F5C2A1D1F0A1CEBF2B10EE3839A125F3F5922954B448900BB8
SHA-512:	4F3BCB3450FC79FF590244A92290A81F3778A54D068707C41D5E4004C95CE7ED6438ED4B9BE14A4859E97F81196509DE8DF9B216AE7728CA9146A64E0234FE3F
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\c7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5923
Entropy (8bit):	7.94549113759105
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlOV/2Tp7NZcuDC62lG1sMNLVYCea5Fa/R:DSHIIHUCD4wa0WpRm6aOlnYzqZzJSOrO
MD5:	A36C79AF24FFC5CF60CE48A0D8AC91C8
SHA1:	A72EB372B7120626EAB15F65FEE1DE0B21017309
SHA-256:	933E44985ED6F8B7E0A2DDD87450D2B10E0399CC7CD2B4B5D0BA7465851D0C21
SHA-512:	800A014121F6C02246F1728E03217DEFB4402EB6341CCD62E7B0401912B4F1E7962320C00225E3A424DE285120B0B2CFF6C9B2C1D4B4DE6BA8FA885050B3927C
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\d1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5854
Entropy (8bit):	7.931380069706328
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlar8h03p8ny/7G21Vz6EaMnCG:DSHIIHUCD4wa+8e8cSi6Eaez
MD5:	D6C878679A509DFF584F21D833529765
SHA1:	06934089DDFF17EFDF740419266D1302A8336D61
SHA-256:	DFD68108928757E44226A321BE84683BBCF8BBA022F8BE98A31FAC29B0C040CC
SHA-512:	7201A14D8AB639534F23AC734CFFB494A7961996CA04A727674E8ECA63114F05DB8B72E92DA8A895611371416477E770FD498D26E639781C363E23B2CF11900F
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\d2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	7.935737910308455
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x/E47B3aJyVEUvQRabEKUmp7kdcKxk/sga:DSHIIHUCD4waWGBn7QRabxUJG/zeBt
MD5:	A3427D5F697E5B6055DB379A9AC45F31
SHA1:	115D08827FC0BA6AE704B7207A9560BE6831B99B
SHA-256:	F61FD27B5A259E83877BA63E04CB8A8681D218E3118DD34DD14B1008E2B2F127
SHA-512:	047B53E37D103F19189EC22EBAD082A2DB0C23C779CA38D41542C4D19E85ED9D50F049E94F72BC316A00F43A565E8A0B309A7A9D441833F22F85BA712FFDC656
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\d3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5930
Entropy (8bit):	7.939726018427637
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlJVUex+PQ2iZAsWt6cO4LE5aRTr:DSHIIHUCD4wadVLxWB2Asw6s/
MD5:	8E03F38728BB9937A1EC9B5F6A4BC12F
SHA1:	44C6A6FF53D71B80CB68105A1E4F2AB4F29D0196
SHA-256:	210CFF2A72B9C907168A03DB1820302A020547CFF25A4C1680DF42612ED94507
SHA-512:	40F763D9DC93CB2475EFE3CE965E24212FFB17A50C69F320C4941FB2571BC5D863D6F232F9AB7267F988DA46E69E6C62E786DA0D9AB604CC867102662E89216C
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\d4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5200
Entropy (8bit):	7.921125186905808
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xl89oXEVcynjV3gnYBuRO2+ck+GwG:DSHIIHUCD4wajtXNyjVWYBuRvFk+fG
MD5:	1906251A2A1C3DCA41524C1E20ECB263
SHA1:	8AB5462692958E753BAA60062F4E4AC2C0B9D4BD
SHA-256:	0CCF27605A0A91C78FDF9261A0E479673F2D870552EB96EF9F4E03B6EB3DB362
SHA-512:	ADE431480DF3040748BC7C0B73BB6F58377EF83B9383D4843935A0290EFDEB55650518873704DB4CF3CB7A670AF60A4032AB30496FA516CD100018D548B14F5A
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\d7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6325
Entropy (8bit):	7.943367776507074
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x7tjVsortIQCVuhUaZevHbQn8q9Jc1U:eSHIIHUCD4wauoRUchtev88q9JH
MD5:	67F3D0AB15DF99980CF97E0DC918CADB
SHA1:	AB0F849F180FD5B6E402F9563B74A4DCA3952EDB
SHA-256:	7CA1C1D1B1306D626EDD4AE9472598C98F5A579FD66C7544E3ED3E6995F8F9BA
SHA-512:	946CE8313E7D920C74CEB681F6CC71ED14502A0C8BA03E07F7DE97E246475D1800968EF09EB11BE2DD863A6635DAD4888E824102CA9BF39D27AAC2F45A17F218
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\e7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5593
Entropy (8bit):	7.906449125376266
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xVDApRnz+XBlwEEH483rPOGy6XgvY:DSHIIHUCD4wa3An68EEvnyQ
MD5:	5DFDF789079B53F4279629AB67343CB2
SHA1:	6A7AC94DA7F3C197DB3758F596135698A1326D40
SHA-256:	C4C4F2BDB8597B99733D0E2C46D8C9AAF1758D9065DFDCB55FD46B4A6CFC2F88
SHA-512:	BEB6C9FD019BEFBED05BAA65442BAEAA27996CDBA49BB153D0E260CADEF22F69301ED309DE7DEBCBA5AD92D110D7141141EB09D912AFC6B3D9DD01D861CD1505
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\e8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.922601773107069
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xiysV0mpvzVV:DSHIIHUCD4warsNpvzn
MD5:	5EEAE81D432D172CBD8DDC385B77473C
SHA1:	0127BD38D38480B225AB51C29633040B71DDC2EA
SHA-256:	413AFA3754F4DC495EC6DF207D521160E25DAC499899010CA2E6E5115753D0B4
SHA-512:	F11BB122F66A36CF1D7CA8C259FB9BBFF69DF74E41321611020FCD315FFD3C9C705408F7F3671AA8FC5F24CFF5F1B137B2C94C50E6E0D6F898F5A42D3D8F141A
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\e9.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5568
Entropy (8bit):	7.9306951375405
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xWmHcIoVpydVNzewS/Qk+9:DSHIIHUCD4wazHoVQb39
MD5:	CFF91F879418A247CDD4F8A7BDC591D1
SHA1:	6E8335C106954525A519B37910174525FBE2B9D7
SHA-256:	4CB98D65676A033F1A9B6A74BC085A4D82350F8A75CFD3CCD8EFBADE345AA138
SHA-512:	B5779D3780034B97B4294AB6FC8AC1D232D108A9F8A6A4F8E2CB3DE6C58268C4F8221A6ED90E6AFD60C8B9B498A2FC3F5EED733417E50C22B80171AAC60B0FE3
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f0.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4772
Entropy (8bit):	7.925786919345362
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x+A661sU3SDoCMFofDWTkTfFzWKez:DSHIIHUCD4waF1s3DGForWYTFadz
MD5:	708D331AEC75A7ADCEE254350CDAEBA7
SHA1:	0C47CE8A44D883A894FE2FD2A78419C977217A9A
SHA-256:	97034B73AE9389FC057633EDC364E4001BF04C34EB578E47582A44A81A5EC4AF
SHA-512:	8731054808504CB436DA0335EA6712539300347215B2266ECB01C109D877A0B3AB9F37C0176DB1307472B7D01CC186700CFA90461C894BEBF770757F6F1C8547
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	7.936377031580125
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xpldfgXM8c77FxtiE4vej1gBhJ6nLn1cVq:eSHIIHUCD4wa7TacXFSE4kqVq
MD5:	20A94D50BDB481E158D287A0F009DA54
SHA1:	A2731E0700C93BF93DB1301F2293D1881FADA2E4
SHA-256:	41AD106288BB719C80EB7DE00F5F27EE65B42ED8DC971E408BBC32F7934B9DD9
SHA-512:	71F0BEB645A575DC2785AF9E6A8A638B5A03DF514A1AF2871A623770189DE98A5E0EA673CE7CA6FE45A79CABDD32958D17B73192969A47A467AFA21D879B476F
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5031
Entropy (8bit):	7.912840535883012
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xS5kqmb/VWomGKb8Y+Ujs1ZxSq8:DSHIIHUCD4waSkuxGKHDjmLr8
MD5:	BBF18F2B3157E56BDD45BD9F4A424B83
SHA1:	DA32ACBB70B86661095D86D4EE5A652AD32D74AC
SHA-256:	110970E4817AA4D7BAB3C098C37AFDE151A062DF0EC172ACCFDE38A8B36DE7D9
SHA-512:	551B594C13AC7F919CDC86AAC6B93CB0ADDDBF68D875C551BC63D5376B69E5C1023B38DD9D61C459744DF17681706AD42A96E8B8313929CEEEE83840CE1D7126
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4867
Entropy (8bit):	7.920317345530771
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xITOf/I+QHpeNRlhb3xSL+:DSHIIHUCD4waWOozHoblDS+
MD5:	B0BB42428EC645254D8D7FFC19B1CF13
SHA1:	7B416D2CC7FADBDB4FD393A082A010961A9F2BEF
SHA-256:	BB1622F7C64DA910BFFD4691BBCF25478412B9976315FA0A070F33D3B7F78563
SHA-512:	2372111043AC4C0CBCECD79F9C975267BD629BE56F07B8F43F097074D37B0F1BDBA6B08B7B558963B2513928BC81F9E5810EFA1564B0F57D761249354DC204D5
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5262
Entropy (8bit):	7.923412043732724
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xety7j+nwMBTIq4+miz0EgT:DSHIIHUCD4waqyWwgngN
MD5:	15DDBB95561C234A4C1C48E708952FA1
SHA1:	675EE7DBF7A765546CA4DF9513253126036E7A40
SHA-256:	FC9E1D2A1726DA27F3C624B5670E6C601175CDB183A30365B6CAE21DA34FE017
SHA-512:	F3C4F89AB44F4DE1C7D36090B952D98A32008A161BAEA955AE75B9C17F60F069EFE5C772C5827DBE0B91698E080FAB745608E96215137E954CAF1D20F0F13ADF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	7.944073206390078
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waxZnqVCNY3rOIcG2Jx3sICK:250w0wiYSI/2n3sIX
MD5:	6A2DE9C87B82B4FC126A7BD92ACB9968
SHA1:	79ABB60B136DCA72086DD37FF16E31BE40F53CB0
SHA-256:	D0D58AD368CD12F1BA763BDB5A005920DCFB5D53442F00CC29FD8029CA69BA6C
SHA-512:	D72A6DB35105ACF258CD675BD90CC661604DE14994FE1F0F6F38AE79377523DEAE736C7C92B58E34B1C5B7244D4B394AC2053574694DBD408C7E69B603912D20
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6788
Entropy (8bit):	7.953332903977377
Encrypted:	false
SSDEEP:	96:hllcHitlIxv9vk7C1+I4wWHLihk/xW/OHecl5hz18cc70fmKyv2n/SpFwN5lEjDf:CIIHUCD4waVecDhzzc70fmKyGTlQynA1
MD5:	7C09F39A62B8DB1AFDB123909F0A0FC5
SHA1:	E740655C29296987F84214FF02F44A8B76A3A3C2
SHA-256:	D0100AF2B0F6EEDFCCDD8881549765860AC9BB6B14153F731BD8CF7C3B1F1D6F
SHA-512:	ED77FA372CE695E7E29706E8D7C800E57032D58FFC08720643C24B45DAC16082DDA9ACC17DE529E054B7B1906555EB961880D29C474BFD05DA0A09488AF4CCB8
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\f7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	7.914953050775107
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xOS3dL9ynHbSC+v8QVv7atw:DSHIIHUCD4watt9Gu8Oz/
MD5:	4A91007B5C0D2ECBDB0A4939F2D7629E
SHA1:	090544110A60C3DB38E0883C3C83AD9998BE55D7
SHA-256:	F6139EFCC82D5F73641D9115A3507E7CD367D52611E50F7BACF6550A2EDC341A
SHA-512:	6325B9A4617D69B4A953523E5E6D02C543C772A786C82A15ABC9DBD7448BBE518F19E327026D8FBA922E914BC4A516E975A6D8DAC4EBABC3528D11807C5759E0
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6178
Entropy (8bit):	7.931508771766521
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xrzmbEKbGPgKEbN8/bE3pSrAHFvCAYnbNw:DSHIIHUCD4wa6BbGYRRgrOFvCbbzA4W
MD5:	0AFB199A6A561570F2E3D3E78DF1C92C
SHA1:	EF6294A89713AB0BF5A15E982BD858D899C5AD78
SHA-256:	D5808102DC7155644B55A421EBAB16CBBA45C868543FC675117904A98EB16592
SHA-512:	B15AC2BC9A3850D3B34A0F72FD2904650ECCBB9282AD404272D31E1DB3DAE0871D74A005EC051CFFDB44F006CA8EB6A9A3DF9C36518A4875B74E56DF445A63DF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4856
Entropy (8bit):	7.917063367805836
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xyl8dR5XMUr8rEtgyVXw9:DSHIIHUCD4wa+u8w8rEtbS
MD5:	7FA795F9BA88458B5726CD8E21A7CC24
SHA1:	365ACCD427DA7AF1579A36F36DB5AFFF285B9286
SHA-256:	AC4A2ED5B4B9CC578B5ED6B8F98C30A55DD1D5F340D397562A9A01F879CFA0AE
SHA-512:	0AF5C946FC3AF29451143A79EE93B328C2060DC2C4E3AECAF56C172274989DE91A1A706A0039F082ECF16EAAD11FB02ED7961CB25FC67D9EB51BD03F60359054
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5404
Entropy (8bit):	7.928331848642891
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xl+874MLhWPe4eY6OpsxhNF5U1UWLl5:DSHIIHUCD4waPf74iqe4eYAF5U1fLP
MD5:	74483E82FF4C6F05F498406B32C59868
SHA1:	0152E260C4C3C6023CB308272DD67E737782B3A1
SHA-256:	72D6180BDBA9FC8C24F251F75FCCFDDA67532090A4F64BF678CAA9FD8679B2D2
SHA-512:	65A607730D20CC195EA3C53E6A23242F922C4A58EABB174126A5A3F5E0D108F0D535B90E34E628F74AA3459539168730A2093E8AD4F3440900D2F59CDF60B0E3
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4504
Entropy (8bit):	7.9203459566887275
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x/Gux/qXBkpoi6wk2gJlEJ:DSHIIHUCD4waVBcqRzlsO
MD5:	B57E157ECF345A21590321A7BBD03D42
SHA1:	4AEF26E175C02146DD9DFF91F86F5E28D4D20A0B
SHA-256:	467E73490D1C441034565801DDC04D6219FEC42858B6639735CD0BDD0EE4515F
SHA-512:	0C1DDAC4906E776B02D3C2A8DC5BB4E30FB4C3EB528D3C0A2D2F5C216EEB716664B48E6A9AAFFAAAC2E6FECBC8F97E334A217BAA00F3E37AC7E3535370DB49F7
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	7.905910093838858
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xQRafLUtUGiMdk:DSHIIHUCD4wa6MwiPMdk
MD5:	8CC7A91ED853D69E76CF94064F4F81A1
SHA1:	05592D26C5716FAE20C31EF02096926BD242A50F
SHA-256:	5DFBF383CC0B83A71CF105636D3E4E275DB79C6E07A40234D1A784D363E06D35
SHA-512:	A5C90829465DA4082FD628B40DDFAC28583A90DC3113C2892B04DB2D682781084CCF4770BAD6D9CDA95B657575E717747AA7455DFB7FFC8E8CD491213995C95E
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4459
Entropy (8bit):	7.9119860653832665
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xUaezQjF8ue1TqZTEceiY:DSHIIHUCD4waGnzQjF8ue1TKXeiY
MD5:	0C15ABC28399FECB808B378BCAF62EFA
SHA1:	D68093E7D33BAC2C7B2B12FD8C84AD4C7A93DB19
SHA-256:	104F6CB4283277A4CCBE670D289C49BE7AC0E4AA59B47F7A8D0174869E1E4F8A
SHA-512:	F5A195233E616CABF208DFC0F7D26E22486C8DA115D0FC94E8472E3F82D30085FBEEC42488773738DEEA5B2D3910039F579257713E998AE691FBE24538148761
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	7.917055562718003
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xiPQg7oXVEWmu9FLxKaPb:DSHIIHUCD4wadFEWmAb
MD5:	A815C4957EE7B423E09CEC9C8683E908
SHA1:	603F9747DBD2F54842EBEDEF9802C33B9CFF005B
SHA-256:	F33387D900CF83F9AAC9F9FCC31ADEC95BCE67FA8EB0CF40697E42545B7E183C
SHA-512:	608B990FAC9D49613040680D7404E0CB0DBB212ECCF3D647FEED45A65CA3FE114929A3E0FCC1B3498FF5EC381ED28FBC3A00718C82FB9ACAE545EB1C2E03B741
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\g8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4531
Entropy (8bit):	7.913314181210224
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xMXAw6rnIA8aeHCBW3rpj:DSHIIHUCD4wamXAwAnIFFHCY7V
MD5:	2B531F2666A1236FEE6B7705F74B4391
SHA1:	B82DF7FD3729D60E7DE28166D4996ABEC16B7218
SHA-256:	48A44A37C697E843D1BF307D60F54665EE8C1EB86DB991A4903436BE8B266267
SHA-512:	07DA4B36233C66E82E6589535D89CE81F7269F444CAEC87BAA79059845D687C06403E3140A58C3BA3B599A050B766C5DFBFC4DD6C7AB4477D9B3F6F8F0EAB9ED
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6946
Entropy (8bit):	7.941692151976889
Encrypted:	false
SSDEEP:	192:eSHIIHUCD4wa6GEISLfPzl+Kk1ORkcZ9j9qHG:B50wOSLTlk4kcTN
MD5:	4E5620FEB3F34226B3939BB12577368D
SHA1:	CEDD7F19C248108CA8FF3E08C62EFEC1A89FE588
SHA-256:	6810FB9355B410432D9051DC17C3539676DFB98AB1C71F36F555E59648CFCD27
SHA-512:	C6A8D052895AA71E9C072AE39ED09768961A22989E707824CB4F63BFF0B889428BF8F397CB4FD07EC491FED29642DC3245DAF455000B18CC9AFC863E611DFC81
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5970
Entropy (8bit):	7.94568092564666
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlKAtX2elOLiHSgiEBqkrg8fWjDSVA:DSHIIHUCD4wa/H/e88DB
MD5:	1A05C5EF979C8920CED775E2CA7982A5
SHA1:	88789DF52A6ECA20BFA9DDAFA56EB15BC4BF5B4C
SHA-256:	91249FFCD4A1B7E9983F538CFD170EDC1FCA280C7F718E0B9744EBE37E302668
SHA-512:	C19001FBA3C127C60E440E9821A4A628745794CE25EFB4EDD807ABC8A29A7654452F42BA69D6504060E99939C5F04F58CAC724B60031F1FC37308DDCF495702B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6102
Entropy (8bit):	7.931658452183908
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xK8cRQ1sOT7xEd3nZOtpi8B1hvC+ETZhg8:DSHIIHUCD4waARosOynZOtx1hvJKZhnV
MD5:	CC76FA416383E500E38BC8450749303E
SHA1:	B213E5A83DA87CD1CC4907FF9672624E3422BE84
SHA-256:	BFE42F46712FE15FB959B2D64C9BBFFBCBDB015DC53BC6BB7A4169DDCB20CB54
SHA-512:	577CB1BC5F9BAC449A58D61606E9D4BCD2FE3FB5E3847D24D8992B5F836D154C71BAE9789407C2F0D4EE1C6A4ED59EF67542776686A688D267BB8E8F67B63E52
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6174
Entropy (8bit):	7.935480451259524
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xzR6qGjlVgbPjvfrPzO919rE/Mxt313VMM:DSHIIHUCD4waBICbPjOpwWZVoNI
MD5:	D0B82330ED57EEC35012FEF1E11D2310
SHA1:	73BB000BCD6CAC88A54A3CF16D054E59E140A9B0
SHA-256:	844E41398B7A0B821CC1D41CA39AD294EBA00BE4D0FA73A1F8D39C634F880CA7
SHA-512:	BA4C5A39BB6BAA2F6BAECD4F3CC417087F459071B9F72E2014FE7C254F4CADD6BD37A87711D42E0EF96065F5FA9E782207D60AE778078B05903EA7B190250DE6
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6617
Entropy (8bit):	7.941976472055627
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wa5jgKrvNqoX5Dy2WgN5mTm34:250w+jhDXYsMTmo
MD5:	457069D55F0DB1D772994FCB6269FE23
SHA1:	5EA8B45C40AB93F8AE1A5D6D170731DDE2517FA1
SHA-256:	B401C066D6407FCC84D5BD68DA971A4EF8509881C5CA485F77B603AD2093ED5D
SHA-512:	1413BC8A8553473FDC56699ABCBC08D5A294157BB7A7B59BE99BCF6C0BF127B8C92F3C7E5B7A83C076B3DE260452513EA14F818C5A4F31900E8C38E1EA1D2C97
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6457
Entropy (8bit):	7.937866194620337
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waeWHbHWTsK5HR7MD48auxn13:250wcHb2THMD4P6V
MD5:	3EC5EE77AD30EBE6A51289908838E11D
SHA1:	BE0D30C16201EE7DF2E1A0831E595DC83B98659D
SHA-256:	8FEA994A0ABE3440879F71DC0822694048DF08EF8F17513EE3141B9159AC18CA
SHA-512:	5F9208B219D7FE3D14C288FE7AB4D60C59A4DB97E1D99BC0FBFCFC5AC297870747E35A2AFB5EFF1C0BD260FC30E9FA1639AAF3E3BD673AE9327007EC9FFE0F0B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6126
Entropy (8bit):	7.926434064770514
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x5YvoZRIIu6yXhiuqfMNdaNbbNZ6990XIZ:DSHIIHUCD4waLY+vuhiuwMNsNbbNEfMG
MD5:	9A186D9724302DDA4D4A9F4EFCFCDA50
SHA1:	C2A566DB6C8CC2F7664901871E9FDD278086CD69
SHA-256:	0508A7FFDCCD18879049A9FB587FD4C80417987D2C85E2D0F95C458D5150E12C
SHA-512:	F127282140440C6464DD72FFC674215BA5F0B7BA4C658AB3D0B97B6A2B799CC0DE74D228B786AE7B45A1030A497883D5AF7A02D31D8D98888CA15679D597B6CF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\h8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5570
Entropy (8bit):	7.914301440330263
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xrxWsN4zb6lo3pdIy6iBYKKw6BzXE:DSHIIHUCD4waXWg495my6iBKv2
MD5:	A91DC2E8F73D48BED436562BA4CBA7E7
SHA1:	987010C0D033C86446385D6E3EA85EEA0213386A
SHA-256:	DEE177E793F124089AD6C47795398D2B38E4C28FAA84F6A536458B0F7B807AD4
SHA-512:	81F70D1ECA2D6F00C0FD72A5507BC0F5FED909328BEB80E5832D80F828602EAEB069E551ECF59ABF81585306FD9E352C2F496315C67E3288F458F18D9470BFB7
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5527
Entropy (8bit):	7.938436704085556
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x0mOYA4iUFd4q3taJYFm2gytZq6:eSHIIHUCD4wavbDqGmk46
MD5:	4C2FE912AE83B5D377B76979926179E2
SHA1:	956D6155A7D06200D6D4F3AF34D008C4ADE98F0E
SHA-256:	00D68295DDC95F507CF20D6E0836E8130FDCD33399B255BB8E97EF9BFD755B35
SHA-512:	152174E3DDBE60E0086DE13D5C36605BD10D40038CC291F9AB73A54F3706CC53AC3AECCC4820670F136822CCE2D935EAF62E037DC1101B2C5A27AC7D1403FD9C
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4590
Entropy (8bit):	7.903950450753002
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xKCPC87NPVEdZiSLtMW9SeJRZ:DSHIIHUCD4waUkbV+JtX
MD5:	3CB26D74B2EBD10187DB10AA2E51E689
SHA1:	E68F7967C5E7CE18D7250001EE76D3D58C420165
SHA-256:	9776A3EE90BE77C74C6663B1D54ED16AECA34648C3F8A5C06EEBB9AE1B763CE8
SHA-512:	F1BB8F571DDBAF118FD7DC4FF7FAD6A62A072187B2236DA95878A72695995A50566E4E3CE066EF52623619156332F2F7FB49673E1B262060565EDF8080F73391
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	7.944770776892701
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlqWaoN+ztsol3a5ZkT4pSOokL2gvpqWph:eSHIIHUCD4waZzsbiS5gvprpnev8d
MD5:	CC16BC353E242E71EC9C5A26E2D07B0C
SHA1:	6D669966215F6F2172BCE33374CCF8EA2414568E
SHA-256:	1F059E7B8D6B3DFE279D46F452041F32AE5A99936238D2FB8C16DDD4F9E82CDE
SHA-512:	474917726FCA2BB497E726B178685EA16DADE70627B2A025AF72C7640309DD24864A9840DCEE3DAB65DBD2257D804FFA440B5A0A1F5C14386E7F5B751C597FD2
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5909
Entropy (8bit):	7.943851080608724
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlffkuphWEYr3WYn4yJN1cgpje:eSHIIHUCD4wadhJM3W64epje
MD5:	6FE8FA7BA0A8146825660C81378CEAD6
SHA1:	E7314275055FDB6CF8C911F0EC8BF6EB1AA4252E
SHA-256:	E02143423876AE027002A032C6920FD2E598D71934982851E32D212B2C84975F
SHA-512:	A149ADBA7A77ADF743BB6794C8D1B75699C6401F7A6B3C78F9BC408CA7516CE4DB9C89C72B530D7E87BD52E566E5F8E6E74A2FF71AA2A5A83B0C3D1186C15187
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5967
Entropy (8bit):	7.945645233742093
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlIbLaDmBn6rjVmwdgo03zSx2xcLQJwAJP:eSHIIHUCD4wa0LlnUpmw6o03zSEKLQhP
MD5:	AAC4D8D682793CBCCF0858700CD3F67C
SHA1:	485EB1872CDE56E87A43CF6B652B2495564988C8
SHA-256:	F0E2F3512C58051D404EC9944BDB8AAC7C7BE113E98D57CD86DEDC24923538E4
SHA-512:	01D7411C67D3BB2C230773AF4327D21924CF19BC0E33636694CF73984C9E80AF128B114F084AB05AA8BCE36506529435846F71B3FF2677DBDF162517EE6464D1
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6096
Entropy (8bit):	7.945855952994244
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlRjPG+X0aXZWFLGmI0iUwZP5Re2Ou+tb:DSHIIHUCD4waNwaJiqn0iUfRtb
MD5:	233DA532B8F16B717F898ED0C3A41B28
SHA1:	9BBD7B38B2809FAC5A28A90E980EDF23C21638C7
SHA-256:	88FE47DE9A80341C35CCCD6949C9509A76E6198F93F29CB78A53C5478A2281B2
SHA-512:	49AF30FB2BF3320548E70615C9ADA1A5FD0731208D996CD709CA76AC047205F1E3DE28BBD60AB50BEAC3A4F69A35CDFFCF365117804CE979CE2AFE92C7AFF581
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6459
Entropy (8bit):	7.930272681062284
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wa9fOSbyayqVGH5gtJBZ1joJnALqFo06:250wabyayRgbKIqFF6
MD5:	6194A715DAC074E5ADDC2DE9D0E5239D
SHA1:	AA5E45AD51B3145975E0BE783190D533028B4A9E
SHA-256:	9810FA4EA5375E54E7797190EA200A11F88F0C21FE425C4E090CEF34C5252040
SHA-512:	ABE2C6A0858CA7F68F3E47460D4797B86BB512BD955E2C6187CFE9DED8FB5165C228A31530C75C1A35248881B83EF3C4BB17044A974AB8950354068256CA0477
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\i8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6391
Entropy (8bit):	7.931075166438963
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wagydRXqMMIWPxhvQS47Awb:250wp8XqB7piFb
MD5:	356AF7F7C9D0C9F735523326CD20AA5B
SHA1:	92757FF150E0C56B3D7D71D1991E054B80ACF35E
SHA-256:	5241EBD130E4A96E6DB57D1EB9E9AB8C1A3EE6B54E3EE283EF143FC3A9D6B713
SHA-512:	1548471512654FC351532F00978C655F185F1E25A6115F8B96E0B829FF48D3AD7B3728D0DA8B06FB2EB4F6836DDA96A5D7A8A818A388137A4683E9A936B8E1F5
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-03O8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	7.914953050775107
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xOS3dL9ynHbSC+v8QVv7atw:DSHIIHUCD4watt9Gu8Oz/
MD5:	4A91007B5C0D2ECBDB0A4939F2D7629E
SHA1:	090544110A60C3DB38E0883C3C83AD9998BE55D7
SHA-256:	F6139EFCC82D5F73641D9115A3507E7CD367D52611E50F7BACF6550A2EDC341A
SHA-512:	6325B9A4617D69B4A953523E5E6D02C543C772A786C82A15ABC9DBD7448BBE518F19E327026D8FBA922E914BC4A516E975A6D8DAC4EBABC3528D11807C5759E0
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-0DU8L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	7.905910093838858
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xQRafLUtUGiMdk:DSHIIHUCD4wa6MwiPMdk
MD5:	8CC7A91ED853D69E76CF94064F4F81A1
SHA1:	05592D26C5716FAE20C31EF02096926BD242A50F
SHA-256:	5DFBF383CC0B83A71CF105636D3E4E275DB79C6E07A40234D1A784D363E06D35
SHA-512:	A5C90829465DA4082FD628B40DDFAC28583A90DC3113C2892B04DB2D682781084CCF4770BAD6D9CDA95B657575E717747AA7455DFB7FFC8E8CD491213995C95E
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-0F6JM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	7.935737910308455
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x/E47B3aJyVEUvQRabEKUmp7kdcKxk/sga:DSHIIHUCD4waWGBn7QRabxUJG/zeBt
MD5:	A3427D5F697E5B6055DB379A9AC45F31
SHA1:	115D08827FC0BA6AE704B7207A9560BE6831B99B
SHA-256:	F61FD27B5A259E83877BA63E04CB8A8681D218E3118DD34DD14B1008E2B2F127
SHA-512:	047B53E37D103F19189EC22EBAD082A2DB0C23C779CA38D41542C4D19E85ED9D50F049E94F72BC316A00F43A565E8A0B309A7A9D441833F22F85BA712FFDC656
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-0KBSG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5404
Entropy (8bit):	7.928331848642891
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xl+874MLhWPe4eY6OpsxhNF5U1UWLl5:DSHIIHUCD4waPf74iqe4eYAF5U1fLP
MD5:	74483E82FF4C6F05F498406B32C59868
SHA1:	0152E260C4C3C6023CB308272DD67E737782B3A1
SHA-256:	72D6180BDBA9FC8C24F251F75FCCFDDA67532090A4F64BF678CAA9FD8679B2D2
SHA-512:	65A607730D20CC195EA3C53E6A23242F922C4A58EABB174126A5A3F5E0D108F0D535B90E34E628F74AA3459539168730A2093E8AD4F3440900D2F59CDF60B0E3
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-1M6JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	7.924215824851051
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waz97C+lnNaG3+ubKrc7KRRlmuAO:250wA7CenNaG3DKI7KRR9AO
MD5:	0DBB2A89233D8A6B935F3A46D82F1D64
SHA1:	B2EFD2A71197A041C08729D08C9931E7E6B8EA4F
SHA-256:	DF664862B3822385203548885BE93308EC87D627AB4320B249F5381F34A212B1
SHA-512:	52759463D5EFFB1FA58C225FA13C95D47021BD9B2E0BECF5A1E5D08E1D48E12EAD0A56F59DB965792D2F885A8858BDC9F38570DBD793573507308944B6CCFB57
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-25TOS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6788
Entropy (8bit):	7.953332903977377
Encrypted:	false
SSDEEP:	96:hllcHitlIxv9vk7C1+I4wWHLihk/xW/OHecl5hz18cc70fmKyv2n/SpFwN5lEjDf:CIIHUCD4waVecDhzzc70fmKyGTlQynA1
MD5:	7C09F39A62B8DB1AFDB123909F0A0FC5
SHA1:	E740655C29296987F84214FF02F44A8B76A3A3C2
SHA-256:	D0100AF2B0F6EEDFCCDD8881549765860AC9BB6B14153F731BD8CF7C3B1F1D6F
SHA-512:	ED77FA372CE695E7E29706E8D7C800E57032D58FFC08720643C24B45DAC16082DDA9ACC17DE529E054B7B1906555EB961880D29C474BFD05DA0A09488AF4CCB8
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-2AMFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6617
Entropy (8bit):	7.941976472055627
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wa5jgKrvNqoX5Dy2WgN5mTm34:250w+jhDXYsMTmo
MD5:	457069D55F0DB1D772994FCB6269FE23
SHA1:	5EA8B45C40AB93F8AE1A5D6D170731DDE2517FA1
SHA-256:	B401C066D6407FCC84D5BD68DA971A4EF8509881C5CA485F77B603AD2093ED5D
SHA-512:	1413BC8A8553473FDC56699ABCBC08D5A294157BB7A7B59BE99BCF6C0BF127B8C92F3C7E5B7A83C076B3DE260452513EA14F818C5A4F31900E8C38E1EA1D2C97
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-2O33D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6012
Entropy (8bit):	7.947044769035183
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlHbtd0z2I64FIsxVrGz1IinZBV4Q21cp:eSHIIHUCD4waXtd82T4WsidnZBV4N4
MD5:	A7C9A5D6010B920F37FA6B3FE5B3BEEC
SHA1:	4986C4417C535D12D6D5FB5DD563D31C9E4F1C3F
SHA-256:	F9A36D9C9728012B9DE006163F757838B443ADDBE62F61C2725C60026C2C9694
SHA-512:	83D9CC4C85A17E24450CC7CC10C0F7E4E7A9A97BA5EFCF3CFBE0CC51FD5A967FC27AEBC5ADCF09A9902B1A0AC61104CDEF2DF6E11AAC3749B57E58D6024FDC30
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-2SGTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6391
Entropy (8bit):	7.931075166438963
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wagydRXqMMIWPxhvQS47Awb:250wp8XqB7piFb
MD5:	356AF7F7C9D0C9F735523326CD20AA5B
SHA1:	92757FF150E0C56B3D7D71D1991E054B80ACF35E
SHA-256:	5241EBD130E4A96E6DB57D1EB9E9AB8C1A3EE6B54E3EE283EF143FC3A9D6B713
SHA-512:	1548471512654FC351532F00978C655F185F1E25A6115F8B96E0B829FF48D3AD7B3728D0DA8B06FB2EB4F6836DDA96A5D7A8A818A388137A4683E9A936B8E1F5
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-3GM49.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6457
Entropy (8bit):	7.937866194620337
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waeWHbHWTsK5HR7MD48auxn13:250wcHb2THMD4P6V
MD5:	3EC5EE77AD30EBE6A51289908838E11D
SHA1:	BE0D30C16201EE7DF2E1A0831E595DC83B98659D
SHA-256:	8FEA994A0ABE3440879F71DC0822694048DF08EF8F17513EE3141B9159AC18CA
SHA-512:	5F9208B219D7FE3D14C288FE7AB4D60C59A4DB97E1D99BC0FBFCFC5AC297870747E35A2AFB5EFF1C0BD260FC30E9FA1639AAF3E3BD673AE9327007EC9FFE0F0B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-5R91K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5593
Entropy (8bit):	7.906449125376266
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xVDApRnz+XBlwEEH483rPOGy6XgvY:DSHIIHUCD4wa3An68EEvnyQ
MD5:	5DFDF789079B53F4279629AB67343CB2
SHA1:	6A7AC94DA7F3C197DB3758F596135698A1326D40
SHA-256:	C4C4F2BDB8597B99733D0E2C46D8C9AAF1758D9065DFDCB55FD46B4A6CFC2F88
SHA-512:	BEB6C9FD019BEFBED05BAA65442BAEAA27996CDBA49BB153D0E260CADEF22F69301ED309DE7DEBCBA5AD92D110D7141141EB09D912AFC6B3D9DD01D861CD1505
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-754V0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5970
Entropy (8bit):	7.94568092564666
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlKAtX2elOLiHSgiEBqkrg8fWjDSVA:DSHIIHUCD4wa/H/e88DB
MD5:	1A05C5EF979C8920CED775E2CA7982A5
SHA1:	88789DF52A6ECA20BFA9DDAFA56EB15BC4BF5B4C
SHA-256:	91249FFCD4A1B7E9983F538CFD170EDC1FCA280C7F718E0B9744EBE37E302668
SHA-512:	C19001FBA3C127C60E440E9821A4A628745794CE25EFB4EDD807ABC8A29A7654452F42BA69D6504060E99939C5F04F58CAC724B60031F1FC37308DDCF495702B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-8LG4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	7.944770776892701
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlqWaoN+ztsol3a5ZkT4pSOokL2gvpqWph:eSHIIHUCD4waZzsbiS5gvprpnev8d
MD5:	CC16BC353E242E71EC9C5A26E2D07B0C
SHA1:	6D669966215F6F2172BCE33374CCF8EA2414568E
SHA-256:	1F059E7B8D6B3DFE279D46F452041F32AE5A99936238D2FB8C16DDD4F9E82CDE
SHA-512:	474917726FCA2BB497E726B178685EA16DADE70627B2A025AF72C7640309DD24864A9840DCEE3DAB65DBD2257D804FFA440B5A0A1F5C14386E7F5B751C597FD2
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-BDSBP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6446
Entropy (8bit):	7.940208381343962
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x87kftvWPyJZ4ojpmdUnPUEd9BBmfsylsQ:eSHIIHUCD4wamCKe3IduP38fsylgfk
MD5:	2681655EE3B9C8502F1DDDCE3E19F7E1
SHA1:	1C864FDD374AC5E370591F85E2AC38810D4E16F8
SHA-256:	D4EAAA8A40876720F624F888F5D7A151262A198E0B2C59553AC76BEC84144F65
SHA-512:	D670D4DBC40B502C5D33024C0687264484C378C2778FF3EFF0C585F7449BAD143D9243A631939E47406F93D8145AEF34B52991BC1715E3B7CFC76C5D98877323
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-CF6AK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6096
Entropy (8bit):	7.945855952994244
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlRjPG+X0aXZWFLGmI0iUwZP5Re2Ou+tb:DSHIIHUCD4waNwaJiqn0iUfRtb
MD5:	233DA532B8F16B717F898ED0C3A41B28
SHA1:	9BBD7B38B2809FAC5A28A90E980EDF23C21638C7
SHA-256:	88FE47DE9A80341C35CCCD6949C9509A76E6198F93F29CB78A53C5478A2281B2
SHA-512:	49AF30FB2BF3320548E70615C9ADA1A5FD0731208D996CD709CA76AC047205F1E3DE28BBD60AB50BEAC3A4F69A35CDFFCF365117804CE979CE2AFE92C7AFF581
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-CKOMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4772
Entropy (8bit):	7.925786919345362
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x+A661sU3SDoCMFofDWTkTfFzWKez:DSHIIHUCD4waF1s3DGForWYTFadz
MD5:	708D331AEC75A7ADCEE254350CDAEBA7
SHA1:	0C47CE8A44D883A894FE2FD2A78419C977217A9A
SHA-256:	97034B73AE9389FC057633EDC364E4001BF04C34EB578E47582A44A81A5EC4AF
SHA-512:	8731054808504CB436DA0335EA6712539300347215B2266ECB01C109D877A0B3AB9F37C0176DB1307472B7D01CC186700CFA90461C894BEBF770757F6F1C8547
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-DMRAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5200
Entropy (8bit):	7.921125186905808
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xl89oXEVcynjV3gnYBuRO2+ck+GwG:DSHIIHUCD4wajtXNyjVWYBuRvFk+fG
MD5:	1906251A2A1C3DCA41524C1E20ECB263
SHA1:	8AB5462692958E753BAA60062F4E4AC2C0B9D4BD
SHA-256:	0CCF27605A0A91C78FDF9261A0E479673F2D870552EB96EF9F4E03B6EB3DB362
SHA-512:	ADE431480DF3040748BC7C0B73BB6F58377EF83B9383D4843935A0290EFDEB55650518873704DB4CF3CB7A670AF60A4032AB30496FA516CD100018D548B14F5A
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-DTIVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5527
Entropy (8bit):	7.938436704085556
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x0mOYA4iUFd4q3taJYFm2gytZq6:eSHIIHUCD4wavbDqGmk46
MD5:	4C2FE912AE83B5D377B76979926179E2
SHA1:	956D6155A7D06200D6D4F3AF34D008C4ADE98F0E
SHA-256:	00D68295DDC95F507CF20D6E0836E8130FDCD33399B255BB8E97EF9BFD755B35
SHA-512:	152174E3DDBE60E0086DE13D5C36605BD10D40038CC291F9AB73A54F3706CC53AC3AECCC4820670F136822CCE2D935EAF62E037DC1101B2C5A27AC7D1403FD9C
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-E2PK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5262
Entropy (8bit):	7.923412043732724
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xety7j+nwMBTIq4+miz0EgT:DSHIIHUCD4waqyWwgngN
MD5:	15DDBB95561C234A4C1C48E708952FA1
SHA1:	675EE7DBF7A765546CA4DF9513253126036E7A40
SHA-256:	FC9E1D2A1726DA27F3C624B5670E6C601175CDB183A30365B6CAE21DA34FE017
SHA-512:	F3C4F89AB44F4DE1C7D36090B952D98A32008A161BAEA955AE75B9C17F60F069EFE5C772C5827DBE0B91698E080FAB745608E96215137E954CAF1D20F0F13ADF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-E8CHT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5767
Entropy (8bit):	7.928577083510704
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x4re+jpy/MybfICJSIuxquinR9j/e/h0S5:DSHIIHUCD4was0/M2buxyRyDme
MD5:	B7A1392B10C1574EF771DF7B3EBB952F
SHA1:	7999424F5174AE3181AC105F61E9A75B260E48B5
SHA-256:	2397605C65AEE9EE2DBC64CF563A2F3DBFB81C015627D6532ABBE72C714FFB0E
SHA-512:	12CFEC8D493E1FB24872408294276B4BA1353BA06502189CF6041FE6BFCAC881149C85E6776470DD35E8ABDA5AD2571D6657352F026F4E6F6E591A0DF1B58596
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-EEEQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4459
Entropy (8bit):	7.9119860653832665
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xUaezQjF8ue1TqZTEceiY:DSHIIHUCD4waGnzQjF8ue1TKXeiY
MD5:	0C15ABC28399FECB808B378BCAF62EFA
SHA1:	D68093E7D33BAC2C7B2B12FD8C84AD4C7A93DB19
SHA-256:	104F6CB4283277A4CCBE670D289C49BE7AC0E4AA59B47F7A8D0174869E1E4F8A
SHA-512:	F5A195233E616CABF208DFC0F7D26E22486C8DA115D0FC94E8472E3F82D30085FBEEC42488773738DEEA5B2D3910039F579257713E998AE691FBE24538148761
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-EGK32.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5868
Entropy (8bit):	7.935013260302147
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlCsAUQ5dAWne91eJRLZJi8dJJ/8X0:DSHIIHUCD4waOGMdAbQLZg8dJiE
MD5:	5A6252AEA892CD45BE012F7CC93715CA
SHA1:	792D3D9827B555740FD6D0B09183552661650A23
SHA-256:	139E87666E0F3ED7DEBCF66EE9E4733132110E7C4FA2B7CEA1F0B738C7BF3D2C
SHA-512:	BCA61C277F7A1EB5643151FD2DF3534EEB1F059257AB4F099462184C76285249B5396B3906BAE9596A4FF5B938B47C97E8CA598C5B42B6F6638955AE95E09846
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-G37CL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5568
Entropy (8bit):	7.9306951375405
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xWmHcIoVpydVNzewS/Qk+9:DSHIIHUCD4wazHoVQb39
MD5:	CFF91F879418A247CDD4F8A7BDC591D1
SHA1:	6E8335C106954525A519B37910174525FBE2B9D7
SHA-256:	4CB98D65676A033F1A9B6A74BC085A4D82350F8A75CFD3CCD8EFBADE345AA138
SHA-512:	B5779D3780034B97B4294AB6FC8AC1D232D108A9F8A6A4F8E2CB3DE6C58268C4F8221A6ED90E6AFD60C8B9B498A2FC3F5EED733417E50C22B80171AAC60B0FE3
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-G55TL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4504
Entropy (8bit):	7.9203459566887275
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x/Gux/qXBkpoi6wk2gJlEJ:DSHIIHUCD4waVBcqRzlsO
MD5:	B57E157ECF345A21590321A7BBD03D42
SHA1:	4AEF26E175C02146DD9DFF91F86F5E28D4D20A0B
SHA-256:	467E73490D1C441034565801DDC04D6219FEC42858B6639735CD0BDD0EE4515F
SHA-512:	0C1DDAC4906E776B02D3C2A8DC5BB4E30FB4C3EB528D3C0A2D2F5C216EEB716664B48E6A9AAFFAAAC2E6FECBC8F97E334A217BAA00F3E37AC7E3535370DB49F7
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-G6IF2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	7.936377031580125
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xpldfgXM8c77FxtiE4vej1gBhJ6nLn1cVq:eSHIIHUCD4wa7TacXFSE4kqVq
MD5:	20A94D50BDB481E158D287A0F009DA54
SHA1:	A2731E0700C93BF93DB1301F2293D1881FADA2E4
SHA-256:	41AD106288BB719C80EB7DE00F5F27EE65B42ED8DC971E408BBC32F7934B9DD9
SHA-512:	71F0BEB645A575DC2785AF9E6A8A638B5A03DF514A1AF2871A623770189DE98A5E0EA673CE7CA6FE45A79CABDD32958D17B73192969A47A467AFA21D879B476F
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-G875B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6126
Entropy (8bit):	7.926434064770514
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/x5YvoZRIIu6yXhiuqfMNdaNbbNZ6990XIZ:DSHIIHUCD4waLY+vuhiuwMNsNbbNEfMG
MD5:	9A186D9724302DDA4D4A9F4EFCFCDA50
SHA1:	C2A566DB6C8CC2F7664901871E9FDD278086CD69
SHA-256:	0508A7FFDCCD18879049A9FB587FD4C80417987D2C85E2D0F95C458D5150E12C
SHA-512:	F127282140440C6464DD72FFC674215BA5F0B7BA4C658AB3D0B97B6A2B799CC0DE74D228B786AE7B45A1030A497883D5AF7A02D31D8D98888CA15679D597B6CF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-GBMNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6382
Entropy (8bit):	7.925088192084649
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wadQvj0e6GMZvZ9O3LoV0Vw6NGD5:250wI4j0lj9i86VwkG9
MD5:	BDE942DFE1395CEE629207AA51D19EAC
SHA1:	ACE5EE5A02AB789BAB074B987FAC405E772E5643
SHA-256:	0F914422B94FF7C2C090C2DE41A2D90837584731618A277FA8261CB1D3F4DE7F
SHA-512:	52136C8E094E91F98829C27AA2E207612F314FF050056A4B2F4741F685959A6EFE6682C0795F27D0ACDCF193A5F6E0C1D3063996A3C22975D6A3637F9D09BA0B
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-GGMJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4856
Entropy (8bit):	7.917063367805836
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xyl8dR5XMUr8rEtgyVXw9:DSHIIHUCD4wa+u8w8rEtbS
MD5:	7FA795F9BA88458B5726CD8E21A7CC24
SHA1:	365ACCD427DA7AF1579A36F36DB5AFFF285B9286
SHA-256:	AC4A2ED5B4B9CC578B5ED6B8F98C30A55DD1D5F340D397562A9A01F879CFA0AE
SHA-512:	0AF5C946FC3AF29451143A79EE93B328C2060DC2C4E3AECAF56C172274989DE91A1A706A0039F082ECF16EAAD11FB02ED7961CB25FC67D9EB51BD03F60359054
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-H1132.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6459
Entropy (8bit):	7.930272681062284
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wa9fOSbyayqVGH5gtJBZ1joJnALqFo06:250wabyayRgbKIqFF6
MD5:	6194A715DAC074E5ADDC2DE9D0E5239D
SHA1:	AA5E45AD51B3145975E0BE783190D533028B4A9E
SHA-256:	9810FA4EA5375E54E7797190EA200A11F88F0C21FE425C4E090CEF34C5252040
SHA-512:	ABE2C6A0858CA7F68F3E47460D4797B86BB512BD955E2C6187CFE9DED8FB5165C228A31530C75C1A35248881B83EF3C4BB17044A974AB8950354068256CA0477
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-HPQ2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6215
Entropy (8bit):	7.927951948392497
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wajUZcI/3UhSypunLrHdXYCF:250wXZcIId0nPdlF
MD5:	28F5766D3AB6E91427E8740F408BC36F
SHA1:	1049DC973A0A20950E5246930067A39712C28533
SHA-256:	25FEC92372BB6D4706727EC4E2BD8493973E23B1CDC57916E9A37021C3E377CF
SHA-512:	93580531E8CA1049558E1B8523A31CE2D5D1F9693F4AB9B9B636814DFF76DA9447D291E9340582F9A1697C401206916F8EC3727523F9091F16BE519BB694B498
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-IS72O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4867
Entropy (8bit):	7.920317345530771
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xITOf/I+QHpeNRlhb3xSL+:DSHIIHUCD4waWOozHoblDS+
MD5:	B0BB42428EC645254D8D7FFC19B1CF13
SHA1:	7B416D2CC7FADBDB4FD393A082A010961A9F2BEF
SHA-256:	BB1622F7C64DA910BFFD4691BBCF25478412B9976315FA0A070F33D3B7F78563
SHA-512:	2372111043AC4C0CBCECD79F9C975267BD629BE56F07B8F43F097074D37B0F1BDBA6B08B7B558963B2513928BC81F9E5810EFA1564B0F57D761249354DC204D5
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-IU54T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6640
Entropy (8bit):	7.944040955189513
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waJhPm+JydmnO+bds4gSJjV9:250wehO+cwO+bdBgS5V9
MD5:	BC8A02723DF9394A24A3F89DF1C66C3E
SHA1:	A93C7F3803E9F7BC96010378295EEBE046B7F8A8
SHA-256:	CA235B8F7E606DC2A6F2F5B14649F1C286EBB551BA1DFA1AC5FA4C9902348F6C
SHA-512:	C3E11657067087D7433ADA411A6FF0157CA0A8445F89EE450172E156EE302B3767441286A13DAF705E5416809134FF58F48482583705C3F17137DA6418D9BD10
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-IU6CJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6325
Entropy (8bit):	7.943367776507074
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/x7tjVsortIQCVuhUaZevHbQn8q9Jc1U:eSHIIHUCD4wauoRUchtev88q9JH
MD5:	67F3D0AB15DF99980CF97E0DC918CADB
SHA1:	AB0F849F180FD5B6E402F9563B74A4DCA3952EDB
SHA-256:	7CA1C1D1B1306D626EDD4AE9472598C98F5A579FD66C7544E3ED3E6995F8F9BA
SHA-512:	946CE8313E7D920C74CEB681F6CC71ED14502A0C8BA03E07F7DE97E246475D1800968EF09EB11BE2DD863A6635DAD4888E824102CA9BF39D27AAC2F45A17F218
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-JL61E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5930
Entropy (8bit):	7.939726018427637
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlJVUex+PQ2iZAsWt6cO4LE5aRTr:DSHIIHUCD4wadVLxWB2Asw6s/
MD5:	8E03F38728BB9937A1EC9B5F6A4BC12F
SHA1:	44C6A6FF53D71B80CB68105A1E4F2AB4F29D0196
SHA-256:	210CFF2A72B9C907168A03DB1820302A020547CFF25A4C1680DF42612ED94507
SHA-512:	40F763D9DC93CB2475EFE3CE965E24212FFB17A50C69F320C4941FB2571BC5D863D6F232F9AB7267F988DA46E69E6C62E786DA0D9AB604CC867102662E89216C
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-JL65U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4531
Entropy (8bit):	7.913314181210224
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xMXAw6rnIA8aeHCBW3rpj:DSHIIHUCD4wamXAwAnIFFHCY7V
MD5:	2B531F2666A1236FEE6B7705F74B4391
SHA1:	B82DF7FD3729D60E7DE28166D4996ABEC16B7218
SHA-256:	48A44A37C697E843D1BF307D60F54665EE8C1EB86DB991A4903436BE8B266267
SHA-512:	07DA4B36233C66E82E6589535D89CE81F7269F444CAEC87BAA79059845D687C06403E3140A58C3BA3B599A050B766C5DFBFC4DD6C7AB4477D9B3F6F8F0EAB9ED
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-K12IT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5570
Entropy (8bit):	7.914301440330263
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xrxWsN4zb6lo3pdIy6iBYKKw6BzXE:DSHIIHUCD4waXWg495my6iBKv2
MD5:	A91DC2E8F73D48BED436562BA4CBA7E7
SHA1:	987010C0D033C86446385D6E3EA85EEA0213386A
SHA-256:	DEE177E793F124089AD6C47795398D2B38E4C28FAA84F6A536458B0F7B807AD4
SHA-512:	81F70D1ECA2D6F00C0FD72A5507BC0F5FED909328BEB80E5832D80F828602EAEB069E551ECF59ABF81585306FD9E352C2F496315C67E3288F458F18D9470BFB7
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-KAO93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6174
Entropy (8bit):	7.935480451259524
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xzR6qGjlVgbPjvfrPzO919rE/Mxt313VMM:DSHIIHUCD4waBICbPjOpwWZVoNI
MD5:	D0B82330ED57EEC35012FEF1E11D2310
SHA1:	73BB000BCD6CAC88A54A3CF16D054E59E140A9B0
SHA-256:	844E41398B7A0B821CC1D41CA39AD294EBA00BE4D0FA73A1F8D39C634F880CA7
SHA-512:	BA4C5A39BB6BAA2F6BAECD4F3CC417087F459071B9F72E2014FE7C254F4CADD6BD37A87711D42E0EF96065F5FA9E782207D60AE778078B05903EA7B190250DE6
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-M20V6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5854
Entropy (8bit):	7.931380069706328
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlar8h03p8ny/7G21Vz6EaMnCG:DSHIIHUCD4wa+8e8cSi6Eaez
MD5:	D6C878679A509DFF584F21D833529765
SHA1:	06934089DDFF17EFDF740419266D1302A8336D61
SHA-256:	DFD68108928757E44226A321BE84683BBCF8BBA022F8BE98A31FAC29B0C040CC
SHA-512:	7201A14D8AB639534F23AC734CFFB494A7961996CA04A727674E8ECA63114F05DB8B72E92DA8A895611371416477E770FD498D26E639781C363E23B2CF11900F
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-MUHFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4590
Entropy (8bit):	7.903950450753002
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xKCPC87NPVEdZiSLtMW9SeJRZ:DSHIIHUCD4waUkbV+JtX
MD5:	3CB26D74B2EBD10187DB10AA2E51E689
SHA1:	E68F7967C5E7CE18D7250001EE76D3D58C420165
SHA-256:	9776A3EE90BE77C74C6663B1D54ED16AECA34648C3F8A5C06EEBB9AE1B763CE8
SHA-512:	F1BB8F571DDBAF118FD7DC4FF7FAD6A62A072187B2236DA95878A72695995A50566E4E3CE066EF52623619156332F2F7FB49673E1B262060565EDF8080F73391
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-N2UG0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5967
Entropy (8bit):	7.945645233742093
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlIbLaDmBn6rjVmwdgo03zSx2xcLQJwAJP:eSHIIHUCD4wa0LlnUpmw6o03zSEKLQhP
MD5:	AAC4D8D682793CBCCF0858700CD3F67C
SHA1:	485EB1872CDE56E87A43CF6B652B2495564988C8
SHA-256:	F0E2F3512C58051D404EC9944BDB8AAC7C7BE113E98D57CD86DEDC24923538E4
SHA-512:	01D7411C67D3BB2C230773AF4327D21924CF19BC0E33636694CF73984C9E80AF128B114F084AB05AA8BCE36506529435846F71B3FF2677DBDF162517EE6464D1
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-NGB8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5031
Entropy (8bit):	7.912840535883012
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xS5kqmb/VWomGKb8Y+Ujs1ZxSq8:DSHIIHUCD4waSkuxGKHDjmLr8
MD5:	BBF18F2B3157E56BDD45BD9F4A424B83
SHA1:	DA32ACBB70B86661095D86D4EE5A652AD32D74AC
SHA-256:	110970E4817AA4D7BAB3C098C37AFDE151A062DF0EC172ACCFDE38A8B36DE7D9
SHA-512:	551B594C13AC7F919CDC86AAC6B93CB0ADDDBF68D875C551BC63D5376B69E5C1023B38DD9D61C459744DF17681706AD42A96E8B8313929CEEEE83840CE1D7126
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-NOI36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5748
Entropy (8bit):	7.93759093298806
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xEbs9i9abbNE5U1inPWvj5XYy1O2VKvMC5:DSHIIHUCD4waOY9FNE5UEnevFXYy1MME
MD5:	78F5B629DF161FE2BDC6BC3E8E219906
SHA1:	F399C6897C234F59B83CFF8BF7517EE037CD8526
SHA-256:	6E2465950B04F684CE62986DDE884055DF55368D6F96E9EC4DC0BCEB926008B3
SHA-512:	403B57658E9966272DAEDCCAD0775C369481A495F1B0DED69384D152664B37FFA9D7FD95F43C68BA912F009FB2971EC3C6F2617F64A03C2AB407FCA7078C259E
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-OEQDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	7.923131523093608
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xfRhEH/Ml7MV/mvQh/Hbx1LKXrLOA5b:DSHIIHUCD4waflG/+ivfKP35b
MD5:	3082AF499D589F26D28E064267409B2B
SHA1:	8B5421A5B08F7673086B4EBCDEDB75988CE58867
SHA-256:	87B858A4F68FF1F5C2A1D1F0A1CEBF2B10EE3839A125F3F5922954B448900BB8
SHA-512:	4F3BCB3450FC79FF590244A92290A81F3778A54D068707C41D5E4004C95CE7ED6438ED4B9BE14A4859E97F81196509DE8DF9B216AE7728CA9146A64E0234FE3F
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-OQK6L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5983
Entropy (8bit):	7.919999789716348
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xld7cvp37jBeKLFc5wrxa1oltBgaD:DSHIIHUCD4waJ7cx37jtLFc52a1obBge
MD5:	B063588928A10B0389B1851F728037AD
SHA1:	A7FE773A622C2143EC491442817D8B1807024AA5
SHA-256:	A2BD5DC0228BC049682E1B2DA5C833298238168DB6A772B9C7965A0582524C94
SHA-512:	D424E42332FD3409FEFC538FFFCC330C506276C515E770F04FBFDD84011ADAD2C5DB8DA7A70010C73D2573F1033F8E40BB8E8734B61F3746278D6D9E107846AC
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-OQRJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	7.917055562718003
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xiPQg7oXVEWmu9FLxKaPb:DSHIIHUCD4wadFEWmAb
MD5:	A815C4957EE7B423E09CEC9C8683E908
SHA1:	603F9747DBD2F54842EBEDEF9802C33B9CFF005B
SHA-256:	F33387D900CF83F9AAC9F9FCC31ADEC95BCE67FA8EB0CF40697E42545B7E183C
SHA-512:	608B990FAC9D49613040680D7404E0CB0DBB212ECCF3D647FEED45A65CA3FE114929A3E0FCC1B3498FF5EC381ED28FBC3A00718C82FB9ACAE545EB1C2E03B741
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-PIGJ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5909
Entropy (8bit):	7.943851080608724
Encrypted:	false
SSDEEP:	96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xlffkuphWEYr3WYn4yJN1cgpje:eSHIIHUCD4wadhJM3W64epje
MD5:	6FE8FA7BA0A8146825660C81378CEAD6
SHA1:	E7314275055FDB6CF8C911F0EC8BF6EB1AA4252E
SHA-256:	E02143423876AE027002A032C6920FD2E598D71934982851E32D212B2C84975F
SHA-512:	A149ADBA7A77ADF743BB6794C8D1B75699C6401F7A6B3C78F9BC408CA7516CE4DB9C89C72B530D7E87BD52E566E5F8E6E74A2FF71AA2A5A83B0C3D1186C15187
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-POMU3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.922601773107069
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xiysV0mpvzVV:DSHIIHUCD4warsNpvzn
MD5:	5EEAE81D432D172CBD8DDC385B77473C
SHA1:	0127BD38D38480B225AB51C29633040B71DDC2EA
SHA-256:	413AFA3754F4DC495EC6DF207D521160E25DAC499899010CA2E6E5115753D0B4
SHA-512:	F11BB122F66A36CF1D7CA8C259FB9BBFF69DF74E41321611020FCD315FFD3C9C705408F7F3671AA8FC5F24CFF5F1B137B2C94C50E6E0D6F898F5A42D3D8F141A
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-QH3DP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	7.944073206390078
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waxZnqVCNY3rOIcG2Jx3sICK:250w0wiYSI/2n3sIX
MD5:	6A2DE9C87B82B4FC126A7BD92ACB9968
SHA1:	79ABB60B136DCA72086DD37FF16E31BE40F53CB0
SHA-256:	D0D58AD368CD12F1BA763BDB5A005920DCFB5D53442F00CC29FD8029CA69BA6C
SHA-512:	D72A6DB35105ACF258CD675BD90CC661604DE14994FE1F0F6F38AE79377523DEAE736C7C92B58E34B1C5B7244D4B394AC2053574694DBD408C7E69B603912D20
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-QUNH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6946
Entropy (8bit):	7.941692151976889
Encrypted:	false
SSDEEP:	192:eSHIIHUCD4wa6GEISLfPzl+Kk1ORkcZ9j9qHG:B50wOSLTlk4kcTN
MD5:	4E5620FEB3F34226B3939BB12577368D
SHA1:	CEDD7F19C248108CA8FF3E08C62EFEC1A89FE588
SHA-256:	6810FB9355B410432D9051DC17C3539676DFB98AB1C71F36F555E59648CFCD27
SHA-512:	C6A8D052895AA71E9C072AE39ED09768961A22989E707824CB4F63BFF0B889428BF8F397CB4FD07EC491FED29642DC3245DAF455000B18CC9AFC863E611DFC81
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-RL1JV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6102
Entropy (8bit):	7.931658452183908
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xK8cRQ1sOT7xEd3nZOtpi8B1hvC+ETZhg8:DSHIIHUCD4waARosOynZOtx1hvJKZhnV
MD5:	CC76FA416383E500E38BC8450749303E
SHA1:	B213E5A83DA87CD1CC4907FF9672624E3422BE84
SHA-256:	BFE42F46712FE15FB959B2D64C9BBFFBCBDB015DC53BC6BB7A4169DDCB20CB54
SHA-512:	577CB1BC5F9BAC449A58D61606E9D4BCD2FE3FB5E3847D24D8992B5F836D154C71BAE9789407C2F0D4EE1C6A4ED59EF67542776686A688D267BB8E8F67B63E52
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-RSJ9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5286
Entropy (8bit):	7.919096339606273
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xnNHVcqdirl0Kp1C3nZtDtGED+2U84:DSHIIHUCD4watcqdiuo1OZN+Pn
MD5:	C1DD988FFB8BEACBD72D382B58CE7B49
SHA1:	4312E1D714B4F2BBF25CBA0FF0B13F006B37DDE2
SHA-256:	BEF0084A9438CA77128F8E3A2EB7037C006BB038695EC7B57F6C11696C226061
SHA-512:	B804A254D43291E73EF478729E0FA4923F93FD1B76338B99E18CF020DAB6E3EDF2B47A62832C0CA9FD78E3C441141998C985149E12076EBDE1DDEA7D4CB8EC32
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-T5CES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5251
Entropy (8bit):	7.914552592925923
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xXWkZuVMi7+DuqIT:DSHIIHUCD4warPLCqE
MD5:	9E11A3F1889C0C37459C555335724ED8
SHA1:	63A83857102DCE8284590E1A7B730B1F674AA447
SHA-256:	0BCD15BFD255711C5254020072CCBA8344836ED6BF40ADEA134F6A87BB31728E
SHA-512:	842C4DDE5071613E82AE1969283CE1B40297C9BFC344122C306DA8B8F12D61EF5DCD8003192D16FAC9F981C7668649D42AE3A28259DB0A987C72FC6BFADE422D
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-T7K4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5923
Entropy (8bit):	7.94549113759105
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlOV/2Tp7NZcuDC62lG1sMNLVYCea5Fa/R:DSHIIHUCD4wa0WpRm6aOlnYzqZzJSOrO
MD5:	A36C79AF24FFC5CF60CE48A0D8AC91C8
SHA1:	A72EB372B7120626EAB15F65FEE1DE0B21017309
SHA-256:	933E44985ED6F8B7E0A2DDD87450D2B10E0399CC7CD2B4B5D0BA7465851D0C21
SHA-512:	800A014121F6C02246F1728E03217DEFB4402EB6341CCD62E7B0401912B4F1E7962320C00225E3A424DE285120B0B2CFF6C9B2C1D4B4DE6BA8FA885050B3927C
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-THC3H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6147
Entropy (8bit):	7.927412347943324
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xx6S/sGLGHjhCUUDKlu+Pl6htvOO72DQmp:DSHIIHUCD4waZ/sGc5U6N6htdSDQf2EA
MD5:	65D419890C0B4AD328A1130442B0318B
SHA1:	061A02B66D5A591E747F7952812C52A36738A5B4
SHA-256:	E45C5AD392B5088C5F5D287176669E376BB5DA0FF8B66EA2A4B43627DE6CB470
SHA-512:	CD7593F8227F2A28A7262DB23642EA86D3C10B1D4AC7642FE8BC02CC9A282C4002093C1CBF3E98D5F2D6EC4138FF0A37A79B9F26F312FD4FB0F21672C6CC7875
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-TPEB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5823
Entropy (8bit):	7.926348962572957
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xSpYppsDIGATsZ6y4c7JFdGo0+XdGfLCIn:DSHIIHUCD4waQMsDlATry4avdGJMGjKM
MD5:	00D057509584EF0D20A1E880390A7F6C
SHA1:	0F3982646AE1889F37B97F0231C1F819E514CC4B
SHA-256:	36D37F8EFF648979A6A1CAA7E5B893847872577EEFF41AE1BE6213E113605494
SHA-512:	61720E11D7AD88958BE8608694FBAD647FC105E4AECB64E188A87A7328AF48C4118155159FE6E3D029EB26369F9D543A2C0259EAFE731ADC9700EA87C05A0587
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\is-V5MFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6178
Entropy (8bit):	7.931508771766521
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xrzmbEKbGPgKEbN8/bE3pSrAHFvCAYnbNw:DSHIIHUCD4wa6BbGYRRgrOFvCbbzA4W
MD5:	0AFB199A6A561570F2E3D3E78DF1C92C
SHA1:	EF6294A89713AB0BF5A15E982BD858D899C5AD78
SHA-256:	D5808102DC7155644B55A421EBAB16CBBA45C868543FC675117904A98EB16592
SHA-512:	B15AC2BC9A3850D3B34A0F72FD2904650ECCBB9282AD404272D31E1DB3DAE0871D74A005EC051CFFDB44F006CA8EB6A9A3DF9C36518A4875B74E56DF445A63DF
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6215
Entropy (8bit):	7.927951948392497
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4wajUZcI/3UhSypunLrHdXYCF:250wXZcIId0nPdlF
MD5:	28F5766D3AB6E91427E8740F408BC36F
SHA1:	1049DC973A0A20950E5246930067A39712C28533
SHA-256:	25FEC92372BB6D4706727EC4E2BD8493973E23B1CDC57916E9A37021C3E377CF
SHA-512:	93580531E8CA1049558E1B8523A31CE2D5D1F9693F4AB9B9B636814DFF76DA9447D291E9340582F9A1697C401206916F8EC3727523F9091F16BE519BB694B498
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j0.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5748
Entropy (8bit):	7.93759093298806
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xEbs9i9abbNE5U1inPWvj5XYy1O2VKvMC5:DSHIIHUCD4waOY9FNE5UEnevFXYy1MME
MD5:	78F5B629DF161FE2BDC6BC3E8E219906
SHA1:	F399C6897C234F59B83CFF8BF7517EE037CD8526
SHA-256:	6E2465950B04F684CE62986DDE884055DF55368D6F96E9EC4DC0BCEB926008B3
SHA-512:	403B57658E9966272DAEDCCAD0775C369481A495F1B0DED69384D152664B37FFA9D7FD95F43C68BA912F009FB2971EC3C6F2617F64A03C2AB407FCA7078C259E
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6640
Entropy (8bit):	7.944040955189513
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waJhPm+JydmnO+bds4gSJjV9:250wehO+cwO+bdBgS5V9
MD5:	BC8A02723DF9394A24A3F89DF1C66C3E
SHA1:	A93C7F3803E9F7BC96010378295EEBE046B7F8A8
SHA-256:	CA235B8F7E606DC2A6F2F5B14649F1C286EBB551BA1DFA1AC5FA4C9902348F6C
SHA-512:	C3E11657067087D7433ADA411A6FF0157CA0A8445F89EE450172E156EE302B3767441286A13DAF705E5416809134FF58F48482583705C3F17137DA6418D9BD10
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5286
Entropy (8bit):	7.919096339606273
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xnNHVcqdirl0Kp1C3nZtDtGED+2U84:DSHIIHUCD4watcqdiuo1OZN+Pn
MD5:	C1DD988FFB8BEACBD72D382B58CE7B49
SHA1:	4312E1D714B4F2BBF25CBA0FF0B13F006B37DDE2
SHA-256:	BEF0084A9438CA77128F8E3A2EB7037C006BB038695EC7B57F6C11696C226061
SHA-512:	B804A254D43291E73EF478729E0FA4923F93FD1B76338B99E18CF020DAB6E3EDF2B47A62832C0CA9FD78E3C441141998C985149E12076EBDE1DDEA7D4CB8EC32
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5251
Entropy (8bit):	7.914552592925923
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xXWkZuVMi7+DuqIT:DSHIIHUCD4warPLCqE
MD5:	9E11A3F1889C0C37459C555335724ED8
SHA1:	63A83857102DCE8284590E1A7B730B1F674AA447
SHA-256:	0BCD15BFD255711C5254020072CCBA8344836ED6BF40ADEA134F6A87BB31728E
SHA-512:	842C4DDE5071613E82AE1969283CE1B40297C9BFC344122C306DA8B8F12D61EF5DCD8003192D16FAC9F981C7668649D42AE3A28259DB0A987C72FC6BFADE422D
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5823
Entropy (8bit):	7.926348962572957
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xSpYppsDIGATsZ6y4c7JFdGo0+XdGfLCIn:DSHIIHUCD4waQMsDlATry4avdGJMGjKM
MD5:	00D057509584EF0D20A1E880390A7F6C
SHA1:	0F3982646AE1889F37B97F0231C1F819E514CC4B
SHA-256:	36D37F8EFF648979A6A1CAA7E5B893847872577EEFF41AE1BE6213E113605494
SHA-512:	61720E11D7AD88958BE8608694FBAD647FC105E4AECB64E188A87A7328AF48C4118155159FE6E3D029EB26369F9D543A2C0259EAFE731ADC9700EA87C05A0587
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5868
Entropy (8bit):	7.935013260302147
Encrypted:	false
SSDEEP:	96:DSMllcHitlIxv9vk7C1+I4wWHLihk/xlCsAUQ5dAWne91eJRLZJi8dJJ/8X0:DSHIIHUCD4waOGMdAbQLZg8dJiE
MD5:	5A6252AEA892CD45BE012F7CC93715CA
SHA1:	792D3D9827B555740FD6D0B09183552661650A23
SHA-256:	139E87666E0F3ED7DEBCF66EE9E4733132110E7C4FA2B7CEA1F0B738C7BF3D2C
SHA-512:	BCA61C277F7A1EB5643151FD2DF3534EEB1F059257AB4F099462184C76285249B5396B3906BAE9596A4FF5B938B47C97E8CA598C5B42B6F6638955AE95E09846
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\headers\j8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	7.924215824851051
Encrypted:	false
SSDEEP:	192:DSHIIHUCD4waz97C+lnNaG3+ubKrc7KRRlmuAO:250wA7CenNaG3DKI7KRR9AO
MD5:	0DBB2A89233D8A6B935F3A46D82F1D64
SHA1:	B2EFD2A71197A041C08729D08C9931E7E6B8EA4F
SHA-256:	DF664862B3822385203548885BE93308EC87D627AB4320B249F5381F34A212B1
SHA-512:	52759463D5EFFB1FA58C225FA13C95D47021BD9B2E0BECF5A1E5D08E1D48E12EAD0A56F59DB965792D2F885A8858BDC9F38570DBD793573507308944B6CCFB57
Malicious:	false
Preview:	.PNG........IHDR...(...(......./:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3035056
Entropy (8bit):	6.570980510330125
Encrypted:	false
SSDEEP:	49152:C1gSCl49+WxhtZDEJWSgBasmfNQvSRfLXUF7dWTOTAvNDA1jl:C1R9NtZ28yLXUFJmEB
MD5:	EB91F2CD1AA06B56E8A5413A306136FA
SHA1:	C6E05CBAF792EEC2F810D4F7BFB82CC216152077
SHA-256:	9EAAD670832782C294F8701E3D79AC6EC039072ADB4533B40B8155147C6453D1
SHA-512:	AB1F48308454D1EA3EBD25F3A676AD9A2C9FAA0F995EA0B8DDEA61821C1A1AFDC5FC458512AA4FBDC872E8C754C734F7C95CD3C5AC84D713C62DDEA4C01D043A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-06S8G.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....)#a.................d'..........'.......'...@.........................../.....N............@...................@).......(.(5...@-..............,...#...p).0............................`).....................l.(......0)......................text....@'......B'................. ..`.itext..\|!...`'.."...F'............. ..`.data.........'......h'.............@....bss.....j....(..........................idata..(5....(..6...X(.............@....didata......0).......(.............@....edata.......@).......(.............@..@.tls....L....P)..........................rdata..]....`).......(.............@..@.reloc..0....p).......(.............@..B.rsrc........@-......n,.............@..@............../......,..............@..@................

C:\Program Files (x86)\Wise\Wise Care 365\is-0ETB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	ASCII text, with very long lines (870), with CRLF line terminators
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	4.9997611182520005
Encrypted:	false
SSDEEP:	96:mE1rDYW2e5gb+/mGQez/m82F21zZDo9qTXx33YK7woCwKnXKm/IAc6orxinI:R9Zf5g24o1zZ092NU1nXHQhL2I
MD5:	4A0F1A666912E64F1BA811FC24D7135F
SHA1:	DCBADD9698E306F0CD6E80737FC44F53336CF36C
SHA-256:	D6B418C619BA7456B594DFF10C3FACE4AC28609A64F2BF5E635292D7FF4F57E5
SHA-512:	36EBA1CC1C0AC8D5FEE7E88FD90B01EE800945EBED45EF92ADF64E4AA356A2AFE9ACC6B07CAE478CC467CA62B4A7895CECC3AF9BBDF93C2A9C2271253ED00342
Malicious:	false
Preview:	END-USER LICENSE AGREEMENT FOR WiseCleaner Products..=========================================================================..IMPORTANT PLEASE READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE CONTINUING WITH THIS PROGRAM INSTALL: ....WISECLEANER.COM End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and WISECLEANER.COM. for the WISECLEANER.COM software product(s) identified above which may include associated software components, media, printed materials, and "online" or electronic documentation. By installing, copying, or otherwise using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. This license agreement represents the entire agreement concerning the program between you and WISECLEANER.COM, (referred to as "licenser"), and it supersedes any prior proposal, representation, or understanding between the parties. If you do not agree to the terms of this EULA, do not install or us

C:\Program Files (x86)\Wise\Wise Care 365\is-0KH1K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2680240
Entropy (8bit):	6.356218503295663
Encrypted:	false
SSDEEP:	49152:Hg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2tY92:HvqPCnrN4azvSYV/
MD5:	A7F5051B66AD0D9965C6DC9DF8955ED4
SHA1:	36EB44DEB6ABBB0A3105F652D003AB0942618FF9
SHA-256:	30F85D8F31A30BE60C53CBDCEEE0BAC067E2664BBB090CB102975D8EB8847072
SHA-512:	BAE4526B493B353F0DCD3D5712E3161D3BF025F215FBA9A61C2C6AA0AA11F4F60AA46132CC28731C1A8560E4EF00168E998CCC889A15ABA2C69157D316B7E6A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....]..................$...........$.......$...@...........................).....jU)...@......@....................&.......%..5...@&..T............(..#...................................0&.....................D.%.@.....&......................text...8.$.......$................. ..`.itext...&....$..(....$............. ..`.data...DZ....$..\....$.............@....bss.....q...@%..........................idata...5....%..6...(%.............@....didata.......&......^%.............@....edata........&......h%.............@..@.tls....D.... &..........................rdata..]....0&......j%.............@..@.rsrc....T...@&..V...l%.............@..@..............'.......&.............@..@........................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9148336
Entropy (8bit):	6.780757366155507
Encrypted:	false
SSDEEP:	98304:jlO2duwJ/p3HHkUB9ew76CXmFrV60gOncO5x7TiHqYg94P:BOyb9r7evCgr+OnTlYhP
MD5:	1F166F5C76EB155D44DD1BF160F37A6A
SHA1:	CD6F7AA931D3193023F2E23A1F2716516CA3708C
SHA-256:	2D13424B09BA004135A26CCD60B64CDD6917D80CE43070CBC114569EAE608588
SHA-512:	38AD8F1308FE1AAE3DDF7DBC3B1C5442663571137390B3E31E2527B8FEC70E7266B06DF295DF0C411FCC500424022F274FD467D36040DEF2E1A4FEFF88C749B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-0OCO8.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................\b...)......xb.......b...@.................................;............@....................l......Pl..O...pu..............t...#....l.H.............................l......................]l.......l......................text....!b......"b................. ..`.itext..,9...@b..:...&b............. ..`.data...x#....b..$...`b.............@....bss..........c..........................idata...O...Pl..P....c.............@....didata.......l.......c.............@....edata........l.......c.............@..@.tls....X.....l..........................rdata..].....l.......c.............@..@.reloc..H.....l.......c.............@..B.rsrc........pu......jl.............@..@............. ......................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\is-1C06C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	4.854821110610751
Encrypted:	false
SSDEEP:	192:OK/Lqhx9COywG4jGsPwq0owIwOs0Y1VtQVRuVEMcKaY5kIwfcD4cjmj6xsQAV8tF:OK/Lqhx9COywG4jGYwq0owIwOs0Y1Vtb
MD5:	95D94AB71FF2D1D22401AD824FF67B0C
SHA1:	C26C2061C256E9FFBE413CEA4F41153422DC9DEB
SHA-256:	42F9DE7641098FF03B904D2981209BC085064560EFD03BE68A08F3D552EA2B63
SHA-512:	D8DC7CF66183C84482116C0DF60C330C0BF6090C1C4D45A7AD1E77D1FD7CBDCDE803E5B3186D916F06D6A1F032878D811F2E54547BF4327B79D52AE526AB9D13
Malicious:	false
Preview:	{"skins":[.....{"skinname":"Christmas-2021","skinurl":"http://www.wisecleaner.com/theme/v6/Christmas-2021.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Christmas-2021.png","vip":false},.....{"skinname":"Air","skinurl":"http://www.wisecleaner.com/theme/v6/Air.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Air.png","vip":false},.....{"skinname":"Blue-abstract","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-abstract.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Blue-abstract.png","vip":true},.....{"skinname":"Blue-light","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-light.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Blue-light.png","vip":false},.....{"skinname":"Bridge","skinurl":"http://www.wisecleaner.com/theme/v6/Bridge.wskn","previewurl":"http://www.wisecleaner.com/theme/v6/Bridge.png","vip":true},.....{"skinname":"Blue-texture","skinurl":"http://www.wisecleaner.com/theme/v6/Blue-texture.wskn","previewurl":"http://www.wisecleaner.com/

C:\Program Files (x86)\Wise\Wise Care 365\is-2137K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170416
Entropy (8bit):	6.617746620907792
Encrypted:	false
SSDEEP:	3072:Q6aBKvKQg+RXSqxk6hOh87P6v/QgtZhbxAbN4KgbGC5lhjzWanS7htfUrkOVIB:Q98CQg+RXSqxk6hW87CvRRYN4KPC5WaQ
MD5:	47A72FF4AA7DF3BB5B29ADA4B6A5EAED
SHA1:	134F00B03C38F9AC2E2549B39B31F62A1C871B9D
SHA-256:	18B7F367D8EC6BDAA6618744051E5FF25BA317D2731C2706DC7B5DFDE296E37F
SHA-512:	6A5036A9205D6EC1B493CDACAD78FBD86E4B7F1319776EA64867C1208DAF2C0F103B20C1F0FDC511AB7B999393AA87B66ACE8D529E95A95A5958117FC2D18054
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..n2fn=2fn=2fn=...=8fn=...=.fn=...=+fn=..=4fn=.8m<$fn=.8k<.fn=.8j< fn=;..=?fn=2fo=.fn=.8g<'fn=.8n<3fn=.8.=3fn=2f.=3fn=.8l<3fn=Rich2fn=................PE..L...OE.\...........!................/................................................r....@..........................9..0...@F..P....................v...#..........0...8...........................h...@............................................text.............................. ..`.rdata..z...........................@..@.data...D....P.......D..............@....gfids.......p.......R..............@..@.tls.................T..............@....rsrc................V..............@..@.reloc...............\..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-5N4PF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2555312
Entropy (8bit):	6.68571100927552
Encrypted:	false
SSDEEP:	24576:p4raF6K6ZXYELYotABBfWMKW059h6J8PwT1B+SdAIM1JhhTzEWo9JkVzmC9Bfu10:pL0dYE4J4G1sSdAIMgWo9VC9J80
MD5:	5EFBAED4F9A193752FBE806660BAB062
SHA1:	EC9B61F279B87D303898E441710DD10D6B89335C
SHA-256:	E3BB799F3B63B19EAF0D465A32A86AF1FA7B9EB2A72F30754B6FD274CCADD46D
SHA-512:	1C4850B286BFF9977DB747061190A0500929B02B70FA626AF110686A6BB46D04FBBAE6F98258531AE472BBE4C6857D2C1032A401C0A530283A15C7A8EFBB1B75
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...f/.a.................l ..j.......y ....... ...@...........................'.....4/'...............................!.5....P!.V3....$...............&..#....!......................................................Y!.......!.<....................text...LO ......P ................. ..`.itext.......` ......T ............. ..`.data....R.... ..T...p .............@....bss....0h.... ..........................idata..V3...P!..4.... .............@....didata.<.....!....... .............@....edata..5.....!.......!.............@..@.rdata..E.....!.......!.............@..@.reloc........!.......!.............@..B.rsrc.........$.......#.............@..@..............'.......&.............@..@........................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	651216
Entropy (8bit):	6.521013546809996
Encrypted:	false
SSDEEP:	12288:gGgO5VMTJY0KQa6fln7STwqm2bV5Gky9c+CqJ888888888888W88888888888s:XPVMTWTQa6f1STw8Kky9TU
MD5:	29887FFC5D12948658902E66BDAA09AD
SHA1:	58029F4FBCCAF1C548D35C213AA8E79088EEDCEC
SHA-256:	03627A4D7FFB6B2424C234C82071701B691DD8DEDC066BC8D3B4937049755808
SHA-512:	0A915FAE7634875041AA88AE3EA74903E52B28935036DB00349489AD48D0953BFCBCEE6040E924442AF194F64D16CFFC356FCECFC29952CA6F3326B870CB390A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-686UE.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...g.YY............................`.............@..............................................@..............................L1..................................................................................0...x............................text...`........................... ..`.itext.............................. ..`.data...x!......."..................@....bss.....R...0...........................idata..L1.......2..................@....tls....<............@...................rdata...............@..............@..@.reloc...............B..............@..B.rsrc...............................@..@....................................@..@................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-D7TKL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows icon resource - 7 icons, -128x-128, 32 bits/pixel, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	140206
Entropy (8bit):	6.579372382092634
Encrypted:	false
SSDEEP:	768:FUYTs+MUxrMrnxxmoeYFKwYbmWbKMnnyYyn0HtLJFRrPTDSOIuS82dP7/nA183LD:FNs+/CxYoeDmLMnLvRXS/DA9jJppppp
MD5:	BD185B875AF6E53F699096E2FE95CBBB
SHA1:	7B59C7707159FC489BCC477ACD61248E1C4A155D
SHA-256:	0A326B06AAB1FA6BA3939DB15E82CB5F4387CE9C163C6A8458ACC8C79ABD5490
SHA-512:	E9C7D2FF9A691B8981E95A9279209AFC7652C4DAA99E346437419B13266CC97F44E1AF554B4DD2A5C2608DA44EE18B6CA329A7D1E3A9FD8DF58C84D08EE07090
Malicious:	false
Preview:	............ .(...v...``.... .........@@.... .(B..F...00.... ..%..n... .... ............... ............... .h...F...(............. ........................................................................ ...&...+...0...4...7...:...<...>...?...@...A...A...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...A...A...A...@...?...=...;...9...5...2...-...(...#....................................................H).....................................'...2$..=3..OB&.`J+.lP..vT0..U1..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2

C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18762136
Entropy (8bit):	7.024245223668832
Encrypted:	false
SSDEEP:	196608:w/oJ7Fuozdzah0AvrByJgAUPMiEFC/SA8x5Q1BNZsjEwN1v:w/aFah3tagAUIC/G4HZo73
MD5:	A020B60C4DD43183E92322EBBD984622
SHA1:	0B57DEE576B4C46EA5E022D83392F1B596943E27
SHA-256:	3EA7A31F54953BF9F5B999FE57C11740D3B62BB6194C1925D967568D8414BC58
SHA-512:	E524F27DD070F918193F6D69C08D584C6966283A0CCD6AA1F059A1F93496ADD680DD32F4DDF053D97E8D8D2BE388275F333AFFD53C51F72DFA6691DA0E8891BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-HBE50.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...W..e.................<.........LH.......P....@..........................@'.................@...................`.........XX.......%w..........,..........lr..................................................P..H....@..l....................text............................. ..`.itext...\......^................. ..`.data........P.......@..............@....bss.........@...........................idata..XX......Z..."..............@....didata.l....@.......\|..............@....edata.......`......................@..@.tls....X....p...........................rdata..]...........................@..@.reloc..lr.......t..................@..B.rsrc....%w......&w.................@..@....................................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\is-JV7IH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.046858124219736
Encrypted:	false
SSDEEP:	96:YrrrrP+mmmmCIIIIFQXqHcGmix2kPeASkM:TmmmmVabmiJSx
MD5:	D8E48DE3E5710FABD066C2BC02445C02
SHA1:	D5B86BFF4CD388659633AC3D6969FEE82AED3BDC
SHA-256:	1D1E9558EDEF4CE724F93F80DC96FA5D7306D341F89BCBE61694900A409A2E9B
SHA-512:	BAF61410094AD50EA8DE5918D1688C902EE8366CB6C26CA3FC23FC6C2207001ADBEF05D2C58A1355AD80B9CE790618CCD98580A6E23364A6E3C850CC1ADBE8ED
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... .........................................................................................................................................................................\\\tkkkz444g.......4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4kkkzkkkz...4....222fkkkzYYYs...............................'...............B...Y...........Y...........Y...........Y...........Y...........Y...>...............%...............................\........iii\|...Y...........Y...........Y...........Y...........Y...........Yaaax...........\...................................-...............Y...........Y...........Y...........Y...........Y...........Y...............+...................................3\\\............o...........o...........o...........o...........o...........o........TTT....1..........................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-KVUKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	912816
Entropy (8bit):	6.899756812855131
Encrypted:	false
SSDEEP:	24576:NG22o1/ammmwbii+tOrIghOkBYxSwmvTJsvR+uVB:0k/a+g1mCOfmd+QYB
MD5:	6C4CDEEB711D06134B8DFF91BC6539F1
SHA1:	E240C89F75213A81DB75D410555DA4610CC7E386
SHA-256:	1BCE42E18B135C8C69759D137355813728C560FCAD02FD6CCC3A60FA42E744FC
SHA-512:	162132BDCD1531B11011EA15DDC73CB8516B34A6D5FB9F178A8CA670327E87A64BDF94A1D54D180CDC8E4E7627211275B5A49C528660C997B10B2BFB950C1AAC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?...?...?..@....?..@....?..@....?......?...>...?..@....?..@....?..@....?.Rich..?.........PE..L...9..Y...........!.....:...........R.......P......................................;.....@.........................@...".......(.......x................#......XW...R..................................@............P...............................text...`9.......:.................. ..`.rdata..b....P.......>..............@..@.data...L~... ...\..................@....rsrc...x............d..............@..@.reloc..X_.......`...j..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-LTPNS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8538008
Entropy (8bit):	6.8673233030027925
Encrypted:	false
SSDEEP:	98304:LFavEJUTMF+lQNtZu9SgJp2iGnl4GKCRzfU/nDthDhO4P83WOXgbue3X1:LovEg7lQoNp2BnlswziDtp6fiueV
MD5:	4E793E5FBA64A9EDCDDB922E1AA9DAC4
SHA1:	E16CAC5CD505A67754F5EA21B28ECAFBB66F8B1B
SHA-256:	FC9CA77981DDD0E810C2E88FE8CFC27DC94258D888A08083EC5CEB0E0A6A7D72
SHA-512:	82912430DEB3AB40658F15FADEA2860C7190010211773E8F17A40CAE0176A997B1AE8BFDEC71D75EFD8E5AF6EF3E364ADCA040A0A1419C129552E09ED2F2C7CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-LTPNS.tmp, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...o.[e.................:c.........8Sc......`c...@.......................... ......z............@....................h...... h.rH....q..............*........h.\|_............................h.....................t,h......ph......................text.....c.......c................. ..`.itext...5... c..6....c............. ..`.data.... ...`c.."...>c.............@....bss..........d..........................idata..rH... h..J...`d.............@....didata......ph.......d.............@....edata........h.......d.............@..@.tls....X.....h..........................rdata..].....h.......d.............@..@.reloc..\|_....h..`....d.............@..B.rsrc.........q.......m.............@..@......................\|.............@..@................

C:\Program Files (x86)\Wise\Wise Care 365\is-ML9G6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393648
Entropy (8bit):	2.9786284394853872
Encrypted:	false
SSDEEP:	3072:xozZiaeJ1/tZg9a4hKbs2dVyZVlT05jXvVIN:xoz8R7/tZJVQf05eN
MD5:	F8E1ED1B455716402A50AA9DA2C105B1
SHA1:	FA8E08EF16AF64255259A6D4D8AE61B82396E178
SHA-256:	138D2F3CFF88404660701E5936F0C3FA389622D1987A63514BFF22524C975E2B
SHA-512:	CA46B3FB918614AB4F1AEC2BCD6FA0EB7F69D1E2E4D6192700443C22C8044B532FB5AFF8E910F2811F1FF3D45B871E5A4A042D6D4973409A063745DA4F9285E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..{..(..(..(v..(..(v.9(..(v..(/.(..4(..(..(..(...(..(...(..(..(..(v..(:.(v.<(..(v.=(..(v.:(..(Rich..(........PE..L.....G[...........!.....L...................`......................................y.....@.........................`.......,...<........................#...........b..................................@............`...............................text....J.......L.................. ..`.rdata..._...`...`...P..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8659376
Entropy (8bit):	6.623622938298373
Encrypted:	false
SSDEEP:	98304:1jNjSYr3BGhxgboHTIbnqG2y/MqdM3zyfkCracXHHV+QIIeWRrCa:ftmAjDOjgBHXVLkWb
MD5:	8AA997E56D11675D3D49DFCE26DB57AE
SHA1:	A17F6BA830F7BB16745EA2D45363B3D5629963E7
SHA-256:	18561CFAAA52C6EF2C94C1BB1639A36074C007657E14D9CB3E6B7A10772F3A95
SHA-512:	EAFA6054B028D307D974FEDEFC0E9C549365C2A1937A41A95D3D3A62C1A490F3DC7485F9E5A3C95C1BCE4E1963543CFCC19FC61C2611787946561E339F25C7D3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wise\Wise Care 365\is-NN1JK.tmp, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...0..d................."u..........;u......@u...@.............................................@....................z......Pz.>A.......<...............#....z..............................z......................[z.......z.z....................text...L.t.......t................. ..`.itext...;....u..<....t............. ..`.data...X....@u......&u.............@....bss....0\|....v..........................idata..>A...Pz..B....v.............@....didata.z.....z.......v.............@....edata........z.......w.............@..@.tls....P.....z..........................rdata..].....z.......w.............@..@.reloc.......z.......w.............@..B.rsrc....<.......<.................@..@....................................@..@................

C:\Program Files (x86)\Wise\Wise Care 365\is-Q90PB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1207216
Entropy (8bit):	6.831251001057177
Encrypted:	false
SSDEEP:	24576:6RKrnv+KpPtcSPxJr/fLMQ/L00bZ9wtaCsRjpVqJb1Sbk2Mq:rjrSQ/L00V9IsRjpVqJb1+k2Mq
MD5:	8F5B0181FEF955A2E5117E4BE6F95A4B
SHA1:	4521AEE7FBCE1B08355DF47A1FA19F1052106AFC
SHA-256:	55B0F51ABD2AB649E5B4698217218782CF0B2A318964F91B24891EEED72AD62E
SHA-512:	FED3A7FB81CBE9BC44DEC5E8D78FF1DB3C0A5452D340BAA056564BA0B5F55507C0E7C0CF8AB8BBEE0EB97BF5BA60DFFB0C50C476920C489331A384F2FC9A8A72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zA.zA.zA...A.zA...A.zA.{Af.zA.U.A..zA.zA.zA...AI.zA...A.zA...A.zA...A.zARich.zA........PE..L......N...........!.....D...@.......m.......`.......................................g..........................................x.......8............H...#.........pb..............................(...@............`..4............................text....B.......D.................. ..`.rdata.......`.......H..............@..@.data...D....`...`...<..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-RHK8R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	312240
Entropy (8bit):	6.590510132433095
Encrypted:	false
SSDEEP:	6144:IIufC6zjfoH7OnJ5Kg9CNLb2ZOpbeQNXghjTqJ2DtuRt25VflKDKX0ZxM/vIO81g:IIuFzjfA7OnJ5KICNOOpbeIXghjTE2Dp
MD5:	118A53026B4F7D4E19EFF27CD0638074
SHA1:	8B75D54697529A48204441369DD703E1CAE85C51
SHA-256:	4F35E0A6C0DC447A78D37CD36EB0008728DB2ABD00FDF7673AFE38CB6B128A37
SHA-512:	34B61D312BA208B566F43ED97BA79C6264E5EC88A4298E2EBD8A6173F263E0E228799AB9DB5CDBB163545A2C37FA83B6C3C1E1CF9EE5BB66E4D8426C2C4AF261
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.}.b...b...b...EPh.`...k..B...k..t...k..a...b......k......k..c...k..c...k..c...Richb...................PE..L......N...........!.....\|...<......................................................av..............................P'..p.......<.......8................#.......'..@...................................@............................................text....z.......\|.................. ..`.rdata..............................@..@.data....P...P...6...6..............@....rsrc...8............l..............@..@.reloc...-...........r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-TBFAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45488
Entropy (8bit):	6.373366644054221
Encrypted:	false
SSDEEP:	768:ZB4UyqMIbQuN8hzebTP97pEDMXn8EdEQQVoF5iTZKV:nyq1cu+qPHnFQVoF2KV
MD5:	9DFE36B32427445A2A312D788523F85E
SHA1:	BFC5DA4B0C02342B56387DB5FFF8AF22265608F6
SHA-256:	D36647C7E7CB95F048597468F79AD8915CCBB64F7A01BD42FD1BEB11BBAD5D96
SHA-512:	973A7BE8B754C2F0A60D9E34A55B59606C89B20F1E84B8623D584D68B3ADF94B5DED1996C6672A7DE7C5B4589FB33019F01565D1699C548030C958E7BE7B0AC7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..ft.p5t.p5t.p5oQ.5g.p5oQ.5z.p5oQ.57.p5}..5q.p5t.q50.p5oQ.5v.p5oQ.5u.p5oQ.5u.p5Richt.p5........PE..L......W.................L...>...............`....@.......................................@.................................<{..<........................#.......... a...............................x..@............`...............................text...(J.......L.................. ..`.rdata... ...`..."...P..............@..@.data................r..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\is-TOP6G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1108722
Entropy (8bit):	4.165873403563338
Encrypted:	false
SSDEEP:	24576:BnxJ22jqHYaRWb7hffD+mw2c1+LZsolYkdowdlnH:D
MD5:	1761BE75F77A56AAE7C206432523C87B
SHA1:	B373518A60A2F8373FDD78CC2EA365F5CCB97A04
SHA-256:	AC79928C5802F4D65EF1E4A3079D09E86A30B90F67DE4D0F205DDB6DBF3A42D6
SHA-512:	3B7E8444489354E1A98D18B94133E27FEB2F567AC2B6F9E3D19DA90B5224AE8C982018354AF832F80AC8DE5CE21444BE50CDCA44B53D73D8C6875D097C92EA9E
Malicious:	false
Preview:	[softinfo].e62aba971f3a96a3bfc458f7c976538d=4.3.7b30081e8c8a96de130bc0f28d0dd377=4.3.cc242e2a787df48fa6b0d4759b198247=4.7.e35a6d56f5933c0f3905be43f540d700=4.7.18cc6d39014e39ac60806d71c9e052aa=4.7.fabc24aafe772aef3e98ad185d168ad5=4.6.ed9ab2660d6531acb71d7b154a20ce5f=3.5a1df7c99792e94757ae02f0b999a97d=4.8.a07c7d7bd8bce92a901ec3fe6bad7741=4.7.01fadbf1d1dca9b1a4681a417198b098=4.7.3b90f49891049c3be9c1cb6ac6dff45e=4.3.264f24b21119fc66061f1e0b904c8a4b=3.8.69d51bb3a904da00d322462232f50ae0=3.3.ddb0e9cc2d2c9575ad95a5bbca52e1ae=4.3.2f27245f1f93d30c67f3635c89413445=4.7.9601f5d62a68876f8e635ef5f23aa61f=3.9.76ab5bb19eef12f936152f9bcbf0faaa=3.6.7526ddeadff0fc805ee64626e4765d14=4.7.e065445a3b3ae0ec9d2a850fe08b866f=4.6.eb0f529034a6b15b503034f55a5ab8ed=2.4.d389c1d3714a569b35e1d170fad735b2=4.4.d41d8cd98f00b204e9800998ecf8427e=4.7.76868ae832f6c6bd26cadc7d7c269986=4.4.214b80ae10dbe21f2a2747277bf8564e=4.7.37a25c74b081993d1a122d4f0ebeb963=4.4.570bfb8bbc141986d034a1841f9346d2=3.9.5b84104a0f2974228e031c953d335

C:\Program Files (x86)\Wise\Wise Care 365\is-UR7HO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	422529
Entropy (8bit):	7.9967259675992395
Encrypted:	true
SSDEEP:	12288:Z42OHRnArC3OT5bd1Ny6hTAYX0lCaq1p9QamI65k:+2OH3Ih11TAquCaq1pCafL
MD5:	4F001D0E372BAEF55838F46888E460E4
SHA1:	50450528413983B274823B87214CE6B92AACE3AD
SHA-256:	BD4C6E3FCA00C524FFDF8B1F4B491A78041F9F7E871AA1DA506B341C509CEA5F
SHA-512:	F4D01C4F9F13DAD555083F04994B64408B8A705BDDC28E608368D71FB0B39A79F472A0A46AEB943C4C317177E4F61FDEF613C194B75E19AA0F77E216190FD0A8
Malicious:	false
Preview:	PK.........:A@.&Z...P.......1.png:.kQb.d.y{.....S.'V.`..,....=P.a..."........nl....G..C....\|....m.......i......[+...{..u.\w&.@S..5..VP.i.C.E.3....U<.8BY...&Mj.(...Vpc.N.....b.J.U.?l..p,0.\8x.......b.F....9...y....y^.3....@B.#.<\....b.a..P.%q......YK.~.z...Z..Z{.$:..t..8.,../`..j.8.9.K^.W.E-q......?j.......b....lhU..o].Ao.......q....+()]r.....g..u.t.Bf.2..b....-+.T......I.\|. b..c'.;. ...\|...H.`t"...}>.t..NQ....W.^...{WG.Jq.....!0m...1..dy.t}O{...p..j.j.0..~B...\.['.?.J.>.:..o.:8..K...A.\|.p.L.T..+}......Wd.8.."K.J....Ny.TMl$w.p..ng....t&.......K...f...2......j..L..&..{......"T).p..3.......zG.=h'..kL.x.L.~."...v#.g.@.Rm...H..e#.1....TN.y4.......#*&.n7.zY....%jr....9......6.... /...r.!R...&..I.P]..E..N...XCQ.y..z......o..) 1.d#.-....Cc....n.....j...Id.D.`..J...e...E#r..K.%.R. .yR>.?..w...g`I.`U.......t.\|.0.._;N.\|_..9\|..q....?.C....tR.O}...v....d...#[ZK....#9..[..J....n[.1...~.X.B ..$S....8%b....n...T`.l..5..#=O.._J..p.52.....wb.

C:\Program Files (x86)\Wise\Wise Care 365\is-V74T2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Microsoft HTML Help Project
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.941091908061598
Encrypted:	false
SSDEEP:	6:O1MSif6609FXTb2eMScrT7cMrQYvsOJPd4MKoQXgGgqzofeove9LMJn:O1M3PqFX/2eM3rFrF7JP2TXgnqzo2/L8
MD5:	A0EAC4D8F4EE86740825896D8165532F
SHA1:	0788F2DA879B57ED54D77BC179A4858A35B3DF61
SHA-256:	C0D303506CB38836309D910D2D4131D9C161C9C19387DB375EAEE3812524A1EA
SHA-512:	64A62416C65AEDE86A2402569E00ECE1FDA6EEBC35F6B6E25DAD0DC7033DF46BBA938E74CFB0405C47662D8A457A11F569D4B90013CAB911440EB268707A5381
Malicious:	false
Preview:	[Options]..FileSizeLimit = 100..;If you don't want to defragment your large file (e.g. no less than 100MB), please set FileSizeLimit=the size of your file (i.e. 100)...FragmentsLimit = 0..ExcludeFilter = system volume information;temp;tmp;recycle;.zip;.7z;.rar;.mkv;.avi;.rmvb;.mp4;.iso;..;IncludeFilter =

C:\Program Files (x86)\Wise\Wise Care 365\is-VM9DB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1456048
Entropy (8bit):	6.5930859039642336
Encrypted:	false
SSDEEP:	24576:J5OX+5nxz7z+YV8yNPGCcFs2DhrsbBqSNv450hL+3HSDM1XaE7b1hGG3:J54qRzzxKrsbsSNC0+3HOM1X3v1hG6
MD5:	967CA4A63CCB65C547ACD3BE7631D0AC
SHA1:	1014384A33CB8B9E5859263467EBD9702873F314
SHA-256:	18DAFD7D8F3DBA61F99C233C3A7E2360EAEE4F5255820C6A046042CA99F0DD4D
SHA-512:	1D24E4CE725AEE4DEB43685549A89BD04FF3C05FF77D9F16B80C81F2F945DE025581E6B75835C7EA52FFD53651D6CA7229714E9F9E9E3C3B7AF05A190F5E3DB8
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......[.................n..........8.............@..................................w.......................................@...;...@...l...............#......d....................................................J...............................text....R.......T.................. ..`.itext..X....p.......X.............. ..`.data....M.......N...r..............@....bss....XT...............................idata...;...@...<..................@....didata.............................@....edata..............................@..@.reloc..d...........................@..B.rsrc....l...@...l..................@..@....................................@..@................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1207216
Entropy (8bit):	6.831251001057177
Encrypted:	false
SSDEEP:	24576:6RKrnv+KpPtcSPxJr/fLMQ/L00bZ9wtaCsRjpVqJb1Sbk2Mq:rjrSQ/L00V9IsRjpVqJb1+k2Mq
MD5:	8F5B0181FEF955A2E5117E4BE6F95A4B
SHA1:	4521AEE7FBCE1B08355DF47A1FA19F1052106AFC
SHA-256:	55B0F51ABD2AB649E5B4698217218782CF0B2A318964F91B24891EEED72AD62E
SHA-512:	FED3A7FB81CBE9BC44DEC5E8D78FF1DB3C0A5452D340BAA056564BA0B5F55507C0E7C0CF8AB8BBEE0EB97BF5BA60DFFB0C50C476920C489331A384F2FC9A8A72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zA.zA.zA...A.zA...A.zA.{Af.zA.U.A..zA.zA.zA...AI.zA...A.zA...A.zA...A.zARich.zA........PE..L......N...........!.....D...@.......m.......`.......................................g..........................................x.......8............H...#.........pb..............................(...@............`..4............................text....B.......D.................. ..`.rdata.......`.......H..............@..@.data...D....`...`...<..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\skin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows icon resource - 7 icons, -128x-128, 32 bits/pixel, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	140206
Entropy (8bit):	6.579372382092634
Encrypted:	false
SSDEEP:	768:FUYTs+MUxrMrnxxmoeYFKwYbmWbKMnnyYyn0HtLJFRrPTDSOIuS82dP7/nA183LD:FNs+/CxYoeDmLMnLvRXS/DA9jJppppp
MD5:	BD185B875AF6E53F699096E2FE95CBBB
SHA1:	7B59C7707159FC489BCC477ACD61248E1C4A155D
SHA-256:	0A326B06AAB1FA6BA3939DB15E82CB5F4387CE9C163C6A8458ACC8C79ABD5490
SHA-512:	E9C7D2FF9A691B8981E95A9279209AFC7652C4DAA99E346437419B13266CC97F44E1AF554B4DD2A5C2608DA44EE18B6CA329A7D1E3A9FD8DF58C84D08EE07090
Malicious:	false
Preview:	............ .(...v...``.... .........@@.... .(B..F...00.... ..%..n... .... ............... ............... .h...F...(............. ........................................................................ ...&...+...0...4...7...:...<...>...?...@...A...A...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...B...A...A...A...@...?...=...;...9...5...2...-...(...#....................................................H).....................................'...2$..=3..OB&.`J+.lP..vT0..U1..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2..W2

C:\Program Files (x86)\Wise\Wise Care 365\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	912816
Entropy (8bit):	6.899756812855131
Encrypted:	false
SSDEEP:	24576:NG22o1/ammmwbii+tOrIghOkBYxSwmvTJsvR+uVB:0k/a+g1mCOfmd+QYB
MD5:	6C4CDEEB711D06134B8DFF91BC6539F1
SHA1:	E240C89F75213A81DB75D410555DA4610CC7E386
SHA-256:	1BCE42E18B135C8C69759D137355813728C560FCAD02FD6CCC3A60FA42E744FC
SHA-512:	162132BDCD1531B11011EA15DDC73CB8516B34A6D5FB9F178A8CA670327E87A64BDF94A1D54D180CDC8E4E7627211275B5A49C528660C997B10B2BFB950C1AAC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?...?...?..@....?..@....?..@....?......?...>...?..@....?..@....?..@....?.Rich..?.........PE..L...9..Y...........!.....:...........R.......P......................................;.....@.........................@...".......(.......x................#......XW...R..................................@............P...............................text...`9.......:.................. ..`.rdata..b....P.......>..............@..@.data...L~... ...\..................@....rsrc...x............d..............@..@.reloc..X_.......`...j..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	312240
Entropy (8bit):	6.590510132433095
Encrypted:	false
SSDEEP:	6144:IIufC6zjfoH7OnJ5Kg9CNLb2ZOpbeQNXghjTqJ2DtuRt25VflKDKX0ZxM/vIO81g:IIuFzjfA7OnJ5KICNOOpbeIXghjTE2Dp
MD5:	118A53026B4F7D4E19EFF27CD0638074
SHA1:	8B75D54697529A48204441369DD703E1CAE85C51
SHA-256:	4F35E0A6C0DC447A78D37CD36EB0008728DB2ABD00FDF7673AFE38CB6B128A37
SHA-512:	34B61D312BA208B566F43ED97BA79C6264E5EC88A4298E2EBD8A6173F263E0E228799AB9DB5CDBB163545A2C37FA83B6C3C1E1CF9EE5BB66E4D8426C2C4AF261
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.}.b...b...b...EPh.`...k..B...k..t...k..a...b......k......k..c...k..c...k..c...Richb...................PE..L......N...........!.....\|...<......................................................av..............................P'..p.......<.......8................#.......'..@...................................@............................................text....z.......\|.................. ..`.rdata..............................@..@.data....P...P...6...6..............@....rsrc...8............l..............@..@.reloc...-...........r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\AutoShutdown.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1963
Entropy (8bit):	5.055017473158446
Encrypted:	false
SSDEEP:	24:2d593RLPYEEwGLGtAQOeaxMLjFrfC7HDOf/FuNqCM6TVnN0V6s6rWn9l6VD+QJix:cLpOytTr4Hy1uNRMKk6rkX2i2Byzdn
MD5:	2B3100BBBCCF5DD9FBD6E51848765DB8
SHA1:	77655EC4F57C7F960849242EE3CA47F4792B156A
SHA-256:	6CC9AE74EEBF468BE9689EC0B3C0D68384B4CAB3242FFCC0892FD4AA3A55578A
SHA-512:	AEF6BFA3320307E58159478C13696A7FE614B147679A315592A1AF04BE2D74FA83C464DA23E246B3760A32506514B9D64E3F97CBE033818509AB3815089823AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Auto Shutdown</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Auto Shutdown" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#4D9DE0" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M18.0009711,26.7 C13.194073,26.7 9.3,22.8039848 9.3,17.9990289 C9.3,14.4254158 11.455821,11.3587119 14.5361

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\DateRecovery.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3137
Entropy (8bit):	4.830401809891447
Encrypted:	false
SSDEEP:	48:cLpZo3yt8XcoHyu5YkZc0u/BwPcSJyhssrgiMOUi5KYjXEAlANPd5:WZOXF5dc0PohssrgiMa5KYj0AlAx
MD5:	D96C9920A33DB25880C12CAFA8DD83CA
SHA1:	05C22E14A9F9024E6B89723FDB92A180F3355B2E
SHA-256:	E302398C76130026F3FA76131672B9479D88F2A119075D2C723A928EA4BD90C0
SHA-512:	D8DCCDDA1C20A11864374678530A77D2EFBF3E96BFB1AB13BD53C8946B0B2A52344727D07AAFE566F9DB080524D9FEF940CD3CA98C1A38EC336BFC5A37D3B003
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Data Recovery</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Data Recovery" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Utility Icon - Wise Data Recovery">. <rect id="rectangle" fill="#13BF86" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M20.5139966,22.5069606 L20.5139966,19.775094

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\DuplicateFinder.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3348
Entropy (8bit):	4.751905370912879
Encrypted:	false
SSDEEP:	96:WOjYuB5hp856xN8WofGpKdY5vVZtt4EoXn4m:bkuvhB0GLVnt63Z
MD5:	170A4B795CEF3E2B5E6184E6FCA4A698
SHA1:	E84FB034745E424CD4783EE603829F4C6AC4703E
SHA-256:	A3DBDBB4E21A9A54B256DD8C7F1F17459463DE6A63754E8726FEA13CD39374CD
SHA-512:	5F0920A0FBA30DAF377A8F03678F2A4E1D35DD4D583DC469BBB50A95D55DBB90923E6314855B2DF1A01695FBD6704C8671A2F567A314E80E9DD94CD47165F753
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Duplicate Finder</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Duplicate Finder" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#6086B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M24.1625,12.8902333 L24.1625,11.0625 C24.1625,10.4756975 23.6868025,10 23.1,10 L10.5625,10 C9.9756974

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\FastSearch.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	4.917980202910924
Encrypted:	false
SSDEEP:	48:cLpm3yt2u4HyxoVxevT7XgJla7Da/TXWbP2Pd37knPKLzmPWaqWdn:WmEXgJEDaMkd37YPKLzmPWDI
MD5:	7D5D197F5CB0611CC75DDA197AE8EBA0
SHA1:	A5B2A943CDD3BF9AE423B6ADCE10E0A238169A14
SHA-256:	F8E59D250E4AF0261E549A79D5282F838FB816AD2DCC219EF309177958106E09
SHA-512:	7B8F29D4157FDD439681649061A6722A0C16F865F0F53D22A401EE712F240A5D48B528AC29A005BB8D2DE6D3F8191B693BCF2DB86CCC041B69BBE2DEBB0CA7AE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise JetSearch</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise JetSearch" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#3CA7FF" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M17.0364062,9 C19.0931562,9 21.1499063,9.78372551 22.7197813,11.3535515 C25.4890313,14.1227149 25.8096563,18.409456

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\FolderHider.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	4.792077972269818
Encrypted:	false
SSDEEP:	24:t/cahdqHyM/Kg3yVEkc7VpebVUcLFsvM/KfZ2ddppmcKwr86m1HqqU+WTlOr/0oZ:W2dmpQ+zZ2qcKI8zKqUUrh95
MD5:	0F9E7177F0CB1EC8A45208BE94AEDE13
SHA1:	453B1C0208E3CF4F5F64FC8D66320F3DEE879848
SHA-256:	CBAFFC932A05D28F6032C31D3CF5817D23E3FC5492FEC0F6CB0DB1458C0C0662
SHA-512:	EC0738341B18D0D042A07319A6790AD6604983E09CCD2972967D016F3392F744345657CC2988CE3A81682CB3AA748E5DB76917E42E2A3AE1C92F1385394C4F15
Malicious:	false
Preview:	<svg .. xmlns="http://www.w3.org/2000/svg".. xmlns:xlink="http://www.w3.org/1999/xlink".. width="44px" height="44px">..<defs>..<linearGradient id="PSgrad_0" x1="0%" x2="0%" y1="100%" y2="0%">.. <stop offset="0%" stop-color="rgb(55,151,235)" stop-opacity="1" />.. <stop offset="100%" stop-color="rgb(99,174,240)" stop-opacity="1" />..</linearGradient>....</defs>..<path fill-rule="evenodd" fill="url(#PSgrad_0)".. d="M21.999,0.0 C34.150,0.0 43.999,9.849 43.999,21.999 C43.999,34.150 34.150,43.999 21.999,43.999 C9.849,43.999 0.0,34.150 0.0,21.999 C0.0,9.849 9.849,0.0 21.999,0.0 Z"/>..<path fill-rule="evenodd" fill="rgb(255, 255, 255)".. d="M32.0,32.999 L11.999,32.999 C10.343,32.999 9.0,31.656 9.0,29.999 L9.0,14.0 C9.0,12.343 10.343,10.999 11.999,10.999 L18.999,10.999 C20.656,10.999 22.0,14.0 22.0,14.0 L32.0,14.0 C33.656,14.0 34.999,15.343 34.999,16.999 L34.999,29.999 C34.999,31.656 33.656,32.999 32.0,32.999 ZM19.52,19.438 L17.299,17.285 L16.329,18.75 L17.926,20.35 C16.607,20.862 15.225,22

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\ForceDeleter.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.96733030091051
Encrypted:	false
SSDEEP:	48:cLptxytaE4Hyr+U7uxzmc5SfR29PXcEACxMkEEXdn:Wtvw+U7wmcMJyfcEACPF
MD5:	61DB297B0F6565B4A555824EA5BE93BF
SHA1:	E17BBD1DB8B1CEDC611250DDD6B31496E17A0AD2
SHA-256:	4750E9B9B8962A4035E6E492A0C6DCFD7BF5A0CF717CD1A720318E44130A63CB
SHA-512:	798C7CA4EA4A9B23235F1F4772649FE2F71A9551EECE67550B6BD559FDC8C73F2CA51C18453730CBD0ED46CC877926CAB72FA17EE1E8332F40E9CF0F541367F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Force Deleter</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Force Deleter" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#6086B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M10.6,12.3949676 L10.6,13.0021836 L10.6,13.0021836 L25.2,13.0021836 L25.2,12.3949676 C25.2,11.5665405 24.52

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\GameBooster.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	4.737537692264919
Encrypted:	false
SSDEEP:	48:cLpVytD4HyTYFfPR/rE1A1fXw/42SUO8fZ6MGphd5RByfCFuBpirRgIydn:WnZEO1fXVZSsHfNBUKuBpWRK
MD5:	117BC13C71EF1EDDB52700ED8DF1B7F0
SHA1:	06BF383DE837FE1D832C15D86E2ED093FC4EDF2A
SHA-256:	C6F93FA888F077BEE27087899BB08842857CF75757D1098056F0D042CF2B81EC
SHA-512:	E5949FAF6F493F5A7B10BA7C167FAE8DB7B439580CC5E3A6FC1339EEC9D7B26385962B8A5C51649ED58D7203314B6773A7496E00ABA50F71E69355E5834BEED0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Game Booster</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Game Booster" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#2F93EB" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M18,23.5 C18.4700995,23.5 18.8575482,23.8538702 18.9104996,24.309764 L18.9166667,24.4166667 L18.9166667,27.16

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\MemoryOptimizer.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2749
Entropy (8bit):	4.8902810774147865
Encrypted:	false
SSDEEP:	48:cLp7ytx4HynhVnF9kCnm00GnhCsZjxbO8dn:WQfPfnm00WCQbOu
MD5:	8FA2AC19F7B58047168D471DD809208A
SHA1:	525C94B68003B81B27BD691A629063DCCA35012B
SHA-256:	2368EE864828D106FC092D1250360A1F784D28F1BE38805D9071690651035607
SHA-512:	CB4ADFE349512486273CF7721A7981F57A6439DE118AEA49D96C07A7000B2FD34D43B6CE7D76EAD5A0A39526A9CC74C50CDD3BC5CCC9305B3BCE88A7334406BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Memory Optimizer</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Memory Optimizer" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#0EB3B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M8.5,11.4620536 L8.5,20.3085938 C8.5,20.8608785 8.94771525,21.3085938 9.5,21.3085938 L9.925,21.308593

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\ProgramUninstaller.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3406
Entropy (8bit):	4.749366753377691
Encrypted:	false
SSDEEP:	48:cLpjZKlyt2x4HykkTxS/D4hsm6Q8Ob255ONU8NVeFGcBHjYGqdy0Dvotzupt8Umi:W7/4hsOb255OS8NVpcBHjGclupt8WC+5
MD5:	7CF723171DCBD35B029A20668106EAD0
SHA1:	66DCA7371442E11080BADD4410C38E35FD93FE75
SHA-256:	A440591F2638A1C8AC09D00DF87B428BF5D34B74108658BEF8E70B831084F001
SHA-512:	779790D605A11A820C28FDD88601CE51B9F49B02D2404046E2D90996AF05557FD86F021EB3B1D562BEF7F51C852F75E7A3B692714992A318050F1B1677FFA859
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Program Uninstaller</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Program Uninstaller" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#10A38B" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M24.2592933,14.1797475 L24.2892701,14.1820049 C24.5860075,14.2118427 24.8104096,14.4530939 24.8

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\Reminder.svg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	5.053787804132326
Encrypted:	false
SSDEEP:	48:cLpFytwr4HyY7ShEbkHZaE3a/n+2Xhdjv:WOSCg3S+2Hv
MD5:	D4AD51DC2849DCB314F3CA8AC7757143
SHA1:	E9DD1EF3D6A0573AAF8B9C453BC32C0EE71BF5A9
SHA-256:	8890A391D09D4C1B73913A65E6DB9E40F7C06F1CA8C2F1CF0AA94F19731D9783
SHA-512:	12DDD5389C2A371826EB50D6099C6649C3260E82D24B85393086C92C2049C5DEAF45182D7C4113468836FC6E1C76B500AF8B0DEFDFAF6C4412120A2620083FAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Reminder</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Reminder" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#4D9DE0" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M20.5945946,24.2566845 C20.5945946,25.6743138 19.432955,26.8235294 18,26.8235294 C16.6221586,26.8235294 15.4951636,25

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-0JVAF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	4.792077972269818
Encrypted:	false
SSDEEP:	24:t/cahdqHyM/Kg3yVEkc7VpebVUcLFsvM/KfZ2ddppmcKwr86m1HqqU+WTlOr/0oZ:W2dmpQ+zZ2qcKI8zKqUUrh95
MD5:	0F9E7177F0CB1EC8A45208BE94AEDE13
SHA1:	453B1C0208E3CF4F5F64FC8D66320F3DEE879848
SHA-256:	CBAFFC932A05D28F6032C31D3CF5817D23E3FC5492FEC0F6CB0DB1458C0C0662
SHA-512:	EC0738341B18D0D042A07319A6790AD6604983E09CCD2972967D016F3392F744345657CC2988CE3A81682CB3AA748E5DB76917E42E2A3AE1C92F1385394C4F15
Malicious:	false
Preview:	<svg .. xmlns="http://www.w3.org/2000/svg".. xmlns:xlink="http://www.w3.org/1999/xlink".. width="44px" height="44px">..<defs>..<linearGradient id="PSgrad_0" x1="0%" x2="0%" y1="100%" y2="0%">.. <stop offset="0%" stop-color="rgb(55,151,235)" stop-opacity="1" />.. <stop offset="100%" stop-color="rgb(99,174,240)" stop-opacity="1" />..</linearGradient>....</defs>..<path fill-rule="evenodd" fill="url(#PSgrad_0)".. d="M21.999,0.0 C34.150,0.0 43.999,9.849 43.999,21.999 C43.999,34.150 34.150,43.999 21.999,43.999 C9.849,43.999 0.0,34.150 0.0,21.999 C0.0,9.849 9.849,0.0 21.999,0.0 Z"/>..<path fill-rule="evenodd" fill="rgb(255, 255, 255)".. d="M32.0,32.999 L11.999,32.999 C10.343,32.999 9.0,31.656 9.0,29.999 L9.0,14.0 C9.0,12.343 10.343,10.999 11.999,10.999 L18.999,10.999 C20.656,10.999 22.0,14.0 22.0,14.0 L32.0,14.0 C33.656,14.0 34.999,15.343 34.999,16.999 L34.999,29.999 C34.999,31.656 33.656,32.999 32.0,32.999 ZM19.52,19.438 L17.299,17.285 L16.329,18.75 L17.926,20.35 C16.607,20.862 15.225,22

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-0U1VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.96733030091051
Encrypted:	false
SSDEEP:	48:cLptxytaE4Hyr+U7uxzmc5SfR29PXcEACxMkEEXdn:Wtvw+U7wmcMJyfcEACPF
MD5:	61DB297B0F6565B4A555824EA5BE93BF
SHA1:	E17BBD1DB8B1CEDC611250DDD6B31496E17A0AD2
SHA-256:	4750E9B9B8962A4035E6E492A0C6DCFD7BF5A0CF717CD1A720318E44130A63CB
SHA-512:	798C7CA4EA4A9B23235F1F4772649FE2F71A9551EECE67550B6BD559FDC8C73F2CA51C18453730CBD0ED46CC877926CAB72FA17EE1E8332F40E9CF0F541367F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Force Deleter</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Force Deleter" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#6086B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M10.6,12.3949676 L10.6,13.0021836 L10.6,13.0021836 L25.2,13.0021836 L25.2,12.3949676 C25.2,11.5665405 24.52

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-B6N3P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1963
Entropy (8bit):	5.055017473158446
Encrypted:	false
SSDEEP:	24:2d593RLPYEEwGLGtAQOeaxMLjFrfC7HDOf/FuNqCM6TVnN0V6s6rWn9l6VD+QJix:cLpOytTr4Hy1uNRMKk6rkX2i2Byzdn
MD5:	2B3100BBBCCF5DD9FBD6E51848765DB8
SHA1:	77655EC4F57C7F960849242EE3CA47F4792B156A
SHA-256:	6CC9AE74EEBF468BE9689EC0B3C0D68384B4CAB3242FFCC0892FD4AA3A55578A
SHA-512:	AEF6BFA3320307E58159478C13696A7FE614B147679A315592A1AF04BE2D74FA83C464DA23E246B3760A32506514B9D64E3F97CBE033818509AB3815089823AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Auto Shutdown</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Auto Shutdown" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#4D9DE0" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M18.0009711,26.7 C13.194073,26.7 9.3,22.8039848 9.3,17.9990289 C9.3,14.4254158 11.455821,11.3587119 14.5361

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-C4PA2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	5.053787804132326
Encrypted:	false
SSDEEP:	48:cLpFytwr4HyY7ShEbkHZaE3a/n+2Xhdjv:WOSCg3S+2Hv
MD5:	D4AD51DC2849DCB314F3CA8AC7757143
SHA1:	E9DD1EF3D6A0573AAF8B9C453BC32C0EE71BF5A9
SHA-256:	8890A391D09D4C1B73913A65E6DB9E40F7C06F1CA8C2F1CF0AA94F19731D9783
SHA-512:	12DDD5389C2A371826EB50D6099C6649C3260E82D24B85393086C92C2049C5DEAF45182D7C4113468836FC6E1C76B500AF8B0DEFDFAF6C4412120A2620083FAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Reminder</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Reminder" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#4D9DE0" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M20.5945946,24.2566845 C20.5945946,25.6743138 19.432955,26.8235294 18,26.8235294 C16.6221586,26.8235294 15.4951636,25

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-FTFR1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3137
Entropy (8bit):	4.830401809891447
Encrypted:	false
SSDEEP:	48:cLpZo3yt8XcoHyu5YkZc0u/BwPcSJyhssrgiMOUi5KYjXEAlANPd5:WZOXF5dc0PohssrgiMa5KYj0AlAx
MD5:	D96C9920A33DB25880C12CAFA8DD83CA
SHA1:	05C22E14A9F9024E6B89723FDB92A180F3355B2E
SHA-256:	E302398C76130026F3FA76131672B9479D88F2A119075D2C723A928EA4BD90C0
SHA-512:	D8DCCDDA1C20A11864374678530A77D2EFBF3E96BFB1AB13BD53C8946B0B2A52344727D07AAFE566F9DB080524D9FEF940CD3CA98C1A38EC336BFC5A37D3B003
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Data Recovery</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Data Recovery" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Utility Icon - Wise Data Recovery">. <rect id="rectangle" fill="#13BF86" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M20.5139966,22.5069606 L20.5139966,19.775094

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-GF8OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3348
Entropy (8bit):	4.751905370912879
Encrypted:	false
SSDEEP:	96:WOjYuB5hp856xN8WofGpKdY5vVZtt4EoXn4m:bkuvhB0GLVnt63Z
MD5:	170A4B795CEF3E2B5E6184E6FCA4A698
SHA1:	E84FB034745E424CD4783EE603829F4C6AC4703E
SHA-256:	A3DBDBB4E21A9A54B256DD8C7F1F17459463DE6A63754E8726FEA13CD39374CD
SHA-512:	5F0920A0FBA30DAF377A8F03678F2A4E1D35DD4D583DC469BBB50A95D55DBB90923E6314855B2DF1A01695FBD6704C8671A2F567A314E80E9DD94CD47165F753
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Duplicate Finder</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Duplicate Finder" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#6086B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M24.1625,12.8902333 L24.1625,11.0625 C24.1625,10.4756975 23.6868025,10 23.1,10 L10.5625,10 C9.9756974

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-IUBVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2749
Entropy (8bit):	4.8902810774147865
Encrypted:	false
SSDEEP:	48:cLp7ytx4HynhVnF9kCnm00GnhCsZjxbO8dn:WQfPfnm00WCQbOu
MD5:	8FA2AC19F7B58047168D471DD809208A
SHA1:	525C94B68003B81B27BD691A629063DCCA35012B
SHA-256:	2368EE864828D106FC092D1250360A1F784D28F1BE38805D9071690651035607
SHA-512:	CB4ADFE349512486273CF7721A7981F57A6439DE118AEA49D96C07A7000B2FD34D43B6CE7D76EAD5A0A39526A9CC74C50CDD3BC5CCC9305B3BCE88A7334406BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Memory Optimizer</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Memory Optimizer" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#0EB3B3" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M8.5,11.4620536 L8.5,20.3085938 C8.5,20.8608785 8.94771525,21.3085938 9.5,21.3085938 L9.925,21.308593

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-QOVQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	4.917980202910924
Encrypted:	false
SSDEEP:	48:cLpm3yt2u4HyxoVxevT7XgJla7Da/TXWbP2Pd37knPKLzmPWaqWdn:WmEXgJEDaMkd37YPKLzmPWDI
MD5:	7D5D197F5CB0611CC75DDA197AE8EBA0
SHA1:	A5B2A943CDD3BF9AE423B6ADCE10E0A238169A14
SHA-256:	F8E59D250E4AF0261E549A79D5282F838FB816AD2DCC219EF309177958106E09
SHA-512:	7B8F29D4157FDD439681649061A6722A0C16F865F0F53D22A401EE712F240A5D48B528AC29A005BB8D2DE6D3F8191B693BCF2DB86CCC041B69BBE2DEBB0CA7AE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise JetSearch</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise JetSearch" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#3CA7FF" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M17.0364062,9 C19.0931562,9 21.1499063,9.78372551 22.7197813,11.3535515 C25.4890313,14.1227149 25.8096563,18.409456

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-RPCRV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3406
Entropy (8bit):	4.749366753377691
Encrypted:	false
SSDEEP:	48:cLpjZKlyt2x4HykkTxS/D4hsm6Q8Ob255ONU8NVeFGcBHjYGqdy0Dvotzupt8Umi:W7/4hsOb255OS8NVpcBHjGclupt8WC+5
MD5:	7CF723171DCBD35B029A20668106EAD0
SHA1:	66DCA7371442E11080BADD4410C38E35FD93FE75
SHA-256:	A440591F2638A1C8AC09D00DF87B428BF5D34B74108658BEF8E70B831084F001
SHA-512:	779790D605A11A820C28FDD88601CE51B9F49B02D2404046E2D90996AF05557FD86F021EB3B1D562BEF7F51C852F75E7A3B692714992A318050F1B1677FFA859
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Program Uninstaller</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Program Uninstaller" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#10A38B" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M24.2592933,14.1797475 L24.2892701,14.1820049 C24.5860075,14.2118427 24.8104096,14.4530939 24.8

C:\Program Files (x86)\Wise\Wise Care 365\tools\img\is-VCGTP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	4.737537692264919
Encrypted:	false
SSDEEP:	48:cLpVytD4HyTYFfPR/rE1A1fXw/42SUO8fZ6MGphd5RByfCFuBpirRgIydn:WnZEO1fXVZSsHfNBUKuBpWRK
MD5:	117BC13C71EF1EDDB52700ED8DF1B7F0
SHA1:	06BF383DE837FE1D832C15D86E2ED093FC4EDF2A
SHA-256:	C6F93FA888F077BEE27087899BB08842857CF75757D1098056F0D042CF2B81EC
SHA-512:	E5949FAF6F493F5A7B10BA7C167FAE8DB7B439580CC5E3A6FC1339EEC9D7B26385962B8A5C51649ED58D7203314B6773A7496E00ABA50F71E69355E5834BEED0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="36px" viewBox="0 0 36 36" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Utility Icon - Wise Game Booster</title>. <defs>. <linearGradient x1="15.4159993%" y1="16.5258737%" x2="83.0777585%" y2="85.5614823%" id="linearGradient-1">. <stop stop-color="#FFFFFF" stop-opacity="0.28" offset="0%"></stop>. <stop stop-color="#FFFFFF" stop-opacity="0" offset="100%"></stop>. </linearGradient>. </defs>. <g id="Utility Icon - Wise Game Booster" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <rect id="rectangle" fill="#2F93EB" x="0" y="0" width="36" height="36" rx="18"></rect>. <rect id="rectangle-10" fill="url(#linearGradient-1)" x="0" y="0" width="36" height="36" rx="18"></rect>. <path d="M18,23.5 C18.4700995,23.5 18.8575482,23.8538702 18.9104996,24.309764 L18.9166667,24.4166667 L18.9166667,27.16

C:\Program Files (x86)\Wise\Wise Care 365\tools\is-LFJ0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Generic INItialization configuration [Wise Folder Hider]
Category:	dropped
Size (bytes):	3716
Entropy (8bit):	5.187348624869407
Encrypted:	false
SSDEEP:	96:TeZq0yM9q0kVFtBbXPX/qGH8Zi7971quSAqtVTVXHqmH4qT5FTLaqD7Eqy:6Z7r97yFt9XPX//cy971WAeVXp429ahj
MD5:	E4A16E80077552B0D8BF893AE9B59D3D
SHA1:	52F39D9C9687E10A22E850ED1D167AF3F59C6AB4
SHA-256:	C3E511B68286C7A958C004973B43E20D591C2FE355F3E90BE9D09551E3F81DD4
SHA-512:	37DF848DD658F6CEF0F197F5C3BAC8C8AC56C8C1835F6D11014B14FD5C02D650E3485914C61E45C66E6D9CC31BD00EEB9C0BA9DD447B0D1F67CD8DFA58F9CC69
Malicious:	false
Preview:	[Wise Duplicate Finder]..TranSection=DuplicateFinder..DefaultName=Duplicate Finder..Exe=WiseDuplicateFinder.exe..TranDesc=DuplicateFinderDesc..Desc=A duplicate file management tool..Build=61..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg..PngLocal=img\DuplicateFinder.svg..DownloadUrl=http://downloads.wisecleaner.com/soft/WDFSetup.exe..InstallPar=/VERYSILENT....[Wise Folder Hider]..TranSection=FolderHider..DefaultName=Folder && File Hider..Exe=WiseFolderHider.exe..TranDesc=FolderHiderDesc..Desc=Easy to hide Private Data..Build=235..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg..PngLocal=img\FolderHider.svg..DownloadUrl=https://downloads.wisecleaner.com/soft/WFHSetup_5.0.5.235.exe..InstallPar=/VERYSILENT....[Wise Force Deleter]..TranSection=ForceDeleter..DefaultName=Force Deleter..Exe=WiseDeleter.exe..TranDesc=ForceDeleterDesc..Desc=A safely and easily file unlocker & deleter..Build=56..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/Force

C:\Program Files (x86)\Wise\Wise Care 365\tools\toolsv6.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	Generic INItialization configuration [Wise Folder Hider]
Category:	dropped
Size (bytes):	3716
Entropy (8bit):	5.187348624869407
Encrypted:	false
SSDEEP:	96:TeZq0yM9q0kVFtBbXPX/qGH8Zi7971quSAqtVTVXHqmH4qT5FTLaqD7Eqy:6Z7r97yFt9XPX//cy971WAeVXp429ahj
MD5:	E4A16E80077552B0D8BF893AE9B59D3D
SHA1:	52F39D9C9687E10A22E850ED1D167AF3F59C6AB4
SHA-256:	C3E511B68286C7A958C004973B43E20D591C2FE355F3E90BE9D09551E3F81DD4
SHA-512:	37DF848DD658F6CEF0F197F5C3BAC8C8AC56C8C1835F6D11014B14FD5C02D650E3485914C61E45C66E6D9CC31BD00EEB9C0BA9DD447B0D1F67CD8DFA58F9CC69
Malicious:	false
Preview:	[Wise Duplicate Finder]..TranSection=DuplicateFinder..DefaultName=Duplicate Finder..Exe=WiseDuplicateFinder.exe..TranDesc=DuplicateFinderDesc..Desc=A duplicate file management tool..Build=61..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg..PngLocal=img\DuplicateFinder.svg..DownloadUrl=http://downloads.wisecleaner.com/soft/WDFSetup.exe..InstallPar=/VERYSILENT....[Wise Folder Hider]..TranSection=FolderHider..DefaultName=Folder && File Hider..Exe=WiseFolderHider.exe..TranDesc=FolderHiderDesc..Desc=Easy to hide Private Data..Build=235..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg..PngLocal=img\FolderHider.svg..DownloadUrl=https://downloads.wisecleaner.com/soft/WFHSetup_5.0.5.235.exe..InstallPar=/VERYSILENT....[Wise Force Deleter]..TranSection=ForceDeleter..DefaultName=Force Deleter..Exe=WiseDeleter.exe..TranDesc=ForceDeleterDesc..Desc=A safely and easily file unlocker & deleter..Build=56..PngUrl=http://www.wisecleaner.com/toolbox/imagesv6/Force

C:\Program Files (x86)\Wise\Wise Care 365\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	InnoSetup Log Wise Care 365, version 0x418, 60239 bytes, 123716\37\user\376, C:\Program Files (x86)\Wise\Wise Care 365\
Category:	dropped
Size (bytes):	60239
Entropy (8bit):	3.8779942310909976
Encrypted:	false
SSDEEP:	1536:3vmA2IY3LHbn6TLmZIDKvspu4zOJkf61wBGXctDD9snWRA7a6fkJOz4dAcXtwGBu:3OA2IYvH
MD5:	2625892F5017EDB87F537F4259FDAA72
SHA1:	44968D1F53B6733E4FCE402A8DC14B1E5D7D0C58
SHA-256:	00BEBC4623F922BA7D7BB8AD6B3416FAACD6F9CCA265CA24A61EAF718F7E4ABF
SHA-512:	1B48352F00211B2EE4043BECBBAAAAF5A7392C92BED615ED9415E86261AF82956629733E41B552A4F091103A84050941E009E20FBA7A7B25DF194D57A6CD38FB
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Wise Care 365...................................................................................................................Wise Care 365...........................................................................................................................O...............................................................................................................................5.\:...............1.2.3.7.1.6......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5....................... ...........}..IFPS....>........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TNEWBUTTON....TNEWBUTTON.........TLABEL

C:\Program Files (x86)\Wise\Wise Care 365\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2680240
Entropy (8bit):	6.356218503295663
Encrypted:	false
SSDEEP:	49152:Hg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2tY92:HvqPCnrN4azvSYV/
MD5:	A7F5051B66AD0D9965C6DC9DF8955ED4
SHA1:	36EB44DEB6ABBB0A3105F652D003AB0942618FF9
SHA-256:	30F85D8F31A30BE60C53CBDCEEE0BAC067E2664BBB090CB102975D8EB8847072
SHA-512:	BAE4526B493B353F0DCD3D5712E3161D3BF025F215FBA9A61C2C6AA0AA11F4F60AA46132CC28731C1A8560E4EF00168E998CCC889A15ABA2C69157D316B7E6A8
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....]..................$...........$.......$...@...........................).....jU)...@......@....................&.......%..5...@&..T............(..#...................................0&.....................D.%.@.....&......................text...8.$.......$................. ..`.itext...&....$..(....$............. ..`.data...DZ....$..\....$.............@....bss.....q...@%..........................idata...5....%..6...(%.............@....didata.......&......^%.............@....edata........&......h%.............@..@.tls....D.... &..........................rdata..]....0&......j%.............@..@.rsrc....T...@&..V...l%.............@..@..............'.......&.............@..@........................................................

C:\Program Files (x86)\Wise\Wise Care 365\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	InnoSetup messages, version 6.0.0, 243 messages (UTF-16), Cancel installation
Category:	dropped
Size (bytes):	23403
Entropy (8bit):	3.2724848290334094
Encrypted:	false
SSDEEP:	192:G1qXSCkf3STsfr69FTyPanTa1tznL7VF+Iqfc51U5YQDztXfbKJg/Bfvo:G1v6ir64+WX+7Q1U5YQDzt7/B3o
MD5:	A5E1C77434480346133FAF90A3FF8BF2
SHA1:	F7771EBC1D19475F1A83D769F276557B676F03C0
SHA-256:	B1718D2001564B8BE91D99EDDE12899305DE4286455B2507017B64AF3441C22E
SHA-512:	D4B60886B35F1C7BE0B14F6BE044829A55B78921B6C0542EE5D2DEB2252DBC7FBB3F99C28D2930F1C655A7B4CC49571FEB51DAC53D1698CFF8D17598EEDC2F42
Malicious:	false
Preview:	Inno Setup Messages (6.0.0) (u)......................................[.....h..wC.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3276226053571891
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrG:KooCEYhgYEL0In
MD5:	933E667A7B79F25E6D43AF42C8978C23
SHA1:	111065A8C5DA5CF76CBF8106622E7E194C5605DD
SHA-256:	A08E9A6DCF7EC74F67DF94326599F2E82CA463D958BF8B0A3D93B82984D090C2
SHA-512:	2139C65DC5C1030DA04C5CA342EA7E8908732F923AB40CBA676F6D207E512E1C6D92FCB40A3552830BDBDC2709C9E33D5DE259BDE97A98226DEB15B715AEE15D
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfd71ae79, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210135246914077
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	79E59DFFC48222DF4A92FD7A0FC07361
SHA1:	32FA884A23B429D6DDEDE8EF4E04764BEF8CDE5A
SHA-256:	4BBD339E5FF394F3485333535A59039C1CC5C449BD6D9822CD474226A2388B54
SHA-512:	E56C45CB77E55FFF88B34BA11AF08194F262654A02344DE6FE939E1D6F38F2AA98D3E63DAF4879D51FA162B028E8DB0E4B1E1C905D7FFE4A94DF47EF8DABB4F1
Malicious:	false
Preview:	.q.y... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...........................................\|..................-.Vn.....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07550460806928552
Encrypted:	false
SSDEEP:	3:g/8YeNjsavjn13a/csh/tallcVO/lnlZMxZNQl:gUzNjZ53qVIOewk
MD5:	E444B0D70B1AFB69FEF7F998A8E5BE14
SHA1:	917E3DA7A3BB1F769868EF148D26AB7177243718
SHA-256:	5EE448DCD74AC7D64EE7E643FC3142E8DC23E89A4EC5DD0AE42D72DD29B55485
SHA-512:	C1DA64C3470C911C11D92A1ADE7A7B3746B6F54B4BCE60C536DE2B116D7ED39FB1261F595B88C91040AD3B9A60B9F84C048B4351AC4B3FBBA436768101DBCD2F
Malicious:	false
Preview:	.L.l.....................................;...{.......\|.......{A..............{A......{A..........{A]................-.Vn.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Uninstall Wise Care 365.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 12:30:14 2024, mtime=Thu Apr 25 12:30:14 2024, atime=Thu Apr 25 12:30:00 2024, length=2680240, window=hide
Category:	dropped
Size (bytes):	1236
Entropy (8bit):	4.623432209092513
Encrypted:	false
SSDEEP:	24:8mYcMuEidOEVKrWstIdAUAyyMFdBrDq8dBr/oUUkpLnqyFm:8m9IidOSstSEyyWddDq8dd/974yF
MD5:	AA4A5FDBCF62A264F6C26D502BE814E9
SHA1:	96519CEA5978FB9ED488442F6E5389F11095CF74
SHA-256:	A555C62594BE0779469B8E4E2507EF43898ACB9CD545DC7D49DC0A0FF8A2AB06
SHA-512:	C78CC4A56DCC6EC9264BD508E18FEC3C115C73BB462999F80CD4034F7504E0E49D9EEE93E04FB1129527ADED255DE196C9EFAAD05B1ED939F2BE792829571CC0
Malicious:	false
Preview:	L..................F.... ... DD..... DD.....t>c.......(..........................P.O. .:i.....+00.../C:\.....................1......X.k..PROGRA~2.........O.I.X.k....................V......c0.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1......X.k..Wise..:......X.k.X.k....)......................c0.W.i.s.e.....d.1......X.k..WISECA~1..L......X.k.X.k............................W.i.s.e. .C.a.r.e. .3.6.5.....f.2...(..X.k .unins000.exe..J......X.k.X.k...........................j..u.n.i.n.s.0.0.0...e.x.e.......e...............-.......d....................C:\Program Files (x86)\Wise\Wise Care 365\unins000.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.\.u.n.i.n.s.0.0.0...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.........................@Z\|...K.J.........`.......X.......123716...........hT..CrF.f4... ..T..b...,.......hT..CrF.f

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Care 365.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 12:30:18 2024, mtime=Thu Apr 25 12:30:19 2024, atime=Wed Mar 20 14:49:40 2024, length=18762136, window=hide
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	4.597882983374532
Encrypted:	false
SSDEEP:	24:8m+fRo37E4dOEVK6Wsg7BcALyMEdBrDybBEdBr/oUUkpLfqyFm:8m4N4dOvseLydddDrdd/97YyF
MD5:	CF174F66F340A20DEAD802B75722628E
SHA1:	B2C84CC7457D5BDFD8A326F6A3FDE4323FD3CC3B
SHA-256:	E9069ED2800BB20C348B9B6327072A433695AE5DFC45A6235121407C33846401
SHA-512:	0405E1FE2DFDA8B7A6DE971B1E21B46F9F2A8C509A5999E8AC261EDDA89FD8256D3DBC09D7D438462B8D2E687E01E886DA73ABB4AD625C0FBBDB467624900B63
Malicious:	false
Preview:	L..................F.... .........<[F........7.z...I...........................P.O. .:i.....+00.../C:\.....................1......X.k..PROGRA~2.........O.I.X.k....................V.......6.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1......X.k..Wise..:......X.k.X.k....)......................c0.W.i.s.e.....d.1......X.k..WISECA~1..L......X.k.X.k............................W.i.s.e. .C.a.r.e. .3.6.5.....l.2..I..tX4~ .WISECA~1.EXE..P......X.k.X.k.....C........................W.i.s.e.C.a.r.e.3.6.5...e.x.e.......h...............-.......g....................C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe..H.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.\.W.i.s.e.C.a.r.e.3.6.5...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.........................@Z\|...K.J.........`.......X.......123716...........hT..CrF.f4... ..T..b...,.

C:\Users\Public\Desktop\Wise Care 365.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 12:30:18 2024, mtime=Thu Apr 25 12:30:20 2024, atime=Wed Mar 20 14:49:40 2024, length=18762136, window=hide
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	4.608874823158895
Encrypted:	false
SSDEEP:	24:8mmMuEidOEVKrWsg7BcALyMUedBrDybBEdBr/oUUkpLfqyFm:8mmIidOSseLy+ddDrdd/97YyF
MD5:	CF9A895A14E9C863DE6D66BBE9CE11E2
SHA1:	4D19C27842B85FF5D100B7B72010B03351D68371
SHA-256:	33EBC0B82A78673350701D5ACFF24123ACF79729540C614D5892D7D5BA6D85BC
SHA-512:	368256AB3F70275A3D1D3A4B304F1F99B05C82520D0669EC364F4D34023EBE45B14459743749B0B8E0F43C4260791C9275EE4EFF7DF29777EFE6CAFF449B07DD
Malicious:	false
Preview:	L..................F.... .........7.b........7.z...I...........................P.O. .:i.....+00.../C:\.....................1......X.k..PROGRA~2.........O.I.X.k....................V......c0.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1......X.k..Wise..:......X.k.X.k....)......................c0.W.i.s.e.....d.1......X.k..WISECA~1..L......X.k.X.k............................W.i.s.e. .C.a.r.e. .3.6.5.....l.2..I..tX4~ .WISECA~1.EXE..P......X.k.X.k.....C........................W.i.s.e.C.a.r.e.3.6.5...e.x.e.......h...............-.......g....................C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe..?.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.\.W.i.s.e.C.a.r.e.3.6.5...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.i.s.e.\.W.i.s.e. .C.a.r.e. .3.6.5.........................@Z\|...K.J.........`.......X.......123716...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4..

C:\Users\user\AppData\Local\Temp\bojvgash.ini

Download File

Process:	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11050
Entropy (8bit):	4.964263088797895
Encrypted:	false
SSDEEP:	96:vici3JT/Yctd+WqnamuIJcywyiA2p6Q+PFcRB:vRW/Yctd+WqnaD0cywyiAO8FcP
MD5:	8650A10D7B3F6FE2328505AF9339FACD
SHA1:	17155FFB077E23F64A9E5E384B3BBF1F43F7FDF5
SHA-256:	F616D7AAE6285C2EB0D1CA7C54502A38DABA3A47C8A88A5E3DC51D84BCC20BF1
SHA-512:	5627313EF923F5ABF66492D121522DEEC69B53AA39E076A2217814E7020DE76F731C7E7DB7A791A442E62E74FE4B3EAD02A15EF8656EBEA16D5F7082378D0F78
Malicious:	false
Preview:	{"id":"31","name":"Wise Care 365 v6","build":"635","setup":"0","url":"https:\/\/www.wisecleaner.com\/update-wisecare365.html","download_exe":"https:\/\/downloads.wisecleaner.com\/soft\/WiseCare365_6.6.5.635.exe","download_files":[{"file_name":"AutoUpdate.exe","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/AutoUpdate_6.0.3.593.zip","path":"","build":"161"},{"file_name":"BootLauncher.exe","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/BootLauncher_6.0.3.593.zip","path":"","build":"2"},{"file_name":"BootPack.wpk","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/BootPack_6.0.3.593.zip","path":"","build":""},{"file_name":"BootTime.exe","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/BootTime_6.0.3.593.zip","path":"","build":"54"},{"file_name":"DefragOptions.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/DefragOptions_6.0.3.593.zip","path":"","build":""},{"file_name"

C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2680240
Entropy (8bit):	6.356218503295663
Encrypted:	false
SSDEEP:	49152:Hg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2tY92:HvqPCnrN4azvSYV/
MD5:	A7F5051B66AD0D9965C6DC9DF8955ED4
SHA1:	36EB44DEB6ABBB0A3105F652D003AB0942618FF9
SHA-256:	30F85D8F31A30BE60C53CBDCEEE0BAC067E2664BBB090CB102975D8EB8847072
SHA-512:	BAE4526B493B353F0DCD3D5712E3161D3BF025F215FBA9A61C2C6AA0AA11F4F60AA46132CC28731C1A8560E4EF00168E998CCC889A15ABA2C69157D316B7E6A8
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....]..................$...........$.......$...@...........................).....jU)...@......@....................&.......%..5...@&..T............(..#...................................0&.....................D.%.@.....&......................text...8.$.......$................. ..`.itext...&....$..(....$............. ..`.data...DZ....$..\....$.............@....bss.....q...@%..........................idata...5....%..6...(%.............@....didata.......&......^%.............@....edata........&......h%.............@..@.tls....D.... &..........................rdata..]....0&......j%.............@..@.rsrc....T...@&..V...l%.............@..@..............'.......&.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\Icon_128.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PC bitmap, Windows 3.x format, 128 x 128 x 24, image size 49152, resolution 3779 x 3779 px/m, cbSize 49206, bits offset 54
Category:	dropped
Size (bytes):	49206
Entropy (8bit):	4.923768530939549
Encrypted:	false
SSDEEP:	384:k5Ak+SFV2iXbW/9KriSmxFzwj9XY/24f+U9aKKKKKKKKKKKKYKKKKKKKKKKKKw0C:r0Ski3xFzwj9XY/2yp9oVCQMo
MD5:	C957F78F99CD6749C7E11291C37FE801
SHA1:	783F1C87740259EE070506FEB910BEB70672FBDA
SHA-256:	C761FC16DA7C304FC7C4586E9DC78CAE5F8AC88BBF4699A41CA923A75327C16D
SHA-512:	72FB5F6812EBD698A80919928F83F55CD7911F1DF236E6F4B72BF0A9E92C749BE688E7C9ED08D9062CA90AF89910EB8FB4258E5AD5B4636B09CB7BCE0BDDA316
Malicious:	false
Preview:	BM6.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\introduce.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.831029492580734
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2frSLfGruZbiO7boW9vn:HRYFVm4GLuMbTv
MD5:	5D5B88E842BBF908EF66E0A7A6029CAC
SHA1:	CC62F248564FE14AA3123FC9B839C9D045EA22DB
SHA-256:	7D40567D395CA94546A9EA880E3E6AEE6928016BD5F67DCC1AA30F0EA617ADE4
SHA-512:	DFFEE443400A65313F429E514AA1A2B4A08C3306B41C24941A01AD6A9A1D52DF399917CA83EE30F579A0CBAFBDCE8203ED16F7B3220B801031DD85FA5324C699
Malicious:	false
Preview:	[InternetShortcut]..URL=https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html..

C:\Users\user\AppData\Local\Temp\is-1Q5HG.tmp\license.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
File Type:	ASCII text, with very long lines (870), with CRLF line terminators
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	4.9997611182520005
Encrypted:	false
SSDEEP:	96:mE1rDYW2e5gb+/mGQez/m82F21zZDo9qTXx33YK7woCwKnXKm/IAc6orxinI:R9Zf5g24o1zZ092NU1nXHQhL2I
MD5:	4A0F1A666912E64F1BA811FC24D7135F
SHA1:	DCBADD9698E306F0CD6E80737FC44F53336CF36C
SHA-256:	D6B418C619BA7456B594DFF10C3FACE4AC28609A64F2BF5E635292D7FF4F57E5
SHA-512:	36EBA1CC1C0AC8D5FEE7E88FD90B01EE800945EBED45EF92ADF64E4AA356A2AFE9ACC6B07CAE478CC467CA62B4A7895CECC3AF9BBDF93C2A9C2271253ED00342
Malicious:	false
Preview:	END-USER LICENSE AGREEMENT FOR WiseCleaner Products..=========================================================================..IMPORTANT PLEASE READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE CONTINUING WITH THIS PROGRAM INSTALL: ....WISECLEANER.COM End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and WISECLEANER.COM. for the WISECLEANER.COM software product(s) identified above which may include associated software components, media, printed materials, and "online" or electronic documentation. By installing, copying, or otherwise using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. This license agreement represents the entire agreement concerning the program between you and WISECLEANER.COM, (referred to as "licenser"), and it supersedes any prior proposal, representation, or understanding between the parties. If you do not agree to the terms of this EULA, do not install or us

C:\Users\user\AppData\Roaming\Wise Care 365\UpdateInfo\012055670.png

Download File

Process:	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
File Type:	PNG image data, 1500 x 240, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	84047
Entropy (8bit):	7.957112598168655
Encrypted:	false
SSDEEP:	1536:wJBdYLVnlXJ8qNbmG2+94hz67wkenMM8XkMJFyI39/49po3u5A7v2iXPyTxhx9tM:yUJlr/2+94h2H9XAI39/E07hAz9M2K
MD5:	7C853B33034E2D747B52115E17D20BE4
SHA1:	0250B26D1EABEEAE1D7E05908000BA5D3B71DA94
SHA-256:	F90F1ABF8BB63C7388BF7979ED07D178703B77545E841A6D509D90A2E7859E6E
SHA-512:	4C19E7200094AA977CDD095D9C2FD65C464E5007DBAB6A9E777BC4FB5A1F6BD09E270FF4EBC9EC6D36C8EE96BABBE009087EE4BA68964B36B5AB47CC0327D49D
Malicious:	false
Preview:	.PNG........IHDR.............-.V.....PLTE...N..pg.of.R..Z..nk.N..D......z.vl.mg.mm.mj.a..T..W..R..Y..e..L..op.b..]..[..Q..ri.Y..J..j..F.....p..^..N..F..qf.}..w..b..G..O......S..D..zo....L..U..L..u..o..j..f......r....R..I..`.....x.......L..[..~t....t..V......}...u.......w..k....[..}..v.sv.f.....k..`.......y....n..t..}..d.....y........y........_a.r........h..e.....[..XZ{...w....~..\|......e..p..V.....P.....~....s{............}m.h..Y..RTr...P..............l..~..~....{.....p..............q...............dg............SNhq.......{.........p..[.....\|........g.......p..s......l.................u.......................~.p.............[.....}..~........s.a..r.............g..s.....rj\|.....m................q..i..Nz.3..at....O..\..g..N.......h..dx.q.3_.CX.+....C..'f.L}.~..........tRNS.........t.X!..D.IDATx....@.E...;. ..e..`.....Wn..m..s.E.E.R&.tS.}9.B&Qr..N..M..."CI..{2..[>...P.....l.q.=.=...*....$......A.X..YW.w.b_(2.......a.3.y-.9....w].......Q..[..,

C:\Users\user\AppData\Roaming\Wise Care 365\config.ini

Download File

Process:	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
File Type:	Generic INItialization configuration [BootBooster]
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.353580130547482
Encrypted:	false
SSDEEP:	24:1a6DqbSEQ2nQsemLFHaTWONINVmkyRyMiuE4lWquyw:1aMqhVnQsem561eNpyRyOE4lvk
MD5:	3A532E124ABF5CFA26B4707F9D612CAB
SHA1:	80F33592BF48564A60E0B73A07CA3CD03777C239
SHA-256:	6F9EA36D709021914B8A9F32726C68783370ED1C7AB0EF05E7CCADB0D9B25526
SHA-512:	364D923B25EA8BC459B6C0F4530B7997962F3D3E10C8B0324D772BEB2D56D8D5235F5DA1A3E2087853B4795B959BE3E2ED184A6B7E28353837134BB45CDED9F1
Malicious:	false
Preview:	[General]..LastCheckUpdate=45407.6462046412..ShowDiscDate=45407.6462046412..AppBuild=636..Language=English..UpdateMode=0..BootStartup=1..StartBooster=1..TurboCheck=1..MessageIDs=..HintSpecialDay5=0..ReviewGuid={CEB46A53-2B81-4836-9364-F55B9F26D829}..SetupGuid=..SetupVer=..ExpireHint=0..UserUE=1..TmperatureTag=1..SysProtect=0..FirstRun=25/04/2024 15:30:32..Disc=0..IgnoreVer=0..ContextMenuFileShred=1..Silent=0..Newfeature=..CloseTray=0..autocreatepointer=1..UpUe=30/12/1899....[BootBooster]..AutoGet=1..City=Hollywood..Country=United States..CountryIsoCode=US....[GUI]..HeadImage=..CustomHead=0..ThemeFile=C:\Program Files (x86)\Wise\Wise Care 365\Themes\default.wskn..FormLeft=0..FormTop=0..FormWidth=1080..FormHeight=720..FormState=0..NickName=..Alpha=255..SpecialSkin=....[Turbo]..TrashSize=500..TraceSize=1000....[CleanHistory]..TotalTrashSize=0..TotalTraceCount=0..TotalRegErrors=0..TotalPrivacyCount=0..TotalOptimizeCount=0....[Assist]..UserToken=....

C:\Users\user\AppData\Roaming\Wise Care 365\toolsv6.ini

Download File

Process:	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
File Type:	Generic INItialization configuration [Wise Folder Hider]
Category:	dropped
Size (bytes):	3735
Entropy (8bit):	5.181321707654326
Encrypted:	false
SSDEEP:	96:TAwq0yI1q0kV74BbjPXqqGH8Zi697Uqu71qtVTK+HqmVpqT5STL7qD79by:kw7F17y749jPXq/c197Un1eKajp2i7uu
MD5:	663BA22FFDA64293A4A1CBAFBD842BEB
SHA1:	4781782ED4C36EAE1F78C4B5BBE82F03C817D831
SHA-256:	10FD578EAD94C43EF97F7E2FEE25D5A3B6D1FB63045EF487251B669272AE784C
SHA-512:	1359B6453C638F08C6792F10BB611E710B54999DC9E8541B5040C1A6623BE030891E38A2973F8B14C48451AD705C8B699F25856E4EE6C6AC631CFD918054EFEA
Malicious:	false
Preview:	[Wise Duplicate Finder]..TranSection=DuplicateFinder..DefaultName=Duplicate Finder..Exe=WiseDuplicateFinder.exe..TranDesc=DuplicateFinderDesc..Desc=A duplicate file management tool..Build=60..PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/DuplicateFinder.svg..PngLocal=img\DuplicateFinder.svg..DownloadUrl=https://downloads.wisecleaner.com/soft/WDFSetup.exe..InstallPar=/VERYSILENT....[Wise Folder Hider]..TranSection=FolderHider..DefaultName=Folder && File Hider..Exe=WiseFolderHider.exe..TranDesc=FolderHiderDesc..Desc=Easy to hide Private Data..Build=232..PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/FolderHider.svg..PngLocal=img\FolderHider.svg..DownloadUrl=https://downloads.wisecleaner.com/soft/WFHSetup_5.0.2.232.exe..InstallPar=/VERYSILENT....[Wise Force Deleter]..TranSection=ForceDeleter..DefaultName=Force Deleter..Exe=WiseDeleter.exe..TranDesc=ForceDeleterDesc..Desc=A safely and easily file unlocker & deleter..Build=55..PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	744
Entropy (8bit):	5.134332230661175
Encrypted:	false
SSDEEP:	12:TMHdVVzIu/KYTeaxMovFtrDWwlxzgi5chQnucfvnDnbt+Rj0gbrso:2dfzFLTeaxMAtPvxzgtAfvDn8Rj0gbrX
MD5:	2A06EF63CA9D63D9CEDF72E3AD57700A
SHA1:	0C190533C21D3D9826728DF4B4D2E65DED8AAEA6
SHA-256:	79C4562C88FB3E4F8F1DF296108AFB7CBB4ECAE6C80361CBFFFECD433EFC0459
SHA-512:	71AD6ADBD854DCDBFEDCF021F64DFDD92EE7D9CDD63BD93F0D7CAC26F64541124A13DCD7A1BD71B81AE973320D36E3EE953FBDE2D1DC069EE0D7DCC8E13372B1
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/icon/icon_arrow_eff0f2_12.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="12" height="12" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#EFF0F2" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "></path>. </g>.</svg>.

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9040)
Category:	downloaded
Size (bytes):	9041
Entropy (8bit):	5.09164417045931
Encrypted:	false
SSDEEP:	96:UgvQZDksirWrk7VTcK7HALp20BCgvfTAsf8hPdSc2:YDpBk71cK7ALp20BO1Pd0
MD5:	F7E862CAC384BD7627C63818F65DD298
SHA1:	AA494F36D6230CF418BA10649675A8B55D23FC27
SHA-256:	FFF7B5B76321E4080E4CF8A5B312D74A943B7EBC2AEC9081AC7E17458123FCB2
SHA-512:	6F66B3337BCF02D11ED709C0A0A707DB05BB7C6C014ACB8FFF22204ED384BC8F9AEC929F4B3C828520736B782D5B771C7D5384FE32E3D0FC7275AE758781DA05
Malicious:	false
URL:	https://www.youtube.com/s/subscriptions/subscribe_embed/css/www-subscribe-embed-card_v0.css
Preview:	.yt-valign{white-space:nowrap}.yt-valign-center{white-space:nowrap;text-align:center}.yt-valign:before,.yt-valign-container{vertical-align:middle;display:inline-block}.yt-valign:before{content:'';height:100%}.yt-thumb{overflow:hidden;background:#f1f1f1;font-size:0;vertical-align:middle;display:inline-block}.yt-thumb .vertical-align{height:100%}.yt-thumb img{font-size:13px;outline:none}.yt-thumb-clip{position:absolute;_position:static;bottom:-100px;top:-100px;left:-100px;right:-100px;text-align:center;white-space:nowrap;word-break:normal}.yt-thumb-clip img,.yt-thumb-clip .vertical-align{display:inline-block;vertical-align:middle}.yt-thumb-poster,.yt-thumb-square,.yt-thumb-feed,.yt-thumb-related-playlist,.yt-thumb-default{display:block;height:auto}.yt-thumb-poster{padding-bottom:142.857143%}.yt-thumb-square{padding-bottom:100%}.yt-thumb-feed{padding-bottom:67.027027%}.yt-thumb-related-playlist{padding-bottom:63.333333%}.yt-thumb-default{padding-bottom:56.25%}.yt-pl-thumb .yt-thumb-43 .yt

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20303)
Category:	dropped
Size (bytes):	547271
Entropy (8bit):	5.430981386239354
Encrypted:	false
SSDEEP:	6144:+YS2IJfKPwG/wl4WbJLPGMZjC7W86QExWydtwv9bR/h5nFDuTU86x:+YKGoo6QExWyaRDuTU86x
MD5:	F113C6FFA4FB4824FBE1BA9A1FFAC324
SHA1:	F320031FAA47147F46DAB431C2429146C1E61F18
SHA-256:	AFCDB7635B58AB749AE3853275DB4E3E52082C0C6FF85A73B026DD2355E75506
SHA-512:	2F938C660EA7D8054FDC78C9CC42DF2D2692B18A66F3CF585DF5E732A951FFDCD22AD677DD9BCD6B65D95BA8CEB74DAC89000D26F3051252EFAC39BB1440F038
Malicious:	false
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	7.342146877643202
Encrypted:	false
SSDEEP:	48:+FTUfDYz0CFGPIhx6a3GpYBfvIDiv3dbkJ0gaLawW5WlIqFgm/Dcc:+FgLC0o6OzxBoW1bkJDt5wIqcc
MD5:	A30024712439E51D02DC1CE50C9282FE
SHA1:	757C8C96D83CE01A5EFC669D655DBF4CA719EAEA
SHA-256:	6F18B542D2E2494BBC375B3BE5D4ED353A705714EEBCC3E5DDB8A11F996D73EE
SHA-512:	4C31324E16F843409406466B6D2264613A9E2E0893A7E8700E9F7547FC7074A92E0BBC80883F994F9E602B72883255318E0B96B0F5A415B03A44D797B76A4468
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE............ ..*$.QE.........................................................................6..G<.@7.............91.J@.aS.......(".0(.OC.0).>6....".....2,.]P....-&.YM.hZ.........$................................................................................................................................................C9.........yh....sc.% ..........{k....VJ.pa....m_....92................t...........................dW.........J@........q....<3.......}....+%....-'.............................B9....#...............x.......................................z..........i[..........#...\|............................o.............]R.UI.=5.............VK.'".LB.eV.....................................................................................mp.G....tRNS...s...k.........................n}........W.................................................................................................................

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1375
Entropy (8bit):	4.3958418384526325
Encrypted:	false
SSDEEP:	24:tcwNlfWoexVUfvjlOHX0yEppbanUxXFqQzEUYuvOslffBtfK2acM0E3f3Kr1+:2GexsEEyKBKQAUYdEg2ajdt
MD5:	D8AE5A9D9B759BDDB365C95DBE6A45BC
SHA1:	BC89F0E5EBDEEE33BA08B6B9DB3A722547625905
SHA-256:	A7A1461461D6D2BF27E41B64138B6A5DDE34EC73D5A9059124EE2E8E5CD1A8C4
SHA-512:	22E1E3C8FF13674FA6F95306442BC11FF57AEEC5F80199B850D26EF5FAA1651FE7340EB780C59F17B4B977AE4F6956745A1700EBE900BB6FAF31FAC3A0555850
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_china.svg
Preview:	<svg viewBox="0 0 1546 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M11.321867 1017.710074h1520.904177V6.289926H11.321867v1011.420148z m1524.678133 3.773955v-3.773955 3.773955zM5.031941 1024V0h1533.48403v1024H5.031941z" fill="#353636"></path><path d="M8.805897 2.515971h1527.194103V1020.226044H8.805897z" fill="#D64B24"></path><path d="M264.176904 118.250614l32.707617 99.380836h104.412776L317.012285 278.014742l31.449631 99.380835L264.176904 315.7543l-84.285012 61.641277 32.707617-99.380835-84.285013-60.383292h104.412777zM535.90172 65.415233l-1.257985 35.223588 31.449631 12.579852-33.965602 8.805897-1.257985 33.965602-18.869779-28.933661-32.707617 7.547912 21.38575-26.417691-17.611794-28.933661 31.449632 13.837838zM652.894349 177.375921l-15.095823 30.191647 23.90172 23.901719-33.965602-5.031941-15.095823 30.191647-5.031941-33.965602-33.965602-5.031941L603.832924 202.535627l-5.031941-33.965602 23.90172 23.901719zM617.670762 315.7543l11.321867 32.70

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11215), with no line terminators
Category:	downloaded
Size (bytes):	11215
Entropy (8bit):	4.980315726164858
Encrypted:	false
SSDEEP:	192:xbIKZtwxmUAqPJVakapBA2c6FKrzbgP1TeKe/zTmbqW/erEs2C1:xbPZ2xmUAuMe/70eoE1
MD5:	28601875C7A1E4AD79B7724225412DFD
SHA1:	C6492AEB4D19618694B4A86E3E7B831C27A06F7B
SHA-256:	3BFF4A928BC9BEA4346168A676221F39ACB7B92342619AFCB887AC4E8700D525
SHA-512:	C61E84DCBE618B8BEEAE107C3FB2A34D1F9AA61A65E3F72E87A7CFF56A6F6AB17EA9B4F5B94A88BD5B99280050E17FF76E80028FF30083BFB514B21358FE9312
Malicious:	false
URL:	https://www.wisecleaner.com/static/css/layout.css?v=1.24
Preview:	.page-width{max-width:1200px;margin:0 auto}.header-wrap{position:relative;z-index:9000;height:90px;background-color:#fff}.header-box{margin:0 auto;max-width:1200px;height:100%}.header-link-active{position:absolute;right:-153px;top:-48px;height:90px;width:120px;cursor:pointer}.bottom-filter-box{position:fixed;display:block;width:100%;left:0;bottom:0;z-index:100000}.bottom-filter-box img{width:100%}.bottom-filter-close{display:inline-block;right:40px;top:20px;cursor:pointer;position:absolute}.header-nav-wrap{padding-top:5px;display:flex;align-items:center;justify-content:flex-end}.header-nav-box{display:flex;justify-content:center;align-items:center;height:28px}.header-nav-box a{margin-right:28px;color:#1f2238;font-size:14px}.select-site-wrap{position:relative;left:-15px;width:122px;color:#1f2238}.select-site{position:relative;display:flex;padding-right:20px;padding-left:16px;cursor:pointer;justify-content:center;align-items:center}.site-img{margin-right:5px}.site-name{margin-right:7px}.

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	156
Entropy (8bit):	5.996895892400488
Encrypted:	false
SSDEEP:	3:yionv//thPl9ztjll1lllGBx+RC1ae0PURI5BaC7XD/f0gIU9lxGJHeyoGyr/1p:6v/lhP/N93VBaC7T/f0gIU9rGzFyhp
MD5:	3A8E642AD57B76E2890447AD02FEEA76
SHA1:	E8B7156D51855DB513ECF3CCCEFF4955ACB4B3AF
SHA-256:	CDB5CA36664E6906C51C4336873D7B45F29CB48C3B3188C853980813DA650712
SHA-512:	5AF2F4A9F8C7FD75C72599547F1D0221E9C5993E46947F2DA007A0264B63357A264E14554C3523BCBD9329148740C90D9DF1B91EC4DD45365821A88650646B97
Malicious:	false
Preview:	.PNG........IHDR.............k.=....cIDATx.c....'.?.O"...d O3........<.........x..........W.g.3......q2....L..I.xa.rZ.".....d...A..' ...[.o..Z....IEND.B`.

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4776
Entropy (8bit):	7.736968769564805
Encrypted:	false
SSDEEP:	96:7DIHEQH3voZnr6U6vNcGKjs4VbvNXZ+tpsJQT1kpc:XIHEQ/oZnWzHMVXCSc
MD5:	2E3E4BB13278E0B8076D74A1B5D4D144
SHA1:	BAAA91EC9756EE32512F0E9DAB0784488F2F0D4A
SHA-256:	AF7E620F410FA44A7F385E6FB817173BA492F8E5FE6788464C2A5A1F3DFD4C07
SHA-512:	D42F6B2049C19C873AB3F182BFDEA1198AD55558A6D6BEC8E4CD59C1FB26F335D2CF00EB0D37A75DB4B8014EA02F10B36DB7D3DF81474164C4E385CC813AA322
Malicious:	false
Preview:	.PNG........IHDR.......d.....c.(.....gAMA......a.....PLTE..............................................................................................................................................................................bt\|lz..6X.%9.<Mlz.l{.m{.m{.n\|.cw~hx.m{.cx~dv}i{.m{.kz.m{.hz.jz.k{.av}_v}l{.[pxo\|.l{.l{.m{.l{.m{.m{.lz..$;..4.9M.K_.t......$.....+..".)>.[o....!9..!.....1..:.....6..2..2.....+..)..'\|.%u.!`.....x..t...6E.\e./<w."{.).-6y.'.'3....s..cs...mx.lu.KU.LVj..U..b.(..................................................................................................................................................)..+}.+....Pf..-..,..6..5..(.0F.HZ.M`.....!.CQ...i{................................U`..................122......y.0n....(..*..1.......!.0<.>H.CL.s{.......z...as.}..jw........F7.b....tRNS.....................xpmg%....\| ..%C=......QNIVa]73.e.............-.I.xY8a..%.D...........l..7$X........................l..........uY.~........PKHW...cjS)E52..8\\|...

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39210), with no line terminators
Category:	downloaded
Size (bytes):	39210
Entropy (8bit):	4.8933330593539175
Encrypted:	false
SSDEEP:	192:x20BO3MMDpBk71cK7ALfgJfaEjdr7SZX1A5KCtVlCZyFdWxNMFjdYx2VsdurZBNO:XBH59SaFxClJBtvw4iGiO25WB9Fbv
MD5:	27710EBD53987083F2FD2F37A5590440
SHA1:	616B3862FAB2AD15DDB2EC56255D8810A879B21A
SHA-256:	9325CB86C14E757A3266AB710EFA8294B3CD00403310DFE09E6F561F7C94B438
SHA-512:	39C59D07E9CB5B5A9445147A1B16DF9C1D3A9265B273CB56D835DA71E0FBCF986CF8F02448A4C0D58A4B6A43C0FC0AF9096EDCF96B3E50A5B10AF7A4A8A489A5
Malicious:	false
URL:	https://www.youtube.com/s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.css
Preview:	body{line-height:1;text-align:left;text-align:start}menu,ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:before,blockquote:after,q:before,q:after{content:'';content:none}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}strong,b{font-weight:500}body{border:0}a,abbr,acronym,address,applet,b,big,blockquote{margin:0;padding:0;border:0;font-size:100%;background:transparent}button{margin:0;padding:0;border:0;background:transparent}canvas,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,embed,fieldset,font,form{margin:0;padding:0;border:0;font-size:100%;background:transparent}h1,h2,h3,h4,h5,h6{margin:0;padding:0;border:0;background:transparent}hr,html,i,iframe,img,ins,kbd,label,legend,li,menu,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub{margin:0;padding:0;border:0;font-size:100%;background:transparent}sup{margin:0;padding:0;border:0;background:transparent}table,tbody,td,tfoot,th,thead,tr,tt,u,ul,var{margin:0;padding:0

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	66035
Entropy (8bit):	5.57737127949819
Encrypted:	false
SSDEEP:	1536:TVp1T5UI9yvkWs5yC9waydVo/29skTVC6H28wA:QI9yvDsl3kwlA
MD5:	63E5A0B45632B3DDE3694FFCAF0E3F7A
SHA1:	923736D0CDC308331D5CFAA0EA159BFEDC83D53F
SHA-256:	889109910477919B3457416E7764BCD0ADD19FD959848253026125C7C35C43DB
SHA-512:	5B886C4B5122D61F0209EDE748AA84445C9388CF38813316C41B3DBD2308216E88394D9A45CFC27113C0CF3BC93B9C37D808F6D3C67888244C176EE095D42259
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:H4c+z:Yc4
MD5:	144A62C445E20458EE944F590461B4D1
SHA1:	9133A7426B5D9C80E734241AF14CBC9A2EF2807B
SHA-256:	271FC9114DA3B61D3539EB79B1C469C6963607BC09BA2C7ACAF3DCBB2AC2095E
SHA-512:	9AD894DB86909683D6638A78CE2D0C65D7B39F2711FC08FF982D8034AE994F37BB2DD92EAAEECCB39BF693DEB2EC944C25DB5379316EE0BC9EE3A974E057820E
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkhBotPWeT8SxIFDZP3Fhk=?alt=proto
Preview:	CgkKBw2T9xYZGgA=

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	748
Entropy (8bit):	5.127986550332345
Encrypted:	false
SSDEEP:	12:TMHdVfNIu/KYTeaxMovFtrDWwlxzgi5chQnucfvnDnbt+C0gbrso:2d1NFLTeaxMAtPvxzgtAfvDn8C0gbrso
MD5:	797F0C9EC141CA277793D0D8C19AF830
SHA1:	0A15637EABE05E515F7A2AE01BBC17D2AEE34C6E
SHA-256:	E8957EB389559C9CA8E5C29F05D6BB4F50EC114438079D196CB6B8A80725C7FB
SHA-512:	CB164A08848500A5B141A2011A3F314F054277F12B956A63A0BFD82997E60EECE708EC1C90A3421933F7858C4C8C3D70593CBDA896F44097C39DC62B636DBCCC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="18px" height="18px" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#1F2238" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "></path>. </g>.</svg>.

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.58217158566916
Encrypted:	false
SSDEEP:	24:YEFz7kZPZ+sDZbfIup6GvyqT6ZwF7DZmZ+51DZd/nm7UZX:YEdkVgMNwHqPMyVr/mIp
MD5:	71CE7883D9ABF309F53EF092357D23D5
SHA1:	CFBA3242222B06C12F749288D749FBE0DDE3E526
SHA-256:	234BB6FAB6F527CAD346235618DC4BBB9E2441EFAA5D835FF15BA63398028C97
SHA-512:	884E5D73292D2DD2C7AC2BE95B746C37D8FAE1C73AE3BCF4ED72C386FD8523E4D2431CC3A85CC43AF514E5ED1F52B0552775E6A3B5D8667FBD953B595BAAD77B
Malicious:	false
Preview:	{"should_obtain_cookie_consent":false,"features":{"tfw_timeline_list":{"bucket":[],"version":null},"tfw_follower_count_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_backend":{"bucket":"on","version":null},"tfw_refsrc_session":{"bucket":"on","version":null},"tfw_fosnr_soft_interventions_enabled":{"bucket":"on","version":null},"tfw_mixed_media_15897":{"bucket":"treatment","version":null},"tfw_experiments_cookie_expiration":{"bucket":1209600,"version":null},"tfw_team_holdback_11929":{"bucket":"control","version":11},"tfw_show_birdwatch_pivots_enabled":{"bucket":"on","version":null},"tfw_duplicate_scribes_to_settings":{"bucket":"on","version":null},"tfw_use_profile_image_shape_enabled":{"bucket":"on","version":null},"tfw_video_hls_dynamic_manifests_15082":{"bucket":"true_bitrate","version":null},"tfw_legacy_timeline_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_frontend":{"bucket":"on","version":null}}}

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	7.898201825739682
Encrypted:	false
SSDEEP:	48:0blgZA0zpnuSmnzUvhzoAvhFq7s4mS1ZPIGI6Vldm9R+:0x+AIFREIZZhFAmqQXAldwM
MD5:	BFF1D4E34F8E0D8AFDAE892AF344BEC3
SHA1:	EF3E0AC5F884773BCD08307D42989D185F5993C4
SHA-256:	CCE449F7775F735BDFCF7836F996C844C739EA02047201D20B501A29CEDF0697
SHA-512:	63F5E997476B84D811169CAE319B750E2930A05E8514CA2DAA47979A94AEE46AAA203FF806CA1314F6E624A4AFCC036C61854FC1195EAABC8CF2F0E88C4D5E5A
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE.Q.. o.@..#93...P....?\..O..E.Hh.8R}..../NM..._.p..Y.....#=`~.i...z.Rs..m.E_..f.O...$>+Ci$X.Lf.{...}.t..Sv.St./Mvl....1Ww.Z....%.=kf..5].Mk..3Xm....<.Gw.v.7T."i..;k"{..W.G...'M.....-`.....>b.._.Ln.a..Vw.Uq.@a.St....Ah./q.,Go....?qJc..#=\{.0e.{...w..4X.[.Ks._..Lu.+b..Z....w..Bm.......*Ag\|.....@..9y.+..)g..].F......2k+Mz+\.q...I.b......l.\..=m.3a..].6...q.(..g..9U........R..=..%Z.J..n...l.=...B..f.n......N....Lv..P......+...i.@..Xk.....\|.......(..#..5..L..>..2Io.Y....,...Y.,......t.'...].U..-..CW\|...[...p.C^."..)..\|.....+....#...0...........#...a....%..B..Vp.;...h.8../....i."..B.............Q..Q.Pg.Ul.......G.....u..2..4.....;..%...e..r.5..n...k.D..Zs........x..>{"..8.......v......k..8......T.x........8..g.....@..p......\|. .....d{.`x..o.5..{..Sr....[tRNS...........d....A.....'.....E.4..a..XP..A.....K..g.S..'...;.gu..]9......V....'..%...Ok....IDATx...gXSg..pk....=ZG.{...,.)4.t.].n.(.....A6.7..$a.@..$.$...

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2106
Entropy (8bit):	7.894670123887617
Encrypted:	false
SSDEEP:	48:f2G6V5uoAmbakhdWnNuF99uw/Y17rB2u5cng0f:uJV5uhmbbhdWNyTUrVqt
MD5:	554B0C4749474771D5AFEDDD07749B3F
SHA1:	F4305CCF5F02D9B812EE45BC382E318DE7367B2B
SHA-256:	28979E17D529D3FB2C2B96BFB6E0289C6A5762E8EF46336E95EA075B5AC5058F
SHA-512:	B0023298D104F617AAC6F3DC66A61F4DBF1DC6531DE0DB85F2D5A2E947776662ADE875531F28D1C2D994780936F95AF213184B489D508CB4E5D4E4299255A5BE
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/was-60.png
Preview:	RIFF2...WEBPVP8L%.../;.......m..k.}...~.t@....._=....-9R~U........9..&).s5.S].!6..H..8f..Lx...w..fv..Z.mk.VM....7....H#.=..Uh......\|.....%%(h.+../Z...I.4H./!I..:qr.qhm..........N..;..KQw....E>.HZ..q.....%.G...%..XK...K...6%....X..R%lG...h.......R...S]&..aP....'..G.3.x....~...g..`...=.......V....}..+......4...d'..Vd(..K...WJy..1.x..UH.=..9.c....9..6@%$.dJN.U.Dbw\.. .....R....(..F..`A....F>LV...9A.....R[...$.9.t.K\.......8\|Gw~x...../.<t`q6.y....t...}ID.....?..#..X.....5._..!V[.w.. h`R..w.....<..0q..([.E].....A...w....C4.QH.....(W....e.OGz.6.....Tw...J.9>=...:....*4Ir.q..!.Yz4X.BHA...gO.#f.....s........P>...\.....l.<h..+.E.`....m...5..J..&.8.....r.....O..5/?U\_y.....PW...3....zc........g......OA....i..SB.[..4T.6uww..wgp....b.......M...........3p.HQ.Y.O...S.w......-....(.H.o..[../. .<.o.k...o&t....k ..M..tro1zhxB..Qc.6.:..:1_..b.'oF...2.Z.l....b....#<.m....^...?...;w...TS....6.to..T.k....'B.g...:.>"....nj..g.y..]_I..Z.@.^..?z...A...

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUk4lmfpse:eBse
MD5:	377D257F2D2E294916143C069141C1C5
SHA1:	B7CAE69682CF31DD670B65088DB8395ACDA6ED3E
SHA-256:	AC8778041FDB7F2E08CEB574C9A766247EA26F1A7D90FA854C4EFCF4B361A957
SHA-512:	01211111688DC2007519FF56603FBE345D057337B911C829AAEE97B8D02E7D885E7A2C2D51730F54A04AEBC1821897C8041F15E216F1C973ED313087FA91A3FB
Malicious:	false
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2054)
Category:	downloaded
Size (bytes):	15119
Entropy (8bit):	5.465753181392154
Encrypted:	false
SSDEEP:	384:IQojHdEA+ggCiU7nnaClpF++5SYOelHO91TIuW:IQumA+QDnRROGT
MD5:	23A7AB8D8BA33D255E61BE9FC36B1D16
SHA1:	042D8431D552C81F4E504644AC88ADCE7BF2B76F
SHA-256:	127FFE5850ED564A98F7AC65C81F0D71C163EA45DF74F130841F78D4AC5AFAD5
SHA-512:	E7C5314731E0B8A54AB1459D7199B36FC25CD0367BC146F5287D3850BD9FE67BA60017D79C97EA8D9A91CD639F2BC2253096CE826277E7088F8ABFE6F0534B63
Malicious:	false
URL:	https://apis.google.com/js/rpc:shindig_random.js?onload=init
Preview:	(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	153068
Entropy (8bit):	4.8037978631451335
Encrypted:	false
SSDEEP:	3072:344xS2g2iidDR5GIqdH1u2k4BYIqGjm98Vss7zM8:oqqsu7Hm98VRzD
MD5:	F9BA6497187042F135EA78004E9BEF97
SHA1:	94D17B10ACE330E3DAB9C3AE9E8728865499AEED
SHA-256:	1485460341DD7ACCE60BBFF4B235101869025328E39F205FEA7C0EA0F4B23AC6
SHA-512:	19582BFB8D9EBE6C23122EC635ED74EF4C3F32F344B38A7CBA15952355761C95D63139F5532C779ABA4312B7772E587855E846F29947CBC2A19D1E5A0E11CA04
Malicious:	false
URL:	https://www.youtube.com/s/subscriptions/subscribe_embed/js/www-subscribe-embed-card_v0.js
Preview:	(function() { /.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0. /.var r;.function aa(a) {. var b = 0;. return function() {. return b < a.length ? {done: !1, value: a[b++]} : {done: !0}. }.}.var ba = 'function' == typeof Object.defineProperties ?. Object.defineProperty :. function(a, b, c) {. if (a == Array.prototype \|\| a == Object.prototype) return a;. a[b] = c.value;. return a. };.function ca(a) {. a = [. 'object' == typeof globalThis && globalThis, a,. 'object' == typeof window && window, 'object' == typeof self && self,. 'object' == typeof global && global. ];. for (var b = 0; b < a.length; ++b) {. var c = a[b];. if (c && c.Math == Math) return c. }. throw Error('Cannot find global object');.}.var da = ca(this);.function t(a, b) {. if (b). a: {. for (var c = da, d = a.split('.'), e = 0; e < d.length - 1; e++) {. var f = d[e];. if (!(f in c)) break a;. c = c[f].

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1948
Entropy (8bit):	7.8756603949755934
Encrypted:	false
SSDEEP:	48:BbplPYHLFfGEf7muf4PLD8lHFR0z4HaLYwCNLsYEjRv:BbpqJpjmtPL+HFR0z46EwCCv
MD5:	34B94F99E5CE78478887F4FDD14CC126
SHA1:	A672CFB2EABA1CFF4C3FC8858BDD078ACB7DE260
SHA-256:	0E2530C81C3870C3F90CC74851F92BCEAD1C627CA6AF5E1ACFD778EDBB914F84
SHA-512:	D05943F684B35A614DF44BD4110410E00A0FF174689157ABE912D9592183696C99CE35126348D4BBB9430363057D7F4EB9D40302B8964309D757ABADC13E4424
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/wfh-60.png
Preview:	RIFF....WEBPVP8L..../;........G.T..;...$mO..M......UU{_{.. .@`..pwyz.=.ul.it%/3....n...3Y....XH.`.l.m........\i.,m..$c.....z......h.z.C..Rw.x...)T(..M.j.ui.-.y6.k...$.Yu..&.1R.0..:...6.e_\|.F6....:.O.n.P......DT@Z.0.I.c...5a...}.....M......+\.7...~t..\|..F.W0.N].....ZjV.b.cU.o.....d;.Q..%.Q.2.....0...,\..^....z....J.I!....&.. t.0K.A...%..zB..bX.JY....y..!@....L....A.F..Kb.....b.%...N..0......D(...o...R..V.hi..%d.D....bI]3:.U...U..qiqj...Rri.W?.h..Q....G........Sn}J..C.W...Q...xW'.....F.k..{_.....`.0..D.\|"....x./:@..{!..w.2!_...s.L.L\..&...o..@..-x........e.r$oJ...M..!..Y.1c.(l..e+YL.....F1.F...(..3.....Qm......D>.g..;?\|4Qb......({.+..['.['...w..ei..C......J>....B.E.a......L.p..SS.....N...u{x.=.........l>......bu...^...cx....nb....m.x_......\|{.m..Z....j..Z5.L.;.l.m.m.v.m.m......=..........VQx...{.k....1_.<.......T.C.B.g..?C.V`.^....l.......QpF.i%...)^...B[.n.f......N-Q.hk........Zu..Q;.m!1..J......y.......A.V.....(.?.6.i......q..m.f2...[.n].G

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	553
Entropy (8bit):	4.933065619223014
Encrypted:	false
SSDEEP:	12:tc5glRRNlfGqV3QLOSkyqF7BliBl07VAcBn7VAKDBez7VAhD:tc6Nlfl3Q9nqNjcCA6AvAhD
MD5:	5A5D3A87F03241E552EEED36FDA5B202
SHA1:	51F344C27C6F5DA22C6F5360BA39771738BDBBD7
SHA-256:	DE5204EC70199C02EC0D0DAF0E4BFF8702EBFCB899F8C768E1C6EBFCFB1828FD
SHA-512:	5AE753E869805A27BB26A0D2D01C215873214E904B3162475EA99C9C7D095854F7AF15E64F1C813B536B9E13C502588E8ED86963913FC70B9567F45E65160A28
Malicious:	false
Preview:	<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.051534 1017.717791h1519.038037V7.53865H10.051534v1010.179141z m1521.55092 2.512884v-3.769325 3.769325zM3.769325 1024V0h1531.602454V1022.743558H3.769325z" fill="#353636"></path><path d="M6.282209 680.991411h1525.320245v339.239264H6.282209z" fill="#E51F1F"></path><path d="M6.282209 343.008589h1525.320245v339.239264H6.282209z" fill="#232B8C"></path><path d="M6.282209 3.769325h1525.320245v339.239264H6.282209z" fill="#FFFFFF"></path></svg>.

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	9674
Entropy (8bit):	7.955279741068179
Encrypted:	false
SSDEEP:	192:3v44dUjl/tinDgt+x0jDbKBt14ZOOIJvNz4AygTUcZ:w4d+/0nDlOKL14uvtTzZ
MD5:	4B14E2B7A3D5B21F6370FF2E1308E890
SHA1:	82CAAFA4B7FA7F7891B680CAA76F29F7CB8492CD
SHA-256:	CB07283137E6D38EEF24EE770A46A959C1F35BD8F761E602CE558DE16C2346B4
SHA-512:	17217097D7A8370573214340BEA1318968E27A6D386979DC2E6277B1CA52DB4CB9D2BC01B6A59A2B1834C3D872EF833626C4DD8D7AD032F23D5EA0C69308EB10
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/thanks_box_wdf.png
Preview:	RIFF.%..WEBPVP8L.%../c@..M8l.F. ...#_...SCD.'.Cv...........r.z&.a.(n.....R....2..w..D.T!..VY.md.UF..K#......!...$E........[.-...j.....Yb..H\../.....o~d..O...}..Nd"w.z.....4..Z....r...V.......y.kc.X7[Z....O[..7..5Yb}(...uc.l.d~}.[.. ..]..?.VZ.d:..h.b>..:@0.X+Z.......?_Z.F!@]Md,j../...6.rvw...@'w...kD). G...J.i.m.vl.....)m....e..D..P........!"&@A...m~`1.wQ9t...Jy.......$.9.3.kffffG.}?...5.Kp.....3G....N..{z....6.qut..c..z`.._jYe.......G....8z.BiL[zB.....a6....v.^iu.l?.;..H..I...'.%#...'$..$I..}....V.m[..{... s...:p..5"..b22M.~...L..g..I.s.H..,jf..aZffffff..f......<..<]\...t..n.....8..!.\..t..Q..wcT......C.y.4.J..4...d.R.&...UNC..[...l......>.=Y....=.Q...T..%......#B...=g{.l[.m.R..1.3sl-..[....1333..J.\...d.....P....0.........Z.->....0...g..f.H....=...FibE{.lRL....:aO.q........B!.,I.f...G.....$LH.J...N.....y.>M.V.0...0.&LTN.F...P5...5Ch.M~..1..2.$...D..nq....s..m.;t..3...0..1....B.....J.e^.(2.......e......dV..7"...g.I..\.[[:`.I....hRt.CT

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 100, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2403
Entropy (8bit):	7.867084930490025
Encrypted:	false
SSDEEP:	48:PYOZXpQjo58CiDL6vFsYhRVRiSesA89VQOdUrRSKtn1ysQzx3Dq:xZcoKesYviJslIRSKt1yvzxe
MD5:	8C24DCF083A39D8F918640F5B0C2E1DB
SHA1:	5ED47A627D6739913594E4ABED7627B658AA33B0
SHA-256:	D4DF978B63AAD19A424437AC81D076CB6B1D3B9D74B40D943AD6B9F317626B73
SHA-512:	8AB8A5A8DB3ABB68F1B8705FC87F0B23C151E28D6023228605D9BA2F704F5C6DDED868EFC444F7AF6435872B2758577531D07F58AFF156D084FBF339437EE5BF
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/day_50.png
Preview:	.PNG........IHDR...2...d.......c[...IDATx....Me..........4j"..hRJ.KJZ.5.P)....".#.G..B...G.(E.bYk.!y.0..c.3^.....u..^.^.k...o.s_.\|....{....4.y........$>..D.%B.[.$.Q..J...b...A..y..,.....z........y1Q..U...?.tQ.......0L..'.\|.N..#.4...."J.,a.F.3.......w.WD....9..A......i..h..V..5..[o.L...Q..W.x.xH......k..(<..S..?.b#QK.(..7....,....u.x@,..$\.....Iq..-....RW.,.d..)..j.G....Wy.X..5b4..C...=...I.X.q,...".x8....L. ..b.7..jXq%.k)..+._....QD......xM..K.N..+....f.3..k..UT....(W .p....x...k...D..b-.a..I.....`\|.Cl..Q..c..Tf...$....~.....p._.&........".m..b/C.{...J..1Q./.F7...X. ......a...P...{.I..X#........;E..L.Q(....-.q.....%.Fp._.,nY..g.p...a.Kb.%.....2.)J...e..p#.>.....c...`.h,.[4#Hl....P...-.v"."Xa...d.3`S..GS...b.X/......%.....`........p..@$.).%...3..h.y:J.K...Z.x...Xe.c)..(N......TdAN.5E.3./.r.!...:..K...bY>?-T.%.?b.A$.}.........e.......a..].]`{....%.(.b....q$.(rKG.5H..x..b.....E%a.$..,..........X.(........11V.b..!.v`. ."&.l0..f.{).f.=b

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	6768
Entropy (8bit):	7.964142528963425
Encrypted:	false
SSDEEP:	192:5GSB1fTIij+xp5r/U1ondDSdT3ab3RnYjEUZqBuu:5pBZTz+5rcWDSh3k3RYRPu
MD5:	77EDB56EA5F8C9D4DA03A82E462258C5
SHA1:	362052256F02AB056320CF7464DF8AEE38F83C37
SHA-256:	0C65CCC673880F316384734BFF8325A567812B595BC38D7566FD57F25E74E9AA
SHA-512:	2DAA8AF4F7764E3AC102916A907C0B9B8B4148CBACCF1F195F565BD4EEE294D1CC7F8D2497E8269C2570E9E146FB25EECF2ED2D9E40BA732DB43D47972B4E62B
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/card.png
Preview:	RIFFh...WEBPVP8L[.../q.......mS.y....e....m........m.V.}.ww..(..i.."......U+....}...1)0.......k..$....&."1...i.1.mns........D@)..J..c.m?..A........a.........E.......f......c......LH....J.....C...I..6...p...a.Hl...r.k?....r..%/.....C+u..Y)U...lA...W.. C..Uq2..2.8...g.-..O.K..?.T.9..7...^..u5...$.r.$y..(.$AR...w..9J.0.xN.......2.P+.)..<v.Y....~..7c.l.iMO>#....J.."..u...a1.1.o'.X...u:.^Z.5..igB.Uy.}...u.,(..Tw........U.(..}..}4........?o.....^.V>..-i(..l~9<...Z:.o.....P]..+..4}..N..5{y.t4..6.J-......O>4.v-..\.#......-."".&..g.....A...hIu...M.2...)'.J.C.D..A..E....Td8....>x...y..m."..Q.............<K.?.........]n.e.+6..r...N@+).e!.<H5.[vM....l.1x.4.R.%.......L..w&.w...zE...$Iu.Yi....o............f..A.UBi.@.<..bv..B.....v.o.m.qI"....Oo,.~1. t.d]_.h.d-G.....?...sx....f.ZO.$A.D!..~...%..."W$/U.".....Z...Y.1..w.%........!V7kj.~=..#-$Z....<.D...+..D........[.e>=:.Ik..v.uI7....m..+Q... .Z..:..)J....N.8.@..-.N...y...fqq.~.(k..B?.e...boMM.d...."#...-..

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.280052635092167
Encrypted:	false
SSDEEP:	6:6v/lhPfOSaRquXhkrTLI8SY0LHD5AE5hJQ2cheVp:6v/7eSaDik8SY0DD5AoJtcO
MD5:	388940C42991EFD9EB33F133E3280696
SHA1:	C6B4C460D1CCB5833DEB7844423C54C5F2CD2394
SHA-256:	D65F4B2E8EEE94DDC7F762D098DE19558D879A3B597C8913B4D075532E3ED4B4
SHA-512:	5E103C4E4FAC6343E7A133DC80970C98D5B843BDCA4C5E613F9CAAA5BD295C272E7D3EDA1937FB553CB91111497A25B33DC8B8AA80157D49E92BB70BA5F8F476
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...`PLTE................................................................................................\|%......tRNS.....!.\4....v..2...)....~....CI}....[IDATx..G..0.DQ............Ydv.!.}/j..9..b@.....u.........3.....40..n`q...^.\9.qH..~..._..H<.\|.....IEND.B`.

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	17542
Entropy (8bit):	5.299667857987624
Encrypted:	false
SSDEEP:	192:JUzt9lyuvHcHEy7UshcWkQfqu1+u8Zlt3uQDiqxfN50bvXNwRR3:JUzngusFf+O7+96qFN6xuR3
MD5:	DF8528DB6019A020DF7257520FDA5234
SHA1:	A75C0F67AD8A1EF124C33B341C3F69C0ABDEE96F
SHA-256:	3EB4BF2421B07570F15833A40552D64B815E7F84995E149840627FE60BF017F6
SHA-512:	ED3A1088FB985C2C5D0032CBD4BD2DF829AF85CE9FDECE6C91866383B413BD5B96E548BAC38D52E966DC87A201768529A0371C0A40F904833452A8DA3757FC51
Malicious:	false
URL:	https://www.wisecleaner.com/favicon.ico
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W5..\8G.\8h.\8{.\8..\8~.\8l.\8O.Z7$.K...........................................................................................................................................N0..]9?.\8..]9.]9..\8..]9..]9..\8..]9..]9..]9..]9..]9.\8..]9Q.V4......................................................................................................................U4..^:a.]9.]9..]9..]9..]9..]9..]9..]9..]8..^9.._;..b<..d>..d>..b=..^9..]9.\8z.Z

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 27 x 104, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	529
Entropy (8bit):	7.252570500353867
Encrypted:	false
SSDEEP:	12:6v/7VSN3aNfQ85gaQozBZ2rWfh4Wc/OJ7sz6fc6EGh9:4Q3aN4uuoZ4WP2GX
MD5:	CF3B584C9509ED52C2C20C38A9C71F55
SHA1:	445B44F74714C214793AC8C3BD4B7A0DA9E838D0
SHA-256:	EC17F9A8FED9C5AA8D1E57E5AD49465E1F543791512FCF69927B5A6A67DE68D6
SHA-512:	4C308B6A39E9F29BF4BCDE7B3D693E258622B733447DD9F43C15FF610ED71E1625DEFB969797BD8C39A5EE9DC0E7FF5596009900E39A26556BD93721573FCAFC
Malicious:	false
Preview:	.PNG........IHDR.......h.....7.{.....PLTE.............................................................................................................w..v..r..f..c..X..T..J..F..D..@..>..:..8..1..0..-..%.....$...................................x.qy.^....tRNS.@..f....IDATx......@............?..r........'.&.N...J']..../RfjB.0.. .7...b\.L@..3]....*.T.X.r........Z.Y.v<j..\.{..P.O...kf....`.a...1....5X...Q}....?..}.=.?...B.....:....N......<....@[C.=\|.8.H.....N..D".o..I3F%L._....yb`U.Sd....IEND.B`.

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.873397485540178
Encrypted:	false
SSDEEP:	48:1ycv9X/vyssSziu8ducqBvYyIDIy7Ux1zMh0rX3PSMu:1ycv9X/assSRBidIBMh0rX3P4
MD5:	EA94E3BE9F832706E4715211203CEF93
SHA1:	047D480E19E6BEA3D3C32314C72757BA60D990DB
SHA-256:	B81DA471F3B63EC9B5AB9EC43EBF35E49D3FD32D5793697E83059B3C9F940936
SHA-512:	C6518852C83BD4A869EFF77A93A85C910CAB5D528A280EAC671A52651DC6F8D6A52319A41601D0B6AC34DCA8C14B4DC8CEE7B9FF5A7DAF8264FE643911415C47
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE.w......."..%..-..C4ax..J..c0.zj.+e2.oC..]Y..k.-.......1.q.3.s....................G+.....q.1...&.Jp.............................7......'.@`.......Hk.T~........W..@a..L.Im....Mt....Qx....Op.......?_.Ei....[c......Df....Lr....ie....@b.......[u).....I\..b...8,-/d5..U..<...q+.=u.IZ.........LYJ..fN........9...j/..[mz=..W...6..T..$M...Y.....v.)....q...b.#.x.B.....e......Cg.).~...........F.....`y1.K....s.=.c...\..xA....y9..Q./....U......!....Qm...o..b.._........7g.N..WWX....eE.G.........e.5.S..3......4........}.Q.w.<..v./..f..h..L.....Z.....n.......t..o...\|.9.Y........).e......\|.e..<...xm.&..........T...........s...J4X.:[........?.....[.?....W.....Eh.]........Gp....Nu.b........S\|......................>^........VtRNS....F..........................Mw.y.....ckaa.R2`..<..T.7..0.Y.J.:....L...x.."...L.-.....IDATx...WT.Y..p...].....*...N..6{.+..+.".;.H...%...%=....2..L..w.Y

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1763)
Category:	downloaded
Size (bytes):	189181
Entropy (8bit):	5.52840972121395
Encrypted:	false
SSDEEP:	3072:cqQaf5qZ3fhO+eW68eG1LceF2/eazQthTnXDL9btIMP1dZT:TQX5N4YLceF+CTnXP9RIMzR
MD5:	B38886D4078BECDE8A6EA43A7B188E00
SHA1:	90D7129BA896DB71FF8FA026BB035D8F454F8523
SHA-256:	A3644DADED411839EF4F23EF0F27796F0192C40CB12276C2852938B1680E6380
SHA-512:	95062D89942934882460130D9F191AFD573D7F42921C6DB58A1A1038108373F7C37804A23C6E684CAEB12A67E3768EEB7CF7643F94CFF74201369AD7CEEA022B
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=UA-17835040-1&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":"c"}],. "tags":[{"function":"__rep","vtp_containerId":"UA-17835040-1","vtp_remoteConfig":["map"],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__c",[46,"a"],[36,[17,[15,"a"],"value"]]]. .].,"entities":{."__c":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__c":{}...}....,"security_groups":{."google":[."__c"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},fa=function(a){for(var b=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"obje

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2247)
Category:	downloaded
Size (bytes):	187226
Entropy (8bit):	5.6714205011317
Encrypted:	false
SSDEEP:	1536:yIm2SM2e0RoMx+IPy5EEU7bTeZyaNJJhKK5klQL1QutY2rcgXhH1p/eFJhmX3+PZ:yfhw5klm13jrv8qX38XqXGfMT8YMt4Bw
MD5:	B00039042FABD2C82918A9B84486510C
SHA1:	6EACCF586B0A48C82230683A05D682CA9F00C95C
SHA-256:	897BDD8FD8653D0AD8733D7331D2E516F173728BAA87661D468842E8B23B974E
SHA-512:	561779D27C284BB8FDCA06CA861E9EE581C74079737ABA4D91DC07BD6288B8959721301DBABEDCE9334E8E38CCA5857DAE730D029D93AB9C6E6A23F48C67011D
Malicious:	false
URL:	https://cse.google.com/adsense/search/async-ads.js
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=4;var sffeData_={service_host:"cse.google.com",hash:"15670103027050365096",packages:"search",module:"ads",version:"3",m:{cei:"17301431,17301434,17301435",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:""}};var m;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProper

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2064
Entropy (8bit):	7.907133742547897
Encrypted:	false
SSDEEP:	48:Yvu40FBz8mOkCoUdisob28mk6f8Disq6eiloPZoIY09:YOFpU43xmR8uFOo/9
MD5:	0558220BF91711EFD24716961A4ED370
SHA1:	3F2F44042BCCFAF98E7DB86C376946A414191A78
SHA-256:	A9A78A8D70997CB443D4F8D99CC6BD1BF8808E448020C054046BDFFA93E229F1
SHA-512:	93F61F6963943E424F4A9AF84C072F8B7575EEF2ED329251EA69681F01D8493CF1A701F8A8F8C18A31EF8F432B870971A3E85C4844BCF43F842E6CDCE8B8F7DB
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/wrc-60.png
Preview:	RIFF....WEBPVP8L..../;....'1.m......!.."..wf..{$.H..&R.-.p..;...pwg.i...d[....}..O. ..?."p9.E.m....U.m.v\G[..'].Q.m.~!...H@,0[..3&Y.YR......'.%..-W.....Y..!..oD}c...G...$.h8\|.%..f.j.!..X..[...Z..n6.{p.QSB...1..V..Gi...M...bR..v.C.di....tyq.3G..9...A!.......0B.o..X...r0T.MOP.T$..4....`(."..,.(+..V.1L..90..TO.f$j.(....KY{.8hL....M........Z.....dwMi..Z..<B.......A.{p.h...gm.nX.^.{.....r...2..kr....G.I.>"..O.R.N..e......'f.6.vc.&......} \|..*...">.>.2...D>.o....cA.=..D..`!C'[[........38..I\.....i....p.]..jj....i.#...EIDN..c....v.V..{P60K...D...Zj...JL.d.vo1.........x+s.'.b!.. .e...E!ps._..7..}-.5k....?qtn9.r/`..C....XVEQ.~.=.....//gO..#..].8...sy.}.2..YB.1N.:...&.<!.T.......I>2.?.......W;_2P...t...Am'}.`..r.4.mcF..m..&.m.VN.s.W{..E....F.......>.;v.0n.}......WWn.....sy"q.C..7..........4.....C8"19x..6.s.FGQ5TU......d3..Z..."...7.&.Lbtc3.....N....0............./.?.v7..X..p.u..L.....}....U......x.......,].[..:.eaci.8m.HG.../...,...:G........8L

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3164)
Category:	downloaded
Size (bytes):	9012
Entropy (8bit):	5.448864476543654
Encrypted:	false
SSDEEP:	192:5miE6gVWv3BhTi2Ypi6oiayL/L1NWMbzO1E1wvbvwetvjvI2Fv3vkihvJv2ort93:5m91VO3XTi2YpiTiazLwepzI2hfki19h
MD5:	7EAC9A15B29E38B438A773E13C76B54E
SHA1:	14E477817DE60745CB109302BA0727D1CAC31763
SHA-256:	9715F8F841C05F389B07BC369A24251A78B2C8DF778FA64043DAE5D689AD9BAC
SHA-512:	E4E820B04CF416C2BEA645AC93B5CBE196A36922012703A147C486A28FCB036707C9A86787F9857097C2B80B3F9920D827B7B661E9ABD16BFD1895D976A32ED2
Malicious:	false
URL:	https://cse.google.com/cse.js?cx=017327711740582551031:lqpis72-mwa
Preview:	(function(opts_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var f=this\|\|self;function g(a){return a};var h;function k(a,b){this.h=a===l&&b\|\|"";this.g=m}function n(a){return a instanceof k&&a.constructor===k&&a.g===m?a.h:"type_error:Const"}var m={},l={};function p(a,b){this.h=b===q?a:""}p.prototype.toString=function(){return this.h+""};function r(a){return a instanceof p&&a.constructor===p?a.h:"type_error:TrustedResourceUrl"}.function u(a,b){var c=n(a);if(!v.test(c))throw Error("Invalid TrustedResourceUrl format: "+c);a=c.replace(w,function(d,e){if(!Object.prototype.hasOwnProperty.call(b,e))throw Error('Found marker, "'+e+'", in format string, "'+c+'", but no valid label mapping found in args: '+JSON.stringify(b));d=b[e];return d instanceof k?n(d):encodeURIComponent(String(d))});return x(a)}var w=/%{(\w+)}/g,v=RegExp("^((https:)?//[0-9a-z.:[\\]-]+/\|/[^/\\\\]\|[^:/\\\\%]+/\|[^:/\\\\%][?#]\|about:blank#)","i"),y=/^([^?#])(\?[^#]*)?(#[\s

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12982), with no line terminators
Category:	downloaded
Size (bytes):	12982
Entropy (8bit):	4.923348663200217
Encrypted:	false
SSDEEP:	192:puBgDTo8aTv1bQ49+R7uE+65LvO7HRRNRIV2IxWG:IBETotTb0xO7xzY2IxWG
MD5:	E63466233D8CC237F886AB79DFDEBC33
SHA1:	EFB0499076476BFE86134C0D66ED4491D59AA988
SHA-256:	6FB1A8660487573CF55035C6B40FB1FF82ADADD103397A3E8145DDD2E824514C
SHA-512:	2F7FDD4E5C38CFC87B6803D8B564F048D92BAB028B9C3DF3ECA710DC3E82E621153C8770867655AFEE9142F3AE357EBF50A94391E51EA6C60600D7555E272C4D
Malicious:	false
URL:	https://www.wisecleaner.com/static/page/product/thanks-download/thanks-download.css
Preview:	.thanks_downloading_h1{font-size:32px;text-align:center;background:#ebf8ff;color:#327ca5;line-height:100px;font-weight:400}.download_success_content{width:1000px;margin:0 auto;zoom:1;vertical-align:top;padding-bottom:20px}.download_success_content .icon{float:left;background-image:url(/static/img/product/update/icon.png);background-repeat:no-repeat}.download_success_content h2{width:100%;padding:40px 0;text-align:center;font-size:18px;font-weight:700}.download_success_content h2 span{color:#ff790c}.download_success_content .title{width:100%;height:100px;text-align:center}.download_success_content .title li{float:left;height:100px}.download_success_content .title li strong{display:block;line-height:40px;font-weight:700}.download_success_content .title .wc365,.download_success_content .title .wfh_free,.download_success_content .title .wdc_free,.download_success_content .title .wdf_free,.download_success_content .title .wdr_free{width:380px}.download_success_content .title .wc365_pro,.dow

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 5, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.85194751582915
Encrypted:	false
SSDEEP:	3:yionv//thPlE6hm/IraRMttpCLZlllgRSl0Xnkxt4h3Rjtsup:6v/lhPbwAev/6RSu3g4hhjtjp
MD5:	91F7F433B47F76D152AC4DC8CBB8324E
SHA1:	FFCE61C56DDBFAF6C2D02D3BB2DCDA9B49BEE460
SHA-256:	984601230D8CBFE18370425E8E897037CC1A7ADF831A691A9EDE573CF44479D4
SHA-512:	F291BF986389C3D8F6839405232902350A849955B23F3CE8E9C3373D64DE030FC4CA523056BBDC095BC905C2BE9CED7D199740E65BF8030C69B1E67EA0B0E3E1
Malicious:	false
Preview:	.PNG........IHDR.............v.......PLTE...................@t.....tRNS.."DU........IDAT..c.`.....R.%l..G....IEND.B`.

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 5, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	4.85194751582915
Encrypted:	false
SSDEEP:	3:yionv//thPlE6hm/IraRMttpCLZlllgRSl0Xnkxt4h3Rjtsup:6v/lhPbwAev/6RSu3g4hhjtjp
MD5:	91F7F433B47F76D152AC4DC8CBB8324E
SHA1:	FFCE61C56DDBFAF6C2D02D3BB2DCDA9B49BEE460
SHA-256:	984601230D8CBFE18370425E8E897037CC1A7ADF831A691A9EDE573CF44479D4
SHA-512:	F291BF986389C3D8F6839405232902350A849955B23F3CE8E9C3373D64DE030FC4CA523056BBDC095BC905C2BE9CED7D199740E65BF8030C69B1E67EA0B0E3E1
Malicious:	false
URL:	https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropB_3.png
Preview:	.PNG........IHDR.............v.......PLTE...................@t.....tRNS.."DU........IDAT..c.`.....R.%l..G....IEND.B`.

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1915)
Category:	downloaded
Size (bytes):	11442
Entropy (8bit):	5.574057570778649
Encrypted:	false
SSDEEP:	192:+MvFGmjVGhFkC7s7zpRnhK1deZ+ZzirR+j3IexCAC59RKBUq5hL+XloH:+M0mhG3kC7s7zpRM1Vz8+j3IePyYBUoj
MD5:	40AAADF2A7451D276B940CDDEFB2D0ED
SHA1:	B2FC8129A4F5E5A0C8CB631218F40A4230444D9E
SHA-256:	4B515A19E688085B55F51F1EDA7BC3E51404E8F59B64652E094994BAF7BE28F2
SHA-512:	6F66544481257FF36CDA85DA81960A848EBCF86C2EB7BBE685C9B6A0E91BCA9FC9879C4844315C90AFD9158F1D54398F0F1D650D50204E77692E48B39A038D50
Malicious:	false
URL:	https://ssl.gstatic.com/accounts/o/3604799710-postmessagerelay.js
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k=this\|\|self,u=function(a,b){a=a.split(".");var c=k;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var e;a.length&&(e=a.shift());)a.length\|\|void 0===b?c=c[e]&&c[e]!==Object.prototype[e]?c[e]:c[e]={}:c[e]=b},w=function(a,b){function c(){}c.prototype=b.prototype;a.F=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.D=function(e,d,h){for(var p=Array(arguments.length-2),m=2;m<arguments.length;m++)p[m-2]=arguments[m];return b.prototype[d].apply(e,p)}};function y(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,y);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));void 0!==b&&(this.cause=b)}w(y,Error);y.prototype.name="CustomError";function z(a,b){a=a.split("%s");for(var c="",e=a.length-1,d=0;d<e;d++)c+=a[d]+(d<b.length?b[d]:"%s");y.call(this,c+a[e])}w(z,y);z.prototype.name="AssertionError";var A=function(a,b,c){if(!a){var e="Assertion fai

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12331)
Category:	downloaded
Size (bytes):	12332
Entropy (8bit):	5.0916439525688215
Encrypted:	false
SSDEEP:	192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O
MD5:	88A769D2FE35899FD45A332A0A032CC0
SHA1:	514C6C1D8475D17E412849A4C90159517D0FA10A
SHA-256:	CCF00D1923B0131A10E0C6D26F95E5DEE6EBF8621A27E83C5A2F68A2E0093142
SHA-512:	756CC5CD029FC4ADC9100D0DA2F2B0EFB3DF0F2BF894FBA2824019832FEA594EDD40A238A5FFACC205572CC0155F5632D70F54E37EDC0772460F44C69CB76AB8
Malicious:	false
URL:	https://www.wisecleaner.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Preview:	!function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn\|\|console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}function n(t,e){var n=e.parentNode;n&&h(t,n,e)}function r(t,e){h(t,e,e.childNodes[0])}function o(t){var e=t.parentNode;e&&e.removeChild(t)}function i(t){var e=t.namespaceURI===A?"xlink:href":"src";return t.getAttribute(e)}function a(t,e){var n=t.type.substr(e.length);return!(n&&!E[n.trim()])&&((!k\|\|!t.hasAttribute("nomodule"))&&!(!k&&"module"===n))}function c(t){return a(t,"")}function s(t,e){return function(n){if(e(),t)return t.call(this,n)}}function u(t,e){t.onload=s(t.onload,e),t.onerror=s(t.onerror,e)}function p(t){var e=document.createElementNS(t.namespaceURI,"script");e.async=t.hasAttribute("async"),e.textContent=t.textContent;for(var n=0;n<t.attributes.length;n++){var r=t.attributes[n];try{r.namespaceURI?e.setAttributeNS(r.namespace

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1304
Entropy (8bit):	4.6420980349575425
Encrypted:	false
SSDEEP:	24:t4kZbeaxMG0Ry84Lo8lYiNsswwzNv9Nq5JXoqxQi3SB7IcUrEuYg1FtVBg:f4iHNssZzN1kJXjQi6TAnYgpg
MD5:	D117936B48B29A295867368D81676033
SHA1:	536BD05DB4B1553CCCECCCEA826EAE1B6BBF2C38
SHA-256:	091FE9B452020B0AA709D9C3BC62D76D79C5D80F4A85D4E620B86E488E083C89
SHA-512:	E0CE78A844F4D452E2B337C0035D7C50A471C34BBCB22B1EE9C7469279E3DFD298FB67A4A366125E5194743EE6D34098260DBF762C2FBB1C2D807471F145F2BA
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_follow_youtube.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(3.000000, 7.000000)" fill="#FFFFFF" fill-rule="nonzero" id="youtube">. <path d="M26.4363204,2.9587308 C26.1180446,1.80068637 25.2268924,0.895766055 24.0864672,0.572573076 C21.9819531,1.61449745e-05 13.5121279,1.61449745e-05 13.5121279,1.61449745e-05 C13.5121279,1.61449745e-05 5.06368546,-0.0113956103 2.93778861,0.572573076 C1.79736341,0.895766055 0.906211144,1.80068637 0.587935434,2.9587308 C0.189001259,5.14662552 -0.0076752007,7.36759466 0.00022906088,9.5926607 C-0.00613498522,11.8093306 0.190535027,14.0218101 0.587935434,16.2014491 C0.906211144,17.3594935 1.79736341,18.2644138 2.93778861,18.5876068 C5.04005188,19.1612903 13.5121279,19.1612903 13.5121279,19.1612903 C13.5121279,19.1612903 21.9594449,19.1612903 24.0864672,18.5876068 C25.2268924,18.2644138 26.1180446,17.35949

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.1961893998690174
Encrypted:	false
SSDEEP:	3:CUXPQxkhpse:1Qi/se
MD5:	D44EBB7184C776B663F036174FAA361A
SHA1:	53A278EEDCE146C3A979D190AF4AFFAEC3D7CFEB
SHA-256:	ED1B73C6B4690CDE9B521865B58E031293209BC0B2BA2B5716ECF4BF9885EE4B
SHA-512:	596259EC8195661D7335A95BF8FE82EF9C75676FFF07079187AA314824268B8986AE00E33FB8FA2B977BEBE05D0C426F6D507B1B38B21536E5513FBCB6693042
Malicious:	false
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 370 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7545
Entropy (8bit):	7.945513190018032
Encrypted:	false
SSDEEP:	96:HGc4sG0cyLMTqR8zxewb0IBO6gxCPe6G4gYVsCZ7Qzk3LXu8V8Z+MXVNcYYPEjBd:HGcvZwA8zxlW65H7QzqXuWFyYMBsZtG
MD5:	FC8B3F422A354289B5B7E1FC5AC25C2F
SHA1:	81FEE6B292E5C3952F0199A3E218ED1E97EFCFE6
SHA-256:	353B88231C6EC3DF419B07A634556E45E165C1EA5355CAD90838AED7B0DB6CCC
SHA-512:	AE4AD95B8E2821BC4124E5840DDB57F379564B90E220D7C55A3B05FAAA16774029A013726DDF7BE74AA2F90E7DB876C2C7441CCA504AC3B574694F02367877A8
Malicious:	false
Preview:	.PNG........IHDR...r...d.......K.....PLTE................................SSSooo...\|\|\|....................l........\|........r...."...........................qD/.\#..............................................vvvQQQ.w..........@...k..Y..E.....!}..e..M.*m.^.......... N..5.Ow............^.......V..?............k...X...................$.......z..B............................kkkuuu...........FEEE..0...2A.....................vwu........{...a..3i.!.j.6...&.q...........................zzzddd...YYY...wwwnnn.........ccc^^^WWW...aaa___lll999000FFF.............................]....n.........S.?B..1..i.S0.)WZWY.X..~{.{y.k ................z.7..f.............XS.@(.0.R....]6EAA>@.....g..m.%.Yr.1e.v..........{....tRNS.@..f...{IDATx...R.H....,....T.E.X.Y...}L..6..C...?...Z2.A.i .d...}.%..P.w....:8..?^}._.Y.f.5k.Y.f.5k.Y.f.5k^....0....}.g..(..y5.....o$-~.2.G>.~h.. .RO.S~...O........Z~cc...............F...I.}....f....$.~...M...G f,...3....U.....~..sv..y....V2>[.cL7t

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	136969
Entropy (8bit):	5.473555780628284
Encrypted:	false
SSDEEP:	3072:QI9yvDslCsrCF9f/U2Dj3Fkk7rEePvgciu:l9ytsrieDkdiu
MD5:	4D1BD282F5A3799D4E2880CF69AF9269
SHA1:	2EDE61BE138A7BEAA7D6214AA278479DCE258ADB
SHA-256:	5E075152B65966C0C6FCD3EE7D9F62550981A7BB4ED47611F4286C16E0D79693
SHA-512:	615556B06959AAE4229B228CD023F15526256311B5E06DC3C1B122DCBE1FF2F01863E09F5B86F600BCEE885F180B5148E7813FDE76D877B3E4A114A73169C349
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.707379594203088
Encrypted:	false
SSDEEP:	6:tI9mc4sl9D4WvZ4lft7whYplMAn9BGRshfVplMA8sXAGRshmfVplMAT5RM:t4L4WvylfrpyA9BGeVpyA8sXAGbfVpyH
MD5:	EB502325A4C66BB3D497612E89EFCEA6
SHA1:	E05897D8A78C7B13C71B03CD14E25739A9E87474
SHA-256:	6937CA517FBB92516D1CE91FB8DA88C127F48BFCDC8D2B4835E5D684EAA1CD0D
SHA-512:	D423EFA28E7AA7AACD47ABEBB172D2CBE7CC142E49C73423D77058254B25F28CB09D62877027D7FC7429663E7B48F74B5F644E760E912488A49C0BB25977AB24
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 300 200" width="28" height="28">..<rect x="0" y="0" width="100" height="200" fill="#0055a4"></rect>..<rect x="100" y="0" width="100" height="200" fill="#ffffff"></rect>..<rect x="200" y="0" width="100" height="200" fill="#ef4135"></rect>..</svg>..

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2050)
Category:	downloaded
Size (bytes):	55979
Entropy (8bit):	5.550656449721302
Encrypted:	false
SSDEEP:	768:1kZckfpcaoaFgQvdCcuABzAjGNez4GepEaMywvYaWB5dBszjIAxyXEcceKbhVmy3:gca1gQvUQajGYzQpEa3T+IA4Ucyb
MD5:	E66ACFDB2F1DFCFF8C6DBA736DD4AB6D
SHA1:	36026360B6C8D750488EF2C739E04969F8C5BCD7
SHA-256:	742841B3CF614DD55CE486A7335018BD1992C4D05EF74B45A0781318075A99F3
SHA-512:	113B6E50DED2703CB7A484A66250A38D74833AB9A994DC54042ABC95500FE7405F9E5F384186C15BF392C613420A19108482D279776F6E2FD00245B8BD892FBC
Malicious:	false
URL:	https://apis.google.com/js/platform.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},da=ca(this),r=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.r("Symbol",function(a){if(a)return a;var b=function(f,g){this.ba=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.ba};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1848
Entropy (8bit):	7.8609607538651955
Encrypted:	false
SSDEEP:	48:piEDycHoCJASmR4KhYLx0RtwXd8S/DmgRF9jEguKJ:oE6WBVtXSgDljEg7J
MD5:	2A03DE7B43B6DB803CA26918E60688EA
SHA1:	307852AA729EE6A3D25B3066059F6CD322BBD1F9
SHA-256:	8FF8DA05C04F74DFF2CEFBC3F5A10BF313C0EF89B9621925711785435FF0D454
SHA-512:	4E2192D7E617145DE9A41D7D3626BE0865158E924BCA26B073CA5E98F268036E155FD5B28B53868B0630F88BCABBD3FA3BD06F44152B73F4010D3327657AE882
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/wu-60.png
Preview:	RIFF0...WEBPVP8L$.../;.......$GRVf..i-...^.........v.6..AIN.}.).Q...O..d[.......]..?".p....8...T.w..V.t..Rk...Fm..m...... . .....8...q...D........b.A..`......c....pSa..S..h...).4.)i.".....H5.......{b#.0..0.Y$...L...B....~C.L..#....N-.L..u..?3..o:.....7t..[i._."."`v.1...+=...#.p.2W..-.f...&......c..H.ja.[.<hb....aR...~...L+...........$7..?".A.1..Ig.............X.....b#..,).,../rO......D'...9C1..r..hW.-.N1.=..".".t`.=!. ...@..X.e.M0.$]Jm....U.+.9d.......'..\|.........;..........}...Km.o:.C.w1N.f..e.w........R....Y..w......'.c..0.F2....u..?r.y? #..9..ZA....&...u.K.m;.....9-.6o>0Qy..T+6_...=g.....5....j.v.......P.rq...%.@....nX;._.......mk.$.m.m.m.v...m....mE....o3O.F...6.$%.o..?...f...?~......~?O..w...{..._.fx.......3p.........p...........7...`..c..]..x..9.G.._xx...zw..V.T..p.vmH.=.@..:.{."...{t'..n..R..rw:. .4.$... ...<.D....uL....]..<A.$... ........cU..h.Kg.<.....z.d..w.S.^...E..C.=....-.U.........4lP.....2.....@..{....5.W.....[./..(. ....

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6416, version 1.0
Category:	downloaded
Size (bytes):	6416
Entropy (8bit):	7.967382853876452
Encrypted:	false
SSDEEP:	96:baaSG7AElzVwA4zMZUxj54JnJF99ku5AnjvmvHrh/Qblt14zg:baZG00VwAUIUOJnJ9KevN/k4zg
MD5:	A7CE1016FAA17D37F2BA269AFCEC3EFE
SHA1:	F21DE8E7AFA54F5A1CE3CA7619C6B84CB46EDB01
SHA-256:	25A6495E7B5E321F5BE6E651A33C2E80A22DC16EC16C5CF55A9C61FF3A8476C9
SHA-512:	81B90D567DE6CBCF2E6B6854A5843D74CC0DD3E525060135291CF476B3965499E383626B8F2157398F307CDC98C4ECD427BE5F1DD55D5C3548965F367EC18706
Malicious:	false
URL:	https://www.wisecleaner.com/static/font/roboto/v29/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
Preview:	wOF2..............1..............................j..V.6.`.......P.v.....6.$.... ..t. ..)..f.Z.#..5.....s..u.W.`:....r..(P.c.....D (lT ^..>....E..p&!wFH2..Tkd....Q@G".T.J@. ...q.N....i..C^.R.4..$.".R....\...m.`....._D.Q..ce%.b...o.........S?....F.q....)......3Mg......a.....L...."...@(..m....g......r......x.nV:..^@.[.}\|\|.......?W....%...N..k.ZVy...&..y.%...)....t.%..[G.T.....WH]..'.u..{.Vj.>...L..vO{(..!.dqy2~._.@...".(..gDd.B..C.(B.hA.iCt.B..A..B.XB..B....]...!K.f...>D..;....aYB.i."1@n# ..q..............u...<..J..v.o.m.kk.......~O..s.x....bO..<........%;......C.@m..a....S.~/......".B.$.R.J...C:..LY...'_.BE..(U.J...Z.j.S.>....0i....Y..-Yaec........!^B.R.o..%Y..Ki.....^.A-..X..f....D_eSK.u.......M..... ..^i.N...pq~,.......Qba....[clYV...o5.mL...6...l5C..1.A.D.E.u..N....Q.f....3s)..G.j.HB....%O4(ml.z...j.^;2W....)iOG.6.6....j.<..k.TM...M..%c"b&...r..z..V.l.OJjJJ.tM.+.....T7..&...6.[.......[.Y...,..0a-0zA..z..i.......R..Q.Z..a.B3[.vt..N.M...`.

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.060374921853554
Encrypted:	false
SSDEEP:	12:TMHd6mrIWeaxMovFtrDWwlxzgi5chQnucfvnDnbt+Mt0gbrsqNM:2d6mr3eaxMAtPvxzgtAfvDn8Mt0gbrsv
MD5:	9FFFC933BA091D5805E7EE644E7AAAC1
SHA1:	BF6AA3D7F182FD08BB732B874D1B72835E555D5C
SHA-256:	C9A73EFC9AD2C005768300A0BC1EDCADE17079FC0EBA5CD15545C4817F2BA542
SHA-512:	9D7ACB38037CC38070512633115580B8CEC1083B79932DDB80635BDAA1747A1D83A5CCC665B36DD3C71B258231EC9447B2E1FA1F37D5393A226EA6B9A6CDB97A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="12px" height="12px" viewBox="0 0 18 18" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#1f2238" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "/>. </g>.</svg>.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1687
Entropy (8bit):	4.435341416563254
Encrypted:	false
SSDEEP:	48:fv9+21znTSHLvsK1P5iAJCfipIYgLTrqkTpoJjx:n0me1959gfvYgPrqGm
MD5:	6862A3B0760AA923A0218A5A755269A3
SHA1:	EE5888377B7908BC2AF43A10CE9E31A4842DFB7E
SHA-256:	15EACCBC3AE34FCF82F88790D045F148D02D18F4F764EF20BE7F857F3902E88E
SHA-512:	85F405D8D0BBFDB274DC433E5704BA82514B9A18BD96A3D0442183861A373415C8B26FB05B8C08BF3E46D318C624AE96E3C42D32DBA5A4B86545F4F079443B4F
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_follow_twitter.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(3.000000, 6.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M26.2817007,2.51015163 C25.3312232,2.9202108 24.2968801,3.21532914 23.2314756,3.33026997 C24.3310476,2.6747966 25.1665981,1.64032914 25.5610773,0.410151627 C24.545371,1.01592086 23.3961008,1.46015163 22.2002386,1.69003328 C21.2311243,0.655565828 19.8551063,0.015625 18.3299937,0.015625 C15.3946956,0.015625 13.0340326,2.3952108 13.0340326,5.31532914 C13.0340326,5.72538831 13.0837308,6.13544749 13.1644903,6.52997411 C8.76930853,6.30009246 4.84936548,4.20009246 2.24331776,0.984855769 C1.7836097,1.77390902 1.52269431,2.6747966 1.52269431,3.65955991 C1.52269431,5.49861317 2.45764111,7.1202108 3.88335733,8.07390902 C3.01363937,8.03973743 2.19361959,7.79432322 1.48852682,7.3997966 L1.48852682,7.46503328 C1.48852682,

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3702)
Category:	downloaded
Size (bytes):	5861
Entropy (8bit):	5.416814743778959
Encrypted:	false
SSDEEP:	96:xIjUtBV6BOfZIPAmRjj9Py2eDp/9U9wK32LxikrXcUy5VUvcLVOBlOTrY:egBV6YmY0tPyBp/yt32VJG5VacLVilOY
MD5:	BD633494D1FD64D41B52AB5E815F6EB9
SHA1:	9364293243281303AFDA78AD9EB47F891FB24658
SHA-256:	EA4B11B55658E08D3162CCA49BA67C67903BBABC60ADCA86613DD0811227BD20
SHA-512:	2E5C058B8F5F56D752A412AA74A4C57FB7C67043F7AD01AC613B1FE47306D9E9436453B51CE43ABF4F1A3BB2325EF1837F4129218D665E48752A9159A78FF72E
Malicious:	false
URL:	https://www.wisecleaner.com/static/js/utils/utils.js?v=1.14
Preview:	var browser=getBrowserInfo();var b_name=(browser+"").replace(/[0-9./]/ig,"");var b_version=parseInt((browser+"").replace(/[^0-9.]/ig,""));if(b_name==='IE'&&parseInt(b_version,10)<10){alert('For a perfect experience, use Chrome or IE10 or above!')}.function getBrowserInfo(){var agent=navigator.userAgent.toLowerCase();var regStr_ie=/msie [\d.]+;/gi;var regStr_ff=/firefox\/[\d.]+/gi.var regStr_chrome=/chrome\/[\d.]+/gi;var regStr_saf=/safari\/[\d.]+/gi;var isIE=agent.indexOf("compatible")>-1&&agent.indexOf("msie">-1);var isEdge=agent.indexOf("edge")>-1&&!isIE;var isIE11=agent.indexOf('trident')>-1&&agent.indexOf("rv:11.0")>-1;if(isIE){var reIE=new RegExp("msie (\\d+\\.\\d+);");reIE.test(agent);var fIEVersion=parseFloat(RegExp["$1"]);if(fIEVersion==7){return"IE/7";}else if(fIEVersion==8){return"IE/8";}else if(fIEVersion==9){return"IE/9";}else if(fIEVersion==10){return"IE/10";}}.if(isIE11){return"IE/11";}.if(agent.indexOf("firefox")>0){return agent.match(regStr_ff);}.if(agent.indexOf("safar

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	4970
Entropy (8bit):	7.943823115722197
Encrypted:	false
SSDEEP:	96:GGoQnjdpnqQExY/Q1yPEN4u0BCGXL9renjckpnWgq:GuqtAQgu4lBRrejckR4
MD5:	4CCFBE9F836BB82E47D099BD9104F6CF
SHA1:	B7DD47ECF49D10B4A328D78149F53B94286C2FFA
SHA-256:	F31BCA2832F7ABC586A69F682C18580DAC5914ABC538C3D8A9BB0F639B5FC1D1
SHA-512:	06FC86E7DCF01E23D5617499FD56BD004049214C3E366B7DCE0F361AEF8D040524B68668B1256EFED28A31907D4648DBAA760A1BCC6468A83A0111B34120F1F6
Malicious:	false
URL:	https://www.wisecleaner.com/images/awards/softpedia-wfh.png
Preview:	RIFFb...WEBPVP8LU.../.."...).$GRT....p0.?.}.VuWV'..m.V.}.pgD....CB ..\].r.I....Y-.......U5.a....MZL(M..I+S..q.fB..9.0....4Mq..Z..O..jY..6.Z[-......qC^..jE.T+qo.-..-.......~.q..I+S...iIHCw3..Sw..H.NIH..4$.LiH.....Ish.a0...Ah.............@1.......# ............ .#.. .(..FZ.....F.-.H...c...$.......8.....F@..`.... ...dM#..v=O.)K.L.4.4.}\|..,u.z9.+2..v...k.fl.V<.....(n....x......!....j..3...j..T.zRM..p._.U.2JRI......I-....:.d.....OZ.\|ks.....j..C...V.N... .....2..q:{.O.<....t.'^&n......yz...?_.........;. h.6....~...^!Z...m.[I)imi.R.d.6..50333l.3..j9.....h.v$...U......;......$I....TUO....m+o..9_Jf{.)C..5Dz.P.[;.@).e....S.]4...@...fHrL.{......}"./Q..m......S./x{.FK.m.......+.../.....?.).{lY..t"..Z....Z........s.28..o.t...(.\|3e7)g..%.......;..]p..j....S.....a..3a.......d'.sC{.Wl........H.........G.&..k`r\..S.../\+....c..H.\{w......f.T.$.......i..-...9...H...kK].. !..p[...HKZ.e....)(7..~D..k;.L{....Jq\.t.PT...\|T....Jd qnEM1..S}....T...."U2].!.G.....M[\...

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (38752)
Category:	downloaded
Size (bytes):	93065
Entropy (8bit):	5.182415079046025
Encrypted:	false
SSDEEP:	1536:gOZ0ptDYb251aRoM7dxBKikcHpOPM9BW7PJGu8ryMUsFg4/:gpxFmxDIPwRu4/
MD5:	824BEB891744DB98CCBD3A456E59E0F7
SHA1:	57082A005D743EC4A7F928A928BD7BD561078C7C
SHA-256:	173460E89E6A7244218BADAE2016F65C48A3EAE9D400802273EECA18B07336F1
SHA-512:	6C19E304AF16AE43504A44EB60C542526D0D8F635E4F57AB557E93999AD608BE99C25354898EF4826DEFE63F8BA72E4D09C5EAC445EFBDE4587534CA202958E2
Malicious:	false
URL:	https://platform.twitter.com/widgets.js
Preview:	Function&&Function.prototype&&Function.prototype.bind&&(/(MSIE ([6789]\|10\|11))\|Trident/.test(navigator.userAgent)\|\|(window.__twttr&&window.__twttr.widgets&&window.__twttr.widgets.loaded&&window.twttr.widgets.load&&window.twttr.widgets.load(),window.__twttr&&window.__twttr.widgets&&window.__twttr.widgets.init\|\|function(t){function e(e){for(var n,i,o=e[0],s=e[1],a=0,c=[];a<o.length;a++)i=o[a],r[i]&&c.push(r[i][0]),r[i]=0;for(n in s)Object.prototype.hasOwnProperty.call(s,n)&&(t[n]=s[n]);for(u&&u(e);c.length;)c.shift()()}var n={},r={0:0};function i(e){if(n[e])return n[e].exports;var r=n[e]={i:e,l:!1,exports:{}};return t[e].call(r.exports,r,r.exports,i),r.l=!0,r.exports}i.e=function(t){var e=[],n=r[t];if(0!==n)if(n)e.push(n[2]);else{var o=new Promise(function(e,i){n=r[t]=[e,i]});e.push(n[2]=o);var s,a=document.getElementsByTagName("head")[0],u=document.createElement("script");u.charset="utf-8",u.timeout=120,i.nc&&u.setAttribute("nonce",i.nc),u.src=function(t){return i.p+"js/"+({1:"dm_button

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 39 x 33, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	318
Entropy (8bit):	6.735285544319817
Encrypted:	false
SSDEEP:	6:6v/lhPHCOHrRSrhTb+RmsBsB5bskJx1Q3/I1DEcGeNinbvPcjjp:6v/7vhi+LaBtsOx1QvUEcG+WbXcjN
MD5:	117295A03BF8194590AD92D6F044B4A6
SHA1:	6F6EF687B76A7579D8FB17F1E9A39005F76A753B
SHA-256:	232334D177F358C07F8271994E6FC0C018ABFCE7C8910DEB604DE1440D741C45
SHA-512:	A76321E84A0C1532C3887AAFAF208390DA88C1FDFC5D94257FDF9C9FBE013A1FE7844E6D9DE0976F73376D1A7EF106E8A41581CA0101D8EAB0D5B5330F2E9CC4
Malicious:	false
URL:	https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleSprite_3.png
Preview:	.PNG........IHDR...'...!.....m$B.....PLTE....................................tRNS.."3DUf..X-....IDATx.....0.DQ.I1........o,G..;>e.6I.<.p@j..t@jOs8 .....@...R.}..............}F......BY.+.Pv.P..B.1 .1.G....Z.6{.4..L.x.tM.]Z.'Yw/.xa=.V.zf.N[........x7..a....2.E..f8`"....~_..K...T..^......."=[....IEND.B`.

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1293)
Category:	downloaded
Size (bytes):	124564
Entropy (8bit):	5.489413458481139
Encrypted:	false
SSDEEP:	3072:vA2Ue8q2fFZO3v2hLbs4unPb1Qq7p9+Oa:IJetI/sZnGq7p9+Oa
MD5:	F165295B23D86359A6B448E150A547DC
SHA1:	BBCD1CE172327E84ED8D20AA4E58EC780D78127F
SHA-256:	94629E3EFDC1E5F82B41CD5DCB197EF4FED035F59F33F43EA20393AB7D038C6A
SHA-512:	3B74BC9BAB1501180A3574745BB31947AC18422806AA4A3592F668C2588A76704ABAA1B49148475E681522D82FA3CF6319973D028ECB4AD1CD9BD1FE983990FC
Malicious:	false
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_1?le=scs
Preview:	gapi.loaded_1(function(_){var window=this;._.Yf=_.Yf\|\|{};_.Yf.Mv=function(a,b,c){for(var d=[],e=2,f=arguments.length;e<f;++e)d.push(arguments[e]);return function(){for(var h=d.slice(),k=0,l=arguments.length;k<l;++k)h.push(arguments[k]);return b.apply(a,h)}};_.Yf.wB=function(a){var b,c,d={};for(b=0;c=a[b];++b)d[c]=c;return d};._.Yf=_.Yf\|\|{};_.Yf.a6=function(a){var b=window;"undefined"!=typeof b.addEventListener?b.addEventListener("mousemove",a,!1):"undefined"!=typeof b.attachEvent?b.attachEvent("onmousemove",a):_.Zf("cannot attachBrowserEvent: mousemove")};_.Yf.Eda=function(a){var b=window;b.removeEventListener?b.removeEventListener("mousemove",a,!1):b.detachEvent?b.detachEvent("onmousemove",a):_.Zf("cannot removeBrowserEvent: mousemove")};._.Yf=_.Yf\|\|{};.(function(){function a(c,d){return String.fromCharCode(d)}var b={0:!1,10:!0,13:!0,34:!0,39:!0,60:!0,62:!0,92:!0,8232:!0,8233:!0,65282:!0,65287:!0,65308:!0,65310:!0,65340:!0};_.Yf.escape=function(c,d){if(c){if("string"===typeof c)return

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	699
Entropy (8bit):	5.060374921853554
Encrypted:	false
SSDEEP:	12:TMHd6mrIWeaxMovFtrDWwlxzgi5chQnucfvnDnbt+Mt0gbrsqNM:2d6mr3eaxMAtPvxzgtAfvDn8Mt0gbrsv
MD5:	9FFFC933BA091D5805E7EE644E7AAAC1
SHA1:	BF6AA3D7F182FD08BB732B874D1B72835E555D5C
SHA-256:	C9A73EFC9AD2C005768300A0BC1EDCADE17079FC0EBA5CD15545C4817F2BA542
SHA-512:	9D7ACB38037CC38070512633115580B8CEC1083B79932DDB80635BDAA1747A1D83A5CCC665B36DD3C71B258231EC9447B2E1FA1F37D5393A226EA6B9A6CDB97A
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/icon/icon_arrow_1f2238_12.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="12px" height="12px" viewBox="0 0 18 18" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#1f2238" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "/>. </g>.</svg>.

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	526
Entropy (8bit):	4.902485247149878
Encrypted:	false
SSDEEP:	12:tc5glRRNlfGqDo5tEzw9RpaBliBvS+Rh8BVuVLbyCEvUbyCjdg5W:tc6Nlf0Ow9Rpaj8vRhqu5eCheCJgU
MD5:	D39F018179C0AB39CE22A368C95AE059
SHA1:	55021383C5F0CC11C16D48EC0FF24486B07ABF49
SHA-256:	6B557C105AFA715F334401325E2E3FD3DDFACB08639E188428F0877DB899D3B1
SHA-512:	756B0F4D2A52EBEA4C5C24D2AB20AA5BCCF84E98387B2404F80161A4E7C6763D1792322789A97D87197FBBDB6C0AB3BBEFB2D830D7122B4DB706FB78904F69B1
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_japan.svg
Preview:	<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.039216 1016.470588h1517.17647V7.529412H10.039216V1016.470588z m1519.686274 3.764706V1016.470588v3.764706zM3.764706 1024V1.254902h1529.72549v1021.490196H3.764706z" fill="#353636"></path><path d="M6.27451 5.019608h1523.45098v1015.215686H6.27451z" fill="#FFFFFF"></path><path d="M768 512m-304.941176 0a304.941176 304.941176 0 1 0 609.882352 0 304.941176 304.941176 0 1 0-609.882352 0Z" fill="#C01D3C"></path></svg>.

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	8946
Entropy (8bit):	7.939309771569786
Encrypted:	false
SSDEEP:	192:4iRfLBXAikXv6+++R0/na3QpPImzRJVXb80:4iRzBXytV+aiPIme0
MD5:	2630B88CA01FAB87922D43D37F2F10BC
SHA1:	64171C7F1F1EAB261186403FA20E99665B4F1B40
SHA-256:	8A0F603B43A98BEBC027E52885B2B5E4E3728B6DEB227F3D408116415D213358
SHA-512:	65D6F3CD887389C69F903252DD847AFBBA35DE5913C27E7C0FD188DF57B96B70EA8A203EA3AE129C2F71469149A1EBFE54DD8364638B71AD00D2188ABE9D6839
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/thanks_box_wfh.png
Preview:	RIFF."..WEBPVP8L."../c@..M0j.I.v.............j6!.g.4.M.}o.rq.T..r....%2...,\G.mZ.l.....k>;.7j$IRXk.._..E..}.mA.m.t.b.6.....7...W...... ......D&=...........'.8......#.'..+K.^r......A.......oD.....j.0`..M)...C...=.g...X.,s.}..Ao4.z........6......B............}9..`+..u......!=.Qm..zU...t.....+..'n..JM.:VJ.5..x0N.Hn.s.gfg.b..t......3333333333..bX.h8.T...$...j.U.=.(....r..JS.W.....r..M.....K.S...(Y..(.hU.m.Z...R..C...e..333..W<.].....H.!z..#.G`ffff4K.{.P...}_k~$.Vm.-..>`.....3Deoi.yK(...8......H.j..3.5......,.=...e.d..q7h)i...r(IR....C.ELR.......rBu.(.p..5...C...\|..#..Er...8LZ.`..\...p.:......y...LQ&.(..~.8B.... .J.:..a....6..F.u.QG.."....H.!h]@0.QRP..(.....M4Ch.4.>1lm.c..4P(X. R..R'....I.U....@..#f^.~.._9..J.....f<4...+ ._.D..-...$..Q....j........J&B4...D..`f.r..:H.u_..P .... ........./..E.*.1A.""H...&)...5..L:G.......a.x......@".D@.t.z......7u\|9..\|.E. &(.7.(...w.6G....UbUfca.......>.k1.J.....0.<...4..AX8PA.4..E.$..wg..tS.^..I....O-.H.....%.23.vB..e.

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2040
Entropy (8bit):	7.87081035090934
Encrypted:	false
SSDEEP:	48:A+uk2e62FDzWQCmMNAHaxreR2yVIMrmr/j1+ld:AR9ixzWQCBmaxqwy2mhd
MD5:	EF22FF90C0890583410AF0AC42DD8A15
SHA1:	450E682DE9F933AEA55E9AC0CC758B619B727AC8
SHA-256:	3C81B1FB2D779C819D93DCAE3FFB80EDC17F68228EC38D81DA78AC6BD22C82CB
SHA-512:	EBB76A03D87682B354CDEAC06954291614FC3A4885421B21B4694C3EA196ABB500C2364292B3573B8EE93E441F4FF8D9B93892A1DED4A0AABFB1709C68C85389
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/clean.png
Preview:	RIFF....WEBPVP8L..../......m.A...]z...I"..>..# .. .._.W.(r.I:O..... .. ....b. ..@....!.......\|@ .$....J......... .8@........g...m.A..}.(...F..A..D.R.......a.....!..F10.R1(. ..?.c-........A. .r.\..'2.Q......}-DDb=j..y.......M9 ..;.w...+.Zr....G..)....FR$.1....h..d.*.7..Y.u.f..8......m.m..Mu..}........u..p..{...\O^....l.=_.;.`...C.81..rdZj]....VA.u..4...wSo.N>...W-.,.hCr....wo'Z.1.t....+.Y\|.>..7......MN.G.\....y..s?e.nz...!"..D}..Zs[J.......T..K.1...o..8.g..D.M8..... ...R.L;.p......A......`(.A.X..O..4O&....a\..5.E....C..m..L..\Yy..9C...4.C....n.l.....Y<..A..(.J.'...c..WC..Be0H......l]E.....4=MQ..4.....4....a..DIp..6.. .7.V..9X..<....g..)5.+..t4<..!.!\......$.BJ~...>....,.M..............1p....1....\..+....%.......Qy.......+.D.s...d.a`.4.....D<,.......~Y..6.O.+.L..........S...O\|....rL:.Vf..E.\......F(..Q.X.p%@0...\@.\|.6...r...."...yM.g.O;g....... .{....[n/.x.G0..m...T.k.5.j.@.....0.....E. ....D.n.8f.gB...W..I@:.{........#P...]pT.H.9'"j.

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	884
Entropy (8bit):	4.777769807888115
Encrypted:	false
SSDEEP:	24:tTZZ3eaxM6yRydk4tcSswtJEtOS4yE03aIpZp/klLUGHJTKFc:7/y+oM+Zpf4LUmMFc
MD5:	18FF2C16C42B15E455E84A777373E5F2
SHA1:	04B1F4F40767B796E470E20AF22DBF6A572BE4ED
SHA-256:	07E69E6E5B217B0D3EB173A7C24CD7D2541108A95E1F2A3ED402B195F1FEAEF2
SHA-512:	A5DEB29EF706DC74A151F721CDA012AA940F3221FCCD2F5584C25098CD1B076CD7A53C0B4048D8E4FAE03931480F9CB9FD758EED7D2D79AAB13B0CB54C79780A
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_follow_facebook.svg
Preview:	<svg width="32px" height="32px" viewBox="0 0 32 32" version="1.1" xmlns="http://www.w3.org/2000/svg">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(4.000000, 4.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M1.32400001,24 C0.592613267,23.999448 0,23.406387 0,22.675 L0,1.32499999 C0,0.592999992 0.592999992,0 1.32499999,0 L22.675,0 C23.407,0 24,0.592999992 24,1.32499999 L24,22.675 C24,23.407 23.407,24 22.675,24 L16.56,24 L16.56,14.706 L19.68,14.706 L20.146,11.084 L16.56,11.084 L16.56,8.77000001 C16.56,7.722 16.85,7.00700002 18.355,7.00699999 L20.273,7.00699999 L20.273,3.76699999 C19.941,3.72199999 18.803,3.624 17.478,3.624 C14.712,3.624 12.819,5.31199999 12.819,8.412 L12.819,11.082 L9.69199999,11.082 L9.69199999,14.705 L12.819,14.705 L12.819,24 L1.32400001,24 Z"></path>. </g>. </g>.</svg>.

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 12, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	156
Entropy (8bit):	5.996895892400488
Encrypted:	false
SSDEEP:	3:yionv//thPl9ztjll1lllGBx+RC1ae0PURI5BaC7XD/f0gIU9lxGJHeyoGyr/1p:6v/lhP/N93VBaC7T/f0gIU9rGzFyhp
MD5:	3A8E642AD57B76E2890447AD02FEEA76
SHA1:	E8B7156D51855DB513ECF3CCCEFF4955ACB4B3AF
SHA-256:	CDB5CA36664E6906C51C4336873D7B45F29CB48C3B3188C853980813DA650712
SHA-512:	5AF2F4A9F8C7FD75C72599547F1D0221E9C5993E46947F2DA007A0264B63357A264E14554C3523BCBD9329148740C90D9DF1B91EC4DD45365821A88650646B97
Malicious:	false
URL:	https://www.youtube.com/s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png
Preview:	.PNG........IHDR.............k.=....cIDATx.c....'.?.O"...d O3........<.........x..........W.g.3......q2....L..I.xa.rZ.".....d...A..' ...[.o..Z....IEND.B`.

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3295)
Category:	downloaded
Size (bytes):	27382
Entropy (8bit):	5.410524701316816
Encrypted:	false
SSDEEP:	384:tg+GWjNTCYdzDoM3ai57wXsJns9AU8w475qzEiwrND1kC4pAvWUNNkJLMWuD9QHr:tg+z8maiV5wsqIi4ND1kKTa4esUOjMl
MD5:	795636D4A1F6785702291893F3D81261
SHA1:	207F4AC512A1FFB93BB4FA20F7B68D546C4E94A6
SHA-256:	F8AB8BF0A2B93A2F8BFE40838BA2CF8355477B4A85C6230D52E4205EA7530AA0
SHA-512:	7CAFF65FA58F40D15EF3DFC450F8A4A359729A54DAD990D6BAE3A0A1B087A8C03F6D4E712DD3232D301633FFBDDF80113F8564A5E008E7217C0F99F9F40BAC32
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_2?le=scs"
Preview:	gapi.loaded_2(function(_){var window=this;._.Io=function(a){this.T=a};_.g=_.Io.prototype;_.g.NK=function(a){this.T.anchor=a;return this};_.g.qj=function(){return this.T.anchor};_.g.PK=function(a){this.T.anchorPosition=a};_.g.ke=function(a){this.T.height=a;return this};_.g.Vc=function(){return this.T.height};_.g.We=function(a){this.T.width=a;return this};_.g.Yb=function(){return this.T.width};_.g.setZIndex=function(a){this.T.zIndex=a;return this};_.g.getZIndex=function(){return this.T.zIndex};._.Jo=function(a){a.T.connectWithQueryParams=!0;return a};._.ct=function(a){return"rtl"==_.Ms(a,"direction")};_.dt=function(a,b,c,d){this.left=a;this.top=b;this.width=c;this.height=d};_.g=_.dt.prototype;_.g.clone=function(){return new _.dt(this.left,this.top,this.width,this.height)};_.g.dI=_.fb(6);_.g.intersects=function(a){return this.left<=a.left+a.width&&a.left<=this.left+this.width&&this.top<=a.top+a.height&&a.top<=this.top+this.height};._.g.contains=function(a){return a instanceof _.vs?a.x>=th

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13008
Entropy (8bit):	7.979625178883108
Encrypted:	false
SSDEEP:	192:BT98fVfrPsUF43ie9rFiorBURrx7kEIwMFTrmubMISLxq32/ThB37SQm6:J98ftTJCSEpiSBULIFFRngD/Thln3
MD5:	5FC374D9AC7979532EE873B0F8D0A5F4
SHA1:	EF701AF964FD57A302E33409F585CED6D96925D9
SHA-256:	D2742E211D93614475A85F257F4ACEA11912605330E793D246888E8A38958301
SHA-512:	B4CB6FA73FE71CB67E0E4AEBB0E9B0491232F330C1E24239C97D7AF7A5D9D119712F94C2208393889A659E34D04298FCDD450CB751EA15E96C750B7F51F09192
Malicious:	false
Preview:	.PNG........IHDR...d...n......y.2..2.IDATx....]Wy......y..3..c;..v.=M.p.FDm.i..4...,...m).....5.....E..h.DMCY...H i.$.c;v..g.......[_M\....r..s............Y....7\|.........W..N r.c.Q.N.2.f.#.FLM`.C.H.Y9..?...%H.....W\|..... .`...a`..5..s S.3!0.a..72...s#....> .p."w.]...."..X..0....e...k.N..$h`.@...q`R`..FA.`.0..m........8.;...I...9..0`.....dLY..eQ1.@/.....M.d...&@..LbP..3+.y..VQ....I.........pk...@m..a..[_.......\|.....5...\|;......E.... .....W.Y...3.1c&...FE.o...h.....T.....@.R...>Uk.K.$bu.@3.(.`.lN.........s3..y..N.3G...Y.O.......I.IR.z..Q..z=r.v..b.I?>..KF..D.7....@.....(......$u..[..+Bn.v./;..7.....Q..>..[..lY.Q,8...,...MR. ...d.G..9B.5n...... H..6.........R.lD...R&7.&....&..gN..AfD.Ad...Z]......3(.P....;.x..^v\x.cSM^..o1VI)...... ..........vJ;q.9^c...:...Vtb.a\|.M.....b.X...A^...#..j`1 IB.h./.pM.B..s.19.".D[PF..v.p..b........@...Q.... c..(....3..v\|F.y..."7^..i...V..p.e...).l.5.C.k..j.+/XF..0:.f....d..R..t.-.....{80Vg....[......P...`s.

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	299
Entropy (8bit):	5.280052635092167
Encrypted:	false
SSDEEP:	6:6v/lhPfOSaRquXhkrTLI8SY0LHD5AE5hJQ2cheVp:6v/7eSaDik8SY0DD5AoJtcO
MD5:	388940C42991EFD9EB33F133E3280696
SHA1:	C6B4C460D1CCB5833DEB7844423C54C5F2CD2394
SHA-256:	D65F4B2E8EEE94DDC7F762D098DE19558D879A3B597C8913B4D075532E3ED4B4
SHA-512:	5E103C4E4FAC6343E7A133DC80970C98D5B843BDCA4C5E613F9CAAA5BD295C272E7D3EDA1937FB553CB91111497A25B33DC8B8AA80157D49E92BB70BA5F8F476
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/FEppCFCt76d.png
Preview:	.PNG........IHDR.............(-.S...`PLTE................................................................................................\|%......tRNS.....!.\4....v..2...)....~....CI}....[IDATx..G..0.DQ............Ydv.!.}/j..9..b@.....u.........3.....40..n`q...^.\9.qH..~..._..H<.\|.....IEND.B`.

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3982), with no line terminators
Category:	downloaded
Size (bytes):	3982
Entropy (8bit):	5.0650522322618645
Encrypted:	false
SSDEEP:	48:rLMv6yAdfrKblfEBOCzEaEDETEffEdfNsHTEAtEuGEZhcpKB2yGN4ZxI0U5uYUZs:rLAmfu5O5vK1UKa4ZxU5EZzXgSfOb
MD5:	54F40185664191C23AC19F5F85DE9630
SHA1:	C9706F1B5C87A7A0A83084CBB249B37F94A67B41
SHA-256:	8CBAF65B70ACA04E1D491F2C26F4D27C58269E0AEAC8AA870E1EBEC34EBE2F86
SHA-512:	5D3C8002FA6D1F6C2D28712A535B55687F2C87D5E1D8CA43F42FFC18097C6C6C8751AEC11192F0BF61FCFF909452350D26654D613C1767B458ACD09C38A0A475
Malicious:	false
URL:	https://www.wisecleaner.com/static/css/layout-mobile.css?v=1.08
Preview:	html{-webkit-text-size-adjust:none;font-size:40px}@media(max-width:750px){html{font-size:40px}}@media(max-width:731.25px){html{font-size:39px}}@media(max-width:712.5px){html{font-size:38px}}@media(max-width:693.75px){html{font-size:37px}}@media(max-width:675px){html{font-size:36px}}@media(max-width:656.25px){html{font-size:35px}}@media(max-width:637.5px){html{font-size:34px}}@media(max-width:618.75px){html{font-size:33px}}@media(max-width:600px){html{font-size:32px}}@media(max-width:581.25px){html{font-size:31px}}@media(max-width:562.5px){html{font-size:30px}}@media(max-width:1520px){.header-link-active{display:none}}@media(max-width:1210px){.header-nav-wrap{display:none}.header-wrap{height:auto}.header-menu{display:block}.header-menu-ul{display:none}.header-menu-logo{padding:10px 80px 10px 20px;box-shadow:0 4px 8px 0 rgb(21 58 160/10%);margin-top:0}.header-menu-logo img{height:30px}.header-menu-li-close{height:50px;width:20px;display:flex;align-items:center;justify-content:center;curs

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 140, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	10207
Entropy (8bit):	7.919105994302115
Encrypted:	false
SSDEEP:	192:JcGsHGeAC8Y8018D0gtixwY9m+B/USaPq+MCoTjizmki0PpSf5SeKD5o:JZ6EY8YQ0gtMa+lfaPzMCoHiCF8pC3l
MD5:	DADE2E92F3FF74139609CBEC34884808
SHA1:	8A0E4C65BA3E8CEC6C36DD6709B607C93F64F698
SHA-256:	B70BC7338ABDB5F0EBC7AA50AAC5367C688D6D2795C0295AD48AC108138CE4C7
SHA-512:	7DC6CC9783C6F74AE21AED26D1DD7DA4E693B9BCCB353FF1C0F377562A893F02C8023ECFBD38158171A94866211A86F95520FAC370CA9FE8122F758369610F14
Malicious:	false
URL:	https://www.wisecleaner.com/images/awards/si-award-epick5.png
Preview:	.PNG........IHDR.....................PLTE.../..G7.:).>..=-.7&.kU .h%eP"P?...0t\......g..w..p....aM.SB.kV..............................w_......!.s!..(..."..#..$.... .%....(../..->9.RJ ....3..%~k..4..9..6..8.3..>..C..3..>..B..C..A..6_U.ma".D.F..Q..O..M..8..V..E..j..V.~4..[..]..W..f..e\|p0...........x.....\..dxvO..P..f..q..t..{.`....u..r.............{..........s..Q..j..N.{F^Y0..asoA..Lke7,..FE+Y..?..W[A&b.6..m..3?6.r......;.!0.7\!...Do+..)..*..$..... ...j..T..O{.^..n..z...........d..t.4`.Ck..\|..x.#r.$n. l..i..e..a.'a..Az.\.!H.'\. P."X."U..S. Q..U..Q..M..N..K..H..H..F..D..C..@..=..?..:z.D..3..2h.9p.+]."Y..I.)h.1s.'N..)..8....#!..;t..................................s...................Uy.f..Vw.He.Wn.fv.5U.0U.S].';Z/Aq>SuN..u~.>P.5w.,..)..SL$[I&aN"TC.G8.2 .1../../..0..:..5....tRNS...b.tP...........................................................................................................................................................................

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2684
Entropy (8bit):	7.899701033489017
Encrypted:	false
SSDEEP:	48:VmTibOVt4gTzhWD4TfV/8l704e9iTKoGqoasR5Un6UF0c35h4W6ZT:0TM6tJTzhWD45/8504mcKoGJRy6In3vS
MD5:	2F8F2878777903A44B59BE109221E6D4
SHA1:	840ED962A7565581443F118671DC652F7D0D7EDE
SHA-256:	4C18D622423B3721A523CC6C61D1BBF52B088E9AC37B97351E6A5571DF9E4C15
SHA-512:	F1EE09B53E94E224535AF7AF846CF704641A27F2F4BB4C1206DCE55D67E85A4F2D33ED49E85D8F9182BF111242044BFDB65D608DC8BE64CB609C83A1C7E33A4B
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/bbb.png
Preview:	RIFFt...WEBPVP8Lg.../.......$A.r\./.3.......E.mS........../.Q.m..:.o.}.......0..2..s....g........PO ..S...7 ...Z."...1..>.....P.=...!..C0....A...`........ ......`........".&.)..g...a_A ..w.. .@ y...""...m..D.........]W...u..wMpk...-.\...w2....Rso.......O..m..4.}.!$-..v...@..@....}.o..>t...\|.....>C..;Un.......(...M..........ZY.V.L4.0M3..a1.....8..LQ...dG.!.6.J{..y.h.]..PY.$GB4l]..09.:o.j.:.r.].=..,..........?...`......QfKt...bm...a..(......#.<....Q.... ...+y.,G.+...Dr...M.....Z...yB......t......DZ....F.(......U."&`.;z.6.U.Co....B..$........h....>...}Q....^...M.Hr;.........)L.e..H2..I.....4..fc&H...PL....X.............h$iT.....g@g.......L.`...B...L.C.`"..%..Y.I....,."......N..8.#..So...`&H....C.......Y....%(2...9..F.......5Z....^..C.syh....\....!..R.N#.n..5Q.d..\....\|[...D....,.B./..%...r..<.N.....7.....U%...q@....~..uRtH...E.!.H.. y(...DJ...pH{.@.n.b.)A)Mt/D/...g.X..?.F....H.J.aK.>.efs@`........Y`.rSbc..........sF<*......8.DqqiyY.......V..D. r.0

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (541)
Category:	downloaded
Size (bytes):	16747
Entropy (8bit):	5.178980645782684
Encrypted:	false
SSDEEP:	192:/omYnq+9RlqclaZTBypc0uXKPxJfWmIebMKPyqJODcKvYunQFtKyBMa85pmtqk4z:QmYqMoLXKp1WmvlPWr6Ft85pGDI2cK0
MD5:	8BA400FD2F6308006FB58F5791BC712B
SHA1:	980D87FA0DFF2B50233637C252BA80CD928F6B97
SHA-256:	65CDA947BC1B0E9FB1E8AEE0B406A26CE5474C7CCE8F292EE5550DAB89F4A46A
SHA-512:	F50D67CD0269582C46817AFFF4A295DAE4F36281C1701382C927E3DF8C733F34CF18D64EA75AAEF4BC0BFA65C7BDC21DC7EA0EC68BB5A9910614F927AB1C13D5
Malicious:	false
URL:	https://www.wisecleaner.com/static/js/common/sprint.min.js
Preview:	// Sprint v0.9.2 - sprintjs.com/license.var Sprint;.(function(){var D=function(a,b){for(var c=Sprint(b),d=Object.keys(a),e=d.length,f=0;f<e;f++)for(var g=d[f],h=a[g],k=h.length,l=0;l<k;l++)c.on(g,h[l])},w=function(){var a="animation-iteration-count column-count flex-grow flex-shrink font-weight line-height opacity order orphans widows z-index".split(" ");return function(b,c){if(v(b,a))return c;var d="string"==typeof c?c:c.toString();c&&!/\D/.test(d)&&(d+="px");return d}}(),K={afterbegin:function(a){this.insertBefore(a,this.firstChild)},afterend:function(a){var b=.this.parentElement;b&&b.insertBefore(a,this.nextSibling)},beforebegin:function(a){var b=this.parentElement;b&&b.insertBefore(a,this)},beforeend:function(a){this.appendChild(a)}},E=function(a,b){if(!(1<a.nodeType)){var c=a.sprintEventListeners;c&&D(c,b);for(var d=r("",a),e=d.length,f,g=0;g<e;g++)if(c=d[g].sprintEventListeners)f\|\|(f=r("",b)),D(c,f[g])}},z=function(a,b,c,d,e){var f=[],g=this;this.each(function(){for(var h=a?thi

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	314
Entropy (8bit):	4.707379594203088
Encrypted:	false
SSDEEP:	6:tI9mc4sl9D4WvZ4lft7whYplMAn9BGRshfVplMA8sXAGRshmfVplMAT5RM:t4L4WvylfrpyA9BGeVpyA8sXAGbfVpyH
MD5:	EB502325A4C66BB3D497612E89EFCEA6
SHA1:	E05897D8A78C7B13C71B03CD14E25739A9E87474
SHA-256:	6937CA517FBB92516D1CE91FB8DA88C127F48BFCDC8D2B4835E5D684EAA1CD0D
SHA-512:	D423EFA28E7AA7AACD47ABEBB172D2CBE7CC142E49C73423D77058254B25F28CB09D62877027D7FC7429663E7B48F74B5F644E760E912488A49C0BB25977AB24
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_french.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 300 200" width="28" height="28">..<rect x="0" y="0" width="100" height="200" fill="#0055a4"></rect>..<rect x="100" y="0" width="100" height="200" fill="#ffffff"></rect>..<rect x="200" y="0" width="100" height="200" fill="#ef4135"></rect>..</svg>..

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.877222497768617
Encrypted:	false
SSDEEP:	12:t4kZW2eaxMoRy7dxVNkgaC6P5HM3PJDpTAZAwt4XeNjbecpvi4ONDjuI:t4kZbeaxMoRyrNf/dmadXwuXDjx
MD5:	68D84EB2CBFB1D606CB9C7735EBEC741
SHA1:	78E5A112511DAE6EE3E38D69B8AA88EA05857CA4
SHA-256:	B86E03FC766D8775DDF268BD79C75EFE25A26B3550633B92F0E4700B71BB1196
SHA-512:	303C623A83B00E0EBC6D1D78880C24CC4418B795F6EFD6AFE1CF169E7C67809E21682EE568553292520B9E6BC6023C639BE5D39F045EAE490C9CBDBCA4165B11
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(5.000000, 4.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M3.49737237,17 C1.56764264,17 0,18.5792844 0,20.5034275 C0,22.4386441 1.56764264,24 3.49737237,24 C5.43393393,24 7,22.4386441 7,20.5034275 C7,18.5787571 5.43393393,17 3.49737237,17 Z M0,9 L0,13.3544576 C2.83582316,13.3544576 5.50301506,14.4631789 7.51159056,16.4720548 C9.51743887,18.4759323 10.6251326,21.1541304 10.6251326,24 L15,24 C15,15.7282118 8.26884034,9 0,9 Z M0,0 L0,4.60224 C10.6864609,4.60224 19.3844861,13.3056 19.3844861,24 L24,24 C24,10.77024 13.2319081,0 0,0 Z"/>. </g>. </g>.</svg>.

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	311462
Entropy (8bit):	5.604833638058789
Encrypted:	false
SSDEEP:	6144:K4SQX5NzJ5YLceF+qKXjXP9RIMATz5Ywac:TS+xJoN1Cc
MD5:	DD109242AD733CB9696B7DB3A4CFEB7E
SHA1:	C704594B90D87812EA1EE1CEE818B244D9B2CD01
SHA-256:	CB9E30687E0D08CD8FFC61BCA330330717B3B7F8C3C6CF48A81775ED5FACCA8D
SHA-512:	3ECECAE572592D5E0B3848A930C190DCF6FECBB9E778BA11B21F4AB33C3DB96159A2D310D25AC9047E0EBFF11B87A5C6EB04260CB0B9975B02419B07FB971817
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-9CHTNWCZC6
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":"undefined"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":17,"vtp_value":true,"tag_id":117},{"function":"__ogt_1p_data_v2","priority":17,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneV

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	7.760567009629006
Encrypted:	false
SSDEEP:	48:WspMYs0gxjFbJTFPoJixbePTZEUKN5eysK93ZooX:WKdP059J+cbwVDKN5qK93ZooX
MD5:	4B546EEE6A2D3CEAC687B87DEA1D51E2
SHA1:	7A2FA8FAC7BACE2936A873501DEFF5D85A584C87
SHA-256:	C5195684843E87DB99B2C76064CD4EA4FBDCCB0D82AE5A81113C9FD40C53C078
SHA-512:	C8E3A30972BB787CD5DEE68FFE179DA7AA9CA436BDBDF9A37C4FB3D82C24138F6EC816B11C1D10CC334360C373F198559D2A54F0771292215EB44476EA78C537
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE......U........<h.......C.....1v....p..Aq.......C`r...l..5q....Oiy?x..0J.........m..`w...(\|..v..j..;..>y.+r..P\|.)?Q....._..4l....J...-E...\..h....\|........Mp.....l...Ou+j..Ns.Kr.Iqa..]..R..s..V..........k....v..\..W..N..E..R..=..6z.>p......................................................................................................................................................................................\|....w..}.....l..x..f..\|..l..a..s..`..]..e..[..Y..`..W..h..T..X..]..\..Q.._..[..f..N..K..S..V..W..J..E..Q..F..K..N..D..?..P..?..J..:..?..M..7..D..N..=..5..F..6..2..H}.8..@~.Dz.0..6~.1..?y.-~.Dx.Bw.2\|.5z.,\|.=v.)\|.1w.)x.'x.<r.7q.,u..t.!v.$u.)q. r.(o.2l..p."n..m."k..k.*f.$f..f..f..d..a..^..^..[..X..`K.....tRNS................ #",/132:ABGX[^cffffjnyxz\|.........................................................................................................a.L....IDATx...Ml.

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	7.975411136529163
Encrypted:	false
SSDEEP:	192:hrQfJ04efAX100QkoUeXFdqY0hNdyoc0b82nEkCK:hqJKoXCRkx0FdqHhxrb8GEkX
MD5:	65A3B2D66F03725A74360D220BF54A40
SHA1:	5C223CE6330EEA92180B5F1CCAF8023C28FF3997
SHA-256:	2464F5400B1C3830E3B383662B49A161AA977605298F83B34C5DFC81486C1091
SHA-512:	3A44F25EB49C1215F78C7E5DED14798ACF4A575BF044CF1D1D8EA2FDD233FE28E225E008381FF85BAC856FFB7F4E1FBB1EE6C1B902225698CE50759B82FE8607
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/special_offer_box.png
Preview:	RIFF....WEBPVP8L..../.@....I..J....w]...\z`..)t_.]J.$.e.!.#.m}...z........].v..=...3C!S.\|M...T.....P..@...&M.........d......Drww.....H.F.f.7.xu....m.wF..@.H........8....Z......`E..-5.o...fz...<.\|m.m@C...t@...X.p%...._1...zU..UE.z...M.ld..DjQL."Z.(...B...Q...."D.`..E.....(....xf.X![.c."..)...........N.j......{....-:.w#..y..}..s.9...iD#S@7........\p@zB.N.(;/......d.4..~P....Iq.mDr@c'..k.o..8N.p.lf.t2CZ..3<...j..u....s.V"+.........z#.z..a..Y..q.c..U.U..>......}..4..N..{.F.L.m...]g..w.,E.+..... .(.$.(R....6..... /:.z...D.........b.G...r.a.........^Z... .x....sn...>N..".4;..uG.....u..{~U...TO>.W...8N.O.....d../.q.v...{X.,C. a..!.G./..'{~....]...c.rN}<..Y.M.-...#B.#.$.$..`e-]7\|..).Q...-._D...SM.....i.m.-.We.......=.'.. #M...8@.....TI.fqI.0X.....>..."=.s..........{....%...%I..f.8.-...@o..`I.?.......+v.t....~.v.............e.j'AHe....?...$I...!..+........Fz.4..@.7...9T!...W.>..6.lh.D.........g......Gr.f.1..)........73.?..3H.S..>...k].b.a....R.......

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2206
Entropy (8bit):	7.9074153199358435
Encrypted:	false
SSDEEP:	48:nl+4lRWX9d8ZItwkR99XSPiuAJv4GAFVk5uDNM9:l+4aXUSn99XSPb6v4GAA+2
MD5:	4EC685BEBAAB79553EC153DFA7B2820A
SHA1:	6F64DDA06B63C6379E3CC7ED49284718DFA01D89
SHA-256:	DA99771F8A421CB7C0ED7673E8BDB3942AE15E9CA56F2194233E8F0965925981
SHA-512:	8A3DDE9A598CE50FB7F85139B68EF7866E2D6B0E18897FA67611B2F59740C3EB86868B05DB3A0E0BCA248102206749455E291B880226942A1A2CF14F4EEF746B
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/whk-60.png
Preview:	RIFF....WEBPVP8L..../;.......$GRf..cq.!..{....m$I.]..........I.#)"k....w..Ra.6H.;........7..p._...<....0p.a .4..\..?.... .G......M..1.=...\d......$..d.$.J.J.XUb..k..n.....$k.M.1.sjtOMu...-+Y.85.&=i.....M..Rb...=.....I.n_=...d...T.^rdz..Z..tZ...~.4F1..wa..RmI6~...v..0..K'.O...~.w_...'....t.%...R...!...:8.fd``...o..E1...;..!...x...p.........3...f.^..m.m..&.....A.T/.4..w.#......A.~..N.&M....`...S-XMR..4.g... .....`.#.....I..-.......2.=..c..G.8..n.K9.e..k'v........@.b...8.T......A.Q.X..}...s..}..3eo&.DBD._...1..ylA...W]y.%...4....C.GS..[.....y.G..0gg.-...d.......iih..\|.Y..%..=.^p......1aU.?j..}.0.."..pB0.....Z.j.LE.......:.......8.k...5..5.....2....C!.2.{..m....VU..O.X......`.W.`*_.P....M..p...[..v2..qZ......j,....9....k.....`r..hum...Z5.t....I.di;........d..6,..5.hd.a=.;......Pq...1........bch...;.s:K....:.5B.2...1.I....`YbU`.#...l6Fx.k.-n.Ir...&.T\.4.5.h....o.4.!...E.:.. ...\|..a.. m..b=.,...F......=..I.O;x...J:1LT........c!

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1715), with no line terminators
Category:	downloaded
Size (bytes):	1715
Entropy (8bit):	5.381999093489294
Encrypted:	false
SSDEEP:	48:shac4nhalxbhashaVshayYrhavFehaUV6C:Yac4halraYamaN9adeaUV6C
MD5:	F4B96252A0B5A50DBD2ACFD66B8249B1
SHA1:	F10992B23F3D8CA2A8E64C3E91F6327A7975D426
SHA-256:	5490A1FB7B5992537B0E87C0140D89F6BB9DAED36F0EFB6FCF132DFED9C43A41
SHA-512:	DB2E343BD6C62F0B1CABA3A17BD4248E768FDC4578CDFB201364061B5432361944590C7840682F8FD135202E8446E578A6F26B43C10249F97F0B678F1711776B
Malicious:	false
URL:	https://www.wisecleaner.com/static/css/roboto.css?v=1.07
Preview:	@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu72xKKTU1Kvnz.woff2) format('woff2');unicode-range:U+0460-052F,U+1C80-1C88,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;font-display:swap}@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2) format('woff2');unicode-range:U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116;font-display:swap}@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu7mxKKTU1Kvnz.woff2) format('woff2');unicode-range:U+1F00-1FFF;font-display:swap}@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu4WxKKTU1Kvnz.woff2) format('woff2');unicode-range:U+0370-03FF;font-display:swap}@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu7WxKKTU1Kvnz.woff2) format('woff2'

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3666
Entropy (8bit):	7.9290630552271795
Encrypted:	false
SSDEEP:	96:4Y1MfiG/A4QK55uk5/aoeaTcrLHpj/Xv6aLj6Uy2Y:4CMfiGLQK55wo9cZXy2PY
MD5:	BB71976AB2CEB2BFD087119BB949847D
SHA1:	F8530F66E0AF6DFBFAFC5AC8E2E0B1F5C273D74E
SHA-256:	2645A01054F106203A264F9B407F2F6CE6BF090BC0CA85A96F90F41B07CB7CF0
SHA-512:	AD2CEFE50DB89AC0849E62226E4E46FCA51824D241136F66EB76DE8A97CBC4A3E02668DCACDB1577831238C8EB2E5C1A8789CA351A0D4016ADE6C44158930022
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/norton.png
Preview:	RIFFJ...WEBPVP8L=.../......;.$.J....h.l..........QF..d[......D..q.rw..I.b...3..Oz.<.....,2......r....~.5..........lk.m.........I^6.P\R35A.K.{jsd......4...."...Ucx]....P1...d7m4....h"..E4.M..6.j..V..".@..nv.+.+..Xz....?....{........h.q....}.-..+.j.v..;...si..4Y.6....H./.%....Z....-.:..S.c3.3E.......8..... ...8 .......@......../...`....?.....".......p@@.......1`@.....ds...........k....\|i.>&.o.k.....+.....a.K.w..B.......F.t......IX.%...2.\`,.$%..T.u..@".RT..=.\.Z.Je..L.~E...M.e....a..b&..oTO!.......g.2....J....6.3..^...~}\|~\.}`....t......2.....[...g.y.e...}..I...'o.........c.5...i.....c.b......m..=......'...C.../...K'W...K..\.Wp.....DD..P...mk.m...t^zZ'ww9\|....Tq.....B...F:...H.._....H."I..{.LU.?.Em.!I.cl.m.m.....RWvfUV..m..g..".{Q.....G....(g......G...?.G...'.j..Y.O..<..?.{g<....DO....m.I.nG.A... .#.).m.Q..k.4G.......~T..(Q.?..{..x.NyW.. ....5..>../..Uc4...D.F.z..k......n.+...IY....:....f./6.......;.M{V..Z.vLr..+.Y./...D..n1.B/

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	4.3958418384526325
Encrypted:	false
SSDEEP:	24:tcwNlfWoexVUfvjlOHX0yEppbanUxXFqQzEUYuvOslffBtfK2acM0E3f3Kr1+:2GexsEEyKBKQAUYdEg2ajdt
MD5:	D8AE5A9D9B759BDDB365C95DBE6A45BC
SHA1:	BC89F0E5EBDEEE33BA08B6B9DB3A722547625905
SHA-256:	A7A1461461D6D2BF27E41B64138B6A5DDE34EC73D5A9059124EE2E8E5CD1A8C4
SHA-512:	22E1E3C8FF13674FA6F95306442BC11FF57AEEC5F80199B850D26EF5FAA1651FE7340EB780C59F17B4B977AE4F6956745A1700EBE900BB6FAF31FAC3A0555850
Malicious:	false
Preview:	<svg viewBox="0 0 1546 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M11.321867 1017.710074h1520.904177V6.289926H11.321867v1011.420148z m1524.678133 3.773955v-3.773955 3.773955zM5.031941 1024V0h1533.48403v1024H5.031941z" fill="#353636"></path><path d="M8.805897 2.515971h1527.194103V1020.226044H8.805897z" fill="#D64B24"></path><path d="M264.176904 118.250614l32.707617 99.380836h104.412776L317.012285 278.014742l31.449631 99.380835L264.176904 315.7543l-84.285012 61.641277 32.707617-99.380835-84.285013-60.383292h104.412777zM535.90172 65.415233l-1.257985 35.223588 31.449631 12.579852-33.965602 8.805897-1.257985 33.965602-18.869779-28.933661-32.707617 7.547912 21.38575-26.417691-17.611794-28.933661 31.449632 13.837838zM652.894349 177.375921l-15.095823 30.191647 23.90172 23.901719-33.965602-5.031941-15.095823 30.191647-5.031941-33.965602-33.965602-5.031941L603.832924 202.535627l-5.031941-33.965602 23.90172 23.901719zM617.670762 315.7543l11.321867 32.70

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 241 x 137, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5763
Entropy (8bit):	7.939816004934784
Encrypted:	false
SSDEEP:	96:tRNoJC38OV+spe/FKAgcxm+oowAw3q9EseIVa2c5hwGOAmJc9SA9azv/8I3eN:rKYp2ZtHw3Mee5EIA9aTUjN
MD5:	42ADDF8D853322F53BC8B8967B6E6AF6
SHA1:	A9FB9D567184E414D67A31219C7896110A8D8440
SHA-256:	84F6A7DF78A4E5719FB2B4197C3CF83F5DAAA74D692EDA6F81FB341E77A01BA3
SHA-512:	6B72D7AB43A523BF4F4A0B82E341EEB1171EA2E3C75B86C56877117C131F60D7A42D3861964ACA8E1F50B9C6A7A6CB73FC27B59042AC87E988341AED43144377
Malicious:	false
Preview:	.PNG........IHDR..............d......PLTE.(s...Pk....`y.p..^w.@^.B^............w..........5\|........D^.3S..........G^....Zs..2zLg.....?....,M.....y.........:.......Fc.....I^.K^.G_.f}.Up..4{;Y......M^.O].Q^.S^.U_.P_.N_.U^.W^.Y^.\^.]^._].a^.b^.d^.g^.......i].k^.m^.j_.o_.n^.p^.zu.ts....dv.ou.r_.s^.u_.u].w].y^.{^.z].}_......._....^~.^}.]~.]\|.]\|.^{.^{.^z.]y.^y.^x.^x.q..r.....]v.^w.]u.^v.]u.^u....\|.......]t.]s.]s.]r.]r.^r.]p.]p.^o.]n.]n.]m.^l.^l.]k.]j.]j.]i.]h.^g.q..^g.^f.^f.^e.p..q.........h..^d...~i..\|........^cjm.q_.....^h....gy....e....^b...u..ky............`..dz.^bZh.cd.......ni....y.................x........it.......}r.l...............................cc..mm..hh..............``..{{....vv.....qq...................JJ.[[.....EE.....VV.99.>?.33.=>.NN.@@...... C.O!.....>IDATx....n.@.......A."Q.?P..@../...[x`38CAI..=+......1..N...t:.."...{. .dj..1~.p7.x....o..,..`.}...U..L.j.*Q.r..5.D.....E..6...1....%.N..y.2.......{N....hT4....s:.,.I;. ,..

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	11366
Entropy (8bit):	7.9795159719109385
Encrypted:	false
SSDEEP:	192:O6v0LyLCOG4eptdv9xbXSlxCj14x+gryq5XA6VZNIv1j//r4CE6HLHoqmlaVV:6L2DBC9YCMryq5QDJ3r4C9H/DVV
MD5:	DCB4EB88ED618B0694D2C19D5D17D3BA
SHA1:	F0F3233BD7F9B34D33585F0E1BB97D16771E3DE1
SHA-256:	70B4EFE3B7E1964B0201181B4FD2A58FDED1B112FC37D23868C2BFA541C539B8
SHA-512:	0976F486BBC4E53C94806C1CDFFF067B9C87AD37DD1884D0286015A7BD61CD48D4CA4117BEF6276218D3375FD4A81AB7E528F2E5D5626D4D0602A09EC2D283BC
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/index-menu.png
Preview:	RIFF^,..WEBPVP8LR,../../.....m.......).02."'uwx~....,.M;.....\|%.K.m.\|>.l.6.{..{...Rj.LZ...g.R.mm...O.....I..`.f.Le.3.......0.)0\|.........1.....].8y....}.n".....?:.z.W...\|..._,.....u..S.P."m.1@,.6.$......h}.q......'.m.RC..&.T.W.$q%'.~,d.&[W.k....`.6W.~!u.\...-...(.q-@H...p..7Z O..w;lo..?I...'....$Ff#.......Y.5.F^1+.I.O.RE6f....A>..cti"c...H..J.....~.@.3..9... <.t.....q..}.b...........<eQ../.....Q.>d..D.$....`I.K.<?...;s.m.D..?.DN.f.7.<.......&..=..."...T.Y..p..9....M..V...[O ...D2]SB.Z=..../...=..+1K..i.....K..-..+9....[..}..p..:.....x...-.j.......fC.{B..w.....i.'..W.;L.jU......!..K.<Jk.o...2.,./h.k..@k\|..k......_....E..!.i..)`>.u...Q....^H....ik...{++.2....R%...$..I...N.X..........c...'..v)1pas.O_.nW....8......%......@..S:.^...H..iz....>.?%nO.a...\|r..P...q.d..FF~ ;............S....T..9+.D.m.u:..v/..p\....I[.}.....1P....mR.m..1..M@..j!....%..2.3'.u).5..hB\..a.........qD...$Iu.9..1......}.Gj..v."/.;.....3......\|.K...

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.777769807888115
Encrypted:	false
SSDEEP:	24:tTZZ3eaxM6yRydk4tcSswtJEtOS4yE03aIpZp/klLUGHJTKFc:7/y+oM+Zpf4LUmMFc
MD5:	18FF2C16C42B15E455E84A777373E5F2
SHA1:	04B1F4F40767B796E470E20AF22DBF6A572BE4ED
SHA-256:	07E69E6E5B217B0D3EB173A7C24CD7D2541108A95E1F2A3ED402B195F1FEAEF2
SHA-512:	A5DEB29EF706DC74A151F721CDA012AA940F3221FCCD2F5584C25098CD1B076CD7A53C0B4048D8E4FAE03931480F9CB9FD758EED7D2D79AAB13B0CB54C79780A
Malicious:	false
Preview:	<svg width="32px" height="32px" viewBox="0 0 32 32" version="1.1" xmlns="http://www.w3.org/2000/svg">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(4.000000, 4.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M1.32400001,24 C0.592613267,23.999448 0,23.406387 0,22.675 L0,1.32499999 C0,0.592999992 0.592999992,0 1.32499999,0 L22.675,0 C23.407,0 24,0.592999992 24,1.32499999 L24,22.675 C24,23.407 23.407,24 22.675,24 L16.56,24 L16.56,14.706 L19.68,14.706 L20.146,11.084 L16.56,11.084 L16.56,8.77000001 C16.56,7.722 16.85,7.00700002 18.355,7.00699999 L20.273,7.00699999 L20.273,3.76699999 C19.941,3.72199999 18.803,3.624 17.478,3.624 C14.712,3.624 12.819,5.31199999 12.819,8.412 L12.819,11.082 L9.69199999,11.082 L9.69199999,14.705 L12.819,14.705 L12.819,24 L1.32400001,24 Z"></path>. </g>. </g>.</svg>.

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	5304
Entropy (8bit):	7.961401233985854
Encrypted:	false
SSDEEP:	96:5s5aU5pHrdioOdnIWOVbzfEu6Z43uEBynVjZ2RCqBbVdMmEY3X+Q12ANPD8thR:659Nidu6ZPE+jM4qmmESOQ12ANPD8zR
MD5:	9516B0251935CE44D861D0E52D8FCE39
SHA1:	B5EE9884842257AD2DF714A8A68361C9EE3C595B
SHA-256:	93EF0752597AC5D200764533C323AB8D50113102132F2210B519861CE10B776B
SHA-512:	B4B3350454C851C34D948F2E71C259D048D51DCF0EE1612D9D44CB2C9D0245EC266AA11A60FE8A66FEB993762958EECE025F69639FEAAF31FBEA9C5571DA0E6F
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/thanks_box_365.png
Preview:	RIFF....WEBPVP8L..../c@......%..j...~..... .....d."...V..2.9..u..w.....I.c.{vO.....3p.W...\.Z.3... X..}..k..3.[.>...........P. `.f...3.d......e.+.{...[L.+.#.G.'..P..".....^V....4..fT...`Y./..?.c".-....@.u-.\|...T..+..Z..H4.ZXM.$.....,....F..h.%..K...._...........=....Z.C.?`6..B...I0<.W.0<..p...@\|.... ...+Qr..H......'A..N....Y..C.L.E.L...X..Sz....D.c5ff..)#./...4...c..&.M._....../f.aE........=...[....5.3*M.I\|!..>....._.D.....#...(...lV.u.2A.C0.Zo{...k...L%.4Zrz.z......n..i....E...]N(..V..:.-.l.$O..<5...S./.6..>6."..wz r......9;.wsz...z..._\:..$...........x..Z./..N.g........^..I>.x}...[.zz<p....:.r..aP&.qu.....J...[W.........!".Z....i.]...OM.....k....En...[..s.}.....x/.MI.Abf.?..f....n.F.4.^s9S.#.a...}e..0..c!..X...:6.Q.!h'..A.....@.I..{...0...0...jUQ...%]....WYwWWuWD.!H....%!."%C.r..........G....,.../.W]....?.....R"M.+..(f..%utI...Z..\|>.e..J>.=In}..KB...y:g;~..y`K...>Y...I.P.R.....M....e`.......V.....-U..Xy.(y.&.[SX...R..).La..........%.&.t..t:_.o

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 39 x 220, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	7.03489883252328
Encrypted:	false
SSDEEP:	24:FbR66666z66a6666DDR6USjIxE/Mm4kUAOfBv+BEzD9U0pEkMNGhS9:FbR66666z66a6666DDR6iE/Mm4NfZBzs
MD5:	228D43C4184010D72FB03EA3941E640B
SHA1:	68B2B3D3B577D606AEC5624B8BA8FDEF8CF90521
SHA-256:	41F727505CADE24F6F88CC838D50B7ED7C2C8498D8D263C756B3A55B8E490FB0
SHA-512:	32C273C566102501DF8DF71C34159ECBC98891C1E6C330BFF9CE6610B080119996F4DABEC7F52A29B00998AC039AFD6B9ADA29536E22C6E10B673C47B77D8C09
Malicious:	false
Preview:	.PNG........IHDR...'..........(H....;PLTE.......x..x......x....x..x..x........x....x..x........x....x......x..x..x....x....x..x..x..x..x..x..x..x......x......x..x..x..x..x....x..x....x..x..x..x..x..x..x......x......x....x....x..x..x....x......x..x......x..x..x......x....x..x......x..x..x..x............w..f.."...x..x.\|.b...htRNS..............$)-89:<EEFGHMNSRTTWX]^....................................................................5.....vIDATx...kW.Q...WQ..r....E..RS..I.P..B....r.._.R...4.\|lu...s.s6<...6..r....G..JU.+q..3....E...\|...#.....=..g.e.(....9..A.t..;q........S.n...h.]..x..V...,.......\...sP.r%T....KZ..'...c.K..,..e..=/..C^......7=._..Q...K..d...#..?..t.Y.e.{..z...O.$.....a..a......Ok"...'...`...j.8\|Xo.D...e...^.......{%.{......W..........,.~..K.5..j.6...\w.o_.\.?...+a. ..C..9....J.w.\..Tn......(!z..>....o.a..a..4.ux....R.(.$V/T..z..>b.J...n`....X...hA.+...XY.)..e.@.;.i....)..iQu..;....F....us]Wy}.....I..Dn..^...(...$

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 39 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.735285544319817
Encrypted:	false
SSDEEP:	6:6v/lhPHCOHrRSrhTb+RmsBsB5bskJx1Q3/I1DEcGeNinbvPcjjp:6v/7vhi+LaBtsOx1QvUEcG+WbXcjN
MD5:	117295A03BF8194590AD92D6F044B4A6
SHA1:	6F6EF687B76A7579D8FB17F1E9A39005F76A753B
SHA-256:	232334D177F358C07F8271994E6FC0C018ABFCE7C8910DEB604DE1440D741C45
SHA-512:	A76321E84A0C1532C3887AAFAF208390DA88C1FDFC5D94257FDF9C9FBE013A1FE7844E6D9DE0976F73376D1A7EF106E8A41581CA0101D8EAB0D5B5330F2E9CC4
Malicious:	false
Preview:	.PNG........IHDR...'...!.....m$B.....PLTE....................................tRNS.."3DUf..X-....IDATx.....0.DQ.I1........o,G..;>e.6I.<.p@j..t@jOs8 .....@...R.}..............}F......BY.+.Pv.P..B.1 .1.G....Z.6{.4..L.x.tM.]Z.'Yw/.xa=.V.zf.N[........x7..a....2.E..f8`"....~_..K...T..^......."=[....IEND.B`.

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 11032, version 1.0
Category:	downloaded
Size (bytes):	11032
Entropy (8bit):	7.979626057942352
Encrypted:	false
SSDEEP:	192:IhtEgxBLHrxjyDK1/rAXUzzMegdX3BZxh4UCjkSIsrvXkLLqG3VA2GpWpxdCTub:IhDx9H9j64/xn4nZjCjkL2vXkLLqG3V5
MD5:	694AF05C2FBEF27A364C221536541DF8
SHA1:	30E388D46CCF41084898BF5DE7C23ACB5A894D0F
SHA-256:	A986C26C40FEBDFAC5074B57A925FE2D7B901E75B7BCAD4A19A5CBE3987B51BF
SHA-512:	CAB016AED84D4060013E706AECDAF2FB3AD9FFF0FB46E051D651641A5F3FFC67F6B1177E180D056EF34D8733A77AA0C70B562BCDEF63032AF51308F96E6A6DD7
Malicious:	false
URL:	https://www.wisecleaner.com/static/font/roboto/v29/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Preview:	wOF2......+.......T(............................d..d..^.`.. ....\.r.....6.$.... ..t. ..E....J:.bT..tP...y.......(...VQ.M...QL.O..8K.....R.yX.....\|.\.../.[Uu.....1"......b".{.....[.XgT.h,...'+{d.u.}.g..;.S!+-.f..........c..@vS..2.;..Fe&...(j....x..u...p.:..Y^....A..]........X0..n'..m.E{.OG.d......c!..l..a..x..(...+6....D[<...d..8n.0.-..0!...lf..dK..1..9. {J.J.r..c...zg.b...=...pg..tgs.@..I....!.C.....O...!....,r................`E$H.k\|.tP..b.a.[].E..5..8`.\|.]..>....E.&..W.X..)R .Ad...B..@4h.2.'...l.v@.....6...s..&. vo,..b..}.A.1..`...d.<......x............v..K.).3cl<...r3.\|}.x......MzpO..WA/.#.....:.?..aR..<]B)...,...U.y.....).6.?.....7.B..t.aG.$K."%.NS.F.&-D.L.;..[..9q.T...F..7a.-S..v.]3f.y...Y.a.;.}..'..../...8..0T.SC.A..Q..H.%.Q..L:.N...i....0o......\.f.C^s.&.....GT.jb,[.&L.e.[.d..^.jo.Y.a.{.\|.....k_}.=~...p....e(........Q.*......$.b.;.....a.mz9eR.z@B.I....../a:...K.....7._.....yO...s/.;....-....d...l.G..ZJ@Y.P....n.f.".?%7.e..,.9V.Y.a....?{...

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUk4lmfpse:eBse
MD5:	377D257F2D2E294916143C069141C1C5
SHA1:	B7CAE69682CF31DD670B65088DB8395ACDA6ED3E
SHA-256:	AC8778041FDB7F2E08CEB574C9A766247EA26F1A7D90FA854C4EFCF4B361A957
SHA-512:	01211111688DC2007519FF56603FBE345D057337B911C829AAEE97B8D02E7D885E7A2C2D51730F54A04AEBC1821897C8041F15E216F1C973ED313087FA91A3FB
Malicious:	false
URL:	https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12378
Entropy (8bit):	7.973395376145172
Encrypted:	false
SSDEEP:	192:Kf0S9OYGzIKZONztVkmPrMlQlUZh8jLJIAhz2AHUgfJHzFI973nr0SwDAqWGJj:O1OYcktprMJZAL6AhN0gRHzFW3rRw1WA
MD5:	443AD01A83EB687C821B329067D06162
SHA1:	3E27FFBC10C7D798608B09E65C14D771F65F2013
SHA-256:	4DACFC42E8A40FBD83C287E7518ED8FE2E182575BB87011289534CBEF40E5BB5
SHA-512:	7488F03C35265492B74A3EA53D0691003A60BC4DC9BB1963D98603BA9D28ED25D7AE695B6F7620CCC096684551B5589FE68D6D8B9A4B1192164A5B56C2AA53DE
Malicious:	false
Preview:	.PNG........IHDR...............E....PLTE...\yu............+.....&..q.07..{~~).......'..A.s...)..'..7..=@....Jo....c.]...P...V.q.,..d.D+.."w.R.14s.VNK....S....../VXW...0..HIGFx.;.!8.'....]__l. ......".....~e.aij...6...$m.5v....m.0 ..Y.1...F...`.S..=!..d.....!o....A..z\|.=U..z.....Y...[.0..+D.%...C......7...g....U....b.....Ny..&..S.......R......L.6f8.p..C.....,I1...j.r.....+g....`..nM......j...F.......V..........+..........!...O.1...u....?........L...........Q............9..o....6r......&...f..5~....]..E..O..5..:Z..`..X.(_.....\..\|...b7.F.....@..T.N..r..<8=.........s.....R....t...e..`..-,,...k..T...{A.?.......x......../.n.....)....&.......G[...E...j..-....d...z?k.......T.=.h........:.[.........r.z.r....R..].._..k.*M.^.Z.H....].q.n+_v.N.....X.=k...O.K.o........[.......tRNS......58......Y."u......2.....X....V......@......w....G....oc...vG.......Y......x.....V......~..}.............2o.....'.....,.IDATx...O[e...#/M_..(...&.....1..'.....33f.....E.

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.721060473572876
Encrypted:	false
SSDEEP:	24:t4zS8GeaxMQlMpxJgpHvHqsCCzDZWi+Y0VwlnRjia:jl8xJeHvHq0zstVcF
MD5:	F9FADA41AC3F5570BBBEAAC514388922
SHA1:	53FBA971F2F158D0F7D16326E148D6A7E346A988
SHA-256:	D09264F5F81841A9F74112C32D228CD01F0957E505BC53A7EC79487E9FC9793C
SHA-512:	3A64FD6C956BA4C10B8B2713BF25774956784D179117A1864A2DA73D7CA856439A80BAAE44181AB69F30D2C67AC955C9F528744B6C7791F59B070B816CD5BCE2
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M7.71330084,13.9517336 L7.67742498,13.9194453 L13.9456573,8.68300306 L5.60379959,12.0474423 L2.23649027,9.00660343 C2.04143119,8.83035128 1.95837915,8.5615376 2.02002556,8.30597433 C2.08167197,8.05041106 2.27814486,7.84902377 2.53210746,7.78108364 L20.3624157,3.02394306 C20.6117291,2.95789547 20.8773095,3.03073684 21.0580425,3.21473429 C21.2387755,3.39873175 21.3068515,3.66557339 21.2363519,3.91366468 L16.4863865,20.4797072 C16.4182814,20.7179184 16.2321023,20.9041405 15.9939069,20.9723006 C15.7557114,21.0404607 15.499205,20.9809139 15.315398,20.8147878 L10.703196,16.6503166 L7.71330084,19.6394943 L7.71330084,13.9517336 Z" fill="#EFF0F2" fill-rule="nonzero"/>. </g>.</svg>.

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.450267384685166
Encrypted:	false
SSDEEP:	3:CUEJfh/:iX/
MD5:	F6815F3311F2AD7BACB9C9156B5151BB
SHA1:	4042DFD5B2A00AF6857ACF15E63DC0672592E7D6
SHA-256:	C8DE81A1ACB5F3788959ECC04EAA6526D5BDB29991157CECBEF71042268C0374
SHA-512:	57A7373DB5CBB195675D11A2930A8C43A7366F8D6D89A430D3165DAA9D1AF09F7AC432A0EDF52BBEF34BE7B5A3FC3B81A9F7812F56E5706CF6FCACFFB7017F78
Malicious:	false
URL:	https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/border_3.gif
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	7.860086991314443
Encrypted:	false
SSDEEP:	48:kh2nfvmUtaqZkOy42Qj9wtlX9pSAzatwfxIk0TDTC+2J1mDcXwBAL5YQ1DG:khOHz1ZkOhj9QpS0LSkUTC+2eDcXVL5A
MD5:	9F0D016924397AB2F9D1A6732411161F
SHA1:	CE3698A496B32017A937964E7E0BC4D677D2EE3A
SHA-256:	C52F4E6FF4F01F8FDE6760F00EC60749620291DA57BE944F17A58C108A15C22A
SHA-512:	EF00D4BEAE8AB7D3DD3AD59A6E6128E91C5C2CFF325C676C87E35A8F7AA2FD7678A2D1A02F83C2BCFBCFF299D3C01077A47FB4B8E8945C831586686AD9FA3B49
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE...SSO...'e....u..$^.-p.................e.Tx.f.Q. ...........xxx...t.[\..%}......z......vvs...!d....\|\|y.\....5s.::7$c....441..................HHE.....{......<h.......\.....BB>...........m...y.`BB?...DE@......220.........bbb..................```......###...%),...Y..?r..DwL......z.L4........8t......\|....2.. h.J..{.....V..........ZA.].Co.............Q~...>.&-t...... D.klm......:.....4...V....0..R...:TJ.7:{....Nr...oB.&.............7.".l.i.VG.....9.)...&f..T.......R.?;.%q.`\.K.....A.+Q.>...>\|k.YB.3....~.~..K.7.=j.. Z........... ..D.-....G}K.2.........:s%..W.D....`.O...M.3..-z...............Q................\.J.........................../..$_.........+{..........................g....;w.^........3p....>{...................k.$....[tRNS.O'....z.m.....j.....8t.......JT.L..vk>5..zp.C..W..$;.f.......9....P....R$5.]..'.......'...yIDATx...gP.V....u....M.w.$m....:...w..h...@.a.V....a.`p.m.=b;

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 140, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10207
Entropy (8bit):	7.919105994302115
Encrypted:	false
SSDEEP:	192:JcGsHGeAC8Y8018D0gtixwY9m+B/USaPq+MCoTjizmki0PpSf5SeKD5o:JZ6EY8YQ0gtMa+lfaPzMCoHiCF8pC3l
MD5:	DADE2E92F3FF74139609CBEC34884808
SHA1:	8A0E4C65BA3E8CEC6C36DD6709B607C93F64F698
SHA-256:	B70BC7338ABDB5F0EBC7AA50AAC5367C688D6D2795C0295AD48AC108138CE4C7
SHA-512:	7DC6CC9783C6F74AE21AED26D1DD7DA4E693B9BCCB353FF1C0F377562A893F02C8023ECFBD38158171A94866211A86F95520FAC370CA9FE8122F758369610F14
Malicious:	false
Preview:	.PNG........IHDR.....................PLTE.../..G7.:).>..=-.7&.kU .h%eP"P?...0t\......g..w..p....aM.SB.kV..............................w_......!.s!..(..."..#..$.... .%....(../..->9.RJ ....3..%~k..4..9..6..8.3..>..C..3..>..B..C..A..6_U.ma".D.F..Q..O..M..8..V..E..j..V.~4..[..]..W..f..e\|p0...........x.....\..dxvO..P..f..q..t..{.`....u..r.............{..........s..Q..j..N.{F^Y0..asoA..Lke7,..FE+Y..?..W[A&b.6..m..3?6.r......;.!0.7\!...Do+..)..*..$..... ...j..T..O{.^..n..z...........d..t.4`.Ck..\|..x.#r.$n. l..i..e..a.'a..Az.\.!H.'\. P."X."U..S. Q..U..Q..M..N..K..H..H..F..D..C..@..=..?..:z.D..3..2h.9p.+]."Y..I.)h.1s.'N..)..8....#!..;t..................................s...................Uy.f..Vw.He.Wn.fv.5U.0U.S].';Z/Aq>SuN..u~.>P.5w.,..)..SL$[I&aN"TC.G8.2 .1../../..0..:..5....tRNS...b.tP...........................................................................................................................................................................

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (389)
Category:	downloaded
Size (bytes):	3711
Entropy (8bit):	4.974023151858648
Encrypted:	false
SSDEEP:	48:NmNsl1gZvrzk27I4V5l7I4thjYrpwFdHSP80bUnJtQ+bqkSKnIyGNYZxyGNYZH4T:piZkgdz5dnjYrpqs8f+kRCYB
MD5:	F1BA84A6E932D17FDCB0876E1F5E171F
SHA1:	6640D6EB90E2217DF0F603DFD5E79B4D7C5865DB
SHA-256:	2455428171A40924E808E80A30F6BF836AE9B4909C61DCBCF31DA4D5C1A24B36
SHA-512:	607E235F332CD35FFC7ECE583A1FA03AAA62A3EEF3E4DE14BAF6DA5AFCC57EE8EE49147CD447C17A9226ACED77388875056B606E75055A056F76A2895173A658
Malicious:	false
URL:	https://www.wisecleaner.com/static/page/layout/layout.js?v=1.80
Preview:	$(document).ready(function(){$('#header-menu-input').on('focus',function(){$(this).addClass('header-menu-input-active')}).on('blur',function(){$(this).removeClass('header-menu-input-active')}).$('#layer_newsletter .popup-close').on('click',function(){layer_newsletter_hide()}).$('#footer-nav-newsletter-send').on('click',function(){var email=$('#footer-nav-newsletter-text').val().trim().if(!email){return false}.if(email.indexOf('@')===-1){return false}.ajaxCustom.request({url:'https://www.wisecleaner.com/lists/?p=subscribe',type:'post',data:{"list[2]":"signup",htmlemail:1,email:email,subscribe:'yes',},callback:function(data){if(data){if(data.indexOf('already exists')===-1){var subscribe_title='Thank you for subscribing to our newsletter!'.var subscribe_desc='We have sent an email to your inbox. Please check your inbox and spam folder, then click the Confirmation Link to complete the subscription process.'.document.getElementById('popup-wrap-title').innerHTML=subscribe_title.document.getE

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10203
Entropy (8bit):	3.9988274889146007
Encrypted:	false
SSDEEP:	192:CPIqRwKg8YuOV6uBSGBqfdvMpfUh+wac5H2BOfSBHB3UBe25Lary8RyorU6zgYpY:CPIqRwKg8YuOV6uBSGBqfdvMpfUhRp5n
MD5:	8ACA18366F9A1C47BF61A094F74A9AD1
SHA1:	0A833C108D60D92012F47B78280B77DEA6B6E962
SHA-256:	29ED5A10B0C7C6D616DB291AA0D3C8C07B9EEA0C87251AFC9F85B650F7F5E5FB
SHA-512:	341C1AC7CD665872338D202EF9366F0EEF32124331AD561FA34F69F07B4684E20E9009ADFB6F29AE5676B701F80DFB99C21707B571C8AB6B8CE59CABBF7BF00B
Malicious:	false
Preview:	<svg viewBox="0 0 1542 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M7.547912 1017.710074h1520.904176V6.289926H7.547912v1011.420148z m1523.420147 2.51597v-3.773956 3.773956zM1.257985 1024V0H1534.742015v1024H1.257985z" fill="#353636"></path><path d="M3.773956 706.987715h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 628.992629h1527.194103v77.995086H3.773956z" fill="#C22045"></path><path d="M3.773956 864.235872h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 942.230958h1527.194103v77.995086H3.773956zM3.773956 786.240786h1527.194103v77.995086H3.773956z" fill="#C22045"></path><path d="M3.773956 550.997543h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 315.7543h1527.194103V393.749386H3.773956z" fill="#C22045"></path><path d="M3.773956 80.511057h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 158.506143h1527.194103v77.995086H3.773956zM3.773956 47

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.1961893998690174
Encrypted:	false
SSDEEP:	3:CUXPQxkhpse:1Qi/se
MD5:	D44EBB7184C776B663F036174FAA361A
SHA1:	53A278EEDCE146C3A979D190AF4AFFAEC3D7CFEB
SHA-256:	ED1B73C6B4690CDE9B521865B58E031293209BC0B2BA2B5716ECF4BF9885EE4B
SHA-512:	596259EC8195661D7335A95BF8FE82EF9C75676FFF07079187AA314824268B8986AE00E33FB8FA2B977BEBE05D0C426F6D507B1B38B21536E5513FBCB6693042
Malicious:	false
URL:	https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/spacer.gif
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	41700
Entropy (8bit):	4.965249112595398
Encrypted:	false
SSDEEP:	768:oiIcKPgZ4WFOemQFc/3GBLQ06eMYdaO4Mawgm0s+Rb4FhFQ7qfr3lyFcSZJpfXRf:vgWwemQI32LQ06eMYdaO4Madm0s+J4Hu
MD5:	BACCB7180FE061B63ED061EC10C3B0C8
SHA1:	BFB31590BA6E758EB8F25735B564D7E4A0919025
SHA-256:	A5402DE70228D4BF5379B518225B702918F6AE277E9293F9D16334C2B1FA31E3
SHA-512:	8C572740FC0AECBCF2495797E9125025063F512D7A06F196ABEEBC9B542C2C93311D84DAF7878AC1F8CFDD48B898FC85852286FA2CF2CEFB2957142033D8990B
Malicious:	false
URL:	https://www.google.com/cse/static/element/8435450f13508ca1/default+en.css
Preview:	/** Copyright 2005 Google Inc. All rights reserved. /../ the GSearchControl CSS Classes. * .gsc-control: the primary class of the control. /..gsc-control {. width: 300px;.}...gsc-control div {. position: static;.}../ Slight reset to make the preview have ample padding. /..gsc-control-cse {. padding: 1em;.}...gsc-control-cse,..gsc-control-cse .gsc-table-result {. width: auto;. font-family: Arial, sans-serif;. font-size: 13px;.}...gsc-control-wrapper-cse {. width: 100%;.}../ control inputs. * .gsc-search-box: the container that hosts the text input area. * .gsc-input: the text input area. * .gsc-keeper: the save link below savable results. /.form.gsc-search-box {. font-size: 13px;. margin-top: 0;. margin-right: 0;. margin-bottom: 4px;. margin-left: 0;. width: 100%;.}../. * This table contains the input element as well as the search button. * Note that the search button column is fixed width, designed to hold the. * button div's background image. */.table.gsc-search-b

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3882
Entropy (8bit):	7.363560974284361
Encrypted:	false
SSDEEP:	96:7PJGeMCIQtJJAFLlsUX9jIWtNCsCzyOuZrp0UL6718qgW2Fo:m2s5O+p0ULra2Fo
MD5:	D202E3240BD46EB934AAFB750FEC43A7
SHA1:	EABC6406901059E0A4E4F0F9621BFC2F26858625
SHA-256:	BAC0DCE6040522175AED9B5D80F01AF746BF3A73215CD86E9118E5E48BD757F0
SHA-512:	0B0F9D26F9032ECA011172E8D7D9CC2C344FB68A1722C5D44B1EDB7CD5E46658CFB6140B8A67CB781A2D52E038715AE91884244EC4FCE0F692C895620CED410F
Malicious:	false
Preview:	.PNG........IHDR.......d.....c.(.....gAMA......a.....PLTE...Nz.....Zy....Zy.......Zy....Zy....Zy....Zy....Zy....Zy.......Zy.......Zy.......Zy.Zy.......Zy.Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy.......Zy.Zy.Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy.......Zy.Zy....Zy....Zy....Zy....Zy....Zy....Zy.......Zy....Zy....Zy....Zy.Zy....Zy....Zy....Zy....Zy....Zy.......Zy.Zy....Zy....Zy....Zy....Zy....Zy....Zy.......Zy....Zy.Zy....Zy....Zy....Zy....Zy.Zy.......Zy....Zy....Zy.Zy.......Zy.Zy.......Zy.Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy....Zy.Zy....Zy....Zy.......Zy.Zy....Zy.......Zy....Zy....Zy..........Zy.Zy....Zy....Zy....Zy.Zy....Zy....Zy....Zy....Zy.......Zy....Zy.Zy.......Zy....Zy.Zy....Zy....Zy....Zy.......Zy....Zy....Zy....Zy.Zy....Zy.......Zy.......Zy....Zy.......Zy.ZyJ.".....tRNS.................................!!%%&&((*+-.11334546789:;==??BBEEHHJKJKLLNNPPSSUUWWY[Z\\_^a`abbeeffhhkknonoqqttvvxxzz}}~.............................................

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	538
Entropy (8bit):	4.9546273514495365
Encrypted:	false
SSDEEP:	12:tcjRRNlfGqPT8EIkbLODvTjBliBTlo7OBT8o7MDBTOAo7kW:tczNlffTakbW/jXUfkW
MD5:	963F507DC4B2BB67E10668EF0B78E964
SHA1:	909C87B19C10FEB2EE54908B415F1DCE0E13F543
SHA-256:	C3D1C2132B5286E078153F8350D249D788D8CF9F23910A861026D057847E2CA4
SHA-512:	19EE7AD7CF69CF0D9F5BFF14DE1C534403C86E8E6C5A0576F6CB8FF9A2B51AA0B289332A8AA8807B1784CC916B42F9836DB025A5F878F215DE4A69D6E55F8EA8
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_germany.svg
Preview:	<svg viewBox="0 0 1541 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M6.282209 1017.717791h1519.038036V7.53865H6.282209v1010.179141z m1522.807362 2.512884v-3.769325 3.769325zM0 1024V0h1531.602454V1022.743558H0z" fill="#353636"></path><path d="M3.769325 680.991411h1525.320246v339.239264H3.769325z" fill="#FCDA00"></path><path d="M3.769325 343.008589h1525.320246v339.239264H3.769325z" fill="#DE3B37"></path><path d="M3.769325 3.769325h1525.320246v339.239264H3.769325z" fill="#231815"></path></svg>.

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.134332230661175
Encrypted:	false
SSDEEP:	12:TMHdVVzIu/KYTeaxMovFtrDWwlxzgi5chQnucfvnDnbt+Rj0gbrso:2dfzFLTeaxMAtPvxzgtAfvDn8Rj0gbrX
MD5:	2A06EF63CA9D63D9CEDF72E3AD57700A
SHA1:	0C190533C21D3D9826728DF4B4D2E65DED8AAEA6
SHA-256:	79C4562C88FB3E4F8F1DF296108AFB7CBB4ECAE6C80361CBFFFECD433EFC0459
SHA-512:	71AD6ADBD854DCDBFEDCF021F64DFDD92EE7D9CDD63BD93F0D7CAC26F64541124A13DCD7A1BD71B81AE973320D36E3EE953FBDE2D1DC069EE0D7DCC8E13372B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="12" height="12" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#EFF0F2" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "></path>. </g>.</svg>.

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	4.435341416563254
Encrypted:	false
SSDEEP:	48:fv9+21znTSHLvsK1P5iAJCfipIYgLTrqkTpoJjx:n0me1959gfvYgPrqGm
MD5:	6862A3B0760AA923A0218A5A755269A3
SHA1:	EE5888377B7908BC2AF43A10CE9E31A4842DFB7E
SHA-256:	15EACCBC3AE34FCF82F88790D045F148D02D18F4F764EF20BE7F857F3902E88E
SHA-512:	85F405D8D0BBFDB274DC433E5704BA82514B9A18BD96A3D0442183861A373415C8B26FB05B8C08BF3E46D318C624AE96E3C42D32DBA5A4B86545F4F079443B4F
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(3.000000, 6.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M26.2817007,2.51015163 C25.3312232,2.9202108 24.2968801,3.21532914 23.2314756,3.33026997 C24.3310476,2.6747966 25.1665981,1.64032914 25.5610773,0.410151627 C24.545371,1.01592086 23.3961008,1.46015163 22.2002386,1.69003328 C21.2311243,0.655565828 19.8551063,0.015625 18.3299937,0.015625 C15.3946956,0.015625 13.0340326,2.3952108 13.0340326,5.31532914 C13.0340326,5.72538831 13.0837308,6.13544749 13.1644903,6.52997411 C8.76930853,6.30009246 4.84936548,4.20009246 2.24331776,0.984855769 C1.7836097,1.77390902 1.52269431,2.6747966 1.52269431,3.65955991 C1.52269431,5.49861317 2.45764111,7.1202108 3.88335733,8.07390902 C3.01363937,8.03973743 2.19361959,7.79432322 1.48852682,7.3997966 L1.48852682,7.46503328 C1.48852682,

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20303)
Category:	downloaded
Size (bytes):	547271
Entropy (8bit):	5.430981386239354
Encrypted:	false
SSDEEP:	6144:+YS2IJfKPwG/wl4WbJLPGMZjC7W86QExWydtwv9bR/h5nFDuTU86x:+YKGoo6QExWyaRDuTU86x
MD5:	F113C6FFA4FB4824FBE1BA9A1FFAC324
SHA1:	F320031FAA47147F46DAB431C2429146C1E61F18
SHA-256:	AFCDB7635B58AB749AE3853275DB4E3E52082C0C6FF85A73B026DD2355E75506
SHA-512:	2F938C660EA7D8054FDC78C9CC42DF2D2692B18A66F3CF585DF5E732A951FFDCD22AD677DD9BCD6B65D95BA8CEB74DAC89000D26F3051252EFAC39BB1440F038
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yv/l/en_US/tQNtwFBP_EQ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2547
Entropy (8bit):	4.854453449000075
Encrypted:	false
SSDEEP:	48:+xcR6Q3CGx0XrHJNXNxKuj3HVvFWZRYTqUKaJoPkCbiisL79FM8cs:+Y6X7N8SiZ0qUKCLCK9Wrs
MD5:	A6683370D90D9E184EB75E36A7D62B4B
SHA1:	004A07FDDEA69C5FFBAA7840B1B0F6F1525FC17E
SHA-256:	9209A720E3D6CA178DC559FF539F55D475101705EDC9AD181617EC183DFEB769
SHA-512:	37A418DC475AF9C7813FBA87218D9AD5C13DC1D336B3580D86455EE7F7D9FD298D98E45653C739B7046601B450F9339984C67D4128F9205C2F64BC7638D2BB1B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 256 256"><defs><style>.a{fill:#0181fe;}.a,.b,.c,.e,.f,.g{fill-rule:evenodd;}.b{fill:url(#a);}.c,.d,.e{fill:#fff;}.c{isolation:isolate;opacity:0.1;}.f{fill:url(#b);}.g{fill:url(#c);}</style><linearGradient id="a" x1="25.76" y1="172.95" x2="249.13" y2="74.75" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#027eff"/><stop offset="1" stop-color="#0146d0"/></linearGradient><linearGradient id="b" x1="43.21" y1="136.32" x2="168.11" y2="136.32" xlink:href="#a"/><linearGradient id="c" x1="153.4" y1="126.43" x2="200.34" y2="126.43" xlink:href="#a"/></defs><path class="a" d="M64,0H192a64.06,64.06,0,0,1,64,64V192a64.06,64.06,0,0,1-64,64H64A64.06,64.06,0,0,1,0,192V64A64.06,64.06,0,0,1,64,0Z"/><path class="b" d="M70,6H186a64.06,64.06,0,0,1,64,64V186a64.06,64.06,0,0,1-64,64H70A64.06,64.06,0,0,1,6,186V70A64.06,64.06,0,0,1,70,6Z"/><path class="c" d="M186,6a64.06,64.06,0,0,1,64,64V93L159,6Z"/><pa

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4240
Entropy (8bit):	7.788348245413524
Encrypted:	false
SSDEEP:	96:7Ql6S8kFOZ/93U3nEl5i+1Ae1+xem+d0bCcQhQahWbDneb:a6S85EM5iSArxemEdcQhQWsDneb
MD5:	F3FA8B89FA1DD1010B12CE3DEEB51FB7
SHA1:	2C7925BA1605D567A659EB04CE2BDB751227D934
SHA-256:	3EA31A075DEDB2AD103DFDE059490F89B5D746B99CF8B5384DF090B1E2F22668
SHA-512:	4D940A0BE4C8B7CF9A96A65463FBEEDA75D833117020FFF153D92FFB0ACBE2FF929455F03F644F547479FAA0FB5AFC77B89082FE5771E5AADEE67B49EF11D666
Malicious:	false
Preview:	.PNG........IHDR.......d.....c.(.....gAMA......a.....PLTE.........<<<.q8utt..\..UTT.c...:PPOKKW......\|...(..Asrr.r..APU^..........................,..^..................===..p78F...CCC OQW...........8..............L...[[\iii..8..Ya``750HHH..)..1..r..]..Sxyy..Y..O..E..%..a=@C...+++222===..t.....-DDD@AC..<QQQ.................666..B.....6..{.....D..,.............g...<<<HIL..CGGG..$JJJ........?AAA......999DDDFDA...)))......BBA;;;...---......//..... ...&&&..........................333.....................................................777EEF...>>>.......................................................................................................................?'.....\|....ZG...aad.... .>...........q.......-'...............v_......................................................................6q`.....tRNS..U......q.....A....G.u..Ue.\|....h..y..gZ{...Mr4...#iQ.VD.5..l.*.~l.FF...(.`q,..3...!....>......`..,..%.L.~.g.]@_...K...!H...E......w3\<.d.........J(....

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	4090
Entropy (8bit):	7.9415577135059605
Encrypted:	false
SSDEEP:	96:m/31GDx5jafPVb2IeKcO0eId5P/sLywdPTZD8GyC:C1GnjgPgIerHeqRw57e0
MD5:	1F8EAFB2EF2322D0A1A2C5F55D734106
SHA1:	7A1A541CE0A36DD9275D64B230E378219C685BF4
SHA-256:	88750F5AB883070B4AA9B37D4DFB20ECF4AFE88E24B5CB6AF89DF1F721E12A1C
SHA-512:	963104ADF2164A4C10F8A679FED228691351E50057187E3A02AE8A20A5B4D89699440E888EAD4AAA6910A49FA899D9E158C7219B2BD68E56ACF98FE6C9E4D0F7
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/update/icon.png
Preview:	RIFF....WEBPVP8L..../1.Y...9..D.B{...5q..@O.$3.t....v#)_v...3I.(..{. .X.h.$.C.$I..]S..$../..x.....Lu.$..)hEB......9.4...9Y.Pd.....0..'1..C@ `.L.a.....P.. dX.p...!.M...R.MXe.....YN..ST..z..P!.9d.E.....!...q}.0.@.....`.&...{.eB.V...u.q.l..........X.......i.Y...!..BC...6-.x.$....K-]...w...]>;.L_6..@$.... A@.....6.^oC/M..IH.q....ALR.$.......P.7q.f..G.M[...F.-T..<.m.V.3.77.m._s...)T......+........@....W_.8.I......L1..DLj.......n....y...b_..BK.r.[3.c......U.../S...S......L@......Zo..U...ow....lv........>......=i@...P.u..m:..!".m....J+g%{*'uw...Y..{.j}_......{....7.-..f......`h.?....C.$.m3....."...Y.&..m;.T.x.f..pc.....-po--..)\\.....<"3....1%.!2.......C.$7n3.A..A...<a..<.LM.4f...'@........O.;9/..j.....L.%.r\|..]...MWy..3..k.k.W..1&...K&O......C.8.x.]....J:2@..'z...G..........H....b-.]....v.vJ...E.Y....(.NO...F..:.[...{.!... S.w,..H8..X..3d......g...K.P:=iJ..$.mO.g....K'.....^O..9H..K.......c...SI1.F..E.......s:..?xj..4.T..1Y.E..)=..i..y.m....i

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2403
Entropy (8bit):	7.867084930490025
Encrypted:	false
SSDEEP:	48:PYOZXpQjo58CiDL6vFsYhRVRiSesA89VQOdUrRSKtn1ysQzx3Dq:xZcoKesYviJslIRSKt1yvzxe
MD5:	8C24DCF083A39D8F918640F5B0C2E1DB
SHA1:	5ED47A627D6739913594E4ABED7627B658AA33B0
SHA-256:	D4DF978B63AAD19A424437AC81D076CB6B1D3B9D74B40D943AD6B9F317626B73
SHA-512:	8AB8A5A8DB3ABB68F1B8705FC87F0B23C151E28D6023228605D9BA2F704F5C6DDED868EFC444F7AF6435872B2758577531D07F58AFF156D084FBF339437EE5BF
Malicious:	false
Preview:	.PNG........IHDR...2...d.......c[...IDATx....Me..........4j"..hRJ.KJZ.5.P)....".#.G..B...G.(E.bYk.!y.0..c.3^.....u..^.^.k...o.s_.\|....{....4.y........$>..D.%B.[.$.Q..J...b...A..y..,.....z........y1Q..U...?.tQ.......0L..'.\|.N..#.4...."J.,a.F.3.......w.WD....9..A......i..h..V..5..[o.L...Q..W.x.xH......k..(<..S..?.b#QK.(..7....,....u.x@,..$\.....Iq..-....RW.,.d..)..j.G....Wy.X..5b4..C...=...I.X.q,...".x8....L. ..b.7..jXq%.k)..+._....QD......xM..K.N..+....f.3..k..UT....(W .p....x...k...D..b-.a..I.....`\|.Cl..Q..c..Tf...$....~.....p._.&........".m..b/C.{...J..1Q./.F7...X. ......a...P...{.I..X#........;E..L.Q(....-.q.....%.Fp._.,nY..g.p...a.Kb.%.....2.)J...e..p#.>.....c...`.h,.[4#Hl....P...-.v"."Xa...d.3`S..GS...b.X/......%.....`........p..@$.).%...3..h.y:J.K...Z.x...Xe.c)..(N......TdAN.5E.3./.r.!...:..K...bY>?-T.%.?b.A$.}.........e.......a..].]`{....%.(.b....q$.(rKG.5H..x..b.....E%a.$..,..........X.(........11V.b..!.v`. ."&.l0..f.{).f.=b

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10203
Entropy (8bit):	3.9988274889146007
Encrypted:	false
SSDEEP:	192:CPIqRwKg8YuOV6uBSGBqfdvMpfUh+wac5H2BOfSBHB3UBe25Lary8RyorU6zgYpY:CPIqRwKg8YuOV6uBSGBqfdvMpfUhRp5n
MD5:	8ACA18366F9A1C47BF61A094F74A9AD1
SHA1:	0A833C108D60D92012F47B78280B77DEA6B6E962
SHA-256:	29ED5A10B0C7C6D616DB291AA0D3C8C07B9EEA0C87251AFC9F85B650F7F5E5FB
SHA-512:	341C1AC7CD665872338D202EF9366F0EEF32124331AD561FA34F69F07B4684E20E9009ADFB6F29AE5676B701F80DFB99C21707B571C8AB6B8CE59CABBF7BF00B
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_america.svg
Preview:	<svg viewBox="0 0 1542 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M7.547912 1017.710074h1520.904176V6.289926H7.547912v1011.420148z m1523.420147 2.51597v-3.773956 3.773956zM1.257985 1024V0H1534.742015v1024H1.257985z" fill="#353636"></path><path d="M3.773956 706.987715h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 628.992629h1527.194103v77.995086H3.773956z" fill="#C22045"></path><path d="M3.773956 864.235872h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 942.230958h1527.194103v77.995086H3.773956zM3.773956 786.240786h1527.194103v77.995086H3.773956z" fill="#C22045"></path><path d="M3.773956 550.997543h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 315.7543h1527.194103V393.749386H3.773956z" fill="#C22045"></path><path d="M3.773956 80.511057h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 158.506143h1527.194103v77.995086H3.773956zM3.773956 47

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	526
Entropy (8bit):	4.902485247149878
Encrypted:	false
SSDEEP:	12:tc5glRRNlfGqDo5tEzw9RpaBliBvS+Rh8BVuVLbyCEvUbyCjdg5W:tc6Nlf0Ow9Rpaj8vRhqu5eCheCJgU
MD5:	D39F018179C0AB39CE22A368C95AE059
SHA1:	55021383C5F0CC11C16D48EC0FF24486B07ABF49
SHA-256:	6B557C105AFA715F334401325E2E3FD3DDFACB08639E188428F0877DB899D3B1
SHA-512:	756B0F4D2A52EBEA4C5C24D2AB20AA5BCCF84E98387B2404F80161A4E7C6763D1792322789A97D87197FBBDB6C0AB3BBEFB2D830D7122B4DB706FB78904F69B1
Malicious:	false
Preview:	<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.039216 1016.470588h1517.17647V7.529412H10.039216V1016.470588z m1519.686274 3.764706V1016.470588v3.764706zM3.764706 1024V1.254902h1529.72549v1021.490196H3.764706z" fill="#353636"></path><path d="M6.27451 5.019608h1523.45098v1015.215686H6.27451z" fill="#FFFFFF"></path><path d="M768 512m-304.941176 0a304.941176 304.941176 0 1 0 609.882352 0 304.941176 304.941176 0 1 0-609.882352 0Z" fill="#C01D3C"></path></svg>.

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.6420980349575425
Encrypted:	false
SSDEEP:	24:t4kZbeaxMG0Ry84Lo8lYiNsswwzNv9Nq5JXoqxQi3SB7IcUrEuYg1FtVBg:f4iHNssZzN1kJXjQi6TAnYgpg
MD5:	D117936B48B29A295867368D81676033
SHA1:	536BD05DB4B1553CCCECCCEA826EAE1B6BBF2C38
SHA-256:	091FE9B452020B0AA709D9C3BC62D76D79C5D80F4A85D4E620B86E488E083C89
SHA-512:	E0CE78A844F4D452E2B337C0035D7C50A471C34BBCB22B1EE9C7469279E3DFD298FB67A4A366125E5194743EE6D34098260DBF762C2FBB1C2D807471F145F2BA
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(3.000000, 7.000000)" fill="#FFFFFF" fill-rule="nonzero" id="youtube">. <path d="M26.4363204,2.9587308 C26.1180446,1.80068637 25.2268924,0.895766055 24.0864672,0.572573076 C21.9819531,1.61449745e-05 13.5121279,1.61449745e-05 13.5121279,1.61449745e-05 C13.5121279,1.61449745e-05 5.06368546,-0.0113956103 2.93778861,0.572573076 C1.79736341,0.895766055 0.906211144,1.80068637 0.587935434,2.9587308 C0.189001259,5.14662552 -0.0076752007,7.36759466 0.00022906088,9.5926607 C-0.00613498522,11.8093306 0.190535027,14.0218101 0.587935434,16.2014491 C0.906211144,17.3594935 1.79736341,18.2644138 2.93778861,18.5876068 C5.04005188,19.1612903 13.5121279,19.1612903 13.5121279,19.1612903 C13.5121279,19.1612903 21.9594449,19.1612903 24.0864672,18.5876068 C25.2268924,18.2644138 26.1180446,17.35949

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 110, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	7.892332346569703
Encrypted:	false
SSDEEP:	96:28JtH8nE6F/dc5GqwGiMaiN4etDl1jqfRy+E/QjVwhIakkQDwJ2U+qVadAr:2UH/CLTG5lzD3efRy+EIAI/fwJ25zAr
MD5:	8AA06C21A64A5FA4030C16F4C271C753
SHA1:	66A2F9A0880662F2D348CE57D278045478FB583A
SHA-256:	76CE0E80A68A1D1AC22777E9964ED3DBC82E56E23E4F72C708C027EA579E9563
SHA-512:	8322768A8EEC77555F4C74603F2FF68603343730F7A2A6167362A882D64318BA8EC07CB14EDE13235E101D74EEFCC835FEEC426DE02380ED550D03E36CEB5742
Malicious:	false
Preview:	.PNG........IHDR...d...n......F.....PLTE........................................................................j..o.....\|.........d..\..U..M..H..A..2..;...k..`..p..t.%x.%y.%y.%x.$w.$u.#s."r."q."q.!p.!o.!n.!l. k.!v.$p. i.(z.\|.-}.+}.%w.'\|..e..f..c.%t..i.'y.!o.)..,...Y.6...q.1..+../.....2..3...f..l.,u..[..g..g..a..a.._..\..Z..X.)....].!\|..S.;..D..;z.Q..Y..K..~..a...c....Y....8..D..7..;..@..<...m.!z.#t.#t.C..(n.>..D..l..g..%x.#t.s..#....."p...................L..8~%P\|;`.'CeT).#Y.Ru.$v..S..xJ.....p...Q..../nI..W...(..X..............'...............y.E..3..h...t..~.v........%w........q.$v.$u.$u.$v.......................w...Y..9..2..@..]..X..L..R..F..c..l..0.2...HHH......jjk...WWW...bbb............rrr{{{.................................................................................\|2.....tRNS.................................................................................................................................................................2....<.'............PI

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	4.58217158566916
Encrypted:	false
SSDEEP:	24:YEFz7kZPZ+sDZbfIup6GvyqT6ZwF7DZmZ+51DZd/nm7UZX:YEdkVgMNwHqPMyVr/mIp
MD5:	71CE7883D9ABF309F53EF092357D23D5
SHA1:	CFBA3242222B06C12F749288D749FBE0DDE3E526
SHA-256:	234BB6FAB6F527CAD346235618DC4BBB9E2441EFAA5D835FF15BA63398028C97
SHA-512:	884E5D73292D2DD2C7AC2BE95B746C37D8FAE1C73AE3BCF4ED72C386FD8523E4D2431CC3A85CC43AF514E5ED1F52B0552775E6A3B5D8667FBD953B595BAAD77B
Malicious:	false
URL:	https://syndication.twitter.com/settings?session_id=23573a4b92be966386dd3bcaa06c1e011847d690
Preview:	{"should_obtain_cookie_consent":false,"features":{"tfw_timeline_list":{"bucket":[],"version":null},"tfw_follower_count_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_backend":{"bucket":"on","version":null},"tfw_refsrc_session":{"bucket":"on","version":null},"tfw_fosnr_soft_interventions_enabled":{"bucket":"on","version":null},"tfw_mixed_media_15897":{"bucket":"treatment","version":null},"tfw_experiments_cookie_expiration":{"bucket":1209600,"version":null},"tfw_team_holdback_11929":{"bucket":"control","version":11},"tfw_show_birdwatch_pivots_enabled":{"bucket":"on","version":null},"tfw_duplicate_scribes_to_settings":{"bucket":"on","version":null},"tfw_use_profile_image_shape_enabled":{"bucket":"on","version":null},"tfw_video_hls_dynamic_manifests_15082":{"bucket":"true_bitrate","version":null},"tfw_legacy_timeline_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_frontend":{"bucket":"on","version":null}}}

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	4112
Entropy (8bit):	7.946802463428336
Encrypted:	false
SSDEEP:	96:6ghKhSe3cQeiWKKAtx56ALAa1tgYYpbFRsxz5bykaZ8:DhKhiKKAP566Aa051FRsxzru8
MD5:	60BF317E30D06FA0D357323C786499DB
SHA1:	492BDEAE397AB1D5EE17EC9DE8F336C26D6EA156
SHA-256:	965355BA9C699158EEF6B2FDB8EC73B7081FC645B296A4561DCBFA174D7D1D97
SHA-512:	D67F23E836BD6C9FABFB165CFE7680A9C5C8ED1C3844709D24241077A6512954CAFE8CEF380FDECEA67C386061B47F4A0FA1BABAA3EDEE6016EABAB6599B2C62
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/macfee.png
Preview:	RIFF....WEBPVP8L..../......7.mW...!#$BR..?W........m.q...!2..+p.B.23.....#.V....r.!..`...#.ik..{..m...M...}Pf4.e.ff...u..D...,...,,.,,.,.......B....C.C...G@@tm...._.......]M4v.......0P.y./.T..c..1.0..5.>l..."......+..0H..G...... .`$....,...(....9Lw.....S~...........l.{.KN.......M.}!~.-.lr....l.3..O./..4......O....?.'._-..~....G..8'...l>+.,.....%.Y1...2..........k..R/.l........#3.......~.{..m...<j..7....1._....B.K....AY6....H..%Bq.L.4E..9..R.C.B.L..Dd!3"........i?..z2...G.f..Q.:V...Z..{.o..76....... ......!...Z.#.8b.#..A .......W........ .) .0...u..}b<..US..(/..Z;..6......H.6..._..a....g.....3..... ....U...........Kh.57$...$.w.\..%.!..I."-........r...Wv.rW..m.m3.5......fsU+.".y&.._P..d;ID.'...m..H...{...E.....FI.^...x......5.Z..........K.}..??uf..../R..e}.y..~....W...?..N........./....N.{./.R....~.k._.4.m.-\..J./$.}........n.W.4'.N.W.r..b..v%.......[.c....u....7........%"...H.L..:4r..5].g!G...v0...l..sA......k.3+}.....'.~...5.>..h.c.!.j..5..

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	792
Entropy (8bit):	4.877222497768617
Encrypted:	false
SSDEEP:	12:t4kZW2eaxMoRy7dxVNkgaC6P5HM3PJDpTAZAwt4XeNjbecpvi4ONDjuI:t4kZbeaxMoRyrNf/dmadXwuXDjx
MD5:	68D84EB2CBFB1D606CB9C7735EBEC741
SHA1:	78E5A112511DAE6EE3E38D69B8AA88EA05857CA4
SHA-256:	B86E03FC766D8775DDF268BD79C75EFE25A26B3550633B92F0E4700B71BB1196
SHA-512:	303C623A83B00E0EBC6D1D78880C24CC4418B795F6EFD6AFE1CF169E7C67809E21682EE568553292520B9E6BC6023C639BE5D39F045EAE490C9CBDBCA4165B11
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_follow_wordpress.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g transform="translate(5.000000, 4.000000)" fill="#FFFFFF" fill-rule="nonzero">. <path d="M3.49737237,17 C1.56764264,17 0,18.5792844 0,20.5034275 C0,22.4386441 1.56764264,24 3.49737237,24 C5.43393393,24 7,22.4386441 7,20.5034275 C7,18.5787571 5.43393393,17 3.49737237,17 Z M0,9 L0,13.3544576 C2.83582316,13.3544576 5.50301506,14.4631789 7.51159056,16.4720548 C9.51743887,18.4759323 10.6251326,21.1541304 10.6251326,24 L15,24 C15,15.7282118 8.26884034,9 0,9 Z M0,0 L0,4.60224 C10.6864609,4.60224 19.3844861,13.3056 19.3844861,24 L24,24 C24,10.77024 13.2319081,0 0,0 Z"/>. </g>. </g>.</svg>.

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2818)
Category:	downloaded
Size (bytes):	3035
Entropy (8bit):	5.322442468526134
Encrypted:	false
SSDEEP:	48:NMhoj3dHrs4MuqwEOORj3dHrS3JL5nOHVXwdHr0aLhnOHRrdHjLMQO7F:6crs4MuqwMXrS3JLg1kr0aLIjjLMl7F
MD5:	ACCB9E3ACC914D2FF4CEE0503B395DCF
SHA1:	3F622E4BAECC39A2868BC46A13A8BDA75C9AB55D
SHA-256:	49F78F4A5B71952760520E3C96379827F9D3E64A9BE2D21820BEBB9F7205D5BB
SHA-512:	530F443944FE0AA8BA24C974FB69EA25EB84730667C19344FAC08635D8C12D4AE3085660E220963BFF3A5C78583AF01B96C9725D3DD91FD58F8CD6E914292AB9
Malicious:	false
URL:	https://www.wisecleaner.com/static/page/product/choose-product-discount/choose-product-discount.js
Preview:	$(document).ready(function(){$('.special_offer li .checkbox').on('click',function(){if($(this).parent('li').hasClass('cancel')){$(this).parent('li').removeClass('cancel')}else{$(this).parent('li').addClass('cancel')}.if($('.special_offer li').eq(1).hasClass('cancel')&&$('.special_offer li').eq(2).hasClass('cancel')){$('.special_offer li').eq(3).children('div').children('img').attr({'src':'/static/img/product/thanks-for-choosing/special_offer_box_365.png','alt':'Wise Care 365'}).parent('div').siblings('p').children('#all_price').html('$23.95').siblings('span').children('#del_price').html('$39.95').parent('span').parent('p').siblings('a').attr({'href':'https://store.wisecleaner.com/checkout/buy?merchant=TNGZI&src=thankpage&style=one-column5d48e5ee3d9ce&tpl=one-column&coupon=GFTCPA&prod=5540BE4794&qty=1'});$('#own_price span').html('$23.95');$('#wfh_price span').html('$29.95');$('#wdf_price span').html('$19.95');}else if(!$('.special_offer li').eq(1).hasClass('cancel')&&$('.special_offer

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	5.299667857987624
Encrypted:	false
SSDEEP:	192:JUzt9lyuvHcHEy7UshcWkQfqu1+u8Zlt3uQDiqxfN50bvXNwRR3:JUzngusFf+O7+96qFN6xuR3
MD5:	DF8528DB6019A020DF7257520FDA5234
SHA1:	A75C0F67AD8A1EF124C33B341C3F69C0ABDEE96F
SHA-256:	3EB4BF2421B07570F15833A40552D64B815E7F84995E149840627FE60BF017F6
SHA-512:	ED3A1088FB985C2C5D0032CBD4BD2DF829AF85CE9FDECE6C91866383B413BD5B96E548BAC38D52E966DC87A201768529A0371C0A40F904833452A8DA3757FC51
Malicious:	false
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W5..\8G.\8h.\8{.\8..\8~.\8l.\8O.Z7$.K...........................................................................................................................................N0..]9?.\8..]9.]9..\8..]9..]9..\8..]9..]9..]9..]9..]9.\8..]9Q.V4......................................................................................................................U4..^:a.]9.]9..]9..]9..]9..]9..]9..]9..]8..^9.._;..b<..d>..d>..b=..^9..]9.\8z.Z

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	320
Entropy (8bit):	7.14024162340253
Encrypted:	false
SSDEEP:	6:Ik5Zt3c5ItmpqNz++idUymDsdi6zH7gh9eINY8l07XvOb9pVTrn:I+3cUmpmzLfV6zHtiY7rO9vn
MD5:	56F3691BE05D9FD7094113664F5E5141
SHA1:	17F26370D850743C132D1C2E0566700F7A6C5F61
SHA-256:	2001EB88E65A089E95A27C4C26A825C51DDDBBBD757C8A86A0525E8830DF93B7
SHA-512:	64D5446014AFD6D84E43D03286D43DC6E0A171E59EFA753BBA9C4F8584B2357C06470BFA03C6E93B465CC11E1C2654A429EF952D77FDDF97553ADF00E60B6AD6
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/drw-win-icon_77.png
Preview:	RIFF8...WEBPVP8L,.../....g.m$G...1=.k.....6..?.1..$E....8...I.j;.."..ADB..........$.c...$v.t.b.IY$....-.`i.;."..t.....O. 9...c...6.b.X....... .......www.v2..._...^...O.O.._..=....^...rj<..>.G.%...v......,....}_M.....{_..Hn.r,.36W..t..t.p.U...{.>.uN!..73n.....I.s...y...v2..VGfG..}.E.I..GU^Z[.....g...X...(N

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	4.721060473572876
Encrypted:	false
SSDEEP:	24:t4zS8GeaxMQlMpxJgpHvHqsCCzDZWi+Y0VwlnRjia:jl8xJeHvHq0zstVcF
MD5:	F9FADA41AC3F5570BBBEAAC514388922
SHA1:	53FBA971F2F158D0F7D16326E148D6A7E346A988
SHA-256:	D09264F5F81841A9F74112C32D228CD01F0957E505BC53A7EC79487E9FC9793C
SHA-512:	3A64FD6C956BA4C10B8B2713BF25774956784D179117A1864A2DA73D7CA856439A80BAAE44181AB69F30D2C67AC955C9F528744B6C7791F59B070B816CD5BCE2
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_newsletter.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M7.71330084,13.9517336 L7.67742498,13.9194453 L13.9456573,8.68300306 L5.60379959,12.0474423 L2.23649027,9.00660343 C2.04143119,8.83035128 1.95837915,8.5615376 2.02002556,8.30597433 C2.08167197,8.05041106 2.27814486,7.84902377 2.53210746,7.78108364 L20.3624157,3.02394306 C20.6117291,2.95789547 20.8773095,3.03073684 21.0580425,3.21473429 C21.2387755,3.39873175 21.3068515,3.66557339 21.2363519,3.91366468 L16.4863865,20.4797072 C16.4182814,20.7179184 16.2321023,20.9041405 15.9939069,20.9723006 C15.7557114,21.0404607 15.499205,20.9809139 15.315398,20.8147878 L10.703196,16.6503166 L7.71330084,19.6394943 L7.71330084,13.9517336 Z" fill="#EFF0F2" fill-rule="nonzero"/>. </g>.</svg>.

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1648)
Category:	downloaded
Size (bytes):	325815
Entropy (8bit):	5.572332721548134
Encrypted:	false
SSDEEP:	6144:jP9LSvDsCwb2H2F24rn2HSH2F24rn2HaOelkSZ0LGlt9auPIVL+lQejq5Q85FnVt:hLSvAdb2H824rn2HSH824rn26Oelk7GE
MD5:	894CB0D707BE015FEF54157044F1E257
SHA1:	3301AE907D36859699C3A7F264E2888F3D0F79AF
SHA-256:	1C8CC3CEF0D65C2D9912B24F27BD2F42A79D10BE8E00439562A3984F90F05BDD
SHA-512:	9956C9BD634A19DC2668898FD68BE0BCCFDD15F2253682AD40E56B3B096F4B8C17CF3B34722A169D1C127176EA60BF342844ECB6A4BABD3DBA1117DBD24F8B4B
Malicious:	false
URL:	https://www.google.com/cse/static/element/8435450f13508ca1/cse_element__en.js?usqp=CAI%3D
Preview:	(function(){var g,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ja=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},ka=ja(this),ma=function(a,b){if(b)a:{var c=ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b=function(f,h){this.ls=f;ca(this,"description",{configurable:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.ls};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=functi

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 1, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.826296198764029
Encrypted:	false
SSDEEP:	3:yionv//thPlghJsmRMttpCLZlllgRSl0XM//Ylop:6v/lhP+tv/6RSuclp
MD5:	AB32284AD12B62CFE18E6FC3004DBD91
SHA1:	95C739EA1FFF8024B0728B882698F83289C9A429
SHA-256:	6C7884164B248CB8D87DE9EDF64DC810E5753BB8EC0CD015800D7F39E08371C1
SHA-512:	A25382D4601E2627D05F7A8E3BABB338A91AD0BDCCAFB509525D319CE2089C66C6B6768D423E67F8A0ED0ED74070354A8449CC82A37642A80239F340502428E5
Malicious:	false
Preview:	.PNG........IHDR...............y.....PLTE...................@t.....tRNS.."DU........IDAT..c.1....t....{\....IEND.B`.

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	137325
Entropy (8bit):	5.514404666887139
Encrypted:	false
SSDEEP:	3072:QI9yvDslNkwerQ/UhF9UDj3Fkk7r0ZPnV7GZ:l9y0krrBj/k2V7k
MD5:	B3C8FF778050732504E8C38AFB88BA43
SHA1:	46D8597F9FC8224F0E4AC7B7DA4E82A0E6A73C23
SHA-256:	CF9E74047105822AE7CCC3781B5766FC9D2130B7799E44A417B347F8D3528BC6
SHA-512:	04FA39F7D13F33444BDB4FE1561D471F96D4486CF39FF9B9D6861539F30893C883EACCAF112FADD8733FD15F54D3607BCD4B7A4AB06D8C207EC15C0B38070935
Malicious:	false
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3744), with no line terminators
Category:	downloaded
Size (bytes):	3744
Entropy (8bit):	4.913958271994527
Encrypted:	false
SSDEEP:	48:N1TfX7E3eyDJQiCBsG7Q7a7D7V7Pe7c37a7c3777c37bn7c37SY76747a7476M7J:LX/PBsKvnIPwOVgWu9owll
MD5:	A1175644F5E76D658B3A0E26BD91141C
SHA1:	E067C23CD18908D57135B2E7C69761BAC1367A4F
SHA-256:	AE7B51D12CF6AB33135614D1334B35D781B7A132AF8153A47C25E3FBDA0BF8A2
SHA-512:	2BDACA0F50FD01DE7C94122E57443E6E169C83AD411F6345193B468841A4E2056562DA62F5BB2E8B1C608BAA0D297A1A50AC468AE6E85BF161D877D19E38E76E
Malicious:	false
URL:	https://www.wisecleaner.com/static/css/reset.css
Preview:	body,button,dd,dl,dt,h1,h2,h3,h4,h5,h6,hr,input,li,ol,p,pre,td,textarea,th,ul{margin:0;padding:0;border:0;vertical-align:baseline;font-weight:400}body,html{-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:transparent;-webkit-font-smoothing:antialiased}body,button,input,select,textarea{outline:0;border-radius:0;background-color:#fff;color:#1f2238;font-size:14px;font-family:Roboto,tahoma,helvetica neue,sans-serif;line-height:1.5;-webkit-appearance:none}button{overflow:visible;text-transform:none;white-space:nowrap;cursor:pointer;-webkit-appearance:button}address,cite,dfn,em,i,var{font-style:normal}ol,ul{list-style:none}a{background:0;text-decoration:none;cursor:pointer;color:#09f}a:active,a:hover{outline:0;text-decoration:none}img,svg{border:0;vertical-align:middle;-ms-interpolation-mode:bicubic}table{border-collapse:collapse;border-spacing:0}hr{height:1px;border:0}input::-webkit-inner-spin-button,input::-webkit-outer-spin-button{-webkit-appearance:none}::-webkit-scrollbar{width

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2140
Entropy (8bit):	7.79722496931647
Encrypted:	false
SSDEEP:	48:o03CyPiyE9I+p5ihXRuFpldo5ElnkIieobU6hmMfWXEUbU:bUJuhXAp5lntiHw6hm4mEGU
MD5:	651A21F95788821BD1B8E70F03CE63FF
SHA1:	BFF7F9CE5B206AC536FBAB2A7AA1C21E48EFDA32
SHA-256:	14F5E040A550C134980E5589CEB46963316683B92388DB24905E28560F67EB54
SHA-512:	DDB9C365BA69D99AE369CCC2E9DDF3E62F316C63254D07545FD39EA59BAB38B4B6F09EFB8BC690512DF333C182BD70D31FA6F8C2DFE398E1FE3ACB2A467EF2DA
Malicious:	false
Preview:	.PNG........IHDR...<...<......")@....gAMA......a.....PLTE...!Wp...,..4..3..P..<..1..?..:..G..6..\..H..+../..2..2..:..F..,..+.....1..7..B...\|.Q..V..f..p..T..\..J..X..!..P..V..]..E..G..C..C..F..Q..4..)../..(......t.....c..T.......x..\..i.._..."...JuK.........`.................................................................+l........o....f..Z..\|..K..<........v........._..{.....h..[..G..B..Z..S.....y..Y..Z..[............k............r...f.{{z..........S.....9s.8u..6S.Fh.r.,...x.D..E..O..z..j..D..M...........MLK_^]K.....;..;..5..,..0..3..9..Z..a..T..D..:..4..0..6.... '..'e....(...}./..$.....9..J..B..9..0..4..3..1.....,..-..-..(..%..)..'..'..)..,..(..(..'..'..)....3.C)..,..-.....i.....'..&..)..,...9W.T..Hn,..0...i........]..e.0...r.&..(....&..'..*..,...........<;;......................]......tRNS.....#:,K`:r.OFh.....u.........................................~..........................................................................^............~..............

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.413909765557392
Encrypted:	false
SSDEEP:	3:HCNCkuDKth9Erjn:QuqbQ
MD5:	6550FB86698C0F28E3027DBF12FB1FC5
SHA1:	A76E5B664EEFDCB27C0D3633E25213D7EB63DC4D
SHA-256:	2464FDF0D393B2D5034BFAECA2AC1B5B1994BC3D6A3B08BF37E86F5F5FB6723C
SHA-512:	59D49D63CF6812BBABF10B351B461F776C1CF99B883392B8939885DCC9532E8772D0C5D8F7C0C9AEF809AABABF6BA03CE0CF4B5EB8E6A56DC6AF600FF698ED86
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmBn5R2atxQFxIFDWdns_4SEAkhBotPWeT8SxIFDZP3Fhk=?alt=proto
Preview:	CgkKBw1nZ7P+GgAKCQoHDZP3FhkaAA==

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10455), with no line terminators
Category:	downloaded
Size (bytes):	10455
Entropy (8bit):	5.030374580727381
Encrypted:	false
SSDEEP:	192:wiTPfWv8j8QSNsf39lWNM1DlI6or/9W3fhfCoi59PZ0XWEI0KPW5KWL:wiTnWv08hk0/6or/9W3fhfCoi59PZQWE
MD5:	E774DD1EA43D29FE532976A0F77FF14F
SHA1:	C89B48737755573419ACBE5CE3CC0A9E4329A3C1
SHA-256:	0A71D26D8701CD4CF6B646A7498DF97E0ED0E3FFB0792E85866AD243F205721B
SHA-512:	800F73F4C997A163338CA73CF4BA276013BC12F7777BB5E787C609285C5E9206D3752B68F2A03FA2F8305C1EB01C42CF5184C12809648FD30326B36228B32509
Malicious:	false
URL:	https://www.wisecleaner.com/static/page/product/update/update.css
Preview:	#head{background:#ebf8ff}#head h1{font-size:32px;color:#327ca5;font-weight:400;text-align:center;line-height:100px}.icon{float:left;background-image:url(/static/img/product/update/icon.png);background-repeat:no-repeat}.container-view{width:1000px;margin:0 auto;zoom:1;vertical-align:top;padding-bottom:20px}.container-view h2{width:100%;padding:40px 0;text-align:center;font-size:20px;font-weight:700}.container-view h2 span{color:#ff790c}.container-view .title{width:100%;height:100px;text-align:center}.container-view .title li{float:left;height:100px}.container-view .title li strong{display:block;line-height:40px;font-weight:700}.container-view .title .wc365,.container-view .title .wfh_free,.container-view .title .wdc_free,.container-view .title .wdf_free,.container-view .title .wdr_free{width:380px}.container-view .title .wc365_pro,.container-view .title .wc365_free,.container-view .title .wfh,.container-view .title .wdc,.container-view .title .wdf,.container-view .title .wdr{width:310px

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 360, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4641
Entropy (8bit):	7.9437118746811395
Encrypted:	false
SSDEEP:	96:lntUENTw79msHB4CfwjzSeJw1HZrhg1kE+ZX2yU/4jsToUQ:DUmc0fCfwjeemVZ610XVg4sc
MD5:	DAB664199A5DBD8EA4BA4515603F076E
SHA1:	C88C80F68DDA0C1A24F768AFE59D122C22AC9048
SHA-256:	41E4031D0620CEBD6FFD6EE7BF6BE657CC3F665BB495B9D9EAE6C1E9B3525C72
SHA-512:	1E24EE7F570CA361AF8FC8D6F8DA41AD187EE9E7D2E130DDF9E551CB6B19E6B0C3F3854D469C6AA4B349C5B0F0D2F328AFDAE4431EEC03A20F32A15CCF11B541
Malicious:	false
Preview:	.PNG........IHDR...2...h.....".X.....PLTE................................."..C...........;Y.<Z.:X.;X.y..:Y.[...............Fc.?\..................[t..........<Y.....xk.>+.?+.=+.>+.>,.=+.?+.>.>,..D1.]L.M;....bS.G5.~r........y.........th.......UD.......@-Rm..Q?`x...............lc..........................................................\[.QP.....&".($.)%.%.+&.,'.($.$!.!..! .......;;.ED............................68.NJ.').\|~.PO. #.ik......,/...36.DF...WW.eh...{.xv..0-.XU...............................c^........+,..=8.......C@....41.yy.......................)............ZY........-.....UC.........p.....L..Mh....]..v.....T...........M..>.......S.............d.....P..j........~....8.....0....................+..h....t.....4....X..K..L..M..L..M.........>.....tRNS.@..f....IDATx....n.@...s.1af..R6...t[5i\4.%...._.Pk.&6_....xx.2..F.aY.......G..%;.G......0.y.K...g....!.~m...R\|S..u^.v..A;....`.$.IR.q2S...U.~.-.lb.....L..yN>..R.L......

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7884), with no line terminators
Category:	downloaded
Size (bytes):	7884
Entropy (8bit):	5.0998127410555885
Encrypted:	false
SSDEEP:	96:D6lTNLh4bLRaHHSekaXWuJB6YvJnfI6GPX5ELjFeF6yM+Hm+/:DF/8HHSekwWSFK6G/5ELMF63+HD/
MD5:	FDF02DD038ED38DBF3C240D56262AF0C
SHA1:	9C38EDFD3642747DB836A3A1F3A41328611D48B5
SHA-256:	426E16D014775C77916610F675F58880874C645817ED26D01873DDE3466E6007
SHA-512:	62EC1B51CEE4CD4F2CCE283A2EC2065C04208F60EA6E4A423839AA37FBD5768F9FE5A3A5959508C757CD679BECBE4A77305A05E6276E90A4F282FEDA4699B53A
Malicious:	false
URL:	https://platform.twitter.com/js/button.856debeac157d9669cf51e73a08fbc93.js
Preview:	(window.__twttrll=window.__twttrll\|\|[]).push([[2],{160:function(t,e,n){var r=n(39),a=n(162),s=n(7);(r=Object.create(r)).build=s(r.build,null,a),t.exports=r},161:function(t,e,n){var r=n(71),a=n(37),s=n(34),i=n(38),o=n(0),u=n(7),c=n(33),l=n(5),h=n(165);t.exports=function(t){t.params({partner:{fallback:u(c.val,c,"partner")}}),t.define("scribeItems",function(){return{}}),t.define("scribeNamespace",function(){return{client:"tfw"}}),t.define("scribeData",function(){return{widget_origin:i.rootDocumentLocation(),widget_frame:i.isFramed()&&i.currentDocumentLocation(),widget_partner:this.params.partner,widget_site_screen_name:h(c.val("site")),widget_site_user_id:l.asNumber(c.val("site:id")),widget_creator_screen_name:h(c.val("creator")),widget_creator_user_id:l.asNumber(c.val("creator:id"))}}),t.define("scribe",function(t,e,n){var a=this;return s.getHorizonSettings().then(function(s){var i={session_id:s.sessionId};t=o.aug(a.scribeNamespace(),t\|\|{}),e=o.aug(a.scribeData(),e\|\|{}),r.clientEvent(t,e

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1003), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	32155
Entropy (8bit):	5.058574825202085
Encrypted:	false
SSDEEP:	768:PIQn6fu5Sy1QGty3QI7QSg4UOquw0fovDtdfcNjn:PIQyu5Sy15w3B7nh9bf4DtdfcNjn
MD5:	538AA78A99B184D5470CC6D19BCE899A
SHA1:	08A996948887945761A58E714C5F2A227E108917
SHA-256:	A358E6BEE2EE59A4661E22A2E9D344093501C6C9E5771EA5F3F394DF61285D07
SHA-512:	B8D76FCC5EC7698E01EAFBDDFBD1725EE87343703D981295F3E49458DC3FB5751AFDD8F16AC6A5973083100F2882F01EBCA6E121C6DC93A5479F0AC8946642FA
Malicious:	false
URL:	https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge,Chrome=1">.<meta name="viewport" content="width=device-width,height=device-height,initial-scale=1.0,maximum-scale=1.0,minimum-scale=1.0"><title>Thanks for choosing Wise Care 365! - WiseCleaner</title><meta name="description" content="WiseCleaner is the better choice to speed up your slow computer, making your PC run faster, freeing up more disk space, and protecting your privacy." /><meta name="keywords" content="thank you, how to use, newsletter, award, online help, video tutorial" /><link rel="shortcut icon" href="/favicon.ico"><link rel="stylesheet" href="/static/css/reset.css" /><link rel="stylesheet" href="/static/css/layout.css?v=1.24" /><link rel="stylesheet" href="/static/css/layout-mobile.css?v=1.08" /><link rel="stylesheet" href="/static/css/roboto.css?v=1.07" /><link rel="stylesheet" href="/static/page/product/update/

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	258173
Entropy (8bit):	4.839857929826942
Encrypted:	false
SSDEEP:	3072:ty/t+fl93kSyzFiBBUbM7SI/VFLYd+dhLhRNPmdJe0ksa7O70rUUrDVBX0ekJG3l:E0K4BsEnjf7O7oFrghJG3UB4
MD5:	327FFCC050307627C7DE1C5573E54913
SHA1:	961DEBA0AA58564D08C2457438D9375770FE61DE
SHA-256:	35196923692F06F97491CAF22422CCE4B612D5EF07C51842CA94A088B15456E2
SHA-512:	4C89858D6E51FA04426A90DC0A8F47D1CB5FECBC7FC3C760B9D094B75540CE217009E8568C83AC00E772CB79C3DC660B1CBB9040737349168A1E1B14EBB575B7
Malicious:	false
URL:	https://www.youtube.com/s/subscriptions/subscribe_embed/js/www-subscribe-embed_v0.js
Preview:	(function() { /.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0. /.var m;.function aa(a) {. var b = 0;. return function() {. return b < a.length ? {done: !1, value: a[b++]} : {done: !0}. }.}.var ba = 'function' == typeof Object.defineProperties ?. Object.defineProperty :. function(a, b, c) {. if (a == Array.prototype \|\| a == Object.prototype) return a;. a[b] = c.value;. return a. };.function ca(a) {. a = [. 'object' == typeof globalThis && globalThis, a,. 'object' == typeof window && window, 'object' == typeof self && self,. 'object' == typeof global && global. ];. for (var b = 0; b < a.length; ++b) {. var c = a[b];. if (c && c.Math == Math) return c. }. throw Error('Cannot find global object');.}.var da = ca(this);.function r(a, b) {. if (b). a: {. for (var c = da, d = a.split('.'), e = 0; e < d.length - 1; e++) {. var f = d[e];. if (!(f in c)) break a;. c = c[f].

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 158 x 110, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	8389
Entropy (8bit):	7.923595047245717
Encrypted:	false
SSDEEP:	192:FErq4ijDN7p8ElbuGG5+6QLAFUOGKKBtNNnmABQZWLyfeI3xE:FaRiDxgGG+6scUOEBxnmAB8WLyfeI3q
MD5:	28E71EA995CAA0AA7EB169F1A66DA9B1
SHA1:	5110AFE532A26EE7050EF153F5569348C5898CE3
SHA-256:	D8E3A7FC4165D0890E7FD8412A60167EDA13E685DD352C4978E2135B58D91717
SHA-512:	E70BE34E3D79C3FAF3164259FDDEC7F6B88E6F04E701B5E50116F9FEC858646EE38123B744861746DEA954A43EFF754A1A9DC937128D53B5987D66A0FA3E448C
Malicious:	false
Preview:	.PNG........IHDR.......n.......ZP....PLTE........................C.....x..f..Z..S..H..2..?..$}.(...3X.].#p..^.$d.#^..X.._..d..h..o..x..v.$h.'^.'Y.'V..O..I..B.%q.1{.`..A..N.................................................{..p..e..`..T..I..@..8..2..,.. ...d.......W..R..Y.....#.)K.<l.O..V. c.....................................................................#b.%d.....Q..J.......t..Y........-..P.-..i..=Xx..K.;]}U1%.Q..J..=x.S..[..b..f..l..p..s..v..y..~................'..?..<..9..6..3../..,....'\|.{.$s.#l.!g.!k.!m.!p."s.$u.$w.%y.'}.-..,~..t..n..p.E...a.<..R..^..I..n..........S.5i.Fp.Q}......X..q..9y.-s.>..W..f..N...^..f..c..`..^..Y..T..0.....A.....b..a..g..k.ac._.W..<..'.zs......oc.>X+$(@@@ggfooo...RRRuvw..................]]]......{\|}...............................................C.....tRNS....................QrJ....................................................\|.....`F5$..Ji{..rX?&...............................................................................

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	760
Entropy (8bit):	7.71420514334146
Encrypted:	false
SSDEEP:	12:A5sExUkdBwWqrXFWswrsarX33v/5a3Nby/K9v0YC6qml0mEnqTUFbhNcNNoBIVlA:Sx9nw58zsa7nv/Mxz9sxmtEnnbc7RK
MD5:	AEED13B2B0EC7D157A4FD1E500FC3A87
SHA1:	1A804EACECD18798AE9D98AEE99E9B4FDACE4270
SHA-256:	23D67E7A85D53F696290EBCC8EB2B9E2416CDB8E2E47CB216647E144EBEBC13F
SHA-512:	5092D4711C5E89E0FD4F3ADCD405E4C9F0163507FB16BA36DE5F6238187CACDF69DDE43338832A186FC69036311CECF9DB8E62BC1816569703A7365BA02415B7
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/thanks-for-choosing/sign.png
Preview:	RIFF....WEBPVP8L..../&.6.G.$.$..k<...}.Y...Q.......( (j..2..G4${.."IR.......<....c..78 .#.2`.8..p.(p...\..........p..5>.\|..@.8.....a..a.............#!...!..a$.A.....;......+.....m[3$.j.m.m........._3+..."...$E..mh!a....'.t..:7lC...R...4.......z..9..E..uV.q.-.z...\f.....u...NY7&X&.....FD..<.......A,1.1.....3...b.A.i..N.A.l0.{.).....u.r..%Tg...V.B...&.....s..m...5D.'lB.."..4.....~..AvVg.gC{....8.....a..h..({...........<[orWc....cNS{...]2.w?.97~...w..3....~..:o'. ..f.b<.+..f@t.[.9..Y.eL..d...dj...<.m..z]..&FA...P..y.[.o........;.F.......2D..M.....'.r....C^".5C5.$T......u.N...............Lm.....u.;.4}.......Sn?..........?O...........=. ......V}X/.:....R......6..`.h.kc.9..!Dm....m...^U...u!......',.....n....56...t..

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 1, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	116
Entropy (8bit):	4.826296198764029
Encrypted:	false
SSDEEP:	3:yionv//thPlghJsmRMttpCLZlllgRSl0XM//Ylop:6v/lhP+tv/6RSuclp
MD5:	AB32284AD12B62CFE18E6FC3004DBD91
SHA1:	95C739EA1FFF8024B0728B882698F83289C9A429
SHA-256:	6C7884164B248CB8D87DE9EDF64DC810E5753BB8EC0CD015800D7F39E08371C1
SHA-512:	A25382D4601E2627D05F7A8E3BABB338A91AD0BDCCAFB509525D319CE2089C66C6B6768D423E67F8A0ED0ED74070354A8449CC82A37642A80239F340502428E5
Malicious:	false
URL:	https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropR_3.png
Preview:	.PNG........IHDR...............y.....PLTE...................@t.....tRNS.."DU........IDAT..c.1....t....{\....IEND.B`.

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (24918)
Category:	downloaded
Size (bytes):	37658
Entropy (8bit):	5.348573447849343
Encrypted:	false
SSDEEP:	768:dyUg+ofnICvzjj2g1RuET6Zcm9SBiRreN5rSOIp:dNjofnhzdKETucmaC4op
MD5:	BF4801052EFB5F8F12057C849E9B590F
SHA1:	73CB1586D73EC8D55AE47F2ACFC8714C56CE03B7
SHA-256:	C36E9BB2E913500763AA0F62AC2C2990247D78660B55DCCFF382A3B7E6DD5B8E
SHA-512:	D677CBF7EDB3FC9BC9E354491CDEF6C3EB82C13A601531505746D79D66427DC12433FD334747E99923B336DBA1CBAD9A35DBBD141EB675F7F297F35D71692712
Malicious:	false
URL:	https://platform.twitter.com/widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html
Preview:	<!DOCTYPE html>.<html data-scribe="page:button">.<head>. <meta charset="utf-8">. <title>X Follow Button</title>. <base target="_blank">. <link rel="dns-prefetch" href="//twitter.com">. <link rel="profile" href="http://microformats.org/profile/hcard">. <style type="text/css">html{margin:0;padding:0;font:normal normal normal 12px/18px 'Helvetica Neue',Arial,sans-serif;color:#333;-webkit-user-select:none;-ms-user-select:none;-moz-user-select:none;user-select:none}body{margin:0;padding:0;background:0 0}a{outline:0;text-decoration:none}body.rtl{direction:rtl}#widget{display:inline-block;white-space:nowrap;overflow:hidden;text-align:left}#count,.btn,.btn .label,.btn-o,.count-o{display:inline-block;vertical-align:top;zoom:1}.btn-o{max-width:100%}.btn{position:relative;height:20px;box-sizing:border-box;padding:1px 12px 1px 12px;background-color:#000;color:#fff;border-radius:9999px;font-weight:500;cursor:pointer}.rtl .btn{padding:1px 12px 1px 12px}.btn:active,.btn:focus,.btn:hover{backgro

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.450267384685166
Encrypted:	false
SSDEEP:	3:CUEJfh/:iX/
MD5:	F6815F3311F2AD7BACB9C9156B5151BB
SHA1:	4042DFD5B2A00AF6857ACF15E63DC0672592E7D6
SHA-256:	C8DE81A1ACB5F3788959ECC04EAA6526D5BDB29991157CECBEF71042268C0374
SHA-512:	57A7373DB5CBB195675D11A2930A8C43A7366F8D6D89A430D3165DAA9D1AF09F7AC432A0EDF52BBEF34BE7B5A3FC3B81A9F7812F56E5706CF6FCACFFB7017F78
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11641
Entropy (8bit):	7.970062614684475
Encrypted:	false
SSDEEP:	192:E5PH8+KAcxYcOhAlS53XpSdYvCJ8LNgONW7/oea9Jlt1glebWsPOixYdH1F:E5/8+KZKcOWEtXpiYvCJavW709J31g4I
MD5:	3D05E883CBD84315ECC4F84EE624D15D
SHA1:	DDFC8F03BB23CA7197003029D1DA58B744FF6A34
SHA-256:	7304E1119C0FB43A70DF9D94C79AC590FA11BC400948B10C28B52F11C5E6EB00
SHA-512:	973FEDF1F21F875524833E03FB1E0CDB3CBBAD32A11ABBABF9A74948CC984CD3D105FCC17EF3DC04D03ECB71E63664DA1FF6219B2D6562D127EF252AED769B0F
Malicious:	false
Preview:	.PNG........IHDR...d...n......y.2..-@IDATx..Y.L...~.s..E.WD.{..Q...Z.].]c.tmf..QgS....nZ.....X.R.2Y....j..EAEE."L.#...9..p.{.7......B.-}...;.....yo...t4a..P...W.e.......t.....FV.....4Z,....7.!<..Pl...#Lm0.$...[...QQQ .K....^..4.N....R.oS]G.....4.....t.......\...".n.&...............PQ.=i..Z:K..g#k..\|&.....V...2..<..a(--.b!...g...:.@.b24B.A $.27$i^..z......\|M...DZ-.U.(.h...M~Su...F.....o(...'.......U.>.^3::.....omC.ap..3P..\|....Lg.Q.VG}U.w..z....`.7.L&{.....e~.P.\|..x...p.....>...........NB.....z..U.$..u.t]........3.aK..P..]#......o\|.Is..,$..".\D.A>.D...t0!....1:.....m...&..H......&.I..........J...V...c.\.ruco..e.;..d..l......T.s.M.hm..)...H.........!d....q..a2.U..8...4..5..:..&.........dP...lT..f......]-..i....u..P.?..PT^..3VL....H.)^..u..&......s....w..........>......l.k;}.4...0z.h._.y..Z..B..[.......} ...`...;....,E.........,.+.{hw.........1{.^K.#B..........._....>\|...Gbb..QSS.m90..9s.....gr...]...&N,....k.%.\|8.V..u.... i.."..2.:.....n...@D."t>.

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (56043)
Category:	downloaded
Size (bytes):	327164
Entropy (8bit):	5.5061054495525745
Encrypted:	false
SSDEEP:	3072:zcLShNRXSBeNN9dDon/kyvRweEXMV6AxBUjqN3Lj1TKid0bGpLsev6nsRs2hW/:W8N9+/k4fMqz9GCNvmszU
MD5:	81267302EFDFB3E4524A22631A8FC99E
SHA1:	EFB274E7D019D5F3CDBEE88D317F46FE45BC91EE
SHA-256:	70C00445D6632039ED99AF760731DAF3BF60EB12061863EE61E2CD7276A54D18
SHA-512:	D378A12E5465E2DEFBBB794D1F5CA287D8A9B31E16482F782DC6C53D9F6CB4600B8B2ADCAAC0CCF963AA06B42569C8119E16987F59FB052B4AB1254784ED5EF0
Malicious:	false
URL:	https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.wisecleaner.com
Preview:	<!DOCTYPE HTML>.<meta chartset="utf-8">.<title>Twitter Widget Iframe</title>.<body>.<script type="text/javascript">!function(){Function&&Function.prototype&&Function.prototype.bind&&(/(MSIE ([6789]\|10\|11))\|Trident/.test(navigator.userAgent)\|\|function(e){var t={};function r(n){if(t[n])return t[n].exports;var i=t[n]={i:n,l:!1,exports:{}};return e[n].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)r.d(n,i,function(t){return e[t]}.bind(null,i));return n},r.n=function(e){var t=e&&e.__esModule?functi

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 58, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3015
Entropy (8bit):	7.9000460707913
Encrypted:	false
SSDEEP:	48:T000000rIJmCtc+7slRE+qM4urcla5zarYcQSVmCsuM0dlAKMcGh9Z5tH9NR33Iy:T000000rCC+7sE+qM4urclWarYcfV2uc
MD5:	B5263362121A14D6D3FE5C3A47A07E0D
SHA1:	43C657170A0A7B5CFE3095CE5FB945F622B974F9
SHA-256:	0BC0BEF0F92FBB189FB4231D3E522B8F726C675DB0262EF7564F83D60100719F
SHA-512:	20CD97405BC873CD12C6C62C7FB7C3541A771454887D13B69F99FC56D6313D630397153095083AAD2F3ED7E732812587EAEB51E168C6D0EAC82C5ABB2A871056
Malicious:	false
Preview:	.PNG........IHDR.......:.......:...}PLTEV.....V..V..V..V..V..V..V..V..V.....>..M..B..T..Y..9..P..D..G..R.....J..X.....5..g..a.....R..y..l....:................0.....G..^.............@..M........>.......q..........}...........D....(..........u...........+.....-.........J............. .........p..s..x..6........a..5.....F..-......^..d..i......}..v..n..g..X...%..c.......%.......N........Ms........s..4.v......tRNS....gR0....=....IDATh...n.@...=.............v.E...dYr....U..6..Vm.......9.....n....S.V.~\|K........J.Z.K-..^-.+.w.y.f.3.j>.}.W..=...2.t...f.gA...t@Y.$..g........c...j...0B.K.+......1.......Y.^.]A_.....I....Ve.K.3>..;.....o.+..B)R..............#`? .=M..W.k..vV...mW..&.....l0......j..xV..:...$.....8<.......C.6......?=...w>..<.......>O.s}`..R.....n........Yv.#F.=.U.b8.p....S...)P'h.(..8.B.d.}y.\."..'s......9....e..t.C.8.\.........q.1..+..........y.......d..Kq....E[.U...9oo3..h.Y.T..FwR.>:..f.6.%.6>W..k!"-i..4N.../WH...p ..d.#.#.aKf

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6743
Entropy (8bit):	4.711106725010904
Encrypted:	false
SSDEEP:	96:+AGp4I+WJModSit4IZL79tC7lodsdo+p9M2YEta4e2JysrMVtzo87l+khjh5:F10JMaSwVdsdBRtU2Isotz1II
MD5:	1DBEB2968794A3866A29758B7D68A58D
SHA1:	D6BEC65E6B534730DBCE281C5305C2EC59778479
SHA-256:	AC17EC27C418443E01E16ACC97E25940616F131E94D95F0CE3A404C5D5B619CC
SHA-512:	01B4D96F29122E013CB785C6921507F5B98DFB596C30D1ACD97473E17B8C6764A6EC0BB9FF8CE0C99C201828F27968E7AED2103BE470780A7CF2661246FEEE97
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1024 200.01"><defs><style>.a{fill:#3d62bb;}.b,.e{fill-rule:evenodd;}.b{fill:url(#a);}.c{fill:none;stroke:#144ab3;stroke-width:3px;}.d{fill:#fafafa;}.e{fill:url(#b);}</style><linearGradient id="a" x1="-25.76" y1="-2214.88" x2="250.39" y2="-2443.35" gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.21" stop-color="#6ca2df"/><stop offset="0.4" stop-color="#3a5eb8"/><stop offset="0.7" stop-color="#3d62bb"/><stop offset="1" stop-color="#5988d0"/></linearGradient><linearGradient id="b" x1="10.45" y1="-2104.4" x2="159.1" y2="-2435.68" gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.77" stop-color="#fff" stop-opacity="0"/><stop offset="0.85" stop-color="#fff" stop-opacity="0.01"/><stop offset="0.87" stop-color="#fff" stop-opacity="0.03"/><stop offset="0.89" stop-color="#fff" stop-opacity="0.08"/><st

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2744
Entropy (8bit):	7.9166042688442735
Encrypted:	false
SSDEEP:	48:JsIoUoP8aRX/KYU3CiZjhPtx7MOx/7ny6k9klTJQ38lIsviJAhrVP:3voPLRXiYliZjhlx7Jby6fQsl5vthrx
MD5:	09BFA7F8E5C186D91E5CD510449C7D38
SHA1:	CB5DBFE5FD2521CBF26004583F392649C3A06D74
SHA-256:	DDD938CA8277A297622865943A27B1989FD52897289CEF6954C6DF1593E320C2
SHA-512:	ACA400A4DE336BCA036C45D22863ECB0A456B147FCC878A06C8EBD1FF57FA833E280B54C915F624D54A5FF2630CEE4C389C4D1B63A2CF07FD80BFA34CEFFC587
Malicious:	false
URL:	https://www.wisecleaner.com/images/awards/softonic_w365_4.5stars.png
Preview:	RIFF....WEBPVP8L..../.@.... .$E.y.O._..w......P...vd...Or...*...[..A.D...7....E..(.,.1.....9..!!."..V$BH..LP.,!`.B2...B@..).H..LP......L...L...#.U..x...#....&...H.......).L.....a[.,jL.:.:..v....dMeM.a.M.......,T..u1eQEX5.S.u]LYMU,..n.....gQ......t......:m.U!4.B7.....}.....^7<.G.KwY.N..y..>.8........l...yRm....&.....RiK.m..#M.dK....O.......O..m.V..s6[..C.c ..4@ .R]V%)d.....]s.......zy.@_~..~.......ot.....K...Z..B..K.'].?.\:.^.-3;.....OH.".%.q....Y]..tY.(&.5q.3....R.FO.........6.~`.R(.50..kW..9ge.4..R_\....{u.+.J-%Im.........).w..MI.0+A....O^~?.....\|..%.t2..DY........./.....\|..seo1.E.Z.CE..6.2._ .W.+..S......~3e....$,...:..#UM1p....{.#.g.....~........J.D>... c.....w..'.@[........V...a$.D...=E].../.+.......2..]..!)O...Ty.,..K.M.j!.c.T8.D.y..V.DD.."...3s)Hhf.N.2}.?....<.R.9v..^...s!..#...9o.7(\...=.n.!K^....=[.s..=....c..U.l.H..y.........(6.....5.(M2....N.....N..7wO...&G=."..n.. .$....(5.....[5.`..`..l...3.!.F......T....`....)...B.Iy...!....$2.......6

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4495
Entropy (8bit):	4.948267052980108
Encrypted:	false
SSDEEP:	48:jeePUJMC95SxaO5Sx5QGascw6sU99YENvWoGmuwY6kcPhsMPoBAijzln0TqfTlhL:7LyC7C5CsKNuof3PhsMPBijZnHfRUXM
MD5:	C14E45E189F801818B14F1315605A632
SHA1:	DD7E7FB9D156B343BEEF0155B41DA1C847D69E41
SHA-256:	DCEC22BBCB68119D6C7D6D5E088FB82183A9826D0C9E3403F1386FD837F06A89
SHA-512:	7312D1E49927990CD81CD62C953AC7566C85007350250403ABE3A2A9635AFA516B3511E85477DD5189741FCCB7D0200C8DD24074AAD9938E5D4484BBDEEE59AC
Malicious:	false
URL:	https://www.google.com/cse/static/style/look/v4/default.css
Preview:	/*. Default Theme, v4.. . /../* Selector for entire element. /..gsc-control-cse {. background-color: #fff;. border: 1px solid #fff;.}...gsc-control-cse .gsc-table-result {. width: auto;.}...gsc-resultsHeader {. border: block;.}../ Search input /..gsc-input {. font-size: 16px;.}../ Hide clear input X added by MSIE. /..gsc-input::-ms-clear {. display: none;. height: 0;. width: 0;.}...gsc-input-box {. border: 1px solid #dfe1e5;. background: #fff;.}...gsc-search-box .gsc-input>input:focus,..gsc-input-box-focus {. border: 1px solid #4d90fe;. box-shadow: inset 0 1px 2px rgba(0, 0, 0, .3);. outline: none;.}../ Search button */..gsc-search-button-v2 {. font-size: 0;. padding: 6px 27px;. width: auto;. vertical-align: middle;.. border: 1px solid #666;. border-radius: 2px;.. border-color: #3079ed;. background-color: #4d90fe;. background-image: linear-gradient(top, #4d90fe, #4787ed);.}...gsc-search-button-v2:hover {. border-color: #2f5bb7;. background-color: #357

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	553
Entropy (8bit):	4.933065619223014
Encrypted:	false
SSDEEP:	12:tc5glRRNlfGqV3QLOSkyqF7BliBl07VAcBn7VAKDBez7VAhD:tc6Nlfl3Q9nqNjcCA6AvAhD
MD5:	5A5D3A87F03241E552EEED36FDA5B202
SHA1:	51F344C27C6F5DA22C6F5360BA39771738BDBBD7
SHA-256:	DE5204EC70199C02EC0D0DAF0E4BFF8702EBFCB899F8C768E1C6EBFCFB1828FD
SHA-512:	5AE753E869805A27BB26A0D2D01C215873214E904B3162475EA99C9C7D095854F7AF15E64F1C813B536B9E13C502588E8ED86963913FC70B9567F45E65160A28
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/common/icon_russia.svg
Preview:	<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.051534 1017.717791h1519.038037V7.53865H10.051534v1010.179141z m1521.55092 2.512884v-3.769325 3.769325zM3.769325 1024V0h1531.602454V1022.743558H3.769325z" fill="#353636"></path><path d="M6.282209 680.991411h1525.320245v339.239264H6.282209z" fill="#E51F1F"></path><path d="M6.282209 343.008589h1525.320245v339.239264H6.282209z" fill="#232B8C"></path><path d="M6.282209 3.769325h1525.320245v339.239264H6.282209z" fill="#FFFFFF"></path></svg>.

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3073
Entropy (8bit):	7.067390752497791
Encrypted:	false
SSDEEP:	48:7OscFUkLSGWnjHl9WeUgo4TkfG76vIG7HhgRkrfCXKPTLHX+ZrE0HdiCp:773nLb5No4Tk9I8aX1ZoCp
MD5:	48CE86C10EB16D4B0242BC18DDD7909E
SHA1:	45C6C00DC657CD22ACFC78F497CCCA17FB506953
SHA-256:	F1EC316F3DC1581008DB9D455D32D9B9C76418A14B40D39BE86187101DE53F23
SHA-512:	CD87877BB430899D447D7902CA62E736215D9755316548B9BDA7DADA690DB048DDBB22D1DD9B2A9A603BB01ABB342F3FBC30EDE410CDBDB46E8253E500BDC8DF
Malicious:	false
Preview:	.PNG........IHDR.......d.....c.(.....gAMA......a.....PLTE................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................I;.....tRNS.......U"f.D...l..O.%.\|.....)...c..C..H..#.m[...z....0..<@.BSu...g....\|+..t.=.'...6 !...VYR..t..Ex..P..a.GL...........nxp..M.4e.;Z4....ep..k...RG..L.E...Vv.=>

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2040
Entropy (8bit):	7.886689789494122
Encrypted:	false
SSDEEP:	48:nN6tfkvL/KPYKVrtEQT8Kxrb0Ci7tMJGHSpOxm/CXVdYanv0PhFp0d:nN+fkvLc9t2S4qCn7eXpy
MD5:	FFEE1904D60A4CAD9844A916155B7E40
SHA1:	11EF561DF991A96B0AED99BBCCD4405F647D4E15
SHA-256:	6E19BFE18C629FF6DD680847ABD8831AA442DE4AFA201CC4A2CA1E4E4286C2F4
SHA-512:	1BE0834D8E37B24DE5FF2D00B0BA25C9DB03511E89C36C80D652AA758B18371246227FACE99B3F2FD11D3B4500B2B8FCC8BFCF278721F7156BD44A1BACEA3842
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/product/products_icon/wdc-60.png
Preview:	RIFF....WEBPVP8L..../;.....9.$ERVs.1.@'>KpvO...,5...Z..\..B......h.A..W..^[o...H.jN....d.......&........m..mc..!...A...`.f.c_....@..x............(..8.......x!.\..0vT..9..J.t4.....dl...+P.B.+..t.#..H....#..(.......t..+..-C:..R..et56...O...V-6.._...F}...R.9@.J.....#UD.W....0.BWd.\|.m.".c.].T.e.kQ;....J)..w.>.D......8....@.K`p.Y.b........Si.:.j...::..(..g.......aS.....i:.,..R.1$.YJ"..N.n........S.k.t..Tc.{..h....{.....1....o......-.q.Y.1[F.....W..Z..Y.2:..=..n....e.w...^j.Q`s.k....T...l.C(......n}]....K.=d@h.D..h)II,.BTU&F%1aV....AC..W..^'.......dP.YIR+H.Y[....O...$(K....u.....X.....f.c./.C...#.K...K..U0u...X.+G....._.#.........~CB..\.I.o..o..n.9yX.....n.\.X...k....XH.vw..Nr}..........q....r...7..l.[u..[...m.m...Iw.}.G._D.' ......c.u..........2b8..S....;..&....r^.^6m.x.cFL.9....k...]..P\|.....O$9..N..@...k.....X.K.L.Lr........w.g....................+..9T....]c..UK......f...H.?A...z......U.s./Z.....-...A.. ........F..K.-/?p...8/......Kb0..b

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	538
Entropy (8bit):	4.9546273514495365
Encrypted:	false
SSDEEP:	12:tcjRRNlfGqPT8EIkbLODvTjBliBTlo7OBT8o7MDBTOAo7kW:tczNlffTakbW/jXUfkW
MD5:	963F507DC4B2BB67E10668EF0B78E964
SHA1:	909C87B19C10FEB2EE54908B415F1DCE0E13F543
SHA-256:	C3D1C2132B5286E078153F8350D249D788D8CF9F23910A861026D057847E2CA4
SHA-512:	19EE7AD7CF69CF0D9F5BFF14DE1C534403C86E8E6C5A0576F6CB8FF9A2B51AA0B289332A8AA8807B1784CC916B42F9836DB025A5F878F215DE4A69D6E55F8EA8
Malicious:	false
Preview:	<svg viewBox="0 0 1541 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M6.282209 1017.717791h1519.038036V7.53865H6.282209v1010.179141z m1522.807362 2.512884v-3.769325 3.769325zM0 1024V0h1531.602454V1022.743558H0z" fill="#353636"></path><path d="M3.769325 680.991411h1525.320246v339.239264H3.769325z" fill="#FCDA00"></path><path d="M3.769325 343.008589h1525.320246v339.239264H3.769325z" fill="#DE3B37"></path><path d="M3.769325 3.769325h1525.320246v339.239264H3.769325z" fill="#231815"></path></svg>.

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	6743
Entropy (8bit):	4.711106725010904
Encrypted:	false
SSDEEP:	96:+AGp4I+WJModSit4IZL79tC7lodsdo+p9M2YEta4e2JysrMVtzo87l+khjh5:F10JMaSwVdsdBRtU2Isotz1II
MD5:	1DBEB2968794A3866A29758B7D68A58D
SHA1:	D6BEC65E6B534730DBCE281C5305C2EC59778479
SHA-256:	AC17EC27C418443E01E16ACC97E25940616F131E94D95F0CE3A404C5D5B619CC
SHA-512:	01B4D96F29122E013CB785C6921507F5B98DFB596C30D1ACD97473E17B8C6764A6EC0BB9FF8CE0C99C201828F27968E7AED2103BE470780A7CF2661246FEEE97
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/logo/logo.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1024 200.01"><defs><style>.a{fill:#3d62bb;}.b,.e{fill-rule:evenodd;}.b{fill:url(#a);}.c{fill:none;stroke:#144ab3;stroke-width:3px;}.d{fill:#fafafa;}.e{fill:url(#b);}</style><linearGradient id="a" x1="-25.76" y1="-2214.88" x2="250.39" y2="-2443.35" gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.21" stop-color="#6ca2df"/><stop offset="0.4" stop-color="#3a5eb8"/><stop offset="0.7" stop-color="#3d62bb"/><stop offset="1" stop-color="#5988d0"/></linearGradient><linearGradient id="b" x1="10.45" y1="-2104.4" x2="159.1" y2="-2435.68" gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.77" stop-color="#fff" stop-opacity="0"/><stop offset="0.85" stop-color="#fff" stop-opacity="0.01"/><stop offset="0.87" stop-color="#fff" stop-opacity="0.03"/><stop offset="0.89" stop-color="#fff" stop-opacity="0.08"/><st

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	5.127986550332345
Encrypted:	false
SSDEEP:	12:TMHdVfNIu/KYTeaxMovFtrDWwlxzgi5chQnucfvnDnbt+C0gbrso:2d1NFLTeaxMAtPvxzgtAfvDn8C0gbrso
MD5:	797F0C9EC141CA277793D0D8C19AF830
SHA1:	0A15637EABE05E515F7A2AE01BBC17D2AEE34C6E
SHA-256:	E8957EB389559C9CA8E5C29F05D6BB4F50EC114438079D196CB6B8A80725C7FB
SHA-512:	CB164A08848500A5B141A2011A3F314F054277F12B956A63A0BFD82997E60EECE708EC1C90A3421933F7858C4C8C3D70593CBDA896F44097C39DC62B636DBCCC
Malicious:	false
URL:	https://www.wisecleaner.com/static/img/icon/icon_arrow_1f2238_18.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="18px" height="18px" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <path d="M5,2 C5.51283584,2 5.93550716,2.38604019 5.99327227,2.88337887 L6,3 L6,10 L13,10 C13.5128358,10 13.9355072,10.3860402 13.9932723,10.8833789 L14,11 C14,11.5128358 13.6139598,11.9355072 13.1166211,11.9932723 L13,12 L5,12 C4.48716416,12 4.06449284,11.6139598 4.00672773,11.1166211 L4,11 L4,3 C4,2.44771525 4.44771525,2 5,2 Z" fill="#1F2238" fill-rule="nonzero" transform="translate(9.000000, 7.000000) rotate(-45.000000) translate(-9.000000, -7.000000) "></path>. </g>.</svg>.

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2547
Entropy (8bit):	4.854453449000075
Encrypted:	false
SSDEEP:	48:+xcR6Q3CGx0XrHJNXNxKuj3HVvFWZRYTqUKaJoPkCbiisL79FM8cs:+Y6X7N8SiZ0qUKCLCK9Wrs
MD5:	A6683370D90D9E184EB75E36A7D62B4B
SHA1:	004A07FDDEA69C5FFBAA7840B1B0F6F1525FC17E
SHA-256:	9209A720E3D6CA178DC559FF539F55D475101705EDC9AD181617EC183DFEB769
SHA-512:	37A418DC475AF9C7813FBA87218D9AD5C13DC1D336B3580D86455EE7F7D9FD298D98E45653C739B7046601B450F9339984C67D4128F9205C2F64BC7638D2BB1B
Malicious:	false
URL:	https://pdf.wisecleaner.com/static/svg/logo/pdf_logo.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 256 256"><defs><style>.a{fill:#0181fe;}.a,.b,.c,.e,.f,.g{fill-rule:evenodd;}.b{fill:url(#a);}.c,.d,.e{fill:#fff;}.c{isolation:isolate;opacity:0.1;}.f{fill:url(#b);}.g{fill:url(#c);}</style><linearGradient id="a" x1="25.76" y1="172.95" x2="249.13" y2="74.75" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#027eff"/><stop offset="1" stop-color="#0146d0"/></linearGradient><linearGradient id="b" x1="43.21" y1="136.32" x2="168.11" y2="136.32" xlink:href="#a"/><linearGradient id="c" x1="153.4" y1="126.43" x2="200.34" y2="126.43" xlink:href="#a"/></defs><path class="a" d="M64,0H192a64.06,64.06,0,0,1,64,64V192a64.06,64.06,0,0,1-64,64H64A64.06,64.06,0,0,1,0,192V64A64.06,64.06,0,0,1,64,0Z"/><path class="b" d="M70,6H186a64.06,64.06,0,0,1,64,64V186a64.06,64.06,0,0,1-64,64H70A64.06,64.06,0,0,1,6,186V70A64.06,64.06,0,0,1,70,6Z"/><path class="c" d="M186,6a64.06,64.06,0,0,1,64,64V93L159,6Z"/><pa

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9876469060244
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	SecuriteInfo.com.FileRepPup.14974.19067.exe
File size:	20'168'536 bytes
MD5:	c27c3107bb20803c3f5d8eab7258bb48
SHA1:	9e8384e96c6542eaf091cec68c351b8bde8d1b96
SHA256:	42e35e59355e78dc581115d24babd4424422efacfdb6710395c27e84243959df
SHA512:	b9ad78f4cd7a08f625f5e22fc4cc9ca16d72b2b89d532c26d4639ac20bbc7b9770fd94ad4ffc5f76dca0c2227018bb83bcdaf2d8edc3f0758abd3bad56a59f68
SSDEEP:	393216:JCDxCqqvxE41Fkzko+r1bAmUPSdWyaFV0PdU/0bDlMkjoVRV6OehFrj:PH1Fkgh18mAKxkyPdh5zobV63Hj
TLSH:	30173317B2C8253ED4AD2B340873A05068FB6A7CE91B6D173AF4D49CCF664C41D3AA79
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3769694b27691306

Static PE Info

General

Entrypoint:	0x4a7ed0
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DA1B5ED [Sat Oct 12 11:15:57 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eb5bc6ff6263b364dfbfb78bdb48ed59

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/09/2023 15:07:45 30/04/2026 20:50:14
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization, CN="Lespeed Technology Co., Ltd", SERIALNUMBER=91110101593898951F, O="Lespeed Technology Co., Ltd", L=Beijing, C=CN
Version:	3
Thumbprint MD5:	22FB0C5B612E7109578B0248ABC26A4E
Thumbprint SHA-1:	B910852E34BA52BEF2F23CA9FDE37B2219A718D3
Thumbprint SHA-256:	9E0D034859F798172BCE80B100D296B319184D52AAA699B5EDCA4B5DE18DB30F
Serial:	56D2A5DA5D53DB3AF8B143DF3EC7F692

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2BC4h
call 00007FC45D423CFDh
xor eax, eax
push ebp
push 004A85C2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A857Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FC45D4B7DFBh
call 00007FC45D4B7952h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FC45D439328h
mov edx, dword ptr [ebp-14h]
mov eax, 004B3714h
call 00007FC45D41E587h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B3714h]
mov dl, 01h
mov eax, dword ptr [00423698h]
call 00007FC45D43A38Fh
mov dword ptr [004B3718h], eax
xor edx, edx
push ebp
push 004A852Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FC45D4B7E83h
mov dword ptr [004B3720h], eax
mov eax, dword ptr [004B3720h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FC45D4BE73Ah
mov eax, dword ptr [004B3720h]
mov edx, 00000028h
call 00007FC45D43AC84h
mov edx, dword ptr [004B3720h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb6000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb4000	0xf1c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb9000	0x25710	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x133a1c0	0x1d98
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb8000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb42e0	0x240	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb5000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa50e8	0xa5200	f082ee6260fd65bd4406603aefa5b38a	False	0.35601136686222556	data	6.369284753795082	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1668	0x1800	01fc0e6510748ac1fa24729bd4c8d31d	False	0.541015625	data	5.951810643537571	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x37a4	0x3800	34fa73ad8332bf3785e4314a4334a782	False	0.36063058035714285	data	5.035168539011174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x6778	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb4000	0xf1c	0x1000	daddecfdccd86a491d85012d9e547c63	False	0.36474609375	data	4.791610915860562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb5000	0x1a4	0x200	be0581a07bd7d21a29f93f8752d3e826	False	0.345703125	data	2.7458225536678693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb6000	0x9a	0x200	c7a09d734ff63f677dfd4d18e3440fdf	False	0.2578125	data	1.881069204504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb7000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb8000	0x5d	0x200	955f17d4899f3cf7664168fa46e1b316	False	0.189453125	data	1.3799881252217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xb9000	0x25710	0x25800	a252ea186304e61a992aee8efa57317a	False	0.3122786458333333	data	5.073137512098122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xb9558	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.28142375487992427
RT_ICON	0xc9d80	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.29603741854109733
RT_ICON	0xd3228	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3631317902692489
RT_ICON	0xd7450	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4171161825726141
RT_ICON	0xd99f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5032833020637899
RT_ICON	0xdaaa0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5959016393442623
RT_ICON	0xdb428	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6941489361702128
RT_STRING	0xdb890	0x360	data			0.34375
RT_STRING	0xdbbf0	0x260	data			0.3256578947368421
RT_STRING	0xdbe50	0x45c	data			0.4068100358422939
RT_STRING	0xdc2ac	0x40c	data			0.3754826254826255
RT_STRING	0xdc6b8	0x2d4	data			0.39226519337016574
RT_STRING	0xdc98c	0xb8	data			0.6467391304347826
RT_STRING	0xdca44	0x9c	data			0.6410256410256411
RT_STRING	0xdcae0	0x374	data			0.4230769230769231
RT_STRING	0xdce54	0x398	data			0.3358695652173913
RT_STRING	0xdd1ec	0x368	data			0.3795871559633027
RT_STRING	0xdd554	0x2a4	data			0.4275147928994083
RT_RCDATA	0xdd7f8	0x10	data			1.5
RT_RCDATA	0xdd808	0x2c4	data			0.6384180790960452
RT_RCDATA	0xddacc	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xddaf8	0x68	data	English	United States	0.7692307692307693
RT_VERSION	0xddb60	0x584	data	English	United States	0.2669971671388102
RT_MANIFEST	0xde0e4	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x453ac0
__dbk_fcall_wrapper	2	0x40d3dc
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 15:29:55.378158092 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 15:30:04.987534046 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 15:30:18.645345926 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 15:30:18.645389080 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 25, 2024 15:30:19.212671041 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:19.212699890 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:19.212776899 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:19.215639114 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:19.215653896 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:19.633416891 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:19.634133101 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:19.639128923 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:19.639142036 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:19.639416933 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:19.690681934 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.168431044 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.216119051 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439026117 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439050913 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439059019 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439095020 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439114094 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439121962 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439136028 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439158916 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439167976 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439215899 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.439215899 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439215899 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439215899 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439249992 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439249992 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.439363956 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.705655098 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.705672026 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:20.705683947 CEST	49734	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:20.705689907 CEST	443	49734	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:21.205324888 CEST	49739	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.328705072 CEST	80	49739	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.328788042 CEST	49739	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.328923941 CEST	49739	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.451379061 CEST	80	49739	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.451482058 CEST	80	49739	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.451493979 CEST	80	49739	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.451612949 CEST	49739	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.451662064 CEST	49739	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.573419094 CEST	49740	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.574271917 CEST	80	49739	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.696902990 CEST	80	49740	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.700396061 CEST	49740	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.700556040 CEST	49740	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.823084116 CEST	80	49740	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.823102951 CEST	80	49740	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.823117018 CEST	80	49740	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:21.823223114 CEST	49740	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.823295116 CEST	49740	80	192.168.2.4	52.6.97.148
Apr 25, 2024 15:30:21.945775032 CEST	80	49740	52.6.97.148	192.168.2.4
Apr 25, 2024 15:30:22.061445951 CEST	49723	80	192.168.2.4	23.40.205.34
Apr 25, 2024 15:30:22.171216965 CEST	80	49723	23.40.205.34	192.168.2.4
Apr 25, 2024 15:30:22.171340942 CEST	49723	80	192.168.2.4	23.40.205.34
Apr 25, 2024 15:30:32.227214098 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.227297068 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.227380991 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.228713036 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.228744030 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.470701933 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.474961042 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.474988937 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.476628065 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.476689100 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.478091955 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.478183031 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.478334904 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.521308899 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.521323919 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.568316936 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.926866055 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927022934 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927097082 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.927129984 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927159071 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927405119 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927478075 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.927484989 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927514076 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927558899 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.927592039 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927736998 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927789927 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.927817106 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927910089 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.927958965 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.927972078 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928020000 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928030968 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928139925 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928183079 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928195000 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928267002 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928313017 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928323984 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928540945 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928616047 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928626060 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928728104 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928803921 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928852081 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928864002 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928935051 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.928985119 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.928994894 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.929037094 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.929047108 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.929250002 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.929303885 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.987078905 CEST	49744	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.987116098 CEST	443	49744	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.988154888 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.988199949 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.988380909 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.988449097 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.988481045 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.988787889 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.988810062 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.988816023 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.988867044 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.991039038 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.991050959 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.991344929 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.991357088 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:32.992028952 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:32.992052078 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.024359941 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.024393082 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.024493933 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.033092022 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.033139944 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.033221006 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.033654928 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.033688068 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.033858061 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.045211077 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.045226097 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.045551062 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.045568943 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.045880079 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.045900106 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.154367924 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.154413939 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.154478073 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.154702902 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.154721022 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.158808947 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.158875942 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.158936024 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.159168005 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.159198046 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.224703074 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.224991083 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.225024939 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.225567102 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.225620985 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.225982904 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.226066113 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.226152897 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.226166010 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.226310968 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.227271080 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.227323055 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.227675915 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.227741003 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.228041887 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.228048086 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.228759050 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.229047060 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.229068041 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.230353117 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.230863094 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.230967999 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.230974913 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.231045008 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.268125057 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.271699905 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.271714926 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.280065060 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.280360937 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.280374050 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.282233953 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.283169985 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.283222914 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.284080029 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.284162045 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.284533978 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.284627914 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.284754038 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.284869909 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.284933090 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.285229921 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.285321951 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.285339117 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.288717985 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.290555000 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.290601015 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.293891907 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.293992043 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.297966957 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.298075914 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.298130989 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.328154087 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.328155994 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.333259106 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.333261013 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.333267927 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.333287954 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.340143919 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.349252939 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.349265099 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.379578114 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.379601002 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.388849974 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.389117956 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.389138937 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.390219927 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.390285969 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.391246080 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.391314030 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.391694069 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.391702890 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.392379045 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.393022060 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.393042088 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.394496918 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.394567013 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.394923925 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.395461082 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.395546913 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.395636082 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.395644903 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.441258907 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.441274881 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.494971037 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.495038033 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.495068073 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.495107889 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.495171070 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.495198011 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.495234013 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.495264053 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.497615099 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.497761965 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.497843027 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.497899055 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.497925043 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.498056889 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.498107910 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.504920006 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.504964113 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.504997969 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505007029 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.505023003 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505076885 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505099058 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505112886 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.505116940 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505126953 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.505172968 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505228043 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.505232096 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505548000 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.505729914 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.522413969 CEST	49749	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.522429943 CEST	443	49749	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.524914980 CEST	49750	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.524929047 CEST	443	49750	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.526276112 CEST	49748	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.526285887 CEST	443	49748	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.550961971 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.551121950 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.551230907 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.551242113 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.551270962 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.552386999 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560036898 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560122013 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560170889 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560223103 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560264111 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560317993 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560318947 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560334921 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560404062 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560420036 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560538054 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560579062 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560585022 CEST	49751	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560594082 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560607910 CEST	443	49751	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560817957 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560866117 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.560879946 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560908079 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.560950041 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.563337088 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.563359022 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.563615084 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.563834906 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564009905 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564137936 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564140081 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.564182043 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564239025 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.564256907 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564383030 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564434052 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.564446926 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564594030 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564693928 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564743996 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.564758062 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564811945 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.564824104 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564871073 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.564924002 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.567022085 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.567034960 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.567552090 CEST	49753	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.567585945 CEST	443	49753	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.571170092 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.571187973 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.571326017 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.571816921 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.571836948 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.571969986 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.572520971 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.572544098 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.572607040 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.573242903 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.573256969 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.573323011 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.573338032 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.573441982 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.573457956 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.573844910 CEST	49752	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.573869944 CEST	443	49752	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.665391922 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.665551901 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.665704966 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.665721893 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.665853024 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.665911913 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.720031023 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720081091 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720136881 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.720149040 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720160961 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720185995 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720192909 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.720206976 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720221996 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720258951 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.720267057 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.720300913 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.730731964 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.730789900 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.741827965 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.741866112 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.741883993 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.741898060 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.742355108 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.794393063 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.801486015 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.808312893 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.809612989 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.809626102 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.810117960 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.810129881 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.810276985 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.810442924 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.810648918 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.820167065 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.820187092 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.821839094 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.821898937 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.829797029 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.829837084 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.829874039 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.829884052 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.829921007 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.834336996 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.834398985 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.843367100 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.843455076 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.843528986 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.843543053 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.843553066 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.843550920 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.843600988 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.844166040 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.844324112 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.844336033 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.844348907 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.844645977 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.844753027 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.844767094 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.844847918 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.844964981 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.845002890 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.848261118 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.848331928 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.850357056 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.850389004 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.850411892 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.850419998 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.850559950 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.854697943 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.854922056 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.854928017 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.854950905 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.857223988 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.857275963 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.863317013 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.863372087 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.863424063 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.863466024 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.869405985 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.869482994 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.869806051 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.869858980 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.874919891 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.874974966 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.880598068 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.880626917 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.880644083 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.880654097 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.880750895 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.885905027 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.885957956 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.885963917 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.886033058 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.886132002 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.892112017 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.892123938 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.895981073 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.896162033 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.898912907 CEST	49754	443	192.168.2.4	31.13.65.36
Apr 25, 2024 15:30:33.898931026 CEST	443	49754	31.13.65.36	192.168.2.4
Apr 25, 2024 15:30:33.920734882 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.920761108 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.920869112 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.922010899 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.922038078 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.922259092 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.932995081 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.933016062 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.933701992 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.933716059 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:33.935839891 CEST	49755	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:33.935868979 CEST	443	49755	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.028012991 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.028038979 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.071497917 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.071629047 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.071707010 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.074882030 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.075041056 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.075129986 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.079502106 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.079715967 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.079787970 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.079809904 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.079859972 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.079863071 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.079883099 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.079973936 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080022097 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.080034018 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080079079 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080125093 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.080132008 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080168962 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.080292940 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080452919 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.080499887 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.164513111 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.168521881 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.216084003 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.216110945 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.217070103 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.217102051 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.217472076 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.217705011 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.220691919 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.220788956 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.221283913 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.221602917 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.221842051 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.221878052 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.222117901 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.222147942 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.222172976 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.222223043 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.222363949 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.222423077 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.222609997 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.222624063 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.222837925 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.222848892 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.264147997 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.264162064 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.433511972 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.433660030 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.433710098 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.435806990 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.435919046 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.436134100 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.446410894 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.446695089 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.446707010 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.447403908 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.447616100 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.447645903 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.447755098 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.447812080 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.448879004 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.448937893 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.449289083 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.449295044 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.449317932 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.449378014 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.449726105 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.449806929 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.449839115 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.478252888 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.478297949 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.478370905 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.478370905 CEST	49757	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.478404999 CEST	443	49757	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.481637001 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.481658936 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.482868910 CEST	49756	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.482887030 CEST	443	49756	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.483303070 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.483335018 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.483390093 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.485935926 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.485955954 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.487804890 CEST	49759	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.487818956 CEST	443	49759	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.488224983 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.488264084 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.488328934 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.491350889 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.491370916 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.494280100 CEST	49761	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.494290113 CEST	443	49761	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.494872093 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.494946957 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.495059013 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.496115923 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.497308016 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.497349977 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.497669935 CEST	49760	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.497694016 CEST	443	49760	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.498007059 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.498039961 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.498092890 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.500950098 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.500962973 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.501470089 CEST	49758	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.501483917 CEST	443	49758	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.501728058 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.501750946 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.501943111 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.504637003 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.504650116 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.534750938 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.534778118 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.589304924 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.637412071 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.667870045 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.667984009 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.667999029 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.668231964 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.668365955 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.670944929 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.671009064 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.671370983 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.712868929 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.718385935 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.723201036 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.728439093 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.737561941 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.740319014 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:34.783588886 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783621073 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783669949 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783689022 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783711910 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783715963 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.783747911 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783762932 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.783762932 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.783771038 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.783780098 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.831331015 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831357956 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831413984 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831420898 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.831456900 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831474066 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.831475019 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831497908 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831516981 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831527948 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.831551075 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.831558943 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.831569910 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.838880062 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.838885069 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.838893890 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.873773098 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873794079 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873832941 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873866081 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873864889 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.873884916 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873902082 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873928070 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.873941898 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.873959064 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.901871920 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.901868105 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.901895046 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:34.922172070 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922192097 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922230005 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922247887 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922290087 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.922310114 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922343016 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922375917 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.922384977 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.922398090 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.952574015 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.952594042 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.952666044 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.952670097 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.952716112 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.952744961 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.952759027 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.952759027 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.952775955 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.982561111 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.982579947 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.982620001 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.982671022 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.982695103 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:34.982711077 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:34.982774019 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.011152983 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.011173010 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.011233091 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.011255980 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.011272907 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.011298895 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.011316061 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.028841019 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.028899908 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.028935909 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.028949976 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.028978109 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.031382084 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.031440020 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.031452894 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.046669960 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.046732903 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.046772957 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.046791077 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.046829939 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.061172962 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.061223984 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.061253071 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.061269999 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.061296940 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.074737072 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.074800014 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.074836016 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.074846983 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.074871063 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.089797020 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.089843988 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.089919090 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.089939117 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.089961052 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.091872931 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.091938972 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.091948032 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.102281094 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.102346897 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.102380991 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.102399111 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.102428913 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.116563082 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.116612911 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.116657972 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.116676092 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.116700888 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.128166914 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.128211975 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.128254890 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.128267050 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.128290892 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.140217066 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.140278101 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.140311003 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.140331030 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.140357971 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.140372992 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.140419006 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.140424967 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.149583101 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.149658918 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.149673939 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.149684906 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.149733067 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.158433914 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.158476114 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.158514977 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.158540964 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.158555984 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.168010950 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.168092966 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.168106079 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.168138981 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.168175936 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.175735950 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.175776958 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.175828934 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.175837994 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.175873041 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.177150011 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.177212000 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.177218914 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.184237003 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.184283972 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.184331894 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.184338093 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.184372902 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.191138029 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.191179037 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.191215038 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.191221952 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.191255093 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.198745966 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.198792934 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.198827028 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.198834896 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.198863029 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.204994917 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.205035925 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.205074072 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.205080032 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.205107927 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.206026077 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.206073046 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.206079006 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.210946083 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.211015940 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.211019993 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.211045980 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.211074114 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.217600107 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.217639923 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.217681885 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.217689991 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.217715979 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.223172903 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.223226070 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.223264933 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.223273039 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.223283052 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.229173899 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.229216099 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.229254961 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.229262114 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.229270935 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.229346991 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.229389906 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.229396105 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.234432936 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.234499931 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.234519005 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.234527111 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.234561920 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.240041971 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.240086079 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.240125895 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.240134001 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.240159035 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.244827986 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.244877100 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.244915962 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.244923115 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.244945049 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.249450922 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.249490023 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.249526978 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.249531984 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.249560118 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.250122070 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.250180960 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.250185966 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.254682064 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.254757881 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.254772902 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.254802942 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.254834890 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.256999969 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.257070065 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.257077932 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.257177114 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.257224083 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.929203987 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.929222107 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.929364920 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.929388046 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.929514885 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.929568052 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.929600000 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.929619074 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.929830074 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.929867029 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.929969072 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.930001974 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.930039883 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.930505037 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.930520058 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.930572987 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.931160927 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.931174994 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.931202888 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.931231022 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.931396961 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.931483030 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.931550980 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.931802988 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.931900024 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.932020903 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.932229996 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.932250023 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.932420015 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.932425022 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.932463884 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.932488918 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.932506084 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.932524920 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.932574034 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.933262110 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.933299065 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.933341980 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.933861017 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.933990955 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.933996916 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.934046984 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.934359074 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.934395075 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.934432983 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.934848070 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.934978962 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:35.934988022 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.935044050 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.954513073 CEST	49763	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.954546928 CEST	443	49763	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.968349934 CEST	49762	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:35.968379021 CEST	443	49762	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:35.980120897 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:35.980132103 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.033529997 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.033540010 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.033545017 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.033555984 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.042666912 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.042771101 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.052056074 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052139997 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052182913 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052194118 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.052222013 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052284956 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052323103 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.052356005 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052395105 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.052407980 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052495956 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.052541018 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055162907 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055229902 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055248976 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055375099 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055389881 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055434942 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055438995 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055470943 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055480003 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055532932 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055555105 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055572033 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055577993 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055614948 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055619001 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055775881 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055799007 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055814028 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055818081 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055847883 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.055851936 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055886030 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.055922031 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.056624889 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.056684017 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.056695938 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.056819916 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.056864977 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.056870937 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.056969881 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.057015896 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.057020903 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.057198048 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.057250023 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.057977915 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.058085918 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.058163881 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.058279037 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.058294058 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.058332920 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.058335066 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.058378935 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.059716940 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.059837103 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.059911013 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.059928894 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060029030 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060072899 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.060081005 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060237885 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060281038 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.060286999 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060375929 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.060453892 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.077316046 CEST	49766	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.077337980 CEST	443	49766	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.077820063 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.077858925 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.077922106 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.078977108 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.078993082 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.082869053 CEST	49767	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.082902908 CEST	443	49767	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.083259106 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.083281994 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.083348036 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.084136009 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.084153891 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.093488932 CEST	49769	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.093502998 CEST	443	49769	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.093838930 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.093898058 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.093961000 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.094660044 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.094688892 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.110786915 CEST	49768	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.110819101 CEST	443	49768	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.111893892 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.111923933 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.111984015 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.115031004 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.115056038 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.139709949 CEST	49765	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.139719009 CEST	443	49765	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.157485962 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.157500029 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.157566071 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.158834934 CEST	49764	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.158859015 CEST	443	49764	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.159338951 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.159349918 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.159414053 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.160195112 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.160207033 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.160777092 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.160789013 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.226011992 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.226042032 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.226103067 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.226411104 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.226427078 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.309453964 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.309914112 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.309936047 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.310481071 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.310822010 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.310906887 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.311197996 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.316068888 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.316287041 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.316344976 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.316822052 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.317189932 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.317279100 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.317347050 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.328965902 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.329271078 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.329299927 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.332828045 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.332901955 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.333564043 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.333646059 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.333894014 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.333909988 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.344594955 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.344775915 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.344794035 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.346210957 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.346268892 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.347946882 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.348046064 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.348069906 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.352117062 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.360120058 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.392122984 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.392575979 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.395152092 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.397080898 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.397092104 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.397397041 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.397404909 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.398868084 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.398936033 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.399410963 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.399491072 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.399672985 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.399682045 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.400974989 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.401060104 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.401901007 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.402164936 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.402254105 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.402261019 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.439654112 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.439937115 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.439953089 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.466645956 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.466882944 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.466900110 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.467767000 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.467801094 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.468549013 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.468614101 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.470124960 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.470213890 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.520785093 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.520857096 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.520931959 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.521250963 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.521272898 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.521609068 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.521648884 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.521719933 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.521893978 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.521914959 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.521972895 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522253036 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522274017 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.522324085 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522496939 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522522926 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.522640944 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522667885 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.522758007 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.522768974 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.559156895 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.559186935 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.559247971 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.559420109 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.559431076 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.562895060 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.562983036 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.563050985 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.563241005 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.563280106 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.565675020 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.565700054 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.565749884 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.565922976 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.565934896 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.578824997 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.578977108 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.579032898 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.579054117 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.579197884 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.579262972 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.579276085 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.579385996 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.579437017 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.582590103 CEST	49771	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.582600117 CEST	443	49771	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.582885981 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.582906008 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.582967043 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.583916903 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.583930016 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.586726904 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.586884022 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.586931944 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.586946964 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.587078094 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.587121964 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.588186979 CEST	49772	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.588200092 CEST	443	49772	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.588504076 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.588532925 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.588582993 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.589127064 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.589144945 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602327108 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602448940 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602508068 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.602530956 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602667093 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602730036 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.602742910 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602839947 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.602906942 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.603753090 CEST	49773	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.603771925 CEST	443	49773	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.604127884 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.604155064 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.604202032 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.604826927 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.604840994 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.616246939 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.616316080 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.616316080 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.616359949 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.620187044 CEST	49774	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.620203972 CEST	443	49774	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.620472908 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.620507002 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.620569944 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.621072054 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.621093988 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.632577896 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.632596970 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:36.664691925 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.664912939 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.664994955 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.665055990 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.665117025 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.665163994 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.665177107 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.665249109 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.665292978 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.668123007 CEST	49775	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.668133020 CEST	443	49775	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.668548107 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.668566942 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.668631077 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.669501066 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.669517040 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.669883013 CEST	49776	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.669888973 CEST	443	49776	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.670260906 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.670281887 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.670334101 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.671047926 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.671058893 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.678755999 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.678767920 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.678817987 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.678958893 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.678988934 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.679039955 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.679210901 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.679224014 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.679358006 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.679372072 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.754554987 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.754993916 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.755012035 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.755039930 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.755081892 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.755208969 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.755234957 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.755376101 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.755434036 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.756532907 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.756699085 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.756721973 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.756750107 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.756802082 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757090092 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.757112026 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757150888 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757194996 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.757293940 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757306099 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.757478952 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.757534981 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757628918 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757711887 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.757728100 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.757818937 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.757868052 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.758016109 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.758111000 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.758111000 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.758351088 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.758423090 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.758466959 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.788402081 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.788634062 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.788655043 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.789661884 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.789858103 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.789882898 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.790107965 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.790174961 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.790502071 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.790592909 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.790769100 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.790781021 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.791052103 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.791110039 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.791423082 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.791496038 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.791603088 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.791611910 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.792658091 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.798532963 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.798552036 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.800008059 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.800084114 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.800649881 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.800724030 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.800925970 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.800939083 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.804116011 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.804137945 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.804160118 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.817504883 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.819680929 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.819699049 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.820352077 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.821382999 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.821470976 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.822793961 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.823162079 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.823842049 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.823863029 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.824348927 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.825099945 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.825190067 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.825581074 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.832427025 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:36.832475901 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.832479954 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.832485914 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.832519054 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.838629007 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.849554062 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.850788116 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.850807905 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.851140022 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.851155043 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.852247953 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.852318048 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.852688074 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.852718115 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.852775097 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.852798939 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.853054047 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.853063107 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.853383064 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.853487015 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.853574038 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.864125967 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.872119904 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.893709898 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.893718958 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.893724918 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.893729925 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.893735886 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.893743992 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.893775940 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:36.896116972 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.900368929 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.900713921 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.900728941 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.902232885 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.902308941 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.903614998 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.904932976 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.905019045 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.905189037 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.905217886 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.905339003 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.905347109 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.906503916 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.906666040 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.906728983 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.907109022 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.913863897 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.914040089 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.914295912 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.914315939 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.914432049 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.914450884 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.914546013 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.914556980 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:36.915936947 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.915998936 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.917532921 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.917627096 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.917714119 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.917722940 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.919091940 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.919169903 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.920288086 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.920459032 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.920535088 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:36.920543909 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:36.942888021 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:36.942902088 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:36.942918062 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.001353025 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.001368999 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.001378059 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.001434088 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.023699999 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.023813963 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.023885012 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.025343895 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.025476933 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.025549889 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.025737047 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.025882006 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.025928974 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.026882887 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.027084112 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.027184963 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.027220011 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.027395010 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.027498007 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.036737919 CEST	49781	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.036761999 CEST	443	49781	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.037283897 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.037309885 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.037434101 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.038084030 CEST	49780	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.038127899 CEST	443	49780	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.038320065 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.038361073 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.038438082 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.038882017 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.038896084 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.039402008 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.039429903 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.040705919 CEST	49782	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.040724993 CEST	443	49782	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.041126013 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.041153908 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.041208982 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.041631937 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.041646957 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.044034958 CEST	49779	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.044059992 CEST	443	49779	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.059855938 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.059957027 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.059973001 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060034990 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060062885 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060117960 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060173988 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060307980 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060349941 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060375929 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060447931 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060487032 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060528994 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060538054 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060571909 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060609102 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060847998 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060939074 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.060967922 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.060985088 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.062215090 CEST	49783	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.062233925 CEST	443	49783	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.062606096 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.062628031 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.062761068 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.062968969 CEST	49784	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.062984943 CEST	443	49784	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.063337088 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.063360929 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.063596964 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.064202070 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.064222097 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.064662933 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.064678907 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.066203117 CEST	49785	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.066215038 CEST	443	49785	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.066512108 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.066572905 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.066780090 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.067198038 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.067229986 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.088738918 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.088877916 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.088928938 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.092096090 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.092354059 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.092477083 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.092536926 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.096323013 CEST	49786	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.096332073 CEST	443	49786	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.103802919 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.103825092 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.103892088 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.104013920 CEST	49787	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.104037046 CEST	443	49787	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.104823112 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.104835033 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.109786987 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.109837055 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.109872103 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.109893084 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.109916925 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.110029936 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.110054016 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.110183954 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.112126112 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.112176895 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.118325949 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118381977 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118417978 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118432045 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.118469000 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118506908 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.118515968 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118597984 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118633032 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118670940 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.118690014 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118752956 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.118757010 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.118853092 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.125776052 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.125804901 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.125888109 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.127041101 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.127060890 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.127320051 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.127414942 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.127425909 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.127625942 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.127672911 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.128146887 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.128422976 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.128602982 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.128665924 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.130990982 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.141587973 CEST	49789	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.141628981 CEST	443	49789	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.149904966 CEST	49788	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.149920940 CEST	443	49788	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171607018 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171658039 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171694994 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171736956 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171741962 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.171785116 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171798944 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.171828032 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.171866894 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.171873093 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.172089100 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.172184944 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.172229052 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.174453020 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174575090 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174668074 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174721003 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.174748898 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174829960 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174876928 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.174885988 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.174925089 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.174932003 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.175088882 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.175137043 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.188872099 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.188951969 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.189135075 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.189352036 CEST	49792	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.189367056 CEST	443	49792	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.193255901 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.193308115 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.193711042 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.194164991 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.194201946 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.195805073 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.195828915 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.196511984 CEST	49791	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.196537018 CEST	443	49791	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.197340965 CEST	49790	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.197355032 CEST	443	49790	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.199322939 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.199350119 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.199399948 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.200222015 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.200241089 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.200386047 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.200627089 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.200644016 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.201134920 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.201147079 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.233481884 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.238348007 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238373041 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238411903 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238423109 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.238430023 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238455057 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.238466024 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238478899 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.238488913 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.238518000 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.238527060 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.273984909 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.274410009 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.274442911 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.275002003 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.275300026 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.275403023 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.275415897 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.275440931 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.275592089 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.275619984 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.276437998 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.276686907 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.276696920 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.277097940 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.277159929 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.277596951 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.277681112 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.277740002 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.277750015 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.277858019 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.278161049 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.278331041 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.278389931 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.289088964 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.289109945 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.289150000 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.289160013 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.289177895 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.289222956 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.289232016 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.289273977 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.292263031 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.292470932 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.292501926 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.293941975 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.293998957 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.294326067 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.294415951 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.294452906 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.296868086 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.297044039 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.297061920 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.297580004 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.297760010 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.297777891 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.298549891 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.298607111 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.298804998 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.298861027 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.299009085 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.299092054 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.299406052 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.299469948 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.299567938 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.299577951 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.299623966 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.299637079 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.320121050 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.320135117 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.331614017 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.331660032 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.331722975 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.331738949 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.331773996 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.331798077 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.334443092 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.334671974 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.334693909 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.335158110 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.335508108 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.335585117 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.335649014 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.336137056 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.357057095 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.357671022 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.357688904 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.358148098 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.358526945 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.358608961 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.358628988 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.376548052 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.376594067 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.376635075 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.376652956 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.376673937 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.376686096 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.376698017 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.376713037 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.377111912 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.380120039 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.400119066 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.406260014 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.406316042 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.406344891 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.406363010 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.406378984 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.423794985 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.424787045 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.424810886 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.424849033 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.425146103 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.425170898 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.426436901 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.426527023 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.426606894 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.426668882 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.426805973 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.426896095 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.427078962 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.427189112 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.427217007 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.427234888 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.427267075 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.427283049 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.429430008 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.429652929 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.429681063 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.431124926 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.431189060 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.431488991 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.431590080 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.431600094 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.435005903 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.435185909 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.435210943 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.435936928 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.435991049 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.436013937 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.436032057 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.436052084 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.436062098 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.438957930 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.438967943 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.438973904 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.439003944 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.439007998 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.439064026 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.439138889 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.439502954 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.439634085 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.439640045 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.439673901 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.465147972 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.465179920 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.465229034 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.465248108 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.465281010 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.476116896 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.482501984 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.482526064 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.482836008 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.482856989 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.483059883 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.484118938 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.484123945 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.484196901 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.484344006 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.484929085 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.484981060 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.491200924 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.491200924 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.491202116 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.491214991 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.499921083 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.499973059 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.500005007 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.500022888 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.500041962 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.513984919 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.514008999 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.514050961 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.514066935 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.514092922 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.527285099 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.527307987 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.527391911 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.527411938 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.542121887 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.542145967 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.542202950 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.542217016 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.542252064 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.543981075 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544161081 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544193983 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544209957 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.544228077 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544269085 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544306040 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.544315100 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544338942 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.544388056 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.544389963 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.544394970 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544401884 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.544591904 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.544641972 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.548046112 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.548187017 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.548238993 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.548257113 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.548420906 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.548491001 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.549041986 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549158096 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549209118 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.549220085 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549320936 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549401045 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.549407005 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549460888 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.549516916 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.554378986 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.554442883 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.554450989 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.554472923 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.554507017 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.557049036 CEST	49796	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.557063103 CEST	443	49796	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.557594061 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.557658911 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.557874918 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.558614016 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.558646917 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.558798075 CEST	49795	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.558820963 CEST	443	49795	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.559113979 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.559154987 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.559211016 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.559781075 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.559802055 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.561078072 CEST	49794	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.561096907 CEST	443	49794	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.561368942 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.561398029 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.561450958 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.561893940 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.561911106 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562613010 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562659025 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562664986 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.562681913 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562717915 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.562726021 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562767982 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.562804937 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.562814951 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.563262939 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.563323021 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.565013885 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565076113 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565140009 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565192938 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.565212965 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565258026 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.565354109 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565427065 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.565464973 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.568196058 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.568218946 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.568293095 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.568312883 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.574877024 CEST	49798	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.574888945 CEST	443	49798	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.575165033 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.575200081 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.575264931 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.576428890 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.576442003 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.576783895 CEST	49797	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.576807022 CEST	443	49797	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.577099085 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.577121019 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.577250004 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.577754974 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.577769041 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.579829931 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.579854012 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.579900026 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.579914093 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.579938889 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.582587004 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.582629919 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.582657099 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.582701921 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.582736015 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.582812071 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.582858086 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.587136984 CEST	49799	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.587151051 CEST	443	49799	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.587587118 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.587605953 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.587869883 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.588651896 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.588665009 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.591345072 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.591366053 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.591413021 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.591428995 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.591454029 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.592663050 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.592708111 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.592720032 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.596703053 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.602097988 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.602138042 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.602169037 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.602184057 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.602204084 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.604549885 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.604609966 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.604657888 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.604667902 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.604698896 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.604743004 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.606960058 CEST	49800	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.606966019 CEST	443	49800	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.607393980 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.607413054 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.607518911 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.609381914 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.609394073 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.610846996 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.610868931 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.610912085 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.610924006 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.610959053 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.619333029 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.619355917 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.619410038 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.619425058 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.627556086 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.627681017 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.627746105 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.627759933 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.627896070 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.627945900 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.628156900 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.628180027 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.628215075 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.628223896 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.628256083 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.628376007 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.628403902 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.628416061 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.629463911 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.629535913 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.629544020 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.631539106 CEST	49801	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.631551981 CEST	443	49801	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.635420084 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.635476112 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.635481119 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.635503054 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.635529041 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.636488914 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.636519909 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.636580944 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.637101889 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.637119055 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.643383026 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.643413067 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.643536091 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.643536091 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.643552065 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.650187969 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.650209904 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.650279999 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.650295019 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.656402111 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.656424046 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.656467915 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.656478882 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.656510115 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.657289982 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.657351017 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.657360077 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.663053036 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.663106918 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.663115025 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.663134098 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.663162947 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.668839931 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.668862104 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.668901920 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.668915033 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.668947935 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.675220013 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.675240993 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.675426960 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.675442934 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.680485010 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.680504084 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.680545092 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.680561066 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.680589914 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.681359053 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.681411982 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.681421041 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.686162949 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.686203957 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.686232090 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.686244011 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.686261892 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.691135883 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.691157103 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.691234112 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.691246033 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.691274881 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.694833040 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.694904089 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.694981098 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.694998026 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.695127010 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.695173025 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.695794106 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.695816994 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.695852995 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.695863962 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.695898056 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.696767092 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.696923018 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.696985006 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.697021008 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.697103024 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.697249889 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.697263956 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.697834969 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.697904110 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.697916031 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.698137045 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.698195934 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.698208094 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.698544025 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.698601007 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.699984074 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.700058937 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.700172901 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.700217962 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.701618910 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.701638937 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.701697111 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.701709986 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.701723099 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.702042103 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.702099085 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.702106953 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.705565929 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.705610037 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.705637932 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.705655098 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.705677032 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.706480980 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.706564903 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.706584930 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.706715107 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.706763029 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.708380938 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.708445072 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.708458900 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.708472967 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.708522081 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.708544970 CEST	49802	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.708590031 CEST	443	49802	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.710848093 CEST	49803	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.710867882 CEST	443	49803	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.717277050 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.717308044 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.717363119 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.718266010 CEST	49793	443	192.168.2.4	31.13.88.13
Apr 25, 2024 15:30:37.718286037 CEST	443	49793	31.13.88.13	192.168.2.4
Apr 25, 2024 15:30:37.718806982 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.718820095 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.730854034 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.730884075 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.731029034 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.733092070 CEST	49805	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.733112097 CEST	443	49805	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.733850002 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.733865976 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.734633923 CEST	49804	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.734662056 CEST	443	49804	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.736493111 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.736530066 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.736597061 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.741043091 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.741072893 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.741822958 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.741837978 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.741857052 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.742180109 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.742193937 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.792522907 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.793406963 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.793426037 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.793792963 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.794109106 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.794125080 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.794169903 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.795228004 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.795342922 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.795381069 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.795389891 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.795586109 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.795654058 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.795891047 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.796025991 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.796046019 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.796080112 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.796133995 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.796618938 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.797611952 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.797693014 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.797702074 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.806047916 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.806282997 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.806396961 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.806416988 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.806611061 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.806626081 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.807861090 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.807945013 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808077097 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.808130026 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808231115 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808305979 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.808510065 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808516979 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.808784008 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808861971 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.808919907 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.808928013 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.816211939 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.816596031 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.816644907 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.817661047 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.817723036 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.818118095 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.818185091 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.818234921 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.836118937 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.840126038 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.840209961 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.841636896 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.841650009 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.842211008 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.842508078 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.842596054 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.842639923 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.864162922 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.865052938 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.884120941 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.889802933 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.889832973 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.891037941 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.894411087 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.894586086 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.894663095 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.900113106 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.900116920 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.900124073 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.900122881 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.900160074 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.900173903 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.900211096 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:37.939929962 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.939955950 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:37.940124035 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.951220036 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.952265978 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.952280998 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.953107119 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.953459978 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.953542948 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.953697920 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.959703922 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.960011959 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.960047007 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.961505890 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.961571932 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.961870909 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.961950064 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.961996078 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:37.972161055 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:37.972505093 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.000117064 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.004136086 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.059613943 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.059673071 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.059717894 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.059743881 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.061299086 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.061311960 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.061424017 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.063272953 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.063409090 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.063494921 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.063549042 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.063577890 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.063617945 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.063627005 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.063788891 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.064062119 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.064085960 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.064121962 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.066342115 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.072496891 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.072647095 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.072716951 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.075270891 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.075339079 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.075448990 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.075484037 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.075520039 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.075632095 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.075700045 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.075783968 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.075948000 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.075969934 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.076054096 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.076364994 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.076378107 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.076441050 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.076464891 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.085510969 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.085601091 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.085659981 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.085982084 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.086107016 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.086158991 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.088144064 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.088162899 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.111736059 CEST	49813	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.111763954 CEST	443	49813	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.112317085 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.112349033 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.112411976 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.113305092 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.113323927 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.114017963 CEST	49815	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.114037991 CEST	443	49815	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.114525080 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.114557028 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.114612103 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.115205050 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.115216970 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.115272999 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.115334034 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.115380049 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.115391016 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.115458012 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.115499020 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.116167068 CEST	49814	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.116190910 CEST	443	49814	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.116468906 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.116480112 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.116744995 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.117393970 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.117407084 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.117778063 CEST	49811	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.117841005 CEST	443	49811	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.117986917 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.118006945 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.118069887 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.118657112 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.118674040 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.119380951 CEST	49816	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.119395018 CEST	443	49816	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.121726990 CEST	49812	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.121737003 CEST	443	49812	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.125066996 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.125097036 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.132409096 CEST	49817	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.132420063 CEST	443	49817	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.140597105 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.140625954 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.140769958 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.140994072 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.141010046 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143086910 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143157005 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143198967 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143202066 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.143220901 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143259048 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.143265963 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143368006 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.143419027 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.145749092 CEST	49818	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.145761013 CEST	443	49818	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.149326086 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.149347067 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.149807930 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.151027918 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.151040077 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.194413900 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.220980883 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.221045017 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.221179962 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.221309900 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.240225077 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240305901 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240346909 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240401983 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240401983 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.240416050 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240463018 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.240473032 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240514040 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.240514994 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240529060 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240605116 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.240612030 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240907907 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240957022 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.240972996 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.241024971 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.241048098 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.241080999 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.241107941 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.241162062 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.241584063 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.241727114 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.242093086 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.250694036 CEST	49819	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.250715017 CEST	443	49819	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.255103111 CEST	49821	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.255116940 CEST	443	49821	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.259685993 CEST	49822	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.259705067 CEST	443	49822	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.264516115 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.264544010 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.264641047 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.264864922 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.264878988 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.266441107 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.266473055 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.266530991 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.266797066 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.266813993 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.273709059 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.273736000 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.273899078 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.274173975 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.274187088 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.274513960 CEST	49820	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.274529934 CEST	443	49820	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.346532106 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.350008965 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.351818085 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.353003025 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.365452051 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.365474939 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.365578890 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.365588903 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.365690947 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.365705013 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.365842104 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.365853071 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.366806030 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.366844893 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.366964102 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.367022038 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.368834019 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.368921041 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.369149923 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.369585991 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.369654894 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.374299049 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.374564886 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.374609947 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.374653101 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.374733925 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.374747038 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.374970913 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.375150919 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.375166893 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.375236034 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.375245094 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.375246048 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.375277996 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.375368118 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.375376940 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.375607967 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.375694990 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.375741959 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.383259058 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.389646053 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.389656067 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.390150070 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.394735098 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.394854069 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.394860983 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.395034075 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.416141987 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.420130014 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.420150042 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.493074894 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.495362997 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.495865107 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.495915890 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.495917082 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.508877039 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.526933908 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.592689037 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.592701912 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.593219995 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.593239069 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.593322039 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.593334913 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.594253063 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.594269991 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.594330072 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.594788074 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.594805956 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.594866037 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.597527027 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.597558022 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.597614050 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.598088026 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.598171949 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.604485035 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.604566097 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.604787111 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.604964972 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.604968071 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.604973078 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.605057955 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.605066061 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.605091095 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.605099916 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.615634918 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.615792036 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.615868092 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.615876913 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.615953922 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.616002083 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.616008997 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.616240978 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.618380070 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.619653940 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.619699955 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.619936943 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.619968891 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.619988918 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.619999886 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620026112 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.620553970 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620609045 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.620616913 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620817900 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620846987 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620901108 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.620907068 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.620999098 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621097088 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621150017 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.621164083 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621395111 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621448040 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.621448040 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621457100 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621481895 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621491909 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.621499062 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621514082 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.621721983 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.621774912 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.622037888 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.622080088 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.623390913 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623569012 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623647928 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.623662949 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623749971 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623843908 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623898029 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.623905897 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.623945951 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.624039888 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.624208927 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.624587059 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.624649048 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.624656916 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.624706030 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.624712944 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.624874115 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.626426935 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.638556957 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.638708115 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.638792992 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.651427984 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.651788950 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.651880980 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.704871893 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.706686020 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.761728048 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.761997938 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.762044907 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.766774893 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.766908884 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.766959906 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.770766020 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770829916 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770837069 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.770855904 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770896912 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.770904064 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770941973 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770977020 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.770979881 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.770992041 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.771028042 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.771226883 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.771313906 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.771349907 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.771357059 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.771378994 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.771415949 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.779299974 CEST	49827	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.779320955 CEST	443	49827	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.779580116 CEST	49828	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.779611111 CEST	443	49828	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.782850981 CEST	49825	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.782867908 CEST	443	49825	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.783354044 CEST	49823	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.783360004 CEST	443	49823	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.783638000 CEST	49826	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.783651114 CEST	443	49826	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.783847094 CEST	49824	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:38.783859968 CEST	443	49824	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:38.784899950 CEST	49829	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.784914017 CEST	443	49829	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.785151005 CEST	49830	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.785157919 CEST	443	49830	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:38.791026115 CEST	49831	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:38.791037083 CEST	443	49831	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.234210014 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.234255075 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.234321117 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.234707117 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.234791040 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.234870911 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.235184908 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.235266924 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.235352039 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.235591888 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.235671043 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.235739946 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239156008 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239186049 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.239248991 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239403009 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239419937 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.239548922 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239599943 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.239681005 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239712954 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.239846945 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239882946 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.239968061 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.239984035 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.290481091 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.290494919 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.290556908 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.290781021 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.290791035 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.297514915 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.297528028 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.297585964 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.297787905 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.297802925 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.300820112 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.300867081 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.300937891 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.301146030 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.301177979 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.302498102 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.302517891 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.302588940 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.302755117 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.302774906 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.304991961 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.305001020 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.305056095 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.305267096 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.305280924 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.307012081 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.307034016 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.307132959 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.307310104 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.307337046 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.472342968 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.472592115 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.472609997 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.474272013 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.474327087 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.474781990 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.474919081 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.474932909 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.479513884 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.479768038 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.479830980 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.479856014 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.480024099 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.480048895 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.481324911 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.481389999 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.481554031 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.481611013 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.481704950 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.481796026 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.482022047 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.482153893 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.482171059 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.482187986 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.482218027 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.482228041 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.482367992 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.482538939 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.482551098 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.483289957 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.483350992 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.483479023 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.483526945 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.483716011 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.483802080 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.483820915 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.484261990 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.484767914 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.484877110 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.484884024 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.516138077 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.524132967 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.526760101 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.526834965 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.527482986 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.527491093 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.527934074 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.527941942 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.527957916 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.528131962 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.528541088 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.528620005 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.528868914 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.529211044 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.529655933 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.529766083 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.529872894 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.534615993 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.534629107 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.534632921 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.536648989 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.539289951 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.540683985 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.541130066 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.545474052 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.545510054 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.545553923 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.548291922 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.548312902 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.548377991 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.548388004 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.548494101 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.548511982 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.548585892 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.548614979 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.549977064 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.550025940 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.550154924 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.550215960 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.550415993 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.550483942 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.550760031 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.550841093 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.551426888 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.551516056 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.551686049 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.551794052 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.552018881 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.552027941 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.552052975 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.552124977 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.552124977 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.552138090 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.552144051 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.552153111 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.552591085 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.552778959 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.553051949 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.553066015 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.572138071 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.689524889 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.689544916 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.689544916 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.736136913 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.736211061 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.736382008 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.736398935 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.741218090 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.741277933 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.741322994 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.741344929 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.741432905 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.741676092 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.745842934 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.745894909 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.745930910 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.745963097 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.745985985 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.746005058 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.746020079 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.746088028 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.748378038 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.751697063 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.751827955 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.751921892 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.751972914 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.752000093 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.752142906 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.752159119 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.752183914 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.752238035 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.754194021 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754343033 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754406929 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.754422903 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754508972 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754596949 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754611969 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.754627943 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754689932 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.754702091 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.754996061 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755151033 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755204916 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755213976 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755335093 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755388021 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755399942 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755404949 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755450964 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755458117 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755474091 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755536079 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755567074 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755592108 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755604982 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755610943 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755616903 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755655050 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755795956 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755841970 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.755848885 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755855083 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.755994081 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756023884 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756051064 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.756057024 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756073952 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.756086111 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756154060 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756241083 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756268024 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756292105 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.756299019 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756345034 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.756349087 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.756355047 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756490946 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.756547928 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.761101961 CEST	49835	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.761133909 CEST	443	49835	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.765743971 CEST	49836	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.765759945 CEST	443	49836	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.766711950 CEST	49834	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.766742945 CEST	443	49834	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.767322063 CEST	49833	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.767369032 CEST	443	49833	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.767683983 CEST	49832	443	192.168.2.4	172.67.68.11
Apr 25, 2024 15:30:39.767694950 CEST	443	49832	172.67.68.11	192.168.2.4
Apr 25, 2024 15:30:39.796757936 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.796825886 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.796881914 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.796888113 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.796916008 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.797045946 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.798094988 CEST	49838	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.798101902 CEST	443	49838	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.798557043 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.798579931 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.798618078 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.798686028 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.798777103 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.798903942 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.798922062 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.798968077 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.799190998 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.800023079 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.800040007 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.802486897 CEST	49837	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.802500963 CEST	443	49837	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.802725077 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.802783966 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.802870035 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.803756952 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.803783894 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.805120945 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.805243969 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.805299997 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.805324078 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.805464029 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.805594921 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.806211948 CEST	49839	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.806231976 CEST	443	49839	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.806648016 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.806695938 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.806870937 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.807629108 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.807660103 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810760021 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810811043 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810837984 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810873985 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.810889006 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810925961 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.810926914 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810941935 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.810986042 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811255932 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811337948 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811369896 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811429977 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811438084 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811508894 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811564922 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811578989 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811626911 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811639071 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811669111 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811676979 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811696053 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811701059 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811748981 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811748981 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811764002 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811779976 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811795950 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.811798096 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.811876059 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.812683105 CEST	49841	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.812689066 CEST	443	49841	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.812982082 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.813023090 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.813088894 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.814141989 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.814171076 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.816931009 CEST	49842	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.816945076 CEST	443	49842	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.817218065 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.817231894 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.817327023 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.818381071 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.818397045 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.818763971 CEST	49840	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.818778992 CEST	443	49840	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.818954945 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.818979025 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.819092035 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.820126057 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:39.820138931 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:39.940098047 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:39.940129042 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:39.940188885 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:39.940557957 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:39.940593004 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:39.940795898 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:39.941047907 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:39.941057920 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:39.941356897 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:39.941371918 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.038074017 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.038125038 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.038707018 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.038764954 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.038815022 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.038836002 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.039999962 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.040211916 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.040683031 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.040915966 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.041030884 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.041217089 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.041244984 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.041301012 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.041738033 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.041974068 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.042016983 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.045116901 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.045192957 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.045486927 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.045604944 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.045677900 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.045696974 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.047122955 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.047362089 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.047411919 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.048702002 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.049055099 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.049082994 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.049346924 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.049411058 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.049706936 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.049791098 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.049858093 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.050723076 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.050777912 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.051074982 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.051197052 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.051218987 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.056763887 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.057018042 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.057034016 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.061619043 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.061681986 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.062036991 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.062153101 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.062208891 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.084146976 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.088124990 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.091067076 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091090918 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.091146946 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091290951 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091335058 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.091419935 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091444969 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091480017 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.091535091 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091677904 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091694117 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.091806889 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091835976 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.091934919 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.091970921 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.092135906 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.095978975 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.096082926 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.096091986 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.127234936 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.127240896 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.127250910 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.127254009 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.127270937 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.178971052 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.179178953 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.179198027 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.180821896 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.180877924 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.181905985 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.181994915 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.182285070 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.182291985 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.200354099 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.236613035 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.236686945 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.295370102 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.295589924 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.295604944 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.297359943 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.297420979 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.298310041 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.298394918 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.298480034 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.298492908 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.304152966 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304279089 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304369926 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304378033 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.304442883 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304501057 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.304517984 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304646969 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.304785013 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.310028076 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.310184956 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.310226917 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.310240984 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.310321093 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.310369015 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.312416077 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.312475920 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.312549114 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.312550068 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.312616110 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.312638044 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.312680960 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.313211918 CEST	49848	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.313240051 CEST	443	49848	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.313623905 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.313654900 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.313724995 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.314270020 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.314282894 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.314460039 CEST	49847	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.314472914 CEST	443	49847	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.314771891 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.314815044 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.314882040 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.315315962 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.315349102 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.315850019 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.315972090 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.316019058 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.317126989 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.317142963 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.317223072 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.317277908 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.317296028 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.317317963 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.317374945 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.317522049 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.317533016 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.318665028 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.318733931 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.319056034 CEST	49849	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.319068909 CEST	443	49849	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.319488049 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.319509983 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.319641113 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.320024967 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.320118904 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320172071 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320216894 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320516109 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.320529938 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.320671082 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.320683002 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320781946 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.320792913 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320857048 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.320889950 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.320919991 CEST	49850	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.320935011 CEST	443	49850	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.321228027 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.321247101 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.321295977 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.321677923 CEST	49851	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.321691036 CEST	443	49851	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.321779013 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.321835995 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.321918011 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.321966887 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.322101116 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.322118998 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.322200060 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.322750092 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.322767019 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.323406935 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.323479891 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.324034929 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.324120045 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.324270010 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.324287891 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324640036 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.324647903 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.324698925 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.324708939 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.324732065 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324795008 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324845076 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324856997 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.324870110 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324932098 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.324933052 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.324949026 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.325017929 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.325051069 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.325135946 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.325184107 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.325191021 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.325259924 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.325325966 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.329077005 CEST	49852	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.329087973 CEST	443	49852	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.348527908 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.401535988 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401595116 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401633024 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401679039 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.401695013 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401736975 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401737928 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.401753902 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.401961088 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.408989906 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.416755915 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.416810989 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.416822910 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.424436092 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.424496889 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.424513102 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.424524069 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.424645901 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.425107956 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.425147057 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.425199986 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.425215006 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.425224066 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.425244093 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.425259113 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.425292969 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.432163954 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.433181047 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.433250904 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.447567940 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.447592974 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.447635889 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.447648048 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.447655916 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.447696924 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.447705030 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.447715044 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.477890015 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.477897882 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.511337996 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.515415907 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.515474081 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.515497923 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.522867918 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.522924900 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.522933960 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.530539036 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.530653954 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.530706882 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.530716896 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.531152010 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.531426907 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.531495094 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.531497955 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.531527996 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.531555891 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.531564951 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.531579018 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.538203955 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.542800903 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.542860031 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.542890072 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.542912960 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.542952061 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.543004036 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.543021917 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.543036938 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.543097973 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.544591904 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544636965 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544658899 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544706106 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.544713020 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544724941 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544765949 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.544780016 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.544819117 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.545892954 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.545943022 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.545950890 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.546099901 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546159029 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546201944 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546231985 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.546252966 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546293974 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.546303034 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546364069 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.546407938 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.548692942 CEST	49857	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.548702002 CEST	443	49857	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.548929930 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.550302982 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.550313950 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.550328970 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.550508976 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.550539017 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.550581932 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.550586939 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.550621986 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.550622940 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.550651073 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.550667048 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.550677061 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.551789045 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.552181959 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.552330017 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.552452087 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.552490950 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.554076910 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.554128885 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.554136992 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.556050062 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.556448936 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.556459904 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.557725906 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.557781935 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.557976007 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.558001995 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.558036089 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.558057070 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.558113098 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.558515072 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.558950901 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.559017897 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.559032917 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.559609890 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.559628010 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.559799910 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.559890985 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.559938908 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.559950113 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.560132027 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.560143948 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.560488939 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.560498953 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.560616016 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.560653925 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.561088085 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.561156034 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.561352968 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.561403036 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.561412096 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.561615944 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.561645031 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.561678886 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.561737061 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.561800003 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.562788963 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.562918901 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.563237906 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.563332081 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.563400030 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.563435078 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.563462019 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.563719988 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.563729048 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.563993931 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.564068079 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.564075947 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.564078093 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.564094067 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.564141035 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.564146996 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.565810919 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.567614079 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.567676067 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.567683935 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.568315029 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.568356991 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.568381071 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.568396091 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.568438053 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.571522951 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.571589947 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.571599960 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.571615934 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.571676016 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.572052002 CEST	49854	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:40.572071075 CEST	443	49854	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:40.573463917 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.573538065 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.573576927 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.575295925 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.575304985 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.575365067 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.575373888 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.582389116 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.582416058 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.582499981 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.582513094 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.586420059 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.589446068 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.596162081 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.596494913 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.596554995 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.596565008 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.603568077 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.603658915 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.603668928 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.603688002 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.603765011 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.608114958 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.621357918 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.623984098 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.624084949 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.624141932 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.624154091 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.624196053 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.629522085 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.629717112 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.629748106 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.629765034 CEST	443	49853	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.629779100 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.629797935 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.629812002 CEST	49853	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.637681961 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.637706041 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.637770891 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.637970924 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.637984037 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.639638901 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.639684916 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.639750004 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.640069962 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.640090942 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.652915955 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.653006077 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.653038025 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.654784918 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.654876947 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.654906034 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.656477928 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.656570911 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.656588078 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.658425093 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.658477068 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.658487082 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.664314985 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.664402008 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.664419889 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.664963007 CEST	80	49725	34.202.12.236	192.168.2.4
Apr 25, 2024 15:30:40.665060997 CEST	49725	80	192.168.2.4	34.202.12.236
Apr 25, 2024 15:30:40.665117979 CEST	49725	80	192.168.2.4	34.202.12.236
Apr 25, 2024 15:30:40.666167974 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.666229010 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.666237116 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.671936035 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.672497988 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.672513008 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.673880100 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.673938990 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.673948050 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.679775953 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.679831028 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.679843903 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.681453943 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.682121038 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.682131052 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.687463045 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.687552929 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.687577009 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.689215899 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.689275980 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.689284086 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.689529896 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.695125103 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.695209026 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.695225954 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.696861029 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.697320938 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.697329044 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.702770948 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.702836990 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.702869892 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.704049110 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.704129934 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.704138041 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.709821939 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.709914923 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.709928989 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.711220026 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.711277008 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.711285114 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.716860056 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.716941118 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.716953993 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.718411922 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.718488932 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.718497038 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.723912954 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.723999023 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.724005938 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.724052906 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.724526882 CEST	49858	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.724555016 CEST	443	49858	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.725466967 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.725519896 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.725529909 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.726217031 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:40.726243019 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:40.726536036 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:40.726959944 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:40.726974010 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:40.727139950 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.727169991 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.727170944 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.732712984 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.732768059 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.732777119 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.739905119 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.739985943 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.739994049 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.746975899 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.747044086 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.747061014 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.762845039 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.762871027 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.762928963 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.763180971 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.763195038 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.764704943 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.764764071 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.764771938 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.767499924 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.767549038 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.767556906 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.773156881 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.773219109 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.773228884 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.778422117 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.778517962 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.778526068 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.783427000 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.783488989 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.783497095 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.787121058 CEST	80	49725	34.202.12.236	192.168.2.4
Apr 25, 2024 15:30:40.788405895 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.788456917 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.788465023 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.793340921 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.793394089 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.793402910 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.798449039 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.798502922 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.798510075 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.803152084 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.803200006 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.803212881 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.808140993 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.808187962 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.808196068 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.815618992 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.815680027 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.815686941 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.817502975 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.817758083 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.817820072 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.818468094 CEST	49859	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.818478107 CEST	443	49859	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.820626974 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.820681095 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.820697069 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.825870037 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.825956106 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.825984955 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.825994968 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.826006889 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.826066971 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.826183081 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.826344013 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.826354027 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.826409101 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.826471090 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827076912 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827147007 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827187061 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827230930 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827240944 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827311993 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827339888 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827450037 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827488899 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827516079 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827523947 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827569962 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827603102 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827610016 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827652931 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827692032 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827696085 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.827706099 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.827732086 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.828180075 CEST	49861	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.828211069 CEST	443	49861	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.828347921 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.828406096 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.828413963 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.828452110 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.828572035 CEST	49862	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.828587055 CEST	443	49862	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.828588009 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.830636024 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.830683947 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.830976009 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.831161976 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.831484079 CEST	49863	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.831499100 CEST	443	49863	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.832307100 CEST	49860	443	192.168.2.4	104.26.3.143
Apr 25, 2024 15:30:40.832339048 CEST	443	49860	104.26.3.143	192.168.2.4
Apr 25, 2024 15:30:40.835532904 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.835633039 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.835680008 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.835689068 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.836236000 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.840596914 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.845607996 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.845664024 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.845671892 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.850326061 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.850383997 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.850399971 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.855123997 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.855217934 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.855247021 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.855256081 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.855307102 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.859755039 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.863055944 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.864223957 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.864274979 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.864285946 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.864471912 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.864487886 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.864980936 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.865257978 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.865336895 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.865374088 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.868732929 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.868829012 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.868920088 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.869127989 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.869136095 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.869282007 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.869368076 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.869388103 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.870560884 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.870974064 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.871149063 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.871279955 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.872977972 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.875164032 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.875224113 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.875231981 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.879512072 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.879568100 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.879576921 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.883754969 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.883822918 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.883831024 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.886338949 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.886384010 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.886392117 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.888967991 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.889023066 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.889035940 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.891561985 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.891613960 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.891623020 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.894160986 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.894228935 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.894236088 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.896866083 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.896919966 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.896928072 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.899375916 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.899477959 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.899493933 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.899532080 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.899576902 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.901840925 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.904339075 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.904412031 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.904419899 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.906939983 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.907016039 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.907028913 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.909324884 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.909408092 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.909415960 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.910543919 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.910618067 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.910626888 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.912115097 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.912131071 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:40.912858009 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.912930965 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.912939072 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.915316105 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.917623997 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.917671919 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.917691946 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.917702913 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.917742014 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.920234919 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.922393084 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.922400951 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.922466040 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.922521114 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.922528982 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.924832106 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.927041054 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.927090883 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.927099943 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.927109957 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.927161932 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.929373980 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.930366993 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.930376053 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.931771040 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.931932926 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.931941986 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.934103966 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.934226036 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.934235096 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.936388969 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.936446905 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.936455965 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.939663887 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.939706087 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.939713955 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.939723969 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.939774036 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.941831112 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.944009066 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.944060087 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.944082975 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.944092035 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.944133997 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.946158886 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.948333025 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.948385954 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.948394060 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.950515985 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.950558901 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.950602055 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.950611115 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.950653076 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.952634096 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.954806089 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.954857111 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.954864979 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.956895113 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.956939936 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.956940889 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.956954002 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.957051039 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.958218098 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:40.958997965 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.961067915 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.961111069 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.961117029 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.961124897 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.961169004 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.963170052 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.965236902 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.965281010 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.965290070 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.966265917 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.966444016 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.966451883 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.968766928 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.968841076 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.968848944 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.970344067 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.970408916 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.970417023 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.972269058 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.972347021 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.972356081 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.974314928 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.974356890 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.974366903 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.976202011 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.976358891 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.976370096 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.978249073 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.978290081 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.978298903 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.980217934 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.980293989 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.980303049 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.982022047 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.982150078 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.982157946 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.984131098 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.984348059 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.984357119 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.985846996 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.985897064 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.985905886 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.987571955 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.987787962 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.987799883 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.987813950 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.988018036 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.988028049 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.988357067 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.988424063 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.989367962 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.989419937 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.990324020 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.990405083 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.990607977 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:40.990616083 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:40.990643024 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.990689039 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.990695953 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.992459059 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.992513895 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.992554903 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.992563009 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.992619991 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.994286060 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.996586084 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.996629000 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.996660948 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.996670961 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.996779919 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.998018980 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.999739885 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.999783993 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.999794006 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:40.999802113 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:40.999849081 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.001390934 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.003016949 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.003058910 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.003065109 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.003076077 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.003113985 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.004652023 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.006283998 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.006325006 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.006331921 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.008258104 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.008306026 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.008307934 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.008321047 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.008368969 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.009378910 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.011085033 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.011130095 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.011163950 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.011173964 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.011326075 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.012523890 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.013992071 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.014029980 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.014035940 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.014045000 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.014094114 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.015775919 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.016993999 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.017030954 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.017039061 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.018461943 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.018534899 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.018542051 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.020219088 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.020279884 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.020287991 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.021560907 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.021605968 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.021619081 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.021626949 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.021775007 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.022799969 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.024262905 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.024312973 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.024321079 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.024327993 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.024370909 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.025618076 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.027007103 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.027060032 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.027066946 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.028400898 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.028455019 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.028460979 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.028470993 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.028506994 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.029721975 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.031090021 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.031133890 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.031163931 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.031173944 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.031213045 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.032635927 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.033837080 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.033898115 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.033947945 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.033957005 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.034291029 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.036070108 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.036317110 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.036379099 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.036386013 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.037599087 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.037652016 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.037659883 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.038875103 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.038919926 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.038923979 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.038932085 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.038980961 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.040065050 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.041317940 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.041358948 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.041359901 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.041371107 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.041405916 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.042562008 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.043880939 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.043929100 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.043939114 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.044150114 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.044194937 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.044579029 CEST	49856	443	192.168.2.4	142.250.105.147
Apr 25, 2024 15:30:41.044595003 CEST	443	49856	142.250.105.147	192.168.2.4
Apr 25, 2024 15:30:41.064541101 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.064732075 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.064760923 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.065983057 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.066068888 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.066947937 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.067056894 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.067084074 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.089582920 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.090168953 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090289116 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090332031 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.090346098 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090435028 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090512037 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.090521097 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090588093 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.090637922 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.090645075 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.094569921 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.094723940 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.094784975 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.094805002 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.094872952 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.094918013 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.094926119 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.095046043 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.095223904 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.095232964 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.097387075 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.097547054 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.097554922 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.101953030 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.102385998 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.102406025 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.104974985 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.105282068 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.105289936 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.109740973 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.109792948 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.109802961 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.112113953 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.112663984 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.112715960 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.112723112 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.117294073 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.117372990 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.117382050 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.189677000 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.189694881 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.189693928 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.189707994 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.189723969 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.189730883 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.199853897 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.199907064 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.199918032 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.203526974 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.203588963 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.203597069 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.204329967 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.204384089 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.204395056 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.208153009 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.208218098 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.208228111 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.211215973 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.211263895 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.211272001 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.215867996 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.215922117 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.215930939 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.218983889 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.219063044 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.219069958 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.223582983 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.223654032 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.223663092 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.226736069 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.226807117 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.226820946 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.231163979 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.231338024 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.231348038 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.234394073 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.234448910 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.234456062 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.239029884 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.239222050 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.239231110 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.242295027 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.242501020 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.242507935 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.244923115 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.244975090 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.244976044 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.244991064 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.245034933 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.246685028 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.246752977 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.246762991 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.249157906 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.249279976 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.249289989 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.251102924 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.251971006 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.252022028 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.253735065 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.253942966 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.253954887 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.256428003 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.256503105 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.256517887 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.260909081 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.261024952 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.261037111 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.263525009 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.266396046 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.266407013 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.267991066 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.270534039 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.270543098 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.270657063 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.270709991 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.270716906 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.275147915 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.275198936 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.275207996 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.276299953 CEST	49870	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.276319027 CEST	443	49870	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.291260958 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.291925907 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.291964054 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.292287111 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.292376041 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.292396069 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.292486906 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.292571068 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292628050 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292697906 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.292700052 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.292705059 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292707920 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292808056 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292856932 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.292857885 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292862892 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.292898893 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.292907000 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.293124914 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.293140888 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.293247938 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.293258905 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.293864012 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.293936968 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.293942928 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.294176102 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294812918 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294821024 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294831991 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294842005 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294845104 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294859886 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.294871092 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294883966 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.294889927 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.294914961 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.295409918 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295417070 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295448065 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295459986 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.295469046 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295478106 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295489073 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295500040 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.295501947 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.295510054 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.295527935 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.296678066 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.296729088 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.296737909 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.309674978 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.309756041 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.309763908 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.312642097 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.312685966 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.312693119 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.314141989 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.314287901 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.314297915 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.317276001 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.317353010 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.317362070 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.318130016 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.318181992 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.318188906 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.322598934 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.322654963 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.322664022 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.323510885 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.323570013 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.323577881 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.327892065 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.328028917 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.328037977 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.328527927 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.328571081 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.328577995 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.332957029 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.333040953 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.333051920 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.333714962 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.333782911 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.333791971 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371567011 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371632099 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.371643066 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371706963 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371757030 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.371768951 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371769905 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371814966 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371819019 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.371826887 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.371851921 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.371859074 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372144938 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372195005 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.372203112 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372222900 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372297049 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.372303009 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372440100 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372499943 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.372505903 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372648001 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372915030 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372958899 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.372963905 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.372965097 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.372972012 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.376378059 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.376430988 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.376439095 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.377924919 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.378000975 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.378010988 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.378041983 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.378087044 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.381356001 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.381406069 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.381413937 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.383033991 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.386375904 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.386454105 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.386467934 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.386478901 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.386528015 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.387837887 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.387890100 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.387897015 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.391346931 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.392832994 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.392884016 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.392890930 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.396292925 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.396347046 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.396354914 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.397597075 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.397645950 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.397654057 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.401139975 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.401196003 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.401204109 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.402421951 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.402476072 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.402484894 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.402493954 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.402538061 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.404946089 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.404958963 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.404992104 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405015945 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405035973 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.405042887 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405067921 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.405087948 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.405488014 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405505896 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405551910 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.405560970 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.405597925 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.406060934 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.406084061 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.406128883 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.406136036 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.406189919 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.406863928 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.406879902 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.406928062 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.406934977 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.407021999 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.407031059 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.407073975 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.407082081 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.407500982 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.410801888 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.410856009 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.410881996 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.410888910 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.411021948 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.412014008 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.412054062 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.412064075 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.412071943 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.412117958 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.415508986 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.415585041 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.415657997 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.415666103 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.416860104 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.420067072 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.420120955 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.420128107 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.421295881 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.421338081 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.421344995 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.424350977 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.424412012 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.424418926 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.425587893 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.425640106 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.425647020 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.428700924 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.428759098 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.428766012 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.429936886 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.430018902 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.430025101 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.431217909 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.431272984 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.431279898 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.433908939 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.433986902 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.434014082 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.434020996 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.434120893 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.434241056 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.434288025 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.434293985 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.436566114 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.436933994 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.436985970 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.436992884 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.438987970 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.439070940 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.439078093 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.439502001 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.439539909 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.439589024 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.439595938 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.439793110 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.441659927 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.441723108 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.441729069 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.442146063 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444363117 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444463968 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444513083 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.444521904 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444653988 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.444714069 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444750071 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.444796085 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.444803953 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.445090055 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.446739912 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.447257042 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.449197054 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.449251890 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.449259043 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.449848890 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.449884892 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.449902058 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.449908972 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.450146914 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.451687098 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.451735020 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.451746941 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.452322006 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.452483892 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.452606916 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.453259945 CEST	49866	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.453278065 CEST	443	49866	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.454144001 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.454190969 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.454199076 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.456692934 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.456767082 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.456773996 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.459223986 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.459294081 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.459300995 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.459534883 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.459579945 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.459768057 CEST	49865	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:41.459779024 CEST	443	49865	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:41.516057968 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516077995 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516153097 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.516165018 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516328096 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.516855955 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516870022 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516916037 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.516922951 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.516959906 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.516973972 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.517559052 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.517573118 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.517627001 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.517632961 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.517739058 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.518204927 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.518219948 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.518280983 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.518287897 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.518420935 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.518867970 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.518882990 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.518940926 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.518948078 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.519031048 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.519465923 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.519480944 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.519526958 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.519531965 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.519578934 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.520425081 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.520438910 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.520489931 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.520503044 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.520734072 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.525059938 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.525424004 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.525435925 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.525470018 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.525907993 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.525916100 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.525985956 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.526470900 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.526508093 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.526588917 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.526849031 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.526928902 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.527251005 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.527354002 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.568120003 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.572124004 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.622432947 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.622451067 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.622545004 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.622564077 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.623523951 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.623558998 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.623572111 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.623620987 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.623626947 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.625499010 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.626224041 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.626236916 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.626283884 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.626290083 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.626318932 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.628418922 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.628432035 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.628504038 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.628509045 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.629445076 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.629532099 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.629544973 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.629592896 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.629596949 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.629650116 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.629769087 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.630590916 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.630609989 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.630647898 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.630654097 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.630686998 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.631139994 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.631182909 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.631187916 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.631196022 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.631228924 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.631230116 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.631244898 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.631274939 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.641376972 CEST	49869	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:41.641391993 CEST	443	49869	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:41.751214981 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.751296043 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.751347065 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.751384020 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.751398087 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.751410961 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.751496077 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.752001047 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.752058029 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.752095938 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.752139091 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.752139091 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.752173901 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.752191067 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.758754015 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.758811951 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.758841038 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.759687901 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.759732962 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.759738922 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.766630888 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.766774893 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.766783953 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.767478943 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.767522097 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.767528057 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.774465084 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.774558067 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.774565935 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.775497913 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.775557041 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.775578976 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.782291889 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.782347918 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.782357931 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.783159018 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.783206940 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.783231020 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.790226936 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.790282965 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.790296078 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.791055918 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.791117907 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.791124105 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.833138943 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:41.833164930 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:41.833220005 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:41.833458900 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:41.833472013 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:41.860971928 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.861013889 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.861032009 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.861041069 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.861161947 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.861927032 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.861989021 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.861998081 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.864804983 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.865729094 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.865777016 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.865782976 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.872689962 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.872729063 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.872755051 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.872762918 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.872884035 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.873533010 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.873581886 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.873584986 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.873598099 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.873646975 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.880476952 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.881423950 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.888317108 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.888355970 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.888384104 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.888392925 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.888784885 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.889300108 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.889374971 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.889383078 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.896197081 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.897058964 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.897115946 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.897121906 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.903991938 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.904037952 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.904057026 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.904062986 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.904848099 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.904896021 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.904901028 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.904923916 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.904930115 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.905785084 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.911859989 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.912692070 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.919388056 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.919506073 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.919512033 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.919524908 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.919572115 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.919591904 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.919634104 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.919878960 CEST	49874	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.919898987 CEST	443	49874	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.920274019 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.920340061 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.920377970 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.920384884 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.920423031 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.925805092 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.925831079 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.925883055 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.926116943 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.926127911 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.927376986 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.934326887 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.934401035 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.934431076 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.934437037 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.935880899 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.941251993 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.948278904 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.948364019 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.948431015 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.948441029 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.948486090 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.955178022 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.962066889 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.962105036 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.962160110 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.962168932 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.962210894 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.968980074 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.975895882 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.975920916 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.975956917 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.975964069 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.976010084 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.981071949 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.985861063 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.985941887 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.986007929 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.986012936 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.986051083 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.990309000 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.994729996 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.994771957 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.994777918 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.994784117 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:41.994813919 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:41.999200106 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.003578901 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.005079985 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.005086899 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.005978107 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.006027937 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.006033897 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.010370970 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.010411978 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.010418892 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.014714003 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.014756918 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.014763117 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.019118071 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.019162893 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.019169092 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.023607969 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.025863886 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.025871038 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.027986050 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.028561115 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.028568029 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.032377958 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.032445908 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.032453060 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.033798933 CEST	49731	80	192.168.2.4	13.32.230.50
Apr 25, 2024 15:30:42.036851883 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.036956072 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.036962032 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.041254044 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.041304111 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.041311026 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.045706987 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.046366930 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.046372890 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.050105095 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.050410032 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.050415993 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.054569006 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.054642916 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.054651976 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.061081886 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.061146021 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.061216116 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.061223030 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.061260939 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.065561056 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.069673061 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.069724083 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.069729090 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.069859982 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.070230961 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.070244074 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.071862936 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.071937084 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.072810888 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.072895050 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.072963953 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.072978973 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.073901892 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.073976040 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.074031115 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.074037075 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.074078083 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.077697039 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.081728935 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.081788063 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.081796885 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.085529089 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.085594893 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.085599899 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.089543104 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.089675903 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.089732885 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.089737892 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.089777946 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.093175888 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.096889973 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.096955061 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.097013950 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.097019911 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.097063065 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.099239111 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.101664066 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.101699114 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.101727962 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.101733923 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.101775885 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.104064941 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.105314970 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.105360985 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.105367899 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.107815027 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.107897043 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.107903004 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.110105038 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.110178947 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.110184908 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.112528086 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.112636089 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.112642050 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.115036011 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.115098953 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.115106106 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.117253065 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.117305994 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.117311954 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.119601011 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.119643927 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.119649887 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.121758938 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.122303963 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.122309923 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.124174118 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.124248028 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.124253035 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.126398087 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.126461029 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.126466036 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.128524065 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.128597021 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.128602028 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.130803108 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.130861044 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.130866051 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.133884907 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.133960009 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.133960009 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.133986950 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.134202957 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.136061907 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.138107061 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.138179064 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.138184071 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.140161991 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.140237093 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.141191006 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.141199112 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.142115116 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.142174006 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.142179966 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.142215014 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.143299103 CEST	80	49731	13.32.230.50	192.168.2.4
Apr 25, 2024 15:30:42.144037962 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.144094944 CEST	49731	80	192.168.2.4	13.32.230.50
Apr 25, 2024 15:30:42.146009922 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.146075010 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.146080017 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.147995949 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.148086071 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.148144960 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.148150921 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.148194075 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.150286913 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.151926994 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.152007103 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.152060032 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.152070999 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.152116060 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.153855085 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.155729055 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.155808926 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.155862093 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.155867100 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.155904055 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.157613993 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.157843113 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.158081055 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.158102989 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.158641100 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.159583092 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.159652948 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.159657955 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.159950972 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.160115957 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.160129070 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.160176992 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.160465002 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.162255049 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.162307024 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.162312984 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.162364006 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.162367105 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.164221048 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.165549040 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.165554047 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.166029930 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.166600943 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.166605949 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.167881966 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.169671059 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.169719934 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.169724941 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.169764042 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.169766903 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.171498060 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.173119068 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.173124075 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.173255920 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.174550056 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.174555063 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.175120115 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.176897049 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.176948071 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.176953077 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.176992893 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.176995993 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.178582907 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.180314064 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.180366993 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.180372000 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.180408955 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.181212902 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.182996988 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.183090925 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.183144093 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.183149099 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.183187962 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.184750080 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.186402082 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.186481953 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.186544895 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.186549902 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.186592102 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.188168049 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.189680099 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.189722061 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.189779997 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.189785004 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.191391945 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.191471100 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.191538095 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.191541910 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.191586971 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.191591024 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.193145990 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.194417000 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.194422960 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.194761992 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.195218086 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.195224047 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.196578026 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.197985888 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.198045015 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.198050022 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.198086023 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.198123932 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.198318005 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.198441982 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.198448896 CEST	443	49875	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.198457956 CEST	49875	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.226162910 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226205111 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.226267099 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226381063 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226412058 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.226564884 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226583004 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.226613998 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226732016 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.226742983 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.298542023 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.327464104 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.327625990 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.327678919 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.330598116 CEST	49878	443	192.168.2.4	104.244.42.136
Apr 25, 2024 15:30:42.330657005 CEST	443	49878	104.244.42.136	192.168.2.4
Apr 25, 2024 15:30:42.358515024 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.358544111 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.358709097 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.359045029 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.359059095 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.381618977 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.381795883 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.381969929 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.383249998 CEST	49879	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:42.383270025 CEST	443	49879	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:42.474649906 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.474888086 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.474920988 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.475008011 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.475061893 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.475080967 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.475256920 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.475267887 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.475965977 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.476051092 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.476331949 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.476383924 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.476489067 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.483654022 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.483850002 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.483870029 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.485373020 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.485443115 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.485764027 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.485838890 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.485882044 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.520128012 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.528143883 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.562438011 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.562495947 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.562567949 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.562791109 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.562819004 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.583105087 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.583501101 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.583518982 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.584650040 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.585257053 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.585417986 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.585428953 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.595000029 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.595024109 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.595052958 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.595062971 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.628120899 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.702711105 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.704997063 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.705020905 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.708856106 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.708930969 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.709300041 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.709552050 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.709564924 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.727170944 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.727212906 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.727232933 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.727282047 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.727282047 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.727296114 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.727329969 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.727385044 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.727394104 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.735605955 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.735658884 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.735667944 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.741442919 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.741492987 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.741532087 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.741564035 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.741580963 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.741596937 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.741621017 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.744175911 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.744250059 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.744257927 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.744328022 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.744335890 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.750106096 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.750173092 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.750179052 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.752152920 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.752737045 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.752793074 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.752801895 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.758764029 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.759387016 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.759394884 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.761317968 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.761483908 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.762240887 CEST	49882	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.762253046 CEST	443	49882	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.767541885 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.767591953 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.767600060 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.767729998 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.767781019 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.767852068 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.768183947 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.768229961 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.791372061 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.791388035 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.791393995 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.793355942 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.793593884 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.793616056 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.794169903 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.794265985 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.795222044 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.795320034 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.795835972 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.795932055 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.796400070 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.796416044 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:42.801716089 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.801906109 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.801999092 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802026987 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.802037001 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802165985 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802186966 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.802196026 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802274942 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.802287102 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802385092 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.802505016 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.804986000 CEST	49884	443	192.168.2.4	151.101.12.157
Apr 25, 2024 15:30:42.804994106 CEST	443	49884	151.101.12.157	192.168.2.4
Apr 25, 2024 15:30:42.827550888 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:42.827624083 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:42.827697992 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:42.828125954 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:42.828157902 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:42.834472895 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:42.834508896 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:42.834570885 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:42.835015059 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:42.835036039 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:42.867285013 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.867326021 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.867434025 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.867456913 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.867520094 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.870951891 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.879930973 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.879960060 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.880060911 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.880070925 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.880141973 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.888727903 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.892250061 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.892307997 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:42.897330999 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.897361040 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.897388935 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.897397995 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.897439003 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.908237934 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.918525934 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.918595076 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.918687105 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.918699026 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.918771029 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.923309088 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.931499004 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.931535006 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.931580067 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.931586981 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.936368942 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.939562082 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:42.939579964 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:42.939651012 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:42.939783096 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.939835072 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:42.939841032 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:42.947834969 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.947870016 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.947941065 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.947952986 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.948359966 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.955827951 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.963901043 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.963941097 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.964015961 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.964027882 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.964369059 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.968967915 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.969175100 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.969309092 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.972070932 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.986355066 CEST	49885	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:42.986376047 CEST	443	49885	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:42.992816925 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.992861032 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.992891073 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.992901087 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:42.993232012 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:42.996040106 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.002779961 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.002831936 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.002882004 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.002890110 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.003405094 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.008388996 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.014096022 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.014126062 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.014235020 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.014241934 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.014317989 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.019741058 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.019928932 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:43.020157099 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:43.020279884 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:43.020946026 CEST	49886	443	192.168.2.4	142.250.9.91
Apr 25, 2024 15:30:43.020972013 CEST	443	49886	142.250.9.91	192.168.2.4
Apr 25, 2024 15:30:43.025429964 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.025485039 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.025547981 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.025557041 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.025603056 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.029067039 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.029294968 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.029311895 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.030414104 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.030771971 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.030889034 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.030900955 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.030951977 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.031085968 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.037096024 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.037133932 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.037183046 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.037189007 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.039387941 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.042463064 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.048544884 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.050972939 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.051012039 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.051027060 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.051038027 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.051053047 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.056788921 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.060230970 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.060237885 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.062407970 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.063452959 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.063460112 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.066050053 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.066337109 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.066354036 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.067781925 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.067894936 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.068039894 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.068232059 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.068238974 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.069991112 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.070077896 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.070111990 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.073759079 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.075385094 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.075403929 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.079391956 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.079442024 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.079448938 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.085124969 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.085207939 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.085213900 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.090573072 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.090610981 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.090658903 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.090667009 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.093842983 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.096076965 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.101325989 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.101468086 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.101516962 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.101524115 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.102401018 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.106398106 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.111495018 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.111548901 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.111598015 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.111604929 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.111649036 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.116125107 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.116396904 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.118834972 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.118891954 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.118900061 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.123799086 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.124475956 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.124481916 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.129127026 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.129173994 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.129182100 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.131691933 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.131827116 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.131833076 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.134680033 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.134721041 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.134730101 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.137670994 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.137753963 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.137762070 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.140774012 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.140836000 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.140845060 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.143610954 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.143687010 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.143695116 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.146819115 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.146861076 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.146867990 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.149506092 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.149560928 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.149568081 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.152282000 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.152343988 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.152349949 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.155143976 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.155195951 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.155200958 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.155246973 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.155296087 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.155589104 CEST	49881	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.155603886 CEST	443	49881	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.165644884 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.165878057 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.165896893 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.167516947 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.167598963 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.168251991 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.172328949 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.172363043 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.172588110 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.172719002 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.172772884 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.173458099 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.175268888 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.175270081 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.175349951 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.175662994 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.181732893 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.181749105 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.181988955 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.182195902 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.182204962 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.192631960 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.193377018 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.193393946 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.216150045 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.252274990 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.252281904 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.286099911 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286223888 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286294937 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.286310911 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286340952 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286408901 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.286421061 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.286457062 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286520004 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.286534071 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.286585093 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.286601067 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.288141966 CEST	49889	443	192.168.2.4	108.177.122.154
Apr 25, 2024 15:30:43.288175106 CEST	443	49889	108.177.122.154	192.168.2.4
Apr 25, 2024 15:30:43.294409037 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.294830084 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.294840097 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.298891068 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.303257942 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.303400993 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.303412914 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.312129974 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.312191963 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.312203884 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.386497974 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387202024 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387223959 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387243032 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387269020 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387300014 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387319088 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387367964 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387387037 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387406111 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387428999 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387444973 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387459993 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387479067 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387743950 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387763977 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387780905 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387805939 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387818098 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387845039 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387891054 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387908936 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387944937 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.387969017 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.387984037 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.406909943 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.406939983 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.407056093 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.407125950 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.407309055 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.407321930 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.407381058 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.407402992 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.407896996 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.410324097 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.410393000 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.410408974 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.410434961 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.410485983 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.410732985 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.410860062 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.410871029 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.414693117 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.423475981 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.423527956 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.423543930 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.425812960 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.425872087 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.425887108 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.425928116 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.425973892 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.426184893 CEST	49888	443	192.168.2.4	192.229.163.25
Apr 25, 2024 15:30:43.426198006 CEST	443	49888	192.229.163.25	192.168.2.4
Apr 25, 2024 15:30:43.432274103 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.432336092 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.432349920 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.433154106 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.433758020 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.434232950 CEST	49891	443	192.168.2.4	104.244.42.72
Apr 25, 2024 15:30:43.434245110 CEST	443	49891	104.244.42.72	192.168.2.4
Apr 25, 2024 15:30:43.437129021 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.437160015 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.437323093 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.437510967 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.437522888 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.441142082 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.441211939 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.441242933 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.441253901 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.442354918 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.449996948 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.452112913 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.458837986 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.458901882 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.458908081 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.458930969 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.458972931 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.467559099 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.475501060 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.475565910 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.475620031 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.475631952 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.477242947 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.483561993 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.488019943 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.491657972 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.491713047 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.491765022 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.491795063 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.493448019 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.499522924 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.507559061 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.507652998 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.507709026 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.507742882 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.508344889 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.515566111 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.535082102 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.535165071 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.535222054 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.535242081 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.536348104 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.538049936 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.544346094 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.544419050 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.544428110 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.544455051 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.544507980 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.549928904 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.555493116 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.555571079 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.555634022 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.555654049 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.558773994 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.561183929 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.561376095 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.561446905 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.561461926 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.567045927 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.567708969 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.568378925 CEST	49887	443	192.168.2.4	173.194.219.113
Apr 25, 2024 15:30:43.568394899 CEST	443	49887	173.194.219.113	192.168.2.4
Apr 25, 2024 15:30:43.631983995 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.632215977 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.632227898 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.633249998 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.633316040 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.633631945 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.633690119 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.633780956 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.634140968 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.634289026 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.634382010 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.634447098 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.634478092 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.634526968 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.634565115 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.641398907 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.641478062 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.641535044 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.641551018 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.642363071 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.649204016 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.656738043 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.656785011 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.656847954 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.656857014 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.656930923 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.664433002 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.664783001 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.672847986 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.672882080 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.674022913 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.674807072 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.675033092 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.675044060 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.675112963 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.680113077 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.736906052 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.736922979 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.736973047 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.743855000 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.743921995 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.743951082 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.747534037 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.747596979 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.747608900 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.755350113 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.755436897 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.755455971 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.762890100 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.762970924 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.763003111 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.770646095 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.770740986 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.770754099 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.770991087 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.771069050 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.771765947 CEST	49892	443	192.168.2.4	142.250.105.101
Apr 25, 2024 15:30:43.771781921 CEST	443	49892	142.250.105.101	192.168.2.4
Apr 25, 2024 15:30:43.800520897 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:43.800560951 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:43.800659895 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:43.802066088 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:43.802081108 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:43.858890057 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.858999014 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.859486103 CEST	49893	443	192.168.2.4	142.250.105.157
Apr 25, 2024 15:30:43.859507084 CEST	443	49893	142.250.105.157	192.168.2.4
Apr 25, 2024 15:30:43.932317019 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.932409048 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:43.932470083 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.933235884 CEST	49894	443	192.168.2.4	104.244.42.8
Apr 25, 2024 15:30:43.933286905 CEST	443	49894	104.244.42.8	192.168.2.4
Apr 25, 2024 15:30:44.034080982 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.034358025 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.034372091 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.034919024 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.035366058 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.035446882 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.035550117 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.076143026 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.296468973 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.296547890 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.296575069 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.296958923 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.297015905 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.297151089 CEST	49895	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.297168970 CEST	443	49895	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.311738968 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.311759949 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.311815023 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.312043905 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.312057018 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.312485933 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.312530994 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.312596083 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.312745094 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.312761068 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.537513018 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.537790060 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.537818909 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.538377047 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.538769960 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.538852930 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.538945913 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.543915033 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.544132948 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.544147968 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.544704914 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.545036077 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.545113087 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.545171976 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.584120989 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.588120937 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.765799046 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.765866041 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.765913010 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.765913010 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.765939951 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.765973091 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.765980005 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.770098925 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.770220995 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.770277977 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.770293951 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.770447969 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.770497084 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.770504951 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.772931099 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.772990942 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.773005009 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.777632952 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.777698040 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.777707100 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.780608892 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.780656099 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.780668974 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.781019926 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.781070948 CEST	443	49902	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.781116962 CEST	49902	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.785132885 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.785244942 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.785253048 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.792861938 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.792912960 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.792921066 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.804049969 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.804137945 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.804151058 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.809063911 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.809123039 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.809132099 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.880016088 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.880094051 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.880110979 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.883716106 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.883773088 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.883780956 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.891450882 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.891510963 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.891524076 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.899270058 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.899322987 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.899332047 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.909822941 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.909910917 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.909914017 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.909944057 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.909990072 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.916747093 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.922909975 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.922960997 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.922972918 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.930187941 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.930243015 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.930249929 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.937680006 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.937733889 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.937742949 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.944634914 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.944685936 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.944694042 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.951574087 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.951630116 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.951637030 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.958508015 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.958563089 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.958570004 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.965548992 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.965606928 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.965615988 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.972539902 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.972603083 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.972614050 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.979470015 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.979527950 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.979535103 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.986373901 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.986443996 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.986450911 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.993335009 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.993396997 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.993405104 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.999751091 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:44.999816895 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:44.999825001 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.005714893 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.005763054 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.005773067 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.005954027 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.005997896 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.006005049 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.011470079 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.011524916 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.011533976 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.016809940 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.016866922 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.016879082 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.021776915 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.021859884 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.021869898 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.028902054 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.028987885 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.029000998 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.037990093 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.038042068 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.038053036 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.040602922 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.040674925 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.040683031 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.043240070 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.043304920 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.043312073 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.047955990 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.048042059 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.048079014 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.048089027 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.048135996 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.052712917 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.057674885 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.057749033 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.057759047 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.064321041 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.064374924 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.064383984 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.069360018 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.069426060 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.069434881 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.073940992 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.073996067 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.074003935 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.078644037 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.078705072 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.078712940 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.082696915 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.082751036 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.082757950 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.086937904 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.087023020 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.087028980 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.089060068 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.089142084 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.089159966 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.093097925 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.093154907 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.093168020 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.097287893 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.097352982 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.097361088 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.103868008 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.103952885 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.103960037 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.106414080 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.106489897 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.106506109 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.106532097 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.106578112 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.110152006 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.113980055 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.114054918 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.114063025 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.114088058 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.114130020 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.116275072 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.118772030 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.118855000 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.118868113 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.121063948 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.121129036 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.121135950 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.123502970 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.123565912 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.123573065 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.125874996 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.125941992 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.125950098 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.127165079 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.127227068 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.127233982 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.129607916 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.129676104 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.129683018 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.131917953 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.131989956 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.131998062 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.134396076 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.134468079 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.134475946 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.136815071 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.136884928 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.136893034 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.139180899 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.139251947 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.139260054 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.141565084 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.141634941 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.141643047 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.141767025 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:45.141820908 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.142086029 CEST	49901	443	192.168.2.4	64.233.176.93
Apr 25, 2024 15:30:45.142101049 CEST	443	49901	64.233.176.93	192.168.2.4
Apr 25, 2024 15:30:46.452780962 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:46.452904940 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:46.452960014 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:46.544214964 CEST	49777	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:30:46.544234037 CEST	443	49777	64.233.177.104	192.168.2.4
Apr 25, 2024 15:30:50.311598063 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.311639071 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.311717987 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.313150883 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.313183069 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.313282013 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.313374043 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.313397884 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.313460112 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.313867092 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.316427946 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.316441059 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.316555977 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.316570044 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.316649914 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.316663027 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.423433065 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.423521996 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.423763037 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.533226013 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.547735929 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.547748089 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.547827959 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.547888994 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.548069000 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.548237085 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.550091982 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.550102949 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.550436974 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.551167965 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.551181078 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.551570892 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.552809954 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.552825928 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.553184986 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.581442118 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.581604958 CEST	49913	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.592139006 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.596405983 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.602467060 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.602484941 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.603581905 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.644126892 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.644131899 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.648122072 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.666001081 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.666033030 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.666109085 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.677608967 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.763137102 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:50.763230085 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.763616085 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.765317917 CEST	80	49913	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:50.765388012 CEST	49913	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.769165039 CEST	49913	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.787087917 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.920706034 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.920866966 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.920886993 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.920953035 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.920964003 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921108961 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921161890 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921180010 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921247005 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921248913 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921293974 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921339989 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921382904 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921396017 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921431065 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921483040 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921519995 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921555042 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921577930 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921611071 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921628952 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921678066 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921688080 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921705961 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921760082 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.921771049 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.921840906 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.922501087 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922555923 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922609091 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922612906 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.922637939 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922657013 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922688961 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.922691107 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.922734976 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.923378944 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.923437119 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.923528910 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.923547983 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.923566103 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.923583031 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.923614025 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.923621893 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924393892 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924413919 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924451113 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.924482107 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.924498081 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924549103 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924567938 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.924608946 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.924657106 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925035000 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.925261021 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925306082 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925352097 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925371885 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.925389051 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925404072 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.925412893 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926316977 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926373959 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.926378965 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926423073 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926460981 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926475048 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.926498890 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926537991 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.926552057 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.926587105 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.927095890 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.927136898 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.927177906 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.927196980 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.927217960 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.927269936 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.927272081 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.927310944 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928057909 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928097010 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928097010 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.928157091 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928170919 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.928170919 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928210020 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928226948 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.928247929 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928322077 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.928950071 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.928991079 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.929028034 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.929064989 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.929080009 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.929102898 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.929143906 CEST	80	49912	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:50.929153919 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.929198980 CEST	49912	80	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:50.945343971 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:50.945400953 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:50.952868938 CEST	80	49913	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:50.960829973 CEST	80	49913	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:50.960892916 CEST	49913	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:51.001751900 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.001900911 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.001962900 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.001981974 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.002060890 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.002111912 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.002119064 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.002250910 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.002315998 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.006614923 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.006731033 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.006807089 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.007492065 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007551908 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007591963 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.007595062 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007611036 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007651091 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.007662058 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007801056 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007839918 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.007844925 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.007857084 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.008080006 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.008088112 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.008435011 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.008480072 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.019798040 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.019814014 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.019851923 CEST	49909	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.019857883 CEST	443	49909	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.020278931 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.020304918 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.020508051 CEST	49910	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:51.020514011 CEST	443	49910	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:51.127052069 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:51.176872015 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:51.176950932 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:51.177079916 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:51.194968939 CEST	49908	80	192.168.2.4	23.224.25.138
Apr 25, 2024 15:30:51.376612902 CEST	80	49908	23.224.25.138	192.168.2.4
Apr 25, 2024 15:30:54.244474888 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:54.244501114 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:54.244513035 CEST	49911	443	192.168.2.4	104.26.2.143
Apr 25, 2024 15:30:54.244518995 CEST	443	49911	104.26.2.143	192.168.2.4
Apr 25, 2024 15:30:58.238549948 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.238631964 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:58.238723040 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.239275932 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.239311934 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:58.664449930 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:58.664524078 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.669306040 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.669328928 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:58.669737101 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:58.684314013 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:58.732157946 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.069905043 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.069981098 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070024014 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070086956 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070143938 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070180893 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070199013 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070203066 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070229053 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070262909 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070270061 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070270061 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070296049 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070350885 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.070364952 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070451975 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.070847034 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.076785088 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.076821089 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:30:59.076848984 CEST	49914	443	192.168.2.4	13.85.23.86
Apr 25, 2024 15:30:59.076863050 CEST	443	49914	13.85.23.86	192.168.2.4
Apr 25, 2024 15:31:11.541004896 CEST	49724	80	192.168.2.4	199.232.210.172
Apr 25, 2024 15:31:11.650219917 CEST	80	49724	199.232.210.172	192.168.2.4
Apr 25, 2024 15:31:11.650288105 CEST	80	49724	199.232.210.172	192.168.2.4
Apr 25, 2024 15:31:11.650368929 CEST	49724	80	192.168.2.4	199.232.210.172
Apr 25, 2024 15:31:36.181509018 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:36.181607962 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.181699038 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:36.182061911 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:36.182096958 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.407035112 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.411262035 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:36.411294937 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.411590099 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.419198990 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:36.419287920 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:36.471823931 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:46.457556963 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:46.457633972 CEST	443	49916	64.233.177.104	192.168.2.4
Apr 25, 2024 15:31:46.457684040 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:47.072782040 CEST	49916	443	192.168.2.4	64.233.177.104
Apr 25, 2024 15:31:47.072849989 CEST	443	49916	64.233.177.104	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 15:30:23.104454041 CEST	138	138	192.168.2.4	192.168.2.255
Apr 25, 2024 15:30:32.110753059 CEST	61396	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:32.110894918 CEST	50782	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:32.220869064 CEST	53	62653	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:32.222076893 CEST	53	50782	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:32.222976923 CEST	53	57982	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:32.223599911 CEST	53	61396	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:32.882714033 CEST	53	65030	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:33.043350935 CEST	58174	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:33.043620110 CEST	61306	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:33.044260025 CEST	55993	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:33.044594049 CEST	59247	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:33.153446913 CEST	53	58174	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:33.153682947 CEST	53	61306	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:33.157200098 CEST	53	55993	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:33.158310890 CEST	53	59247	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:33.923858881 CEST	61643	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:33.927531958 CEST	61992	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:34.034120083 CEST	53	61643	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:34.037601948 CEST	53	61992	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.114417076 CEST	56608	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.114698887 CEST	59529	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.224714041 CEST	53	56608	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.224756002 CEST	53	59529	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.403099060 CEST	52022	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.403286934 CEST	53891	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.407825947 CEST	53642	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.408198118 CEST	64158	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.515523911 CEST	53	52022	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.516310930 CEST	53	53891	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.520149946 CEST	53	53642	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.521073103 CEST	53	64158	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.567918062 CEST	65484	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.568104982 CEST	49291	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:36.678066015 CEST	53	65484	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:36.678281069 CEST	53	49291	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.233014107 CEST	51728	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.233171940 CEST	50810	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.343816042 CEST	53	51728	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.343857050 CEST	53	53279	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.348485947 CEST	53	64485	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.348571062 CEST	53	50810	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.788181067 CEST	57272	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.788503885 CEST	51405	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.789218903 CEST	54018	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.789352894 CEST	53233	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.898521900 CEST	53	57272	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.899545908 CEST	53	53233	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.900567055 CEST	53	54018	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:39.979609013 CEST	65172	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:39.980007887 CEST	49349	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.089581966 CEST	53	65172	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.090611935 CEST	53	49349	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.545727968 CEST	53008	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.545859098 CEST	49649	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.614794970 CEST	54713	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.614943981 CEST	60501	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.651727915 CEST	64997	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.652086973 CEST	59922	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:40.655886889 CEST	53	53008	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.656666994 CEST	53	49649	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.659992933 CEST	53	60979	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.762041092 CEST	53	59922	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:40.762383938 CEST	53	64997	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:41.625431061 CEST	53	50764	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:41.722572088 CEST	53235	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:41.722722054 CEST	59014	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:41.832566023 CEST	53	59014	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:41.832592010 CEST	53	53235	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.114634991 CEST	50931	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.114865065 CEST	56599	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.223206043 CEST	53	54408	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.224770069 CEST	53	56599	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.225764990 CEST	53	50931	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.364312887 CEST	58876	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.364517927 CEST	57857	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.451421022 CEST	49574	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.451590061 CEST	55138	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.474193096 CEST	53	58876	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.474390030 CEST	53	57857	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.561642885 CEST	53	49574	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.561819077 CEST	53	55138	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.722431898 CEST	53120	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.722594023 CEST	55476	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.828548908 CEST	60666	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.828695059 CEST	52369	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:42.832685947 CEST	53	53120	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.833996058 CEST	53	55476	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.836289883 CEST	53	55598	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.938664913 CEST	53	52369	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:42.939059019 CEST	53	60666	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:43.295803070 CEST	61564	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:43.295977116 CEST	54202	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:43.405841112 CEST	53	61564	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:43.406084061 CEST	53	54202	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:43.406395912 CEST	55883	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:43.406524897 CEST	56427	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:43.516597986 CEST	53	55883	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:43.516877890 CEST	53	56427	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:43.911159992 CEST	53	54476	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:44.504682064 CEST	53	65476	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:49.947767973 CEST	53	51109	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:50.063605070 CEST	58362	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:50.196460009 CEST	59316	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:50.196739912 CEST	57966	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:30:50.307952881 CEST	53	59316	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:50.309196949 CEST	53	57966	1.1.1.1	192.168.2.4
Apr 25, 2024 15:30:50.577286959 CEST	53	58362	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:05.736952066 CEST	49743	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:31:05.849380970 CEST	53	49743	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:09.567586899 CEST	53	59328	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:24.518975973 CEST	51718	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:31:24.629884958 CEST	53	51718	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:31.710444927 CEST	53	54367	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:32.323560953 CEST	53	63478	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:44.364367962 CEST	50598	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:31:44.475337029 CEST	53	50598	1.1.1.1	192.168.2.4
Apr 25, 2024 15:31:59.290872097 CEST	53	50791	1.1.1.1	192.168.2.4
Apr 25, 2024 15:32:14.237135887 CEST	62316	53	192.168.2.4	1.1.1.1
Apr 25, 2024 15:32:14.348227978 CEST	53	62316	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 15:30:32.110753059 CEST	192.168.2.4	1.1.1.1	0xc1d8	Standard query (0)	www.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:32.110894918 CEST	192.168.2.4	1.1.1.1	0xe	Standard query (0)	www.wisecleaner.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:33.043350935 CEST	192.168.2.4	1.1.1.1	0x2db3	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.043620110 CEST	192.168.2.4	1.1.1.1	0x307b	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:33.044260025 CEST	192.168.2.4	1.1.1.1	0xfb1b	Standard query (0)	pdf.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.044594049 CEST	192.168.2.4	1.1.1.1	0x1b2b	Standard query (0)	pdf.wisecleaner.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:33.923858881 CEST	192.168.2.4	1.1.1.1	0x8c5b	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.927531958 CEST	192.168.2.4	1.1.1.1	0x8d90	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Apr 25, 2024 15:30:36.114417076 CEST	192.168.2.4	1.1.1.1	0x8588	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.114698887 CEST	192.168.2.4	1.1.1.1	0xa09c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:36.403099060 CEST	192.168.2.4	1.1.1.1	0xc779	Standard query (0)	pdf.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.403286934 CEST	192.168.2.4	1.1.1.1	0x9879	Standard query (0)	pdf.wisecleaner.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:36.407825947 CEST	192.168.2.4	1.1.1.1	0xdcdb	Standard query (0)	www.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.408198118 CEST	192.168.2.4	1.1.1.1	0xe700	Standard query (0)	www.wisecleaner.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:36.567918062 CEST	192.168.2.4	1.1.1.1	0xa8dc	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.568104982 CEST	192.168.2.4	1.1.1.1	0x4477	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Apr 25, 2024 15:30:39.233014107 CEST	192.168.2.4	1.1.1.1	0x5014	Standard query (0)	cse.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.233171940 CEST	192.168.2.4	1.1.1.1	0xe508	Standard query (0)	cse.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:39.788181067 CEST	192.168.2.4	1.1.1.1	0x9e45	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.788503885 CEST	192.168.2.4	1.1.1.1	0xeb77	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:39.789218903 CEST	192.168.2.4	1.1.1.1	0xc159	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.789352894 CEST	192.168.2.4	1.1.1.1	0x593	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:39.979609013 CEST	192.168.2.4	1.1.1.1	0x767e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.980007887 CEST	192.168.2.4	1.1.1.1	0xdecd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:40.545727968 CEST	192.168.2.4	1.1.1.1	0xa977	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.545859098 CEST	192.168.2.4	1.1.1.1	0xa811	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:40.614794970 CEST	192.168.2.4	1.1.1.1	0x4aa3	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.614943981 CEST	192.168.2.4	1.1.1.1	0x7995	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:40.651727915 CEST	192.168.2.4	1.1.1.1	0x2709	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.652086973 CEST	192.168.2.4	1.1.1.1	0xc95a	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:41.722572088 CEST	192.168.2.4	1.1.1.1	0x85de	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:41.722722054 CEST	192.168.2.4	1.1.1.1	0x31c	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:42.114634991 CEST	192.168.2.4	1.1.1.1	0x26f2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.114865065 CEST	192.168.2.4	1.1.1.1	0xb586	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:42.364312887 CEST	192.168.2.4	1.1.1.1	0x70d3	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.364517927 CEST	192.168.2.4	1.1.1.1	0x43fc	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:42.451421022 CEST	192.168.2.4	1.1.1.1	0x4127	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.451590061 CEST	192.168.2.4	1.1.1.1	0xa804	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:42.722431898 CEST	192.168.2.4	1.1.1.1	0x9962	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.722594023 CEST	192.168.2.4	1.1.1.1	0x9fb1	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 15:30:42.828548908 CEST	192.168.2.4	1.1.1.1	0x7ca5	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.828695059 CEST	192.168.2.4	1.1.1.1	0xa389	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:43.295803070 CEST	192.168.2.4	1.1.1.1	0x8adb	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.295977116 CEST	192.168.2.4	1.1.1.1	0x5ed3	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 15:30:43.406395912 CEST	192.168.2.4	1.1.1.1	0x47db	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.406524897 CEST	192.168.2.4	1.1.1.1	0x5bd5	Standard query (0)	twitter.com	65	IN (0x0001)	false
Apr 25, 2024 15:30:50.063605070 CEST	192.168.2.4	1.1.1.1	0x8cc7	Standard query (0)	www.wisecleaner.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.196460009 CEST	192.168.2.4	1.1.1.1	0xd758	Standard query (0)	www.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.196739912 CEST	192.168.2.4	1.1.1.1	0xc3b0	Standard query (0)	info.wisecleaner.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:05.736952066 CEST	192.168.2.4	1.1.1.1	0x1a38	Standard query (0)	www.wisecleaner.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:24.518975973 CEST	192.168.2.4	1.1.1.1	0x9700	Standard query (0)	www.wisecleaner.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:44.364367962 CEST	192.168.2.4	1.1.1.1	0xf9af	Standard query (0)	www.wisecleaner.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:32:14.237135887 CEST	192.168.2.4	1.1.1.1	0x8f7	Standard query (0)	www.wisecleaner.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 15:30:32.222076893 CEST	1.1.1.1	192.168.2.4	0xe	No error (0)	www.wisecleaner.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:32.223599911 CEST	1.1.1.1	192.168.2.4	0xc1d8	No error (0)	www.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:32.223599911 CEST	1.1.1.1	192.168.2.4	0xc1d8	No error (0)	www.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:32.223599911 CEST	1.1.1.1	192.168.2.4	0xc1d8	No error (0)	www.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.153446913 CEST	1.1.1.1	192.168.2.4	0x2db3	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:33.153446913 CEST	1.1.1.1	192.168.2.4	0x2db3	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.153682947 CEST	1.1.1.1	192.168.2.4	0x307b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:33.157200098 CEST	1.1.1.1	192.168.2.4	0xfb1b	No error (0)	pdf.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.157200098 CEST	1.1.1.1	192.168.2.4	0xfb1b	No error (0)	pdf.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.157200098 CEST	1.1.1.1	192.168.2.4	0xfb1b	No error (0)	pdf.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:33.158310890 CEST	1.1.1.1	192.168.2.4	0x1b2b	No error (0)	pdf.wisecleaner.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:34.034120083 CEST	1.1.1.1	192.168.2.4	0x8c5b	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:34.034120083 CEST	1.1.1.1	192.168.2.4	0x8c5b	No error (0)	scontent.xx.fbcdn.net		31.13.88.13	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:34.037601948 CEST	1.1.1.1	192.168.2.4	0x8d90	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224714041 CEST	1.1.1.1	192.168.2.4	0x8588	No error (0)	www.google.com		64.233.177.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.224756002 CEST	1.1.1.1	192.168.2.4	0xa09c	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:36.515523911 CEST	1.1.1.1	192.168.2.4	0xc779	No error (0)	pdf.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.515523911 CEST	1.1.1.1	192.168.2.4	0xc779	No error (0)	pdf.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.515523911 CEST	1.1.1.1	192.168.2.4	0xc779	No error (0)	pdf.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.516310930 CEST	1.1.1.1	192.168.2.4	0x9879	No error (0)	pdf.wisecleaner.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:36.520149946 CEST	1.1.1.1	192.168.2.4	0xdcdb	No error (0)	www.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.520149946 CEST	1.1.1.1	192.168.2.4	0xdcdb	No error (0)	www.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.520149946 CEST	1.1.1.1	192.168.2.4	0xdcdb	No error (0)	www.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.521073103 CEST	1.1.1.1	192.168.2.4	0xe700	No error (0)	www.wisecleaner.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:36.678066015 CEST	1.1.1.1	192.168.2.4	0xa8dc	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:36.678066015 CEST	1.1.1.1	192.168.2.4	0xa8dc	No error (0)	scontent.xx.fbcdn.net		31.13.88.13	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:36.678281069 CEST	1.1.1.1	192.168.2.4	0x4477	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.101	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.113	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.139	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.343816042 CEST	1.1.1.1	192.168.2.4	0x5014	No error (0)	cse.google.com		142.250.9.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898463011 CEST	1.1.1.1	192.168.2.4	0xeb77	No error (0)	platform.twitter.com	cs472.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898463011 CEST	1.1.1.1	192.168.2.4	0xeb77	No error (0)	cs472.wac.edgecastcdn.net	cs1-apr-8315.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898463011 CEST	1.1.1.1	192.168.2.4	0xeb77	No error (0)	cs1-apr-8315.wac.edgecastcdn.net	wac.apr-8315.edgecastdns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898463011 CEST	1.1.1.1	192.168.2.4	0xeb77	No error (0)	cs1-lb-us.8315.ecdns.net	cs41.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898521900 CEST	1.1.1.1	192.168.2.4	0x9e45	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.898521900 CEST	1.1.1.1	192.168.2.4	0x9e45	No error (0)	platform.twitter.map.fastly.net		151.101.12.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.899545908 CEST	1.1.1.1	192.168.2.4	0x593	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:39.900567055 CEST	1.1.1.1	192.168.2.4	0xc159	No error (0)	plus.l.google.com		142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.089581966 CEST	1.1.1.1	192.168.2.4	0x767e	No error (0)	www.google.com		142.250.105.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.090611935 CEST	1.1.1.1	192.168.2.4	0xdecd	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.101	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.139	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.113	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.655886889 CEST	1.1.1.1	192.168.2.4	0xa977	No error (0)	www3.l.google.com		64.233.176.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.656666994 CEST	1.1.1.1	192.168.2.4	0xa811	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.724781036 CEST	1.1.1.1	192.168.2.4	0x4aa3	No error (0)	platform.twitter.com	cs472.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.724781036 CEST	1.1.1.1	192.168.2.4	0x4aa3	No error (0)	cs472.wac.edgecastcdn.net	cs1-apr-8315.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.724781036 CEST	1.1.1.1	192.168.2.4	0x4aa3	No error (0)	cs1-apr-8315.wac.edgecastcdn.net	wac.apr-8315.edgecastdns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.724781036 CEST	1.1.1.1	192.168.2.4	0x4aa3	No error (0)	cs1-lb-us.8315.ecdns.net	cs491.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.724781036 CEST	1.1.1.1	192.168.2.4	0x4aa3	No error (0)	cs491.wac.edgecastcdn.net		192.229.163.25	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.725198030 CEST	1.1.1.1	192.168.2.4	0x7995	No error (0)	platform.twitter.com	cs472.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.725198030 CEST	1.1.1.1	192.168.2.4	0x7995	No error (0)	cs472.wac.edgecastcdn.net	cs1-apr-8315.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.725198030 CEST	1.1.1.1	192.168.2.4	0x7995	No error (0)	cs1-apr-8315.wac.edgecastcdn.net	wac.apr-8315.edgecastdns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.725198030 CEST	1.1.1.1	192.168.2.4	0x7995	No error (0)	cs1-lb-us.8315.ecdns.net	cs491.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762041092 CEST	1.1.1.1	192.168.2.4	0xc95a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762041092 CEST	1.1.1.1	192.168.2.4	0xc95a	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.176.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		173.194.219.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		142.250.105.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.177.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.176.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		173.194.219.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.176.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		142.250.105.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.177.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.177.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.176.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		172.253.124.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		172.253.124.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		142.250.105.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		64.233.177.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:40.762383938 CEST	1.1.1.1	192.168.2.4	0x2709	No error (0)	youtube-ui.l.google.com		142.250.105.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:41.832592010 CEST	1.1.1.1	192.168.2.4	0x85de	No error (0)	syndication.twitter.com		104.244.42.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.224770069 CEST	1.1.1.1	192.168.2.4	0xb586	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.113	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.101	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.225764990 CEST	1.1.1.1	192.168.2.4	0x26f2	No error (0)	plus.l.google.com		173.194.219.139	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.474193096 CEST	1.1.1.1	192.168.2.4	0x70d3	No error (0)	syndication.twitter.com		104.244.42.8	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.9.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		74.125.136.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		74.125.136.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		172.253.124.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		74.125.136.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.105.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.105.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.105.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		142.250.105.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		74.125.136.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		172.253.124.190	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		172.253.124.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		64.233.176.136	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561642885 CEST	1.1.1.1	192.168.2.4	0x4127	No error (0)	youtube-ui.l.google.com		172.253.124.93	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561819077 CEST	1.1.1.1	192.168.2.4	0xa804	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:42.561819077 CEST	1.1.1.1	192.168.2.4	0xa804	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 25, 2024 15:30:42.832685947 CEST	1.1.1.1	192.168.2.4	0x9962	No error (0)	stats.g.doubleclick.net		108.177.122.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.832685947 CEST	1.1.1.1	192.168.2.4	0x9962	No error (0)	stats.g.doubleclick.net		108.177.122.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.832685947 CEST	1.1.1.1	192.168.2.4	0x9962	No error (0)	stats.g.doubleclick.net		108.177.122.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.832685947 CEST	1.1.1.1	192.168.2.4	0x9962	No error (0)	stats.g.doubleclick.net		108.177.122.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:42.939059019 CEST	1.1.1.1	192.168.2.4	0x7ca5	No error (0)	syndication.twitter.com		104.244.42.72	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.405841112 CEST	1.1.1.1	192.168.2.4	0x8adb	No error (0)	stats.g.doubleclick.net		142.250.105.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.405841112 CEST	1.1.1.1	192.168.2.4	0x8adb	No error (0)	stats.g.doubleclick.net		142.250.105.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.405841112 CEST	1.1.1.1	192.168.2.4	0x8adb	No error (0)	stats.g.doubleclick.net		142.250.105.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.405841112 CEST	1.1.1.1	192.168.2.4	0x8adb	No error (0)	stats.g.doubleclick.net		142.250.105.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:43.516597986 CEST	1.1.1.1	192.168.2.4	0x47db	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.307952881 CEST	1.1.1.1	192.168.2.4	0xd758	No error (0)	www.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.307952881 CEST	1.1.1.1	192.168.2.4	0xd758	No error (0)	www.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.307952881 CEST	1.1.1.1	192.168.2.4	0xd758	No error (0)	www.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.309196949 CEST	1.1.1.1	192.168.2.4	0xc3b0	No error (0)	info.wisecleaner.com		104.26.2.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.309196949 CEST	1.1.1.1	192.168.2.4	0xc3b0	No error (0)	info.wisecleaner.com		172.67.68.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.309196949 CEST	1.1.1.1	192.168.2.4	0xc3b0	No error (0)	info.wisecleaner.com		104.26.3.143	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:30:50.577286959 CEST	1.1.1.1	192.168.2.4	0x8cc7	No error (0)	www.wisecleaner.net	mailserver.wisecleaner.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:30:50.577286959 CEST	1.1.1.1	192.168.2.4	0x8cc7	No error (0)	mailserver.wisecleaner.net		23.224.25.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:05.849380970 CEST	1.1.1.1	192.168.2.4	0x1a38	No error (0)	www.wisecleaner.net	mailserver.wisecleaner.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:31:05.849380970 CEST	1.1.1.1	192.168.2.4	0x1a38	No error (0)	mailserver.wisecleaner.net		23.224.25.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:24.629884958 CEST	1.1.1.1	192.168.2.4	0x9700	No error (0)	www.wisecleaner.net	mailserver.wisecleaner.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:31:24.629884958 CEST	1.1.1.1	192.168.2.4	0x9700	No error (0)	mailserver.wisecleaner.net		23.224.25.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:31:44.475337029 CEST	1.1.1.1	192.168.2.4	0xf9af	No error (0)	www.wisecleaner.net	mailserver.wisecleaner.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:31:44.475337029 CEST	1.1.1.1	192.168.2.4	0xf9af	No error (0)	mailserver.wisecleaner.net		23.224.25.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:32:14.348227978 CEST	1.1.1.1	192.168.2.4	0x8f7	No error (0)	www.wisecleaner.net	mailserver.wisecleaner.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:32:14.348227978 CEST	1.1.1.1	192.168.2.4	0x8f7	No error (0)	mailserver.wisecleaner.net		23.224.25.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

www.wisecleaner.com

https:

www.facebook.com

pdf.wisecleaner.com

static.xx.fbcdn.net

apis.google.com

platform.twitter.com

www.google.com

www.youtube.com

syndication.twitter.com

stats.g.doubleclick.net

info.wisecleaner.com

ocsps.ssl.com

www.wisecleaner.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49739	52.6.97.148	80

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 15:30:21.328923941 CEST	369	OUT	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCEG1SGHCH6CNNhWAA0ICPk1Y%3D HTTP/1.1 Cache-Control: max-age = 86400 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Nov 2023 17:37:40 GMT If-None-Match: "be34871fa05e0a45e7d6f78f5d8828db47b667ba" User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsps.ssl.com
Apr 25, 2024 15:30:21.451482058 CEST	322	IN	HTTP/1.1 304 Not Modified Server: nginx Date: Thu, 25 Apr 2024 13:30:21 GMT Connection: close Expires: Fri, 01 Nov 2024 17:37:39 GMT ETag: "be34871fa05e0a45e7d6f78f5d8828db47b667ba" Last-Modified: Tue, 07 Nov 2023 17:37:40 GMT Cache-Control: max-age=86400,public,no-transform,must-revalidate X-Proxy-Cache: HIT

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49740	52.6.97.148	80

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 15:30:21.700556040 CEST	371	OUT	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D HTTP/1.1 Cache-Control: max-age = 86400 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Nov 2023 17:37:47 GMT If-None-Match: "4ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267" User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsps.ssl.com
Apr 25, 2024 15:30:21.823102951 CEST	322	IN	HTTP/1.1 304 Not Modified Server: nginx Date: Thu, 25 Apr 2024 13:30:21 GMT Connection: close Expires: Fri, 01 Nov 2024 17:37:46 GMT ETag: "4ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267" Last-Modified: Tue, 07 Nov 2023 17:37:47 GMT Cache-Control: max-age=86400,public,no-transform,must-revalidate X-Proxy-Cache: HIT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49912	104.26.2.143	80	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 15:30:50.423763037 CEST	174	OUT	GET /info_group/index.php?to=getinfonew&pid=15 HTTP/1.1 Connection: Keep-Alive Accept-Charset: utf-8 User-Agent: Embarcadero URI Client/1.0 Host: info.wisecleaner.com
Apr 25, 2024 15:30:50.666001081 CEST	1157	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: PHPSESSID=ailq7c8pkr83vka7j9u3upmkk2; expires=Thu, 25-Apr-2024 15:30:50 GMT; Max-Age=7200; path=/ Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jUSzBaGx6jdJyFjkrK1hDLdd%2FGQu3u0Prolc%2BcpoaIBPfeW3vwunXZkyKXoobHpJkURUwIKOcLea%2Bxut6U5fKvbrZzgMPuKZh5cCSGSrvj6VoXRBWT%2FbupGloaAjm68sA3Vf1D8O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0a18b618bbc-ATL Data Raw: 31 34 36 0d 0a 7b 22 73 65 72 76 65 72 74 69 6d 65 22 3a 20 22 32 30 32 34 2d 30 34 2d 32 35 22 2c 20 22 61 64 73 22 3a 5b 7b 22 69 64 22 3a 22 31 39 33 22 2c 22 70 69 64 22 3a 22 31 35 22 2c 22 65 78 70 69 72 65 22 3a 22 32 30 32 34 2d 30 34 2d 33 30 22 2c 22 74 69 74 6c 65 22 3a 22 57 69 73 65 20 50 44 46 20 45 64 69 74 6f 72 22 2c 22 74 69 70 22 3a 22 46 72 65 65 20 50 44 46 20 52 65 61 64 65 72 22 2c 22 6c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 70 64 66 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 2c 22 69 6d 67 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 69 6e 66 6f 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 69 6e 66 6f 5f 67 72 6f 75 70 5c 2f 69 6d 61 67 65 73 5c 2f 32 30 32 34 5c 2f 30 34 5c 2f 31 32 5c 2f 30 31 32 30 35 35 36 37 30 2e 70 6e 67 22 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 22 2c 22 73 74 61 72 74 64 61 74 65 22 3a 22 32 30 31 38 2d 30 31 2d 30 31 22 2c 22 6c 69 66 65 74 69 6d 65 22 3a 22 30 22 2c 22 73 74 61 74 75 73 22 3a 22 31 22 7d 5d 7d 0d 0a Data Ascii: 146{"servertime": "2024-04-25", "ads":[{"id":"193","pid":"15","expire":"2024-04-30","title":"Wise PDF Editor","tip":"Free PDF Reader","link":"https:\/\/pdf.wisecleaner.com","img":"http:\/\/info.wisecleaner.com\/info_group\/images\/2024\/04\/12\/012055670.png","language":"","startdate":"2018-01-01","lifetime":"0","status":"1"}]}
Apr 25, 2024 15:30:50.666033030 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 25, 2024 15:30:50.677608967 CEST	152	OUT	GET /info_group/images/2024/04/12/012055670.png HTTP/1.1 Connection: Keep-Alive User-Agent: Embarcadero URI Client/1.0 Host: info.wisecleaner.com
Apr 25, 2024 15:30:50.920706034 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:50 GMT Content-Type: image/png Content-Length: 84047 Connection: keep-alive Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: status=not_needed ETag: "1484f-615df6fa63aad" Last-Modified: Fri, 12 Apr 2024 05:20:55 GMT Vary: Accept CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y8ZiOOx1neeq9jD30ows056n2esfgCwmx68kvg1HYlmycPIizGXlo9RSWI8O9%2B3yFx6v5105LgCMeY%2FqEmRIWTjKiTNSjUbGXBFlO6%2F%2FZOP3Opq7UlH053w%2BQl2OgvU8BnJryAjw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0a31fca8bbc-ATL Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 00 f0 08 03 00 00 00 2d bd 56 bc 00 00 02 fd 50 4c 54 45 00 00 00 4e b4 c0 70 67 8f 6f 66 8e 52 95 a8 5a e2 e2 6e 6b 96 4e cd d2 44 aa b2 ff ff ff 00 7a ff 76 6c 92 6d 67 8e 6d 6d 98 6d 6a 93 61 e6 e5 54 d8 d9 57 db dc 52 d5 d7 59 de df 65 e6 e5 4c bd c7 6f 70 9d 62 e3 e2 5d e3 e3 5b e1 e1 51 d0 d4 72 69 90 59 d3 d7 4a b9 c2 6a e6 e5 46 a9 b2 9f d7 da 70 e6 e5 5e d8 da 4e c9 cf 46 a1 aa 71 66 8c 7d e4 e3 77 e5 e4 62 de e0 47 af b7 4f c3 cd 9e da de 99 db df 53 cb d3 44 a5 ad 7a 6f 96 f6 f9 fb 4c 9b a9 55 be c8 4c c3 c9 75 d0 d8 6f 9e be 6a e2 e1 66 99 b9 a5 a7 bf 85 72 95 94 db dc 52 b7 c4 49 b5 bd 60 d0 d5 ad 88 9f 84 78 9d a2 86 a2 9a 82 a1 4c a2 af 5b c9 d2 7e 74 9a a2 d4 d6 74 dd db 56 c5 ce 91 d6 df 89 cb dc 7d dc db 00 75 ff a6 a1 b8 8b db df 77 c4 d6 6b d4 d8 a7 8e a5 5b b4 c8 8f 7d 9e 8e 76 97 73 76 a3 66 bc cb ec f4 f7 6b cb d4 60 96 b2 a4 d0 d1 a3 cb cc 97 79 99 a0 ac c5 6e c0 d1 74 d7 df 7d d8 e0 64 85 9f 90 de e2 79 91 ad 94 a2 b8 87 d5 df 79 8c 9f 9f a3 bc 80 c8 d8 5f 61 85 72 e1 e0 92 93 b2 ab 96 ae 68 db da 65 8c ac 9f 8c aa 5b c0 ce 58 5a 7b 85 de e0 77 a7 c2 9a a5 c2 7e d3 d5 a0 7c 99 88 b4 c4 87 d7 d8 65 c5 d2 70 8e a5 56 98 ae 98 9a b9 50 a9 b4 a7 81 9b 7e b1 c4 8f ca df 73 7b ac 9c ab b4 92 d5 d6 b8 a3 ae 8e c5 d7 7d 6d 92 68 86 a6 59 b9 c0 52 54 72 94 d0 dc 50 b0 ba 84 8a 99 a1 96 b0 a8 b0 b0 80 83 95 6c 93 ae 7e c7 ce 86 7e a5 e6 ee f0 7b 84 a9 92 bb d3 70 83 9e 87 8c ab 83 99 a3 83 94 b3 8b d0 d2 71 89 ad 89 c6 cc 97 8a 93 92 b0 bc 80 cd dc 9b d1 d2 64 67 8f 8b 9b b9 a7 c6 c5 b5 9b af e0 e5 e8 53 4e 68 71 9a b4 a9 d8 de Data Ascii: PNGIHDR-VPLTENpgofRZnkNDzvlmgmmmjaTWRYeLopb][QriYJjFp^NFqf}wbGOSDzoLULuojfrRI`xL[~ttV}uwk[}vsvfk`ynt}dyy_arhe[XZ{w~\|epVP~s{}mhYRTrPl~~{pqdgSNhq
Apr 25, 2024 15:30:50.920866966 CEST	1289	IN	Data Raw: 9f b4 bb 7b 9e af 84 95 c3 9a b6 c3 90 bc c7 70 9b a5 5b b0 b8 9a a2 b1 7c 8c bd 8c a4 ac b4 92 a9 67 bb bf 8e 96 cc 88 c2 dd 70 83 b7 73 b5 d2 99 c8 d7 a9 be bb 6c ac b3 b1 a4 b9 a7 a1 a6 95 9f cf 7f 9d b9 8f 9f c3 75 b8 bc a4 93 98 83 b6 d9 8c Data Ascii: {p[\|gpslu~p[}~sargsrj\|mqiNz3atO\gNhdxq3_CX
Apr 25, 2024 15:30:50.920886993 CEST	1289	IN	Data Raw: 23 08 60 e3 f1 74 8f 86 fb ec 23 0e 35 65 e9 80 e3 39 e2 93 ca 57 77 fe 77 25 71 e2 c7 d2 7f 22 d9 5b ab 38 cc 64 ef 9c 0e 68 27 dd 8b 16 51 9a 67 af 54 4f 5e aa e2 e9 ce 27 cc 76 75 46 69 d7 a0 3d 0e f7 a8 f3 b0 91 37 0a a0 81 83 82 78 4c c5 12 Data Ascii: #`t#5e9Www%q"[8dh'QgTO^'vuFi=7xL/!>tB.lGqp!"5l]AqYw(Zl=GR(UI.z-<~rR/ aO4p4P4rCW;Q*G
Apr 25, 2024 15:30:50.920953035 CEST	1289	IN	Data Raw: 22 13 5e 24 dc ab 3d 3f 21 bc 81 e2 bf a7 ce d3 f1 3e c3 f1 aa 80 3b bd 1b cd bd 6e cc 6a c8 f5 d0 78 9e 2a f7 04 57 0d 55 20 e6 40 8a df a5 dc 81 19 a0 a5 dc d5 bb b6 e1 ce d5 85 de d1 ed 85 3b 09 f5 4b 09 93 55 25 51 32 91 56 b7 97 9a b2 9c 57 Data Ascii: "^$=?!>;njxWU @;KU%Q2VWgfcS#@$[yR3I)>4;YDG6Jl)HHMB8U~oT(6eR=&:r??$:UNPXHTNS5
Apr 25, 2024 15:30:50.921161890 CEST	1289	IN	Data Raw: e5 de 6a 3c d4 b3 c3 e4 2a cc 68 2a fe 2d c1 17 64 59 ca dc 6a b7 70 54 6a 93 4c ab 5b a6 3b 84 4d 16 ee c6 76 a4 aa 76 85 f9 5e 81 70 cf 9e 3b a0 13 68 e7 7a 07 62 12 e5 1f 6d 5f 4a f9 33 d0 14 40 06 64 4f 63 08 9c c6 00 7c 32 68 38 95 b9 85 01 Data Ascii: j<h-dYjpTjL[;Mvv^p;hzbm_J3@dOc\|2h8)aha(,zQ0Vm^@A{yVuvdSC/<]>==w`!I]=~?mh22#=~;qr.}0]j(t`\Yvi{YXy
Apr 25, 2024 15:30:50.921180010 CEST	1289	IN	Data Raw: bb f2 aa 59 77 08 f7 54 3f dd 1c 74 47 09 a5 71 f0 85 c9 a5 7a b3 70 7c 22 67 53 ee 41 f7 8c f7 f3 eb 59 c8 21 6c ff f3 fb e5 78 54 b8 27 06 b8 27 b3 51 b2 6b 94 a1 94 e7 f1 39 c8 7e b5 70 ae 3f c9 1f 8f 40 3c dc 77 fd 4b 74 8e 3c 8a a4 c3 94 7b Data Ascii: YwT?tGqzp\|"gSAY!lxT''Qk9~p?@<wKt<{1mFw2;vz{\|E"&mj;alBT')wJ~sgwO2={vk@&{;x86$-txvR=d-J=h&h*$)y u!Y?o$\|
Apr 25, 2024 15:30:50.921248913 CEST	1289	IN	Data Raw: e5 92 a1 5d a2 fb cb d8 d9 bc 36 56 85 61 9c 01 37 77 e7 27 7e 10 b5 46 e9 c4 3a 91 18 4b 16 d6 6c 1a 9c 4a a0 96 59 34 45 41 25 e0 a6 10 28 85 60 8a 14 17 dd 04 ba 0a dd 95 2e dc 08 dd 48 37 dd 75 d5 55 0b 2d b8 97 d0 a5 e4 7f c8 ca e7 fd be f7 Data Ascii: ]6Va7w'~F:KlJY4EA%(`.H7uU-sNn:3gf~9;y1,;_Cus_Zq?}EXa6w0zS@;})FY`D>^l'/s's}1q?dNe&4['
Apr 25, 2024 15:30:50.921293974 CEST	1289	IN	Data Raw: 58 51 96 e9 8a 80 75 26 fb 2e 06 66 0a 78 c7 fb 07 c4 c3 0f 16 e7 fd 16 77 d9 10 dc c3 ba 2b d9 9d ed 95 0e b4 c6 12 ba af 40 49 59 e6 73 e0 fd 43 0b 87 21 66 3b f9 76 88 e1 7e 77 7e 8e 7f 96 e1 ae 39 82 d0 5d 93 04 e9 f0 c4 40 98 c0 6c 67 b0 0f Data Ascii: XQu&.fxw+@IYsC!f;v~w~9]@lgE!{Jy#KKO0G`Us{]FNZ!^%+L)\|-=.Sc;.=q[=qgN+1&&,)]YTFhqfug;@&m\|~<
Apr 25, 2024 15:30:50.921339989 CEST	1289	IN	Data Raw: a7 e7 e7 37 7b 07 d9 ac 5d 5b 9c cf fa b5 d6 e2 7c 3e 6f d5 9e ce fb f3 79 1f ff 85 9f e6 f3 dd 4a b5 df ef cf f1 9f ed a8 40 77 52 e0 bd e4 dc a1 30 ee fb 87 cc f7 f1 13 88 3e 11 d4 d4 aa 0c 37 00 01 9e d4 bb 8f 11 74 57 e3 2e 49 71 31 2b 86 c0 Data Ascii: 7{][\|>oyJ@wR0>7tW.Iq1+u8HD&0pOL~)'QX&wRq_a_8w.]!lB{Ei)Uawz]r QQNthP\|nwT^I{ly
Apr 25, 2024 15:30:50.921382904 CEST	1289	IN	Data Raw: 1d d3 3b c0 a2 61 26 6e b1 00 7c f4 0a 80 ee 96 7e 94 9d fb 5a ae fa 68 cd d1 18 e6 db cd b9 bf 22 ed 32 5f e4 9d fb d9 d9 d9 21 5e 63 16 07 aa 6b 3b 02 f7 d0 a0 0d b2 93 9e 0f 85 ed e1 db 05 ee 6a de fb fd d1 dd 6d 76 9b fd fd 67 63 9a 9d dc 4d Data Ascii: ;a&n\|~Zh"2_!^ck;jmvgcMod5lilgplls]~#+O^<HDZrq\|]G=Jw b8-\|4;!pM8w$LEg/=S+Pv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49908	23.224.25.138	80	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 15:30:50.763616085 CEST	334	OUT	POST /install_statistics/index.php?p=install_statistics HTTP/1.0 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 82 Host: www.wisecleaner.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Apr 25, 2024 15:30:50.945400953 CEST	82	OUT	Data Raw: 70 72 6f 64 75 63 74 5f 76 65 72 3d 36 2e 36 36 2e 36 33 36 26 70 72 6f 64 75 63 74 5f 69 64 3d 31 26 67 75 5f 69 64 3d 25 37 42 30 30 32 38 30 46 46 30 2d 38 34 34 34 2d 34 35 38 39 2d 41 42 42 31 2d 30 37 41 35 42 39 32 34 37 45 30 42 25 37 44 Data Ascii: product_ver=6.66.636&product_id=1&gu_id=%7B00280FF0-8444-4589-ABB1-07A5B9247E0B%7D
Apr 25, 2024 15:30:51.176872015 CEST	198	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 13:30:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49913	23.224.25.138	80	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 15:30:50.769165039 CEST	191	OUT	GET /wisecleaner_feedback/index.php?to=fetch-unread-message&guid={00280FF0-8444-4589-ABB1-07A5B9247E0B} HTTP/1.1 Accept-Charset: utf-8 Host: www.wisecleaner.net Cache-Control: no-cache
Apr 25, 2024 15:30:50.960829973 CEST	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 13:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Data Raw: 32 0d 0a 5b 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2[]0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PwDlxXseu3VEHbh&MD=lcm7x2Bz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 13:30:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6b14d282-981b-483b-abc0-11ae40dbfa03 MS-RequestId: 8ce51810-c5d8-4737-a50c-aec486c42a70 MS-CV: nQg/r4rI9kSNnRg4.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 13:30:20 GMT Connection: close Content-Length: 24490
2024-04-25 13:30:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 13:30:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:32 UTC	698	OUT	GET /thanks-for-choosing-WiseCare365.html HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:32 UTC	606	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close last-modified: Sun, 07 Apr 2024 01:07:37 GMT vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lNzVteb7R75DlpHJ18CPc4GLK%2F8BcbQMb17T77azDay2Waw9MlgC5Wo7g%2FT7M7dPXJa6qTOFsWuOEpMJ5%2BKI4lu0wYyWu%2Bb7wEa90p9brueJjcCo2mnZFiL%2FzgN3gtB80619i1w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0322cf806e2-ATL
2024-04-25 13:30:32 UTC	763	IN	Data Raw: 37 64 34 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 43 68 72 6f 6d 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 69 6e 69 74 69 61 6c Data Ascii: 7d40<!DOCTYPE html><html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge,Chrome=1"><meta name="viewport" content="width=device-width,height=device-height,initial
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 61 74 69 63 2f 63 73 73 2f 6c 61 79 6f 75 74 2e 63 73 73 3f 76 3d 31 2e 32 34 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 61 74 69 63 2f 63 73 73 2f 6c 61 79 6f 75 74 2d 6d 6f 62 69 6c 65 2e 63 73 73 3f 76 3d 31 2e 30 38 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 61 74 69 63 2f 63 73 73 2f 72 6f 62 6f 74 6f 2e 63 73 73 3f 76 3d 31 2e 30 37 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 61 74 69 63 2f 70 61 67 65 2f 70 72 6f 64 75 63 74 2f 75 70 64 61 74 65 2f 75 70 64 61 74 65 2e 63 73 73 22 20 Data Ascii: el="stylesheet" href="/static/css/layout.css?v=1.24" /><link rel="stylesheet" href="/static/css/layout-mobile.css?v=1.08" /><link rel="stylesheet" href="/static/css/roboto.css?v=1.07" /><link rel="stylesheet" href="/static/page/product/update/update.css"
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 67 2f 63 6f 6d 6d 6f 6e 2f 69 63 6f 6e 5f 67 65 72 6d 61 6e 79 2e 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 20 61 6c 74 3d 22 69 63 6f 6e 20 67 65 72 6d 61 6e 79 22 3e 3c 2f 69 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 6e 61 6d 65 22 3e 44 65 75 74 73 63 68 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 70 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 3e 0a 3c 69 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 69 6d 67 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 69 6d 67 2f 63 6f 6d 6d 6f 6e 2f 69 63 6f 6e 5f 6a 61 70 61 6e 2e 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 Data Ascii: g/common/icon_germany.svg" width="28" height="28" alt="icon germany"></i><span class="site-name">Deutsch</span></a><a class="select-site-li" href="https://jp.wisecleaner.com"><i class="site-img"><img src="/static/img/common/icon_japan.svg" width="28"
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 6e 65 72 2d 70 72 6f 64 75 63 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 73 69 6e 67 6c 65 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 74 69 74 6c 65 22 3e 41 6c 6c 2d 49 6e 2d 4f 6e 65 20 50 72 6f 64 75 63 74 73 3c 2f 70 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 77 69 73 65 2d 63 61 72 65 2d 33 36 35 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 53 79 73 74 65 6d 20 43 6c 65 61 6e 65 72 20 61 6e 64 20 53 70 65 65 64 20 75 70 20 54 6f 6f 6c 22 3e 3c 69 20 63 6c 61 73 73 3d 22 61 72 74 69 63 6c 65 2d 69 63 6f 6e 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 43 61 72 65 20 33 36 35 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 70 20 Data Ascii: ner-product"><div class="menu-inner-single"><p class="menu-inner-title">All-In-One Products</p><a class="menu-inner-link" href="/wise-care-365.html" title="System Cleaner and Speed up Tool"><i class="article-icon"></i><span>Wise Care 365</span></a><p
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 74 6c 65 3d 22 43 6c 65 61 72 20 61 6e 64 20 4f 70 74 69 6d 69 7a 65 20 57 69 6e 64 6f 77 73 20 52 65 67 69 73 74 72 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 77 72 63 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 52 65 67 69 73 74 72 79 20 43 6c 65 61 6e 65 72 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 77 69 73 65 2d 64 69 73 6b 2d 63 6c 65 61 6e 65 72 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 43 6c 65 61 72 20 61 6e 64 20 46 72 65 65 20 75 70 20 44 69 73 6b 20 53 70 61 63 65 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 77 64 63 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 44 69 73 6b 20 43 6c 65 61 6e 65 72 3c 2f Data Ascii: tle="Clear and Optimize Windows Registry"><i class="product-wrc"></i><span>Wise Registry Cleaner</span></a><a class="menu-inner-link" href="/wise-disk-cleaner.html" title="Clear and Free up Disk Space"><i class="product-wdc"></i><span>Wise Disk Cleaner</
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 63 68 65 63 6b 69 74 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 46 72 65 65 20 57 69 6e 64 6f 77 73 20 31 31 20 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 20 43 68 65 63 6b 20 54 6f 6f 6c 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 43 68 65 63 6b 69 74 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 43 68 65 63 6b 69 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 6f 79 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 20 74 69 74 6c 65 3d 22 41 20 73 65 74 20 6f 66 20 75 74 69 6c 69 74 69 65 73 20 66 6f Data Ascii: -link" href="/checkit.html" title="Free Windows 11 Compatibility Check Tool"><i class="product-Checkit"></i><span>Checkit</span></a><a class="menu-inner-link" href="https://toys.wisecleaner.com" target="_blank" rel="noopener" title="A set of utilities fo
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 46 69 6e 64 20 57 69 6e 64 6f 77 73 20 26 20 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 20 6b 65 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 77 77 6b 66 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 57 69 6e 64 6f 77 73 20 4b 65 79 20 46 69 6e 64 65 72 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 73 69 6e 67 6c 65 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 74 69 74 6c 65 22 3e 41 49 20 55 74 69 6c 69 74 69 65 73 3c 2f 70 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 69 2e 77 69 73 65 63 6c 65 61 6e 65 Data Ascii: html" title="Find Windows & Office Product key"><i class="product-wwkf"></i><span>Wise Windows Key Finder</span></a></div><div class="menu-inner-single"><p class="menu-inner-title">AI Utilities</p><a class="menu-inner-link" href="https://ai.wisecleane
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 69 6f 6e 20 54 6f 6f 6c 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 77 76 63 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 77 69 73 65 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6c 6c 2d 46 6f 72 6d 61 74 73 20 4d 65 64 69 61 20 50 6c 61 79 65 72 20 66 6f 72 20 57 69 6e 64 6f 77 73 22 3e 3c 69 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 77 76 70 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 57 69 73 65 20 56 69 64 65 6f 20 50 6c 61 79 65 72 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c Data Ascii: ion Tool"><i class="product-wvc"></i><span>Wise Video Converter</span></a><a class="menu-inner-link" href="/wise-video-player.html" title="All-Formats Media Player for Windows"><i class="product-wvp"></i><span>Wise Video Player</span></a></div></div><
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 65 72 2d 70 61 73 73 77 6f 72 64 2d 62 61 63 6b 2e 68 74 6d 6c 22 3e 3c 69 20 63 6c 61 73 73 3d 22 73 75 70 70 6f 72 74 2d 69 63 6f 6e 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 46 6f 72 67 6f 74 20 57 46 48 20 4c 6f 67 69 6e 20 50 61 73 77 6f 72 64 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 73 69 6e 67 6c 65 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 74 69 74 6c 65 22 3e 57 69 73 65 43 6c 65 61 6e 65 72 20 46 6f 72 75 6d 3c 2f 70 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 72 75 6d 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f Data Ascii: er-password-back.html"><i class="support-icon"></i><span>Forgot WFH Login Pasword</span></a></div><div class="menu-inner-single"><p class="menu-inner-title">WiseCleaner Forum</p><a class="menu-inner-link" href="https://forum.wisecleaner.com/index.php?
2024-04-25 13:30:32 UTC	1369	IN	Data Raw: 72 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 73 69 6e 67 6c 65 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 74 69 74 6c 65 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 70 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 6e 6e 65 72 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 6c 61 6e 67 75 61 67 65 2e 68 74 6d 6c 22 3e 3c 69 20 63 6c 61 73 73 3d 22 73 75 70 70 6f 72 74 2d 69 63 6f 6e 22 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 4c 61 6e 67 75 61 67 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 6d 65 6e 75 Data Ascii: r Products</span></a></div><div class="menu-inner-single"><p class="menu-inner-title">Language</p><a class="menu-inner-link" href="/language.html"><i class="support-icon"></i><span>Languages</span></a></div></div></div></li> <li class="header-menu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	593	OUT	GET /static/css/reset.css HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	743	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 3744 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=3957 etag: "f75-5e70882f6e3bf-gzip" last-modified: Thu, 25 Aug 2022 03:37:06 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 55210 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ohKJXGdxlXfIdxog2NlAJHVWULJEtLK99%2Fi%2F6EyLFbX5mcUphLsWEek7rnIdPsZ8xo233UUI7cebukoeV9Y3Pi0Ysz%2FcT0nzxfIKwSrq9aCN6C%2FPjxaeMzd1Yp6BTp%2FmWmn4i1E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb036fdefaddd-ATL
2024-04-25 13:30:33 UTC	626	IN	Data Raw: 62 6f 64 79 2c 62 75 74 74 6f 6e 2c 64 64 2c 64 6c 2c 64 74 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 72 2c 69 6e 70 75 74 2c 6c 69 2c 6f 6c 2c 70 2c 70 72 65 2c 74 64 2c 74 65 78 74 61 72 65 61 2c 74 68 2c 75 6c 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 62 6f 64 79 2c 68 74 6d 6c 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c Data Ascii: body,button,dd,dl,dt,h1,h2,h3,h4,h5,h6,hr,input,li,ol,p,pre,td,textarea,th,ul{margin:0;padding:0;border:0;vertical-align:baseline;font-weight:400}body,html{-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:transparent;-webkit-font-smoothing:antial
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 6c 65 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 30 39 66 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 69 6d 67 2c 73 76 67 7b 62 6f 72 64 65 72 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 2d 6d 73 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 6d 6f 64 65 3a 62 69 63 75 62 69 63 7d 74 61 62 6c 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 63 6f 6c 6c 61 70 73 65 3b 62 6f 72 64 65 72 2d 73 70 61 63 69 6e 67 3a 30 7d 68 72 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 6f 72 64 65 Data Ascii: le:none}a{background:0;text-decoration:none;cursor:pointer;color:#09f}a:active,a:hover{outline:0;text-decoration:none}img,svg{border:0;vertical-align:middle;-ms-interpolation-mode:bicubic}table{border-collapse:collapse;border-spacing:0}hr{height:1px;borde
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 3b 68 65 69 67 68 74 3a 30 7d 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 74 6f 70 7b 74 6f 70 3a 32 70 78 7d 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 62 6f 78 2d 31 30 7b 77 69 64 74 68 3a 31 30 70 78 3b 68 65 69 67 68 74 3a 31 30 70 78 7d 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 62 6f 78 2d 31 30 20 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 62 6f 74 74 6f 6d 2c 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 62 6f 78 2d 31 30 20 2e 62 6f 74 74 6f 6d 2d 61 72 72 6f 77 2d 74 6f 70 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 35 70 78 20 23 66 66 66 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 35 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 20 64 61 73 68 65 64 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 35 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 20 64 61 Data Ascii: ;height:0}.bottom-arrow-top{top:2px}.bottom-arrow-box-10{width:10px;height:10px}.bottom-arrow-box-10 .bottom-arrow-bottom,.bottom-arrow-box-10 .bottom-arrow-top{border-top:5px #fff solid;border-right:5px transparent dashed;border-bottom:5px transparent da
2024-04-25 13:30:33 UTC	380	IN	Data Raw: 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 63 66 65 7d 2e 70 6f 70 75 70 2d 66 61 64 65 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 61 6e 69 6d 61 74 69 6f 6e 3a 70 6f 70 75 70 2d 66 61 64 65 69 6e 20 2e 35 73 3b 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 62 6f 74 68 7d 2e 70 6f 70 75 70 2d 66 61 64 65 6f 75 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 61 6e 69 6d 61 74 69 6f 6e 3a 70 6f 70 75 70 2d 66 61 64 65 6f 75 74 20 2e 35 73 3b 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 62 6f 74 68 7d 40 6b 65 79 66 72 61 6d 65 73 20 70 6f 70 75 70 2d 66 61 64 65 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 29 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b Data Ascii: kground-color:#fafcfe}.popup-fadein{display:block;animation:popup-fadein .5s;animation-fill-mode:both}.popup-fadeout{display:block;animation:popup-fadeout .5s;animation-fill-mode:both}@keyframes popup-fadein{0%{opacity:0;transform:scale(0)}100%{opacity:1;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	601	OUT	GET /static/css/layout.css?v=1.24 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	750	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 11215 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=11786 etag: "2e0a-6166e7f1f9eda-gzip" last-modified: Fri, 19 Apr 2024 08:01:35 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 40641 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=paUsXtoRWLcv8jLh46%2F2RpXx%2Bn7lp2%2BFr06SYXNNccQ3did5C1d%2F0B%2FqOyBNRh%2BZHhPwPuBZHgDlHGu3djpqoTvGi1771CE5beLiJG1IILkJ293o1l5X%2F8f8fydwLblbJMqmBUU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb036fa07456a-ATL
2024-04-25 13:30:33 UTC	619	IN	Data Raw: 2e 70 61 67 65 2d 77 69 64 74 68 7b 6d 61 78 2d 77 69 64 74 68 3a 31 32 30 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 7d 2e 68 65 61 64 65 72 2d 77 72 61 70 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 39 30 30 30 3b 68 65 69 67 68 74 3a 39 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 65 61 64 65 72 2d 62 6f 78 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 31 32 30 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 68 65 61 64 65 72 2d 6c 69 6e 6b 2d 61 63 74 69 76 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 2d 31 35 33 70 78 3b 74 6f 70 3a 2d 34 38 70 78 3b 68 65 69 67 68 74 3a 39 30 70 78 3b 77 69 64 74 68 3a Data Ascii: .page-width{max-width:1200px;margin:0 auto}.header-wrap{position:relative;z-index:9000;height:90px;background-color:#fff}.header-box{margin:0 auto;max-width:1200px;height:100%}.header-link-active{position:absolute;right:-153px;top:-48px;height:90px;width:
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 32 38 70 78 7d 2e 68 65 61 64 65 72 2d 6e 61 76 2d 62 6f 78 20 61 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 38 70 78 3b 63 6f 6c 6f 72 3a 23 31 66 32 32 33 38 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 77 72 61 70 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6c 65 66 74 3a 2d 31 35 70 78 3b 77 69 64 74 68 3a 31 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 66 32 32 33 38 7d 2e 73 65 6c 65 63 74 2d 73 69 74 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 70 78 3b 70 61 64 64 69 Data Ascii: fy-content:center;align-items:center;height:28px}.header-nav-box a{margin-right:28px;color:#1f2238;font-size:14px}.select-site-wrap{position:relative;left:-15px;width:122px;color:#1f2238}.select-site{position:relative;display:flex;padding-right:20px;paddi
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 74 6f 70 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 73 74 61 72 74 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 37 65 37 65 37 7d 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 20 2e 73 69 74 65 2d 6e 61 6d 65 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 Data Ascii: top:5px;padding-bottom:5px;padding-left:16px;width:100%;cursor:pointer;justify-content:flex-start;align-items:center}.select-site-li:hover{background-color:#e7e7e7}.select-site-li .site-name{white-space:nowrap}.header-menu{padding-top:1px;display:flex;jus
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 2c 2e 67 73 63 2d 69 6e 70 75 74 2d 62 6f 78 2d 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 73 65 61 72 63 68 20 74 61 62 6c 65 20 69 6e 70 75 74 7b 63 6f 6c 6f 72 3a 23 62 37 62 37 62 37 3b 70 61 64 64 69 6e 67 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 65 64 65 64 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 31 30 70 78 7d Data Ascii: ,.gsc-input-box-focus{background-color:transparent!important;border:0!important;padding:0!important}.header-menu-search table input{color:#b7b7b7;padding:0!important;margin:0!important;border:1px solid #dedede!important;border-radius:4px;text-indent:10px}
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 6c 6f 73 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 61 72 72 6f 77 2d 77 72 61 70 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 72 69 67 68 74 3a 2d 38 70 78 3b 74 6f 70 3a 2d 31 70 78 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 68 6f 76 65 72 20 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 61 72 72 6f 77 2d 77 72 61 70 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 2e 6d 65 6e 75 2d 69 6e 6e 65 72 2d 77 72 61 70 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 2e 68 65 61 64 65 72 Data Ascii: lose{display:none}.header-menu-arrow-wrap{display:inline-block;position:relative;right:-8px;top:-1px}.header-menu-hover .header-menu-arrow-wrap svg{transition:all .3s}.header-menu-hover:hover .menu-inner-wrap{display:block}.header-menu-hover:hover .header
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 70 6f 73 69 74 69 6f 6e 3a 2d 33 32 70 78 20 2d 33 32 70 78 7d 2e 70 72 6f 64 75 63 74 2d 77 70 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 39 36 70 78 20 2d 33 32 70 78 7d 2e 70 72 6f 64 75 63 74 2d 77 6d 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 32 70 78 20 2d 36 34 70 78 7d 2e 70 72 6f 64 75 63 74 2d 77 67 62 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 39 36 70 78 7d 2e 70 72 6f 64 75 63 74 2d 77 73 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 36 34 70 78 20 2d 39 36 70 78 7d 2e 70 72 6f 64 75 63 74 2d 77 70 31 73 74 41 69 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 32 70 78 20 2d 31 32 38 70 78 7d 2e 70 72 6f 64 75 63 Data Ascii: position:-32px -32px}.product-wpu{background-position:-96px -32px}.product-wmo{background-position:-32px -64px}.product-wgb{background-position:0 -96px}.product-wsm{background-position:-64px -96px}.product-wp1stAid{background-position:-32px -128px}.produc
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 6e 75 2d 69 6e 6e 65 72 2d 61 72 74 69 63 6c 65 73 20 2e 6d 65 6e 75 2d 69 6e 6e 65 72 2d 73 69 6e 67 6c 65 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 30 70 78 7d 2e 6d 65 6e 75 2d 69 6e 6e 65 72 2d 61 72 74 69 63 6c 65 73 20 69 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 35 70 78 3b 68 65 69 67 68 74 3a 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 39 64 39 64 39 7d 2e 6d 65 6e 75 2d 69 6e 6e 65 72 2d 61 72 74 69 63 6c 65 73 20 73 70 61 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 66 6f 6f 74 65 72 2d 6e 61 76 2d 77 72 61 70 7b 70 61 64 64 69 6e 67 3a 37 30 70 78 20 30 3b 62 61 63 6b 67 72 Data Ascii: nu-inner-articles .menu-inner-single:first-child{padding-right:50px}.menu-inner-articles i{margin-left:20px;width:5px;height:5px;border-radius:100%;background-color:#d9d9d9}.menu-inner-articles span{padding-left:10px}.footer-nav-wrap{padding:70px 0;backgr
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 66 6f 6f 74 65 72 2d 6e 61 76 2d 6e 65 77 73 6c 65 74 74 65 72 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 66 6f 6f 74 65 72 2d 6e 61 76 2d 6e 65 77 73 6c 65 74 74 65 72 2d 74 65 78 74 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 62 30 62 32 62 62 7d 2e 66 6f 6f 74 65 72 2d 6e 61 76 2d 6e 65 77 73 6c 65 74 74 65 72 2d 74 65 78 74 3a 2d 6d 6f 7a 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 62 30 62 32 62 62 7d 2e 66 6f 6f 74 65 72 2d 6e 61 76 2d 6e 65 77 73 6c 65 74 74 65 72 2d 74 65 78 74 3a 3a 2d 6d 6f 7a 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 Data Ascii: ustify-content:center;align-items:center}.footer-nav-newsletter-text{color:#fff}.footer-nav-newsletter-text::-webkit-input-placeholder{color:#b0b2bb}.footer-nav-newsletter-text:-moz-placeholder{color:#b0b2bb}.footer-nav-newsletter-text::-moz-placeholder{c
2024-04-25 13:30:33 UTC	1013	IN	Data Raw: 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 2d 33 30 70 78 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 74 69 74 6c 65 7b 77 69 64 74 68 3a 33 34 30 70 78 3b 63 6f 6c 6f 72 3a 23 31 34 31 37 32 39 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 64 65 73 63 7b 77 69 64 74 68 3a 33 34 30 70 78 3b 68 65 69 67 68 74 3a 36 30 70 78 3b 63 6f 6c 6f 72 3a 23 31 34 31 37 32 39 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 31 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b Data Ascii: absolute;top:0;left:-30px}.why-choose-box-single-title{width:340px;color:#141729;font-weight:600;font-size:16px;padding-bottom:6px}.why-choose-box-single-desc{width:340px;height:60px;color:#141729;font-size:14px}.why-choose-box-single-1{position:absolute;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	608	OUT	GET /static/css/layout-mobile.css?v=1.08 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	742	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 3982 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=4596 etag: "11f4-5ec786748d1de-gzip" last-modified: Wed, 02 Nov 2022 08:12:36 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 40641 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P5p7B%2FO2gf1DKNAVFOqmEw1bNF7OuVGrKzvgVI6H72HT%2FzTDhIXzlV5ftT02M%2Fj39vltVha%2BZtS0KiN4vyom1vulAPGt8NRAp2c2qjQjbND3GLI0O5Oo99w2T2OVX74jCbiWzdk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb036fc3fb06a-ATL
2024-04-25 13:30:33 UTC	627	IN	Data Raw: 68 74 6d 6c 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 6e 6f 6e 65 3b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 37 35 30 70 78 29 7b 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 7d 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 37 33 31 2e 32 35 70 78 29 7b 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 39 70 78 7d 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 37 31 32 2e 35 70 78 29 7b 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 38 70 78 7d 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 36 39 33 2e 37 35 70 78 29 7b 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 37 70 78 7d 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a Data Ascii: html{-webkit-text-size-adjust:none;font-size:40px}@media(max-width:750px){html{font-size:40px}}@media(max-width:731.25px){html{font-size:39px}}@media(max-width:712.5px){html{font-size:38px}}@media(max-width:693.75px){html{font-size:37px}}@media(max-width:
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 31 32 31 30 70 78 29 7b 2e 68 65 61 64 65 72 2d 6e 61 76 2d 77 72 61 70 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 65 61 64 65 72 2d 77 72 61 70 7b 68 65 69 67 68 74 3a 61 75 74 6f 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 75 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 6c 6f 67 6f 7b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 38 30 70 78 20 31 30 70 78 20 32 30 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 34 70 78 20 38 70 78 20 30 20 72 67 62 28 32 31 20 35 38 20 31 36 30 2f 31 30 25 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 7d 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 6c 6f 67 6f 20 69 6d Data Ascii: edia(max-width:1210px){.header-nav-wrap{display:none}.header-wrap{height:auto}.header-menu{display:block}.header-menu-ul{display:none}.header-menu-logo{padding:10px 80px 10px 20px;box-shadow:0 4px 8px 0 rgb(21 58 160/10%);margin-top:0}.header-menu-logo im
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 2e 31 35 73 2c 74 6f 70 20 2e 31 35 73 20 2e 31 35 73 2c 6c 65 66 74 20 2e 31 35 73 20 2e 31 35 73 2c 74 72 61 6e 73 66 6f 72 6d 20 2e 31 35 73 20 2e 31 35 73 7d 2e 68 65 61 64 65 72 2d 77 72 61 70 2e 61 63 74 69 76 65 20 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 63 6c 6f 73 65 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 34 35 64 65 67 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 2e 31 35 73 20 2e 31 35 73 3b 72 69 67 68 74 3a 31 70 78 7d 2e 68 65 61 64 65 72 2d 77 72 61 70 2e 61 63 74 69 76 65 20 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 63 6c 6f 73 65 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 33 29 7b 77 69 64 74 68 3a 35 30 25 3b 72 69 67 68 74 3a 37 25 3b 74 6f 70 3a Data Ascii: .15s,top .15s .15s,left .15s .15s,transform .15s .15s}.header-wrap.active .header-menu-close div:nth-child(2){transform:rotate(-45deg);transition:transform .15s .15s;right:1px}.header-wrap.active .header-menu-close div:nth-child(3){width:50%;right:7%;top:
2024-04-25 13:30:33 UTC	617	IN	Data Raw: 68 3a 31 30 30 25 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 20 2e 35 72 65 6d 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 74 69 74 6c 65 20 73 70 61 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 69 63 6f 6e 2d 62 61 63 6b 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 31 2c 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 32 2c 2e 77 68 79 2d 63 68 6f 6f 73 65 2d 62 6f 78 2d 73 69 6e 67 6c 65 2d 33 Data Ascii: h:100%}.why-choose-box-title{font-size:.8rem;line-height:1.5;padding-top:1rem;margin:0 .5rem}.why-choose-box-title span{font-size:1rem}.why-choose-box-single-icon-back{display:none}.why-choose-box-single-1,.why-choose-box-single-2,.why-choose-box-single-3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	601	OUT	GET /static/css/roboto.css?v=1.07 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	743	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 1715 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=2230 etag: "8b6-5eacfed823302-gzip" last-modified: Wed, 12 Oct 2022 05:47:27 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 46943 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u9iNKxK5NpcXUgolcl9o4Y2%2FpWai39aCuJjWDMPuPMnBRJWLkZjcw2SszOp%2BSRpTWPboO5YdXbCjCpkUtkg9A1SiWpBnMDVwwtn6r%2B6byUm2liV%2BgoF612TLiz0iu4xe%2FbXCacg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb037498d44e1-ATL
2024-04-25 13:30:33 UTC	626	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 72 6f 62 6f 74 6f 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 66 6f 6e 74 2f 72 6f 62 6f 74 6f 2f 76 32 39 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4b 54 55 31 4b 76 6e 7a 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 34 36 30 2d 30 35 32 46 2c 55 2b 31 43 38 30 2d 31 43 38 38 2c 55 2b 32 30 42 34 2c 55 2b 32 44 45 30 2d 32 44 46 46 2c 55 2b 41 36 34 30 2d 41 36 39 46 2c 55 2b 46 45 32 45 2d 46 45 32 46 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 Data Ascii: @font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu72xKKTU1Kvnz.woff2) format('woff2');unicode-range:U+0460-052F,U+1C80-1C88,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;font-display:swap}@font-fa
2024-04-25 13:30:33 UTC	1089	IN	Data Raw: 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 72 6f 62 6f 74 6f 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 66 6f 6e 74 2f 72 6f 62 6f 74 6f 2f 76 32 39 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 34 57 78 4b 4b 54 55 31 4b 76 6e 7a 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 37 30 2d 30 33 46 46 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 72 6f 62 6f Data Ascii: range:U+1F00-1FFF;font-display:swap}@font-face{font-family:roboto;font-style:normal;font-weight:400;src:url(/static/font/roboto/v29/KFOmCnqEu92Fr1Mu4WxKKTU1Kvnz.woff2) format('woff2');unicode-range:U+0370-03FF;font-display:swap}@font-face{font-family:robo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	610	OUT	GET /static/page/product/update/update.css HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	748	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 10455 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=10658 etag: "29a2-603b694954720-gzip" last-modified: Fri, 25 Aug 2023 03:02:52 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 12194 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hMilWtdGatgLOJk8dZEt%2BPoRaEKrOzMvCXJmuzhfME976w3nW6Yxa%2FZ63a%2Fu3u0Wcer1pi7uu1t%2B%2Fo6brPSLdL012leH28cZZLLs1qaw%2Fazel6EYfnMaWQ13DKyFV2MJkOmryXE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0374cacb066-ATL
2024-04-25 13:30:33 UTC	621	IN	Data Raw: 23 68 65 61 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 62 66 38 66 66 7d 23 68 65 61 64 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 33 32 37 63 61 35 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 30 70 78 7d 2e 69 63 6f 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 75 70 64 61 74 65 2f 69 63 6f 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 7b 77 69 64 74 68 3a 31 30 30 30 70 78 3b 6d 61 72 67 69 6e 3a 30 Data Ascii: #head{background:#ebf8ff}#head h1{font-size:32px;color:#327ca5;font-weight:400;text-align:center;line-height:100px}.icon{float:left;background-image:url(/static/img/product/update/icon.png);background-repeat:no-repeat}.container-view{width:1000px;margin:0
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 63 33 36 35 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 66 68 5f 66 72 65 65 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 64 63 5f 66 72 65 65 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 64 66 5f 66 72 65 65 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 64 72 5f 66 72 65 65 7b 77 69 64 74 68 3a 33 38 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 63 33 36 35 5f 70 72 6f 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 74 69 74 6c 65 20 2e 77 63 33 36 35 5f 66 72 65 65 Data Ascii: t-weight:700}.container-view .title .wc365,.container-view .title .wfh_free,.container-view .title .wdc_free,.container-view .title .wdf_free,.container-view .title .wdr_free{width:380px}.container-view .title .wc365_pro,.container-view .title .wc365_free
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 32 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 66 69 72 73 74 5f 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 38 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 66 69 72 73 74 5f 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 34 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 66 69 72 73 74 5f 36 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 33 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 66 69 72 73 74 5f 37 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 33 36 Data Ascii: -position:0 -120px}.container-view table .first_4{background-position:0 -180px}.container-view table .first_5{background-position:0 -240px}.container-view table .first_6{background-position:0 -300px}.container-view table .first_7{background-position:0 -36
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 20 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 36 38 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 31 36 30 70 78 20 2d 36 38 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 36 35 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 74 61 62 6c 65 20 2e 62 75 79 20 64 69 76 20 2e 70 72 69 63 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 37 39 30 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 63 Data Ascii: table .download a{background-position:0 -68px}.container-view table .download a:hover{background-position:-160px -68px}.container-view table .download a{margin-top:65px}.container-view table .buy div .price{font-size:16px;color:#ff790c;font-weight:700}.c
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 77 64 66 5f 66 72 65 65 5f 74 61 62 6c 65 20 2e 62 75 79 20 2e 64 6f 77 6e 6c 6f 61 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 36 38 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 77 66 68 5f 66 72 65 65 5f 74 61 62 6c 65 20 2e 62 75 79 20 2e 64 6f 77 6e 6c 6f 61 64 3a 68 6f 76 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 77 64 63 5f 74 61 62 6c 65 20 2e 62 75 79 20 2e 64 6f 77 6e 6c 6f 61 64 3a 68 6f 76 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 77 64 66 5f 66 72 65 65 5f 74 61 62 6c 65 20 2e 62 75 79 20 2e 64 6f 77 6e 6c 6f 61 64 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 31 36 30 70 78 20 2d Data Ascii: ontainer-view .wdf_free_table .buy .download{background-position:0 -68px}.container-view .wfh_free_table .buy .download:hover,.container-view .wdc_table .buy .download:hover,.container-view .wdf_free_table .buy .download:hover{background-position:-160px -
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 67 68 74 3a 34 30 30 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 31 30 70 78 3b 68 65 69 67 68 74 3a 33 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 39 36 30 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 61 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 63 61 33 32 35 7d 2e 63 Data Ascii: ght:400}.container-view .special_offer a{display:inline-block;width:110px;height:32px;line-height:32px;color:#fff;background-color:#ff9600;margin-top:10px;border-radius:4px;font-weight:700}.container-view .special_offer a:hover{background-color:#fca325}.c
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 30 70 78 7d 2e 66 72 65 65 2d 64 6f 77 6e 6c 6f 61 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 35 30 70 78 7d 23 66 6f 6c 6c 6f 77 7b 68 65 69 67 68 74 3a 31 33 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 30 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 66 65 66 65 66 7d 23 66 6f 6c 6c 6f 77 20 64 74 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 34 30 70 78 7d 23 66 6f 6c 6c 6f 77 20 64 64 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 32 35 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 30 25 7d 23 66 6f 6c 6c 6f 77 20 64 64 20 61 7b 63 6f 6c 6f 72 3a 23 35 35 35 7d 2e 66 Data Ascii: e{background-position:0 -100px}.free-download{background-position:0 -150px}#follow{height:130px;padding-bottom:40px;border-bottom:1px solid #efefef}#follow dt{margin-bottom:40px}#follow dd{float:left;width:250px;line-height:200%}#follow dd a{color:#555}.f
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 69 75 73 3a 34 70 78 7d 23 75 70 67 72 61 64 65 20 23 64 6f 77 6e 6c 6f 61 64 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 65 32 31 34 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 23 75 70 67 72 61 64 65 20 61 7b 63 6f 6c 6f 72 3a 23 32 64 37 65 65 31 7d 23 75 70 67 72 61 64 65 20 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 73 65 6c 6c 7b 77 69 64 74 68 3a 33 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 38 30 70 78 3b 66 6c 6f 61 74 3a 72 69 67 68 74 7d 23 77 69 73 65 63 61 72 65 33 36 35 2d 62 6f 78 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 3a 2d 31 35 70 78 20 30 20 30 20 2d 31 38 30 70 78 3b Data Ascii: ius:4px}#upgrade #download:hover{background-color:#0ee214;text-decoration:none}#upgrade a{color:#2d7ee1}#upgrade a:hover{text-decoration:underline}#sell{width:320px;padding-left:180px;float:right}#wisecare365-box{position:absolute;margin:-15px 0 0 -180px;
2024-04-25 13:30:33 UTC	251	IN	Data Raw: 30 70 78 7d 2e 61 77 61 72 64 73 2d 77 72 61 70 20 2e 61 77 61 72 64 73 2d 73 69 6e 67 6c 65 2d 74 69 74 6c 65 7b 66 6c 65 78 3a 31 3b 63 6f 6c 6f 72 3a 23 35 36 36 65 39 38 7d 2e 61 77 61 72 64 73 2d 77 72 61 70 20 2e 61 77 61 72 64 73 2d 73 69 6e 67 6c 65 2d 74 69 74 6c 65 20 73 70 61 6e 7b 70 61 64 64 69 6e 67 3a 30 20 32 36 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 61 77 61 72 64 73 2d 77 72 61 70 20 2e 61 77 61 72 64 73 2d 73 69 6e 67 6c 65 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 61 64 62 65 30 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 61 64 62 65 30 7d Data Ascii: 0px}.awards-wrap .awards-single-title{flex:1;color:#566e98}.awards-wrap .awards-single-title span{padding:0 26px;display:block;word-break:break-word}.awards-wrap .awards-single:nth-child(2){border-left:1px solid #dadbe0;border-right:1px solid #dadbe0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	628	OUT	GET /static/page/product/thanks-download/thanks-download.css HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	738	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: text/css Content-Length: 12982 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=13349 etag: "3425-6050ad2149939-gzip" last-modified: Mon, 11 Sep 2023 00:58:12 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 12194 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JS7nxlXmZdQaJenYnmD5L0f6Sr%2Ff39ANM9P19BM3LFpWBWQEyVx7lVfBFKTpkpTGogrXZIIC2oS26vXxkoxtciDZw8aeNMjtCYo6i1k2eXqF8UtVBsj0Mp5YFAN5huPtDpcHkpM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0375d0eade4-ATL
2024-04-25 13:30:33 UTC	631	IN	Data Raw: 2e 74 68 61 6e 6b 73 5f 64 6f 77 6e 6c 6f 61 64 69 6e 67 5f 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 62 66 38 66 66 3b 63 6f 6c 6f 72 3a 23 33 32 37 63 61 35 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 7a 6f 6f 6d 3a 31 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 69 63 6f 6e 7b 66 Data Ascii: .thanks_downloading_h1{font-size:32px;text-align:center;background:#ebf8ff;color:#327ca5;line-height:100px;font-weight:400}.download_success_content{width:1000px;margin:0 auto;zoom:1;vertical-align:top;padding-bottom:20px}.download_success_content .icon{f
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 3a 31 30 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 74 69 74 6c 65 20 6c 69 20 73 74 72 6f 6e 67 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 74 69 74 6c 65 20 2e 77 63 33 36 35 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 74 69 74 6c 65 20 2e 77 66 68 5f 66 72 65 65 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 74 69 74 6c 65 20 2e 77 64 63 5f 66 72 65 65 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 74 69 74 6c 65 Data Ascii: :100px}.download_success_content .title li strong{display:block;line-height:40px;font-weight:700}.download_success_content .title .wc365,.download_success_content .title .wfh_free,.download_success_content .title .wdc_free,.download_success_content .title
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 5f 66 72 65 65 5f 66 69 72 73 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 75 70 64 61 74 65 2f 75 70 64 61 74 65 5f 77 64 66 5f 66 72 65 65 5f 69 63 6f 6e 2e 70 6e 67 29 20 30 20 30 20 6e 6f 2d 72 65 70 65 61 74 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 74 61 62 6c 65 20 2e 77 64 72 5f 66 69 72 73 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 75 70 64 61 74 65 2f 75 70 64 61 74 65 5f 77 64 72 5f 69 63 6f 6e 2e 70 6e 67 29 20 30 20 30 20 6e 6f 2d 72 65 70 65 61 74 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 74 61 62 6c 65 20 2e 66 69 72 73 74 5f 32 7b Data Ascii: _free_first{background:url(/static/img/product/update/update_wdf_free_icon.png) 0 0 no-repeat}.download_success_content table .wdr_first{background:url(/static/img/product/update/update_wdr_icon.png) 0 0 no-repeat}.download_success_content table .first_2{
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 20 74 61 62 6c 65 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 34 30 70 78 3b 68 65 69 67 68 74 3a 33 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 34 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 75 70 64 61 74 65 2f 62 75 74 74 6f 6e 2e 70 6e 67 29 20 30 20 30 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 74 61 62 6c 65 20 61 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 Data Ascii: table a{display:inline-block;width:140px;height:34px;line-height:34px;text-align:center;padding-left:20px;color:#fff;background:url(/static/img/product/update/button.png) 0 0 no-repeat;margin-left:75px}.download_success_content table a:hover{background-p
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 65 5f 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 77 64 63 5f 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 77 64 66 5f 66 72 65 65 5f 74 61 62 6c 65 20 2e 64 6f 77 6e 6c 6f 61 64 20 61 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 37 38 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 6c 69 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 32 30 38 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 32 30 38 70 78 3b 68 65 69 67 68 74 3a 32 37 30 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 32 37 30 70 78 3b 62 6f 72 Data Ascii: e_table .download a,.download_success_content .wdc_table .download a,.download_success_content .wdf_free_table .download a{margin-top:78px}.download_success_content .special_offer li{float:left;width:208px;max-width:208px;height:270px;max-height:270px;bor
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 3a 37 30 30 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 61 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 63 61 33 32 35 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 2e 70 6c 75 73 2c 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 2e 65 71 75 61 6c 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 33 39 70 78 3b 68 65 69 67 68 74 3a 33 39 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 39 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 Data Ascii: :700}.download_success_content .special_offer a:hover{background-color:#fca325}.download_success_content .special_offer .plus,.download_success_content .special_offer .equal{position:absolute;width:39px;height:39px;min-height:39px;background:url(/static/i
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 6e 3a 30 20 2d 32 38 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 79 6f 75 74 75 62 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 33 32 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 23 6d 6f 72 65 2d 66 72 65 65 2d 70 72 6f 64 75 63 74 73 7b 68 65 69 67 68 74 3a 32 33 38 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 66 65 66 65 66 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 23 6d 6f 72 65 2d 66 72 65 65 2d 70 72 6f 64 75 63 74 73 20 64 74 7b 6d 61 72 67 Data Ascii: n:0 -280px}.download_success_content .youtube{background-position:0 -320px}.download_success_content #more-free-products{height:238px;border-bottom:1px solid #efefef;padding-bottom:30px;overflow:hidden}.download_success_content #more-free-products dt{marg
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 73 75 70 70 6f 72 74 20 2e 6d 61 63 66 65 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 74 68 61 6e 6b 73 2d 66 6f 72 2d 63 68 6f 6f 73 69 6e 67 2f 6d 61 63 66 65 65 2e 70 6e 67 29 20 2d 31 30 70 78 20 30 20 6e 6f 2d 72 65 70 65 61 74 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 75 70 70 6f 72 74 20 2e 62 62 62 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 69 6d 67 2f 70 72 6f 64 75 63 74 2f 74 68 61 6e 6b 73 2d 66 6f 72 2d 63 68 6f 6f 73 69 6e 67 2f 62 62 62 2e 70 6e 67 29 20 2d 31 30 70 78 20 30 20 6e 6f 2d 72 65 70 65 61 74 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 63 6f 6e 74 65 6e 74 20 2e 73 75 70 70 6f Data Ascii: support .macfee{background:url(/static/img/product/thanks-for-choosing/macfee.png) -10px 0 no-repeat}.download_success_content .support .bbb{background:url(/static/img/product/thanks-for-choosing/bbb.png) -10px 0 no-repeat}.download_success_content .suppo
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 32 30 70 78 3b 6c 65 66 74 3a 31 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 62 6f 78 20 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 73 5f 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 63 6f 6c 6f 72 3a 23 35 35 35 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 77 69 64 74 68 3a 32 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 Data Ascii: ;border-radius:40px;position:absolute;top:-20px;left:130px;line-height:40px;text-align:center;color:#fff}.download_success_box .download_success_s_t{font-size:16px;font-weight:700;color:#555;line-height:1.4;width:250px;text-align:center;padding-bottom:10p
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 30 70 78 3b 6d 61 72 67 69 6e 3a 36 70 78 20 61 75 74 6f 20 30 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 62 6f 78 20 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 73 69 6e 67 6c 65 5f 6c 65 66 74 20 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 73 5f 63 5f 73 69 6e 67 6c 65 20 73 76 67 7b 77 69 64 74 68 3a 31 30 70 78 3b 68 65 69 67 68 74 3a 31 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 62 6f 78 20 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 73 69 6e 67 6c 65 5f 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 3a 30 20 34 30 70 78 7d 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 62 6f 78 20 2e 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 73 73 5f 73 69 6e 67 6c 65 5f 63 65 6e 74 65 72 20 2e 64 6f Data Ascii: 0px;margin:6px auto 0}.download_success_box .download_success_single_left .download_success_s_c_single svg{width:10px;height:10px}.download_success_box .download_success_single_center{margin:0 40px}.download_success_box .download_success_single_center .do

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	31.13.65.36	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	854	OUT	GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fwisecleanersoft&send=false&layout=button_count&width=110&show_faces=false&font&colorscheme=light&action=like&height=21 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	923	IN	HTTP/1.1 200 OK Vary: Accept-Encoding reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-25 13:30:33 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-25 13:30:33 UTC	1583	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-25 13:30:33 UTC	91	IN	Data Raw: 31 61 65 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 73 76 67 20 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 Data Ascii: 1aed<!DOCTYPE html><html lang="en" id="facebook" class="no_svg no_js"><head><meta chars
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 6a 57 67 33 53 65 4e 22 3e 5f 5f 44 45 56 5f 5f 3d 30 3b 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 6a 57 67 33 53 65 4e 22 3e 2e 5f 33 32 71 61 20 62 75 74 74 6f 6e 7b 6f 70 61 63 69 74 79 3a 2e 34 7d 2e 5f 35 39 6f 76 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 39 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 Data Ascii: et="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="zjWg3SeN">__DEV__=0;</script><title>Facebook</title><style nonce="zjWg3SeN">._32qa button{opacity:.4}._59ov{height:100%;height:910px;position:relative
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 6f 6d 3a 31 7d 2e 64 61 74 61 77 72 61 70 7b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 77 6f 72 64 5f 62 72 65 61 6b 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 65 6c 6c 69 70 73 69 73 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 61 65 72 6f 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 63 6f 6c 75 6d 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 7d 23 66 61 63 65 62 6f 6f 6b 20 2e 68 69 64 64 65 6e 5f 65 6c 65 6d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 Data Ascii: om:1}.datawrap{word-wrap:break-word}.word_break{display:inline-block}.ellipsis{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.aero{opacity:.5}.column{float:left}.center{margin-left:auto;margin-right:auto}#facebook .hidden_elem{display:none!imp
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 37 37 66 62 63 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 35 37 37 66 62 63 7d 2e 5f 32 74 67 61 2e 5f 34 39 76 65 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 30 20 30 20 32 70 78 7d 2e 5f 32 74 67 61 2e 5f 38 6a 39 76 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 36 70 78 7d 2e 5f 32 74 67 61 2e 5f 33 65 32 61 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 34 70 78 20 30 20 36 70 Data Ascii: 77fbc;border:1px solid #577fbc}._2tga._49ve{border-radius:3px;font-size:11px;height:20px;padding:0 0 0 2px}._2tga._8j9v{border-radius:3px;font-size:11px;height:20px;padding:0 6px}._2tga._3e2a{border-radius:4px;font-size:13px;height:28px;padding:0 4px 0 6p
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 6c 28 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 4e 2f 72 2f 73 46 77 6b 79 56 65 68 31 69 55 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 36 31 36 70 78 20 32 38 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7a 6f 6f 6d 3a 31 7d 2e 5f 34 39 76 65 2e 5f 32 74 67 61 2e 69 73 5f 61 6e 69 6d 61 74 69 6e 67 20 2e 5f 33 6a 6e 5f 7b 6c 65 66 74 3a 2d 36 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 2d 36 70 78 7d 2e 5f 34 39 76 67 2c 2e 5f 35 6e 32 79 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 Data Ascii: l(https://static.xx.fbcdn.net/rsrc.php/v3/yN/r/sFwkyVeh1iU.png) no-repeat;background-position:0 0;background-size:616px 28px;display:inline-block;zoom:1}._49ve._2tga.is_animating ._3jn_{left:-6px;position:relative;top:-6px}._49vg,._5n2y{vertical-align:mid
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 6f 6d 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 30 70 78 7d 2e 5f 32 6f 31 6b 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 34 70 78 7d 2e 5f 32 6f 31 6c 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 36 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 36 70 78 7d 2e 5f 36 62 75 61 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 2e 5f 32 70 69 37 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 34 70 78 7d 2e 5f 32 70 69 38 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 7d 2e 5f 32 70 69 39 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a Data Ascii: om:20px;padding-top:20px}._2o1k{padding-bottom:24px;padding-top:24px}._2o1l{padding-bottom:36px;padding-top:36px}._6bua{padding-left:0;padding-right:0}._2pi7{padding-left:4px;padding-right:4px}._2pi8{padding-left:8px;padding-right:8px}._2pi9{padding-left:
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 2e 5f 33 2d 38 6f 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 32 70 78 7d 2e 5f 33 2d 38 70 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 7d 2e 5f 33 2d 38 71 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 7d 2e 5f 32 2d 6f 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 34 70 78 7d 2e 5f 31 61 34 69 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 5f 33 2d 38 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 Data Ascii: x;margin-top:8px}._3-8o{margin-bottom:12px;margin-top:12px}._3-8p{margin-bottom:16px;margin-top:16px}._3-8q{margin-bottom:20px;margin-top:20px}._2-ox{margin-bottom:24px;margin-top:24px}._1a4i{margin-left:0;margin-right:0}._3-8r{margin-left:4px;margin-righ
2024-04-25 13:30:33 UTC	1500	IN	Data Raw: 7d 2e 5f 6c 69 20 2e 5f 39 62 70 2d 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 35 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 5f 6c 69 20 2e 5f 39 62 70 2d 20 2e 66 62 5f 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 31 30 30 70 78 7d 2e 5f 6c 69 20 2e 5f 61 36 36 66 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 35 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 5f 6c 69 20 2e 5f 61 36 36 66 20 2e 66 62 5f 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 38 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 37 32 70 78 7d 2e 5f 35 66 30 76 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 5f 33 6f 78 74 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 20 23 33 62 35 39 39 38 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 76 65 72 74 7d 2e 77 65 Data Ascii: }._li ._9bp-{padding-top:5px;text-align:center}._li ._9bp- .fb_logo{height:100px}._li ._a66f{padding-top:5px;text-align:center}._li ._a66f .fb_logo{height:80px;padding-top:72px}._5f0v{outline:none}._3oxt{outline:1px dotted #3b5998;outline-color:invert}.we

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	609	OUT	GET /static/svg/logo/pdf_logo.svg HTTP/1.1 Host: pdf.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:33 UTC	677	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:33 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Fri, 26 May 2023 06:15:03 GMT etag: W/"9f3-5fc92a854c79b-gzip" vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1215 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y8AWF4TfnvE6YwUG%2BoaQSNd7R9z6osqYfC3BbvNTrJw50AUMYoKidWJwoSgkLZiR8YPSz4%2BaEJ8Z%2FCJmJ9A9pABgx7pSmsYKvdWuCHKDSHfPDax0CGFZjz7EHZTSsjPoH19FOR4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb037f985452c-ATL
2024-04-25 13:30:33 UTC	692	IN	Data Raw: 39 66 33 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 35 36 20 32 35 36 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 30 31 38 31 66 65 3b 7d 2e 61 2c 2e 62 2c 2e 63 2c 2e 65 2c 2e 66 2c 2e 67 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 62 7b 66 69 6c 6c 3a 75 72 6c 28 23 61 29 3b 7d 2e 63 2c 2e 64 2c 2e 65 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 2e 63 7b 69 73 6f 6c 61 74 69 6f 6e 3a 69 73 6f 6c 61 74 65 3b 6f 70 61 63 69 74 79 3a 30 2e 31 3b 7d 2e 66 7b 66 69 6c 6c Data Ascii: 9f3<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 256 256"><defs><style>.a{fill:#0181fe;}.a,.b,.c,.e,.f,.g{fill-rule:evenodd;}.b{fill:url(#a);}.c,.d,.e{fill:#fff;}.c{isolation:isolate;opacity:0.1;}.f{fill
2024-04-25 13:30:33 UTC	1369	IN	Data Raw: 39 32 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 36 34 56 31 39 32 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2d 36 34 2c 36 34 48 36 34 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 30 2c 31 39 32 56 36 34 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 30 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 37 30 2c 36 48 31 38 36 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 36 34 56 31 38 36 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2d 36 34 2c 36 34 48 37 30 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 2c 31 38 36 56 37 30 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 37 30 2c 36 5a 22 2f 3e 3c 70 61 74 68 20 63 Data Ascii: 92a64.06,64.06,0,0,1,64,64V192a64.06,64.06,0,0,1-64,64H64A64.06,64.06,0,0,1,0,192V64A64.06,64.06,0,0,1,64,0Z"/><path class="b" d="M70,6H186a64.06,64.06,0,0,1,64,64V186a64.06,64.06,0,0,1-64,64H70A64.06,64.06,0,0,1,6,186V70A64.06,64.06,0,0,1,70,6Z"/><path c
2024-04-25 13:30:33 UTC	493	IN	Data Raw: 2c 36 2e 38 34 2d 31 35 2e 36 36 2c 31 35 2e 35 38 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 66 22 20 64 3d 22 4d 34 39 2e 32 32 2c 31 38 34 2e 35 35 63 34 2e 34 37 2d 31 33 2e 37 33 2c 31 39 2e 33 36 2d 34 32 2e 38 31 2c 36 35 2e 33 34 2d 34 32 2e 38 39 61 35 2e 33 37 2c 35 2e 33 37 2c 30 2c 30 2c 31 2c 35 2e 33 31 2c 35 2e 33 32 6c 30 2c 32 2e 32 33 61 35 2e 34 39 2c 35 2e 34 39 2c 30 2c 30 2c 30 2c 39 2e 31 2c 34 2e 31 33 6c 33 36 2e 37 2d 33 32 2e 31 38 61 37 2e 30 37 2c 37 2e 30 37 2c 30 2c 30 2c 30 2d 31 2e 30 39 2d 31 31 2e 34 63 2d 31 30 2e 38 35 2d 36 2e 33 2d 33 30 2e 33 37 2d 31 37 2d 34 37 2e 30 38 2d 32 32 2e 38 32 61 34 2e 32 39 2c 34 2e 32 39 2c 30 2c 30 2c 30 2d 35 2e 33 32 2c 35 2e 37 32 68 30 61 36 2c 36 2c 30 2c 30 2c 31 2d 33 Data Ascii: ,6.84-15.66,15.58Z"/><path class="f" d="M49.22,184.55c4.47-13.73,19.36-42.81,65.34-42.89a5.37,5.37,0,0,1,5.31,5.32l0,2.23a5.49,5.49,0,0,0,9.1,4.13l36.7-32.18a7.07,7.07,0,0,0-1.09-11.4c-10.85-6.3-30.37-17-47.08-22.82a4.29,4.29,0,0,0-5.32,5.72h0a6,6,0,0,1-3
2024-04-25 13:30:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	653	OUT	GET /static/img/common/icon_america.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	691	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:40 GMT etag: W/"27db-5e7089344368d-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56038 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XlkZofL2cvz36JOesWyJtjpiAbdt1m%2BaVy%2FFFlXeAqfKay0RBB7VuarAfcsAtf9g1vIRXKXD6QDnHl%2B60Cuh10j2QqucwJ%2BL6rKgr%2FXmTp8utoXBHUtPflttzwjFQUgJK87J6SA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03a9cfa8bbb-ATL
2024-04-25 13:30:34 UTC	678	IN	Data Raw: 32 37 64 62 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 32 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 37 2e 35 34 37 39 31 32 20 31 30 31 37 2e 37 31 30 30 37 34 68 31 35 32 30 2e 39 30 34 31 37 36 56 36 2e 32 38 39 39 32 36 48 37 2e 35 34 37 39 31 32 76 31 30 31 31 2e 34 32 30 31 34 38 7a 20 6d 31 35 32 33 2e 34 32 30 31 34 37 20 32 2e 35 31 35 39 37 76 2d 33 2e 37 37 33 39 35 36 20 33 2e 37 37 33 39 35 36 7a 4d 31 2e 32 35 37 39 38 35 20 31 30 32 34 56 30 48 31 35 33 34 2e 37 34 32 30 31 35 76 31 30 32 34 48 Data Ascii: 27db<svg viewBox="0 0 1542 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M7.547912 1017.710074h1520.904176V6.289926H7.547912v1011.420148z m1523.420147 2.51597v-3.773956 3.773956zM1.257985 1024V0H1534.742015v1024H
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 35 35 30 2e 39 39 37 35 34 33 68 31 35 32 37 2e 31 39 34 31 30 33 76 37 37 2e 39 39 35 30 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 33 31 35 2e 37 35 34 33 68 31 35 32 37 2e 31 39 34 31 30 33 56 33 39 33 2e 37 34 39 33 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 43 32 32 30 34 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 38 30 2e 35 31 31 30 35 37 68 31 35 32 37 2e 31 39 34 31 30 33 76 37 37 2e 39 39 35 30 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 3e 3c 2f 70 61 74 68 3e Data Ascii: h><path d="M3.773956 550.997543h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 315.7543h1527.194103V393.749386H3.773956z" fill="#C22045"></path><path d="M3.773956 80.511057h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path>
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 2e 38 33 37 38 33 38 7a 4d 34 36 32 2e 39 33 38 35 37 35 20 34 38 38 2e 30 39 38 32 38 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 33 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 38 2e 38 30 35 38 39 36 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 33 36 31 2e 30 34 31 37 36 39 20 33 31 2e 34 34 39 36 33 31 6c 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 Data Ascii: .837838zM462.938575 488.09828l3.773956 12.579853h13.837838l-11.321868 8.805896 5.031941 12.579853-11.321867-7.547911-11.321867 7.547911 5.031941-12.579853-11.321868-8.805896h13.837838zM361.041769 31.449631l3.773956 13.837838h13.837838l-11.321868 7.547912
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 31 32 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 32 35 39 2e 31 34 34 39 36 33 20 32 36 30 2e 34 30 32 39 34 38 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 33 48 32 37 36 2e 37 35 36 37 35 37 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 37 2d 31 30 2e 30 36 33 38 38 32 2d 38 2e 38 30 35 38 39 36 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 36 20 33 2e 37 37 33 39 35 36 2d 31 33 2e 38 33 37 38 33 37 2d 31 31 2e 33 32 31 38 36 38 2d 37 2e 35 34 37 39 31 32 68 31 33 2e 38 33 37 38 33 38 7a 4d 32 35 39 2e 31 34 34 39 36 33 20 33 37 36 2e 31 33 37 35 39 32 6c 33 2e 37 Data Ascii: 12 3.773956-12.579853-11.321868-8.805896h13.837838zM259.144963 260.402948l3.773956 12.579853H276.756757l-11.321868 7.547912 3.773956 13.837837-10.063882-8.805896-11.321867 8.805896 3.773956-13.837837-11.321868-7.547912h13.837838zM259.144963 376.137592l3.7
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 35 34 2e 30 39 33 33 36 36 20 33 31 2e 34 34 39 36 33 31 6c 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 38 2d 37 2e Data Ascii: 12.579853-11.321867-7.547911-11.321867 7.547911 5.031941-12.579853-11.321868-8.805896h13.837838zM54.093366 31.449631l3.773956 13.837838h13.837838l-11.321868 7.547912 5.031941 12.579852-11.321867-7.547911-11.321867 7.547911 5.031941-12.579852-11.321868-7.
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 36 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 32 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 37 7a 4d 35 31 33 2e 32 35 37 39 38 35 20 34 33 36 2e 35 32 30 38 38 35 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 32 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 32 20 35 2e 30 33 31 39 34 31 20 31 33 2e 38 33 37 38 33 37 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 Data Ascii: 7838l-11.321867 8.805896 5.031941 12.579853-11.321867-7.547912-11.321868 7.547912 3.773956-12.579853-11.321867-8.805896h13.837837zM513.257985 436.520885l3.773956 12.579852h13.837838l-11.321867 7.547912 5.031941 13.837837-11.321868-8.805896-11.321867 8.805
2024-04-25 13:30:34 UTC	1369	IN	Data Raw: 30 39 2e 34 36 34 33 37 33 20 33 31 38 2e 32 37 30 32 37 6c 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 68 31 32 2e 35 37 39 38 35 33 6c 2d 31 30 2e 30 36 33 38 38 32 20 37 2e 35 34 37 39 31 31 20 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 37 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 37 20 35 2e 30 33 31 39 34 31 2d 31 33 2e 38 33 37 38 33 38 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 68 31 33 2e 38 33 37 38 33 38 7a 4d 33 30 38 2e 32 30 36 33 38 38 20 34 33 31 2e 34 38 38 39 34 33 6c 35 2e 30 33 31 39 34 31 20 31 33 2e 38 33 37 38 33 38 48 33 32 37 2e 30 37 36 31 36 37 6c 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 Data Ascii: 09.464373 318.27027l5.031941 12.579853h12.579853l-10.063882 7.547911 3.773956 13.837838-11.321868-8.805897-11.321867 8.805897 5.031941-13.837838-11.321867-7.547911h13.837838zM308.206388 431.488943l5.031941 13.837838H327.076167l-11.321867 7.547912 3.773956
2024-04-25 13:30:34 UTC	1319	IN	Data Raw: 20 33 2e 37 37 33 39 35 35 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 68 31 33 2e 38 33 37 38 33 38 7a 4d 31 30 35 2e 36 37 30 37 36 32 20 33 31 34 2e 34 39 36 33 31 34 6c 33 2e 37 37 33 39 35 35 20 31 32 2e 35 37 39 38 35 33 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 37 20 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 32 2d 31 30 2e 30 36 33 38 38 32 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 31 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 37 2d 38 2e 38 30 35 38 39 37 48 31 30 30 2e 36 33 38 38 32 31 7a 4d 31 30 34 2e 34 31 32 37 37 36 20 34 32 38 2e 39 37 32 39 37 33 6c 33 2e 37 37 33 Data Ascii: 3.773955-12.579853-11.321867-7.547911h13.837838zM105.670762 314.496314l3.773955 12.579853h13.837838l-11.321867 8.805897 3.773956 12.579852-10.063882-7.547911-11.321868 7.547911 3.773956-12.579852-11.321867-8.805897H100.638821zM104.412776 428.972973l3.773
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49756	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	659	OUT	GET /static/img/icon/icon_arrow_1f2238_12.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:42:55 GMT etag: W/"2bb-5e70897c01dc2-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46944 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e6SUj45ixz3yimqb8HCWLbfaJEDvbo9nl71a99n7%2FET6GlZCd%2Bk9i71sVwup0UenI00PbyP5ShcfcFDxFUJOEvqWoABCMyr2oy2j1UNPrs5u9yUByaEkENvz89ywievvqrj%2BUtU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03a8b9e53e1-ATL
2024-04-25 13:30:34 UTC	683	IN	Data Raw: 32 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 32 70 78 22 20 68 65 69 67 68 74 3d 22 31 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 35 2c 32 20 43 35 2e 35 31 32 38 33 35 38 34 2c 32 20 35 2e Data Ascii: 2bb<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="12px" height="12px" viewBox="0 0 18 18" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <path d="M5,2 C5.51283584,2 5.
2024-04-25 13:30:34 UTC	23	IN	Data Raw: 20 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: "/> </g></svg>
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49757	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	652	OUT	GET /static/img/common/icon_french.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:45 GMT etag: W/"13a-5e708939e453b-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46944 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGY6XAFc7ZvEs5xoWuCVLNg6rctY7NRyfJQvtUi%2BLscs1RiSUthCxnbemB0qnins%2FL%2Fzrfdg1ZMn3YTvZRbVe8Rn97pqIvP6bFm37CHmkbA5yNh0EyUhrQWtKshtcD1VXIzN0Z0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03a886b8bba-ATL
2024-04-25 13:30:34 UTC	321	IN	Data Raw: 31 33 61 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 30 30 20 32 30 30 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 66 69 6c 6c 3d 22 23 30 30 35 35 61 34 22 3e 3c 2f 72 65 63 74 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 31 30 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 66 69 6c 6c 3d 22 23 66 66 66 66 66 66 22 3e 3c 2f 72 65 63 74 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 32 30 30 22 Data Ascii: 13a<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 300 200" width="28" height="28"><rect x="0" y="0" width="100" height="200" fill="#0055a4"></rect><rect x="100" y="0" width="100" height="200" fill="#ffffff"></rect><rect x="200"
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49759	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:33 UTC	653	OUT	GET /static/img/common/icon_germany.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:46 GMT etag: W/"21a-5e70893ad3d43-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46944 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztrbm7QytWaGB6uF7IJ2pWTuhr9cA66MwP8hJC0CNqIwpH6KbegF8456FMPzEelClwIGQE6qdT2BMy8N0rAV3gZbrdvbXG0SStcyn4xDtamcdDPjue%2F0Td4MwcNQhrQ4ziG9a0E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03a9b297bd5-ATL
2024-04-25 13:30:34 UTC	545	IN	Data Raw: 32 31 61 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 31 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 36 2e 32 38 32 32 30 39 20 31 30 31 37 2e 37 31 37 37 39 31 68 31 35 31 39 2e 30 33 38 30 33 36 56 37 2e 35 33 38 36 35 48 36 2e 32 38 32 32 30 39 76 31 30 31 30 2e 31 37 39 31 34 31 7a 20 6d 31 35 32 32 2e 38 30 37 33 36 32 20 32 2e 35 31 32 38 38 34 76 2d 33 2e 37 36 39 33 32 35 20 33 2e 37 36 39 33 32 35 7a 4d 30 20 31 30 32 34 56 30 68 31 35 33 31 2e 36 30 32 34 35 34 56 31 30 32 32 2e 37 34 33 35 35 38 48 30 Data Ascii: 21a<svg viewBox="0 0 1541 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M6.282209 1017.717791h1519.038036V7.53865H6.282209v1010.179141z m1522.807362 2.512884v-3.769325 3.769325zM0 1024V0h1531.602454V1022.743558H0
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49761	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:34 UTC	651	OUT	GET /static/img/common/icon_japan.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	685	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:47 GMT etag: W/"20e-5e70893bc2993-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 3069 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jnPFY13i3Y6k2%2FlvuYKzmk6tn0qQYbu5ZNy5750QJEJWnRLK0el34mQHWEBA%2B86o8GmayhH19yE1OjJY9TYESKHnSRbHtrRULJbLdDhZYuTQKhcZ47zAYpEyJ4sz%2FZgI47COxp0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03cdc1dad57-ATL
2024-04-25 13:30:34 UTC	533	IN	Data Raw: 32 30 65 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 34 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 30 33 39 32 31 36 20 31 30 31 36 2e 34 37 30 35 38 38 68 31 35 31 37 2e 31 37 36 34 37 56 37 2e 35 32 39 34 31 32 48 31 30 2e 30 33 39 32 31 36 56 31 30 31 36 2e 34 37 30 35 38 38 7a 20 6d 31 35 31 39 2e 36 38 36 32 37 34 20 33 2e 37 36 34 37 30 36 56 31 30 31 36 2e 34 37 30 35 38 38 76 33 2e 37 36 34 37 30 36 7a 4d 33 2e 37 36 34 37 30 36 20 31 30 32 34 56 31 2e 32 35 34 39 30 32 68 31 35 32 39 2e 37 32 Data Ascii: 20e<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.039216 1016.470588h1517.17647V7.529412H10.039216V1016.470588z m1519.686274 3.764706V1016.470588v3.764706zM3.764706 1024V1.254902h1529.72
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49760	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:34 UTC	652	OUT	GET /static/img/common/icon_russia.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:34 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:49 GMT etag: W/"229-5e70893d9e2f2-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18924 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzYVAh8hr%2Fa%2F5LLNaoUeaopBaOyy17TNmbzhy73QqAQMZha64UMXHf89SCgBVYsbvZf4EduZhckXcdcQ32IoVVOYA%2B2DBzWDiXCbE9RtvWF0sO7t%2FG3kpvaNZUtokm7yVuihmgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb03cdf727bae-ATL
2024-04-25 13:30:34 UTC	560	IN	Data Raw: 32 32 39 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 34 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 30 35 31 35 33 34 20 31 30 31 37 2e 37 31 37 37 39 31 68 31 35 31 39 2e 30 33 38 30 33 37 56 37 2e 35 33 38 36 35 48 31 30 2e 30 35 31 35 33 34 76 31 30 31 30 2e 31 37 39 31 34 31 7a 20 6d 31 35 32 31 2e 35 35 30 39 32 20 32 2e 35 31 32 38 38 34 76 2d 33 2e 37 36 39 33 32 35 20 33 2e 37 36 39 33 32 35 7a 4d 33 2e 37 36 39 33 32 35 20 31 30 32 34 56 30 68 31 35 33 31 2e 36 30 32 34 35 34 56 31 30 32 32 2e Data Ascii: 229<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.051534 1017.717791h1519.038037V7.53865H10.051534v1010.179141z m1521.55092 2.512884v-3.769325 3.769325zM3.769325 1024V0h1531.602454V1022.
2024-04-25 13:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49762	31.13.88.13	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:34 UTC	609	OUT	GET /rsrc.php/v3iEpO4/yv/l/en_US/tQNtwFBP_EQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	1773	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8RPG/6T7SCT74bqaH/rDJA== Expires: Thu, 24 Apr 2025 20:47:12 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: WychVhhAVGY8GkT8mFoTt9ujomiQJ+cag6I2YkkAhQcPUwrZ3Bdib8GU4rHVTS3uJIRMCgHAAJpLXULJ86+A1w== Date: Thu, 25 Apr 2024 13:30:34 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=110, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=3, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 547271
2024-04-25 13:30:34 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-25 13:30:34 UTC	16035	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 54 68 69 73 7c 7c 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 73 65 6c 66 7c 7c 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 5f 5f 6c 69 73 74 65 6e Data Ascii: /FB_PKG_DELIM/"use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listen
2024-04-25 13:30:34 UTC	16384	IN	Data Raw: 6e 75 6d 65 72 61 62 6c 65 3d 64 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 3b 64 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 3b 22 76 61 6c 75 65 22 69 6e 20 64 26 26 28 64 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 64 2e 6b 65 79 2c 64 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 63 26 26 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 2c 63 29 3b 64 26 26 61 28 62 2c 64 29 3b 72 65 74 75 72 6e 20 62 7d 7d 28 29 3b 62 2e 69 6e 68 65 72 69 74 73 4c 6f 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 61 2c 62 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 62 26 26 62 2e 70 Data Ascii: numerable=d.enumerable\|\|!1;d.configurable=!0;"value"in d&&(d.writable=!0);Object.defineProperty(a,d.key,d)}}return function(b,c,d){c&&a(b.prototype,c);d&&a(b,d);return b}}();b.inheritsLoose=function(a,b){Object.assign(a,b);a.prototype=Object.create(b&&b.p
2024-04-25 13:30:34 UTC	16384	IN	Data Raw: 69 63 74 22 3b 76 61 72 20 67 3d 7b 50 52 45 56 49 4f 55 53 5f 46 49 4c 45 3a 31 2c 50 52 45 56 49 4f 55 53 5f 46 52 41 4d 45 3a 32 2c 50 52 45 56 49 4f 55 53 5f 44 49 52 3a 33 2c 46 4f 52 43 45 44 5f 4b 45 59 3a 34 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 6e 65 77 20 45 72 72 6f 72 28 61 29 3b 69 66 28 62 2e 73 74 61 63 6b 3d 3d 3d 76 6f 69 64 20 30 29 74 72 79 7b 74 68 72 6f 77 20 62 7d 63 61 74 63 68 28 61 29 7b 7d 62 2e 6d 65 73 73 61 67 65 46 6f 72 6d 61 74 3d 61 3b 66 6f 72 28 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 64 3d 6e 65 77 20 41 72 72 61 79 28 63 3e 31 3f 63 2d 31 3a 30 29 2c 65 3d 31 3b 65 3c 63 3b 65 2b 2b 29 64 5b 65 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 62 2e 6d 65 73 73 Data Ascii: ict";var g={PREVIOUS_FILE:1,PREVIOUS_FRAME:2,PREVIOUS_DIR:3,FORCED_KEY:4};function a(a){var b=new Error(a);if(b.stack===void 0)try{throw b}catch(a){}b.messageFormat=a;for(var c=arguments.length,d=new Array(c>1?c-1:0),e=1;e<c;e++)d[e-1]=arguments[e];b.mess
2024-04-25 13:30:34 UTC	16384	IN	Data Raw: 59 28 62 2e 73 61 6d 70 6c 65 5f 77 65 69 67 68 74 29 2c 73 63 72 69 70 74 3a 61 2e 73 63 72 69 70 74 2c 73 69 74 65 5f 63 61 74 65 67 6f 72 79 3a 62 2e 73 69 74 65 5f 63 61 74 65 67 6f 72 79 2c 73 74 61 63 6b 46 72 61 6d 65 73 3a 5a 28 61 2e 73 74 61 63 6b 46 72 61 6d 65 73 29 2c 74 79 70 65 3a 61 2e 74 79 70 65 2c 70 61 67 65 5f 74 69 6d 65 3a 59 28 61 2e 70 61 67 65 5f 74 69 6d 65 29 2c 70 72 6f 6a 65 63 74 3a 61 2e 70 72 6f 6a 65 63 74 2c 70 75 73 68 5f 70 68 61 73 65 3a 62 2e 70 75 73 68 5f 70 68 61 73 65 2c 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 3a 62 2e 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 2c 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 5f 72 65 66 3a 62 2e 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 5f 72 65 66 2c 72 6f 6c 6c 6f 75 74 5f 68 61 73 68 3a 28 Data Ascii: Y(b.sample_weight),script:a.script,site_category:b.site_category,stackFrames:Z(a.stackFrames),type:a.type,page_time:Y(a.page_time),project:a.project,push_phase:b.push_phase,report_source:b.report_source,report_source_ref:b.report_source_ref,rollout_hash:(
2024-04-25 13:30:34 UTC	1500	IN	Data Raw: 61 73 65 45 76 65 6e 74 45 6d 69 74 74 65 72 22 2c 5b 22 45 6d 69 74 74 65 72 53 75 62 73 63 72 69 70 74 69 6f 6e 22 2c 22 45 72 72 6f 72 47 75 61 72 64 22 2c 22 45 76 65 6e 74 53 75 62 73 63 72 69 70 74 69 6f 6e 56 65 6e 64 6f 72 22 2c 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 2c 22 75 6e 72 65 63 6f 76 65 72 61 62 6c 65 56 69 6f 6c 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 24 32 3d 6e 65 77 28 62 28 22 45 76 65 6e 74 53 75 62 73 63 72 69 70 74 69 6f 6e 56 65 6e 64 6f 72 22 29 29 28 29 2c 74 68 69 73 2e 24 31 3d 6e 75 6c 6c 7d 76 61 72 20 63 3d 61 2e 70 Data Ascii: aseEventEmitter",["EmitterSubscription","ErrorGuard","EventSubscriptionVendor","emptyFunction","unrecoverableViolation"],(function(a,b,c,d,e,f){var g;a=function(){"use strict";function a(){this.$2=new(b("EventSubscriptionVendor"))(),this.$1=null}var c=a.p
2024-04-25 13:30:34 UTC	14884	IN	Data Raw: 6e 74 65 78 74 2c 65 2c 7b 6e 61 6d 65 3a 22 45 76 65 6e 74 45 6d 69 74 74 65 72 20 22 2b 63 2b 22 20 65 76 65 6e 74 22 7d 29 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 65 2e 65 78 70 6f 72 74 73 3d 61 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 46 61 6c 63 6f 43 6f 6e 73 65 6e 74 43 68 65 63 6b 65 72 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 64 29 7b 63 61 73 65 22 73 74 72 69 6e 67 22 3a 65 3d 61 5b 53 74 72 69 6e 67 28 64 29 5d 3b 72 65 74 75 72 6e 21 65 3f 21 31 3a 65 3c 3d 62 3b 63 61 73 65 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 67 28 61 2c 62 Data Ascii: ntext,e,{name:"EventEmitter "+c+" event"})};return a}();e.exports=a}),null);__d("FalcoConsentChecker",[],(function(a,b,c,d,e,f){"use strict";function g(a,b,c,d){var e;switch(typeof d){case"string":e=a[String(d)];return!e?!1:e<=b;case"number":return g(a,b
2024-04-25 13:30:34 UTC	16384	IN	Data Raw: 29 7b 76 61 72 20 63 3d 62 2e 70 72 65 76 3b 63 26 26 28 63 2e 6e 65 78 74 3d 61 2c 61 2e 70 72 65 76 3d 63 29 3b 61 2e 6e 65 78 74 3d 62 3b 62 2e 70 72 65 76 3d 61 7d 74 68 69 73 2e 24 32 3d 61 3b 74 68 69 73 2e 69 73 41 63 74 69 76 65 28 29 26 26 74 68 69 73 2e 24 31 39 28 29 7d 3b 64 2e 6d 61 72 6b 49 74 65 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3f 74 68 69 73 2e 6d 61 72 6b 49 74 65 6d 41 73 43 6f 6d 70 6c 65 74 65 64 28 61 29 3a 74 68 69 73 2e 6d 61 72 6b 49 74 65 6d 41 73 46 61 69 6c 65 64 28 61 29 7d 3b 64 2e 24 32 32 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 72 28 61 29 3b 76 61 72 20 62 3d 74 68 69 73 2e 24 31 3b 62 26 26 28 62 2e 6e 65 78 74 3d 61 2c 61 2e 70 72 65 76 3d 62 29 3b 74 68 69 73 2e 24 31 3d 61 3b 74 68 69 73 2e 24 32 Data Ascii: ){var c=b.prev;c&&(c.next=a,a.prev=c);a.next=b;b.prev=a}this.$2=a;this.isActive()&&this.$19()};d.markItem=function(a,b){b?this.markItemAsCompleted(a):this.markItemAsFailed(a)};d.$22=function(a){a=r(a);var b=this.$1;b&&(b.next=a,a.prev=b);this.$1=a;this.$2
2024-04-25 13:30:35 UTC	16384	IN	Data Raw: 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 71 75 65 72 79 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 71 75 65 72 79 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 24 36 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 24 36 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d Data Ascii: .apply(k(this),arguments)};a.query=function(b){return a.prototype.query.apply(k(this),arguments)};a.registerCallback=function(b,c){return a.prototype.registerCallback.apply(k(this),arguments)};a.$6=function(b,c,d){return a.prototype.$6.apply(k(this),argum
2024-04-25 13:30:35 UTC	14884	IN	Data Raw: 20 62 7c 7c 68 28 30 2c 31 31 38 30 32 29 3b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 73 74 72 69 6e 67 22 29 69 66 28 61 3e 62 29 72 65 74 75 72 6e 20 31 3b 65 6c 73 65 20 69 66 28 61 3c 62 29 72 65 74 75 72 6e 2d 31 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 30 3b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 29 69 66 28 61 3e 62 29 72 65 74 75 72 6e 20 31 3b 65 6c 73 65 20 69 66 28 61 3c 62 29 72 65 74 75 72 6e 2d 31 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 30 3b 74 79 70 65 6f 66 20 61 3d 3d 3d 74 79 70 65 6f 66 20 62 7c 7c 68 28 30 2c 31 31 38 30 32 29 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: b\|\|h(0,11802);if(typeof a==="string"&&typeof b==="string")if(a>b)return 1;else if(a<b)return-1;else return 0;if(typeof a==="number"&&typeof b==="number")if(a>b)return 1;else if(a<b)return-1;else return 0;typeof a===typeof b\|\|h(0,11802);return 0}function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49763	31.13.88.13	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:34 UTC	611	OUT	GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:34 UTC	1608	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: OIlAxCmR79nrM/Ez4ygGlg== Expires: Mon, 14 Apr 2025 06:22:11 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: 2xR30nnS5hIxWPnfuaoDdcll+Wnx+yVWdX/f5ZTm6rd83Oqz3qbdN8OAazbEVIWmSv4QkOoughvh1wudgIvYhQ== Date: Thu, 25 Apr 2024 13:30:34 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 299
2024-04-25 13:30:34 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-25 13:30:34 UTC	298	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 03 00 00 00 28 2d 0f 53 00 00 00 60 50 4c 54 45 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 7c 25 1c ba 00 00 00 1f 74 52 4e 53 00 f0 fc 01 fe 21 c5 5c 34 f5 e1 fa e6 76 ab 1b 32 a8 f8 e8 29 14 d9 ee a0 fb 7e de fd eb 1e 43 49 7d 1d 00 00 00 5b 49 44 41 54 78 da 95 cd 47 0a c0 30 0c 44 51 b9 a5 f7 de e7 fe b7 0c 8e b1 b1 03 59 64 76 ff 21 10 7d 2f 6a c3 16 39 c6 00 62 40 f9 9d a4 c8 84 d7 75 01 94 e4 ad c2 b3 b9 d1 c1 c0 a8 33 d0 0f 1a 00 90 34 Data Ascii: PNGIHDR(-S`PLTE\|%tRNS!\4v2)~CI}[IDATxG0DQYdv!}/j9b@u34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49769	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	638	OUT	GET /static/font/roboto/v29/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.wisecleaner.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.wisecleaner.com/static/css/roboto.css?v=1.07 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	673	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: font/woff2 Transfer-Encoding: chunked Connection: close last-modified: Wed, 12 Oct 2022 05:46:47 GMT etag: W/"2b18-5eacfeb239ddd-gzip" vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4828 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jMyj4NptvAnb%2FQ1beHvV65PFkYI50CrMD8NmkVyOr6YaFiQRPd0cfoulbLJN9ZxzKvUdvdmif3tzQLINtwHIq78PGWiWApyYokrtrmt2iW7sw4R1tXr5fy5tw00a%2FeXsbUEQEgw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046fdd46766-ATL
2024-04-25 13:30:36 UTC	696	IN	Data Raw: 32 62 31 38 0d 0a 77 4f 46 32 00 01 00 00 00 00 2b 18 00 0e 00 00 00 00 54 28 00 00 2a c2 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 64 1c 85 5e 06 60 00 83 20 11 0c 0a f1 5c da 72 0b 84 0a 00 01 36 02 24 03 88 10 04 20 05 82 74 07 20 1b c1 45 a3 a2 ac f4 4a 3a a2 62 54 88 a2 74 50 c6 04 7f 79 c0 83 a1 bc a1 0b 97 28 0e a1 a0 56 51 d7 a1 4d ab c6 0c 51 4c f0 4f 0f 87 38 4b 84 05 f3 9f c3 e4 52 fb 79 58 b8 9e c6 9e 81 e3 7c d4 5c 9e 7f f2 2f fe 5b 55 75 ea f6 13 c3 0f 31 22 9c 8d 15 81 f1 c4 a0 62 22 83 7b ff c0 db ed fd 5b ce 58 67 54 2a a1 68 2c bb ac 15 27 2b 7b 64 9d 75 d6 88 7d 03 67 ce 06 3b c7 be 53 21 2b 2a 2d 9a 66 99 ed e5 7f e7 c8 e4 fa d3 e4 63 0a 07 40 76 53 8a 00 32 ea 3b b7 9b 46 65 26 f4 a6 81 28 6a Data Ascii: 2b18wOF2+T(dd^` \r6$ t EJ:bTtPy(VQMQLO8KRyX\|\/[Uu1"b"{[XgTh,'+{du}g;S!+*-fc@vS2;Fe&(j
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 44 c6 4c 98 3b c7 92 15 5b f6 1c 39 71 e1 a6 54 99 0a 95 46 8d 19 37 61 d2 2d 53 a6 dd 76 c7 5d 33 66 cd 79 ec 89 a7 16 ac 59 b7 61 d3 3b ef 7d f0 d1 27 9f fd f0 d3 2f bf fd 81 38 9d a7 30 54 09 53 43 a0 41 d4 02 51 08 a1 48 90 25 10 51 84 f3 4c 3a b6 4e ac 7f c2 69 c2 0c b2 c8 30 6f 18 05 a2 b3 ac d8 5c db 66 9d 43 5e 73 cc 26 97 c8 1c b7 96 47 54 15 6a 62 2c 5b e3 26 4c ba 65 2a 16 5b b4 64 d9 8a 97 5e c5 6a 6f ac 59 b7 61 d3 7b 1f 7c f4 c9 e7 f8 d2 6b 5f 7d f3 3d 7e b4 e9 e7 86 70 ca c8 e1 ed 65 28 f6 f8 a4 a4 16 d6 e9 cc 51 cd 2a b5 bc a5 91 05 0b 24 c6 62 e6 3b e3 fe b7 f7 e1 61 f2 94 6d 7a 39 65 52 d0 7a 40 42 0e 49 89 a9 cc e4 a2 a6 1e 06 2f 61 3a 04 d7 db 4b 1e 84 80 1f 8f 37 13 5f 88 e3 1a 9c 13 79 4f e5 f6 cc 73 2f cc 97 3b e0 08 e0 1e 2d f7 04 Data Ascii: DL;[9qTF7a-Sv]3fyYa;}'/80TSCAQH%QL:Ni0o\fC^s&GTjb,[&Le[d^joYa{\|k_}=~pe(Q$b;amz9eRz@BI/a:K7_yOs/;-
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 71 3e 98 a1 ac 88 23 30 1c 8d 27 cd 80 e4 b6 17 82 43 1b 20 e8 e7 73 e5 1b 82 d2 7a f5 47 fc 98 5e 88 55 1d 97 ab da 7d ae 0e 4c 9d ba 74 eb 99 55 f7 20 b6 b6 7d e2 84 8b d0 6f 00 0b db a0 6b 50 90 e5 97 3c ea 75 2d 0f 16 cc f7 4e 05 d0 f6 e3 f5 c6 8f 9c ef 00 1e 12 c2 2b 1c 87 81 4b 61 ff 96 70 e1 95 e6 86 a0 0d f2 6f 81 ff e0 81 55 45 07 09 c8 87 00 75 e6 64 92 68 1d fd 58 30 f8 9e 15 91 53 4c 7b cb 37 ab 8b 68 c3 c2 03 5b 25 a9 d3 a6 dd 90 09 f7 ac fb 60 1b 91 6b 56 fd 5a 9f e8 cf fb fc fe 28 89 8d 12 9b 25 f6 48 88 49 88 4b 48 49 c8 48 28 48 a8 4a e8 4b 44 48 b4 49 2e 4b 11 fe 6f 6f ff cb 36 38 6c 25 a1 4e bd 76 57 0d 9b 74 df 86 8f 23 d7 2c 0d bb ec 96 d8 29 b1 a7 f7 f2 12 2a 2d e5 f3 3d ab 24 73 93 48 46 80 01 f2 0f c4 31 d5 af f5 ef d6 bf de ff f7 Data Ascii: q>#0'C szG^U}LtU }okP<u-N+KapoUEudhX0SL{7h[%`kVZ(%HIKHIH(HJKDHI.Koo68l%NvWt#,)*-=$sHF1
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: e1 2f c3 9b e4 d9 9b 8a a6 ea 06 e8 60 06 da d8 ea d6 09 62 c6 72 1b 6a c8 b0 a2 81 cc f9 2a f3 29 b4 66 3e 6a 83 0a 87 84 7c c2 57 aa 6f 9d a7 d5 0c bf 87 d0 b6 9b 7e 2e f8 88 4a 35 37 8e 8e f8 64 42 ae 56 ae e7 5c 87 0a 28 19 f0 86 88 2b 60 83 70 28 85 b6 28 9e 1d 52 a2 06 70 a8 28 cc eb 13 3e 1c c1 47 f0 be 47 9b af f4 0d 49 3b b1 a1 6c dd 98 dc d0 29 7f 1c 1a 0a 0e fe cd db 29 5c ca c7 2c 3e 0e ab 26 1e 3b f2 c1 22 63 78 5e 13 bb e4 b9 2a 66 2b ef 32 bc 05 b5 78 93 13 5d 74 2e 2e 4d dc 0b 79 24 19 ba 55 fe 20 76 8c 24 e7 82 9e 3b e2 af d7 d6 da 82 83 6b 15 b0 f4 b0 75 f7 67 33 c4 21 c1 fd 2e fe 1e b9 d9 78 e0 a0 05 58 e2 69 3f 2b 86 58 72 67 ce 3d b2 6d ab c1 f5 a1 ea 84 06 97 b5 cf 3d b8 1a 4a f5 f6 fa e3 b5 c5 7d 92 e2 38 a0 9d 14 97 92 e3 5c 32 20 Data Ascii: /`brj)f>j\|Wo~.J57dBV\(+`p((Rp(>GGI;l))\,>&;"cx^f+2x]t..My$U v$;kug3!.xXi?+Xrg=m=J}8\2
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 34 9d 18 d3 fe c6 0a 94 f5 97 22 ca 3e 3a a4 19 c9 84 96 47 b2 3f 22 27 24 1e da f9 55 ed f5 30 97 09 4d 33 7a 6f 13 55 09 c2 97 9e 1c 77 38 5e 72 3c 04 6f 57 ce e9 7c 28 e8 78 a9 bc e3 38 5f bc 0b 6b 5f f7 ce 04 47 38 fc 8a b7 a4 a3 e4 0e fb 4e f2 1f 74 33 1b 32 24 fd 0c 5d 52 d1 b4 c6 de 7c 1f cf 29 e0 11 df 2c dd 04 86 bb 2c 83 dc 21 7b a2 9d 9c 03 cc 84 5a 19 dc f1 1a d0 be 18 64 b0 a0 f6 76 6b 49 11 2d ff 43 67 e1 d4 bb 37 0b c7 50 2a 03 3c 6f d2 1e 33 72 53 e6 90 85 43 6f 29 cb 74 6a fa 23 d4 2b 78 c6 7e 10 41 69 12 9c d8 0b 0a ec 8c 1f 27 43 92 ac 6b 6c c8 d4 fc 70 5a 59 55 36 6b 0a f5 e3 d9 ed 37 b3 9d 4f 04 0f 65 34 bc 80 9d 5e f2 f4 54 a4 38 83 0c db 59 2e 25 8c d5 fe 77 75 74 66 eb d9 4d b7 b8 4e ff a3 d1 d2 a9 1d 17 c6 b6 d7 2a 60 a1 8f 1d 5e Data Ascii: 4">:G?"'$U0M3zoUw8^r<oW\|(x8_k_G8Nt32$]R\|),,!{ZdvkI-Cg7P<o3rSCo)tj#+x~Ai'CklpZYU6k7Oe4^T8Y.%wutfMN`^
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: fe f2 f6 83 c7 0b ab 3e a7 7c 4f bd 7a b2 70 e7 c1 0a 78 cf c6 3f 7f be cf 2b 7f df f0 be a4 45 e7 e1 74 95 4e f5 81 3c b9 d5 54 c1 9a 1f 39 20 d1 bb 39 04 38 ca 50 59 2c 70 0c c4 02 2a 83 c9 94 c1 1d 67 02 94 24 c7 35 8c b8 b2 91 a1 3f b1 46 40 ec f2 e0 f5 95 b6 23 8f 2f 1c 7e dc 0a 2a c9 a5 45 a5 45 b0 f7 f2 f3 5a 44 7a 09 0e 6d 73 5e 9d 9c d1 5d 77 a7 87 de 0c ec ad 1e 1b 8f 70 72 98 57 86 97 21 fb 1c b9 64 cc 2e 6a f0 11 1b 7d e9 73 b1 b4 9d c0 d7 6c bb 4a 07 29 c3 c5 7c eb 49 bb 70 0f d0 45 09 fe 7c 75 6c f8 6e 48 1e 3e a1 05 70 c0 d2 08 a1 d1 96 0f a3 07 30 d7 f3 ef 52 fb cd 9b 67 ad 9b 7b 32 0a ef 82 46 aa 57 61 34 87 43 07 c6 39 b2 71 cc 2b 78 01 23 03 fb 6a c2 bf 3d cd 2a ea fb f8 8c a3 bd 83 c3 2f 37 d3 3f a7 62 7a 78 ff 60 f9 14 b8 4a ff 7a 73 Data Ascii: >\|Ozpx?+EtN<T9 98PY,pg$5?F@#/~EEZDzms^]wprW!d.j}slJ)\|IpE\|ulnH>p0Rg{2FWa4C9q+x#j=*/7?bzx`Jzs
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 1b a7 39 0d 22 3b b0 fd 08 c6 ff 53 30 f8 6c 53 de 56 57 53 7d ed 61 5f 30 f3 c6 c3 ca ba d6 4b c5 05 5e ae d6 4e ae 81 d4 f8 b0 98 40 aa ab b3 b3 95 cf ff b4 b6 da 03 84 2b da 82 57 6a 0f b4 b5 54 4b 12 1a ea eb 84 2e d7 ec 27 37 4f b3 1d 8c 27 92 89 13 6c 87 e9 f1 6e 3b e3 fb 13 e3 c6 33 bd 76 e0 3f dc 69 73 d6 26 39 3a 25 de 37 a4 21 ba 8d a4 98 95 60 60 a6 a4 50 c7 ed db 9a 42 cd 28 cf cd 54 f7 d8 65 e1 14 77 d4 ee 20 3b 37 d4 12 ec 35 15 5c 41 6d 25 9a 8d cf a8 d7 02 87 a7 d2 a3 e4 89 ce cc ad ae 5e a8 a9 4a b2 ad b5 4a 42 a8 f8 11 34 f4 d5 32 e7 9c 70 79 53 6a 62 fc 05 ed 58 39 28 d7 b0 c5 0a e4 3f 62 49 f0 bb 91 d1 1d 17 aa 0c 11 3b 1d 65 a2 a9 ba 37 0d e4 d7 44 eb 18 75 80 3f 30 ec 57 54 19 e0 57 50 e1 1f 50 50 ec e7 5f 5c fc 5f 44 99 78 46 45 95 Data Ascii: 9";S0lSVWS}a_0K^N@+WjTK.'7O'ln;3v?is&9:%7!``PB(Tew ;75\Am%^JJB42pySjbX9(?bI;e7Du?0WTWPPP_\_DxFE
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 95 08 1f 49 a1 da e8 bd 31 3f f7 1c c0 72 77 25 74 51 bb 12 bb 38 b1 7b c4 bf 04 64 8a 0b d5 93 a4 82 2f 33 a7 b1 83 17 12 93 a9 c9 a0 b1 26 49 a7 2a d2 29 54 c7 5d a1 8c 5c 46 6e e8 2e c7 af 93 85 b7 9c 6e 15 9d 4b 05 cd 2e ba 5e a9 1e 4c e7 98 ab ea dc 3b 33 75 3d b4 45 5d bc 32 41 2e 2c da 2f 20 d0 75 81 b1 d0 4a b4 6f 7d 05 ac 57 bc 90 c9 ad 87 81 79 27 63 7d f4 e2 88 82 b6 a1 fe 4e 9f 23 ea 80 7d ca ca 51 1b e5 01 0b 64 8b 3f c9 75 91 b1 b8 e7 2a e5 b5 16 b0 54 3f 4e a1 60 12 fd 08 50 1d 74 32 2d d5 be dc ab ee d8 d1 7b da 1f 3f a9 3e 3b 45 94 71 ca 34 4e 6e 28 29 ce ab a5 21 49 b7 09 85 47 55 2e 28 ba 39 ab 39 6a 9f 70 32 99 72 9c 6e 99 36 ee c6 d0 38 1c a9 b9 9a 9a 56 36 0f 7e 98 3c 3f 9d ae d2 bf 58 da 9e 43 af 6c 85 da dc 4b 15 ed f4 9c d2 56 a4 Data Ascii: I1?rw%tQ8{d/3&I)T]\Fn.nK.^L;3u=E]2A.,/ uJo}Wy'c}N#}Qd?uT?N`Pt2-{?>;Eq4Nn()!IGU.(99jp2rn68V6~<?XClKV
2024-04-25 13:30:36 UTC	761	IN	Data Raw: 0f c0 c6 8b 3f c7 7f e3 d3 43 74 a3 b4 1a 6f e1 2d fa ff 7b 7f b7 f6 ed ea 3a 03 a5 de 89 ae 24 c1 73 9e 7f fd e2 d3 7c f8 f6 6b 32 fa 2d 32 83 6c 4f 51 99 b5 02 7b bb 12 e9 be 5b de 30 41 78 d3 c2 81 16 70 01 57 50 82 0a 48 07 53 08 6d 69 ef f6 51 66 eb 74 b8 04 19 95 b7 b2 3a 21 73 4c 3a bb 3a 29 60 9e b6 a7 fe 68 9e 4a a2 a7 96 e6 ca 0e 8d 34 ef 1b 2e 6e f6 64 e9 c7 f5 57 00 a5 89 f1 82 99 7b f9 ab 59 ca 64 b2 a8 c9 c3 5b 36 a8 de 69 aa 21 16 35 41 6e ca ca 9e 3b ec 59 ed a2 31 31 54 6a 06 7f 7d 9b 6d df a7 60 18 39 14 2d c3 39 6e a2 3d aa 60 fa cb 54 ca 51 50 25 ca 2e 59 ce 95 c6 ad 34 b8 f4 49 ea 6e 61 ee e5 27 bb 7d 92 d3 b6 32 54 7c 8c f9 49 d5 0a 8d 5e 01 6f 45 79 9c f4 66 36 b7 de 9b 20 b1 b2 d5 38 eb 61 94 b1 4c 72 41 3b 3a 7e 38 3c a6 88 86 66 Data Ascii: ?Cto-{:$s\|k2-2lOQ{[0AxpWPHSmiQft:!sL::)`hJ4.ndW{Yd[6i!5An;Y11Tj}m`9-9n=`TQP%.Y4Ina'}2T\|I^oEyf6 8aLrA;:~8<f
2024-04-25 13:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49767	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	640	OUT	GET /static/font/roboto/v29/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.wisecleaner.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.wisecleaner.com/static/css/roboto.css?v=1.07 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	675	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:35 GMT Content-Type: font/woff2 Transfer-Encoding: chunked Connection: close last-modified: Wed, 12 Oct 2022 05:46:49 GMT etag: W/"1910-5eacfeb409fa5-gzip" vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5931 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qoSRmuITVoY3pZoFCEB5Qssxr0rVJpuiR3dy3UQ2P4URpW3OBnfxAhxqY3mC1SOuYiAcmcQd6mwq%2BPjXU%2Fpq8shPhVMtY0KBLYUUltx%2FBvF2eUhzb8iEK28T2SdNTuStgl5riXw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046fdc8673a-ATL
2024-04-25 13:30:36 UTC	694	IN	Data Raw: 31 39 31 30 0d 0a 77 4f 46 32 00 01 00 00 00 00 19 10 00 0e 00 00 00 00 31 e4 00 00 18 bb 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 6a 1b 96 56 1c 36 06 60 00 82 04 11 0c 0a bc 50 ae 76 0b 82 10 00 01 36 02 24 03 84 1c 04 20 05 82 74 07 20 1b 05 29 b3 a2 66 b4 5a e5 23 8a 92 35 19 08 fe cb 04 73 0c 9d 75 d0 57 b4 60 3a cd d6 1a 04 72 b0 e4 28 50 b2 63 eb 81 fb d9 a5 f6 9f 44 20 28 6c 54 20 5e 89 93 3e e7 0e b1 05 45 0f 07 70 26 21 77 46 48 32 db 12 54 6b 64 cf dd de 03 51 40 47 22 db 54 14 4a 40 cb 20 14 a0 8e 71 cc 4e d1 f8 f0 fd 69 7f ee 43 5e e4 52 c9 34 a9 ac 24 85 22 0d 52 ae 06 e2 ea 8b 5c 02 1a a2 6d 1e 60 0c cc d8 a6 8b c8 5f 44 da 85 51 9b d1 63 65 25 a0 62 82 d1 af fd 6f a1 8d 11 89 91 98 0b 17 d2 53 3f 89 d5 c9 Data Ascii: 1910wOF21jV6`Pv6$ t )fZ#5suW`:r(PcD (lT ^>Ep&!wFH2TkdQ@G"TJ@ qNiC^R4$"R\m`_DQce%boS?
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 42 1d 52 ea a0 6f 83 b1 25 59 8d cb af 4b 69 ed ca e3 a8 04 ab 5e a8 41 2d ea 82 fa 58 1a c1 66 a0 05 ed e8 44 5f 65 53 4b ac 75 b0 b5 c1 a9 e9 c6 cd bd 4d f3 c5 11 00 f6 20 c4 cd 5e 69 ab 4e 9c 84 ca a4 70 71 7e 2c f5 8d de c2 b2 d0 e4 08 51 62 61 fa 91 a6 e9 5b 63 6c 59 56 b3 f2 b5 2e 6f 35 d2 6d 4c 13 ad 8b 36 8f be 15 6c 35 43 11 eb 31 89 41 90 44 2e 45 85 75 d4 0c 4e 90 b6 0e 97 51 a9 66 d3 0a f7 92 33 73 29 e3 2a d3 8a 47 da 6a 94 48 42 ab 92 da 94 d2 25 4f 34 28 6d 6c 1d 7a 95 a9 c3 6a ff 5e 3b 32 57 a8 8d e9 02 29 69 4f 47 15 36 92 36 92 96 10 c9 6a 8a 3c 0b f6 6b 2a a3 54 4d a6 be 19 4d cd ea 25 63 22 62 26 13 90 9d 72 ab 93 7a b1 ca 56 ad 6c 14 4f 4a 6a 4a 4a 0f 74 4d d0 2b 1a f8 82 c6 e6 54 37 af 97 26 d0 ea d1 36 fb 5b b1 d1 98 00 1b 13 18 07 Data Ascii: BRo%YKi^A-XfD_eSKuM ^iNpq~,Qba[clYV.o5mL6l5C1AD.EuNQf3s)GjHB%O4(mlzj^;2W)iOG66j<kTMM%c"b&rzVlOJjJJtM+T7&6[
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: ff 30 dc 09 ad 98 7a 15 08 19 06 c9 38 72 8c 28 67 05 82 32 4c 6e e4 10 c3 31 2e 74 b7 ca 0b 5a 4c 4e 64 89 96 ba ca d8 02 1d 5f e2 43 9d ac 49 14 b9 7b 15 35 3b 69 3f b7 7a 17 74 1f 7f 53 67 45 fb ad 18 f8 ec 0f 11 eb c8 0a 77 dc 0c bb 08 55 94 9e 91 7a aa 26 7e 6e 72 e9 bc 84 f3 0b ba 3c a7 e2 12 4c a7 98 47 0c 38 1f ec 4e c0 93 d7 d8 a3 10 ae c9 1a 03 25 56 3b 42 d7 47 32 49 57 49 4b 2f fb 47 4a c0 64 b3 44 bc 43 d5 4b 46 a7 ec 15 c4 46 ae 58 53 88 cd 0e 86 f6 b6 ad ef e0 e0 73 e1 dd 93 df 57 73 32 1c 53 98 d5 9e 95 5a b7 40 08 47 ea 1f 99 78 1c 79 b8 c7 ad b6 e4 c4 8b 4a 1c 25 53 63 7e 60 0e 1a ec 3d ac 56 d7 25 b5 82 10 a2 12 e2 06 de ff 0d 0e 6f f6 a3 6e ca 17 5b 1e 36 6f e6 4f 7e c6 a8 6e 08 4f 14 c9 b3 41 b2 ac 01 13 cc 1c 3d 6b 17 8e 89 fa 28 b7 Data Ascii: 0z8r(g2Ln1.tZLNd_CI{5;i?ztSgEwUz&~nr<LG8N%V;BG2IWIK/GJdDCKFFXSsWs2SZ@GxyJ%Sc~`=V%on[6oO~nOA=k(
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: d5 b9 3b 36 a5 ef 6d a2 b6 2f da 28 f1 22 c1 72 82 bc be df 23 40 3f 02 21 75 72 27 cd 97 5d 55 9d cd 4c 81 fa 6e a8 f0 ca ce 1b 67 43 7f 5e b8 79 bb e6 5d b1 a8 dc 09 8b fc 4b 90 3f 36 35 30 72 28 c6 e5 df 88 57 c0 b0 f0 d9 ff 02 d1 0e 5b 63 3e c1 43 c2 67 ff 22 3b f2 12 fb 7d fd 12 86 ea 72 92 87 7c bd 92 fa c1 9d 09 c5 cf f1 93 15 35 56 2e 78 04 b0 03 29 3b ec ad 7c 58 55 13 07 79 8a 70 85 91 9d 9e c9 ef 42 b9 df 86 a4 7d a5 75 80 33 09 f2 cf 6c 6f a5 af 31 de bd b4 7d fd 75 ac 30 ab 88 5d 1a 8a 3e f7 30 d7 35 b0 56 7a 74 cf e4 9e f8 8d 34 85 b7 0e 4a 41 33 99 08 a9 4e cd 8a a1 8d 70 a9 7b 9b d9 98 b8 bd 07 bf 65 72 bc fb 74 24 cd 12 7b 7e 87 52 a2 b7 5b ea 5d ea 01 4b 82 42 55 c7 6b 77 5e 18 d7 17 18 da 77 5f 4c 16 d3 9c 7f b6 57 5f 67 1e 7e e0 54 03 Data Ascii: ;6m/("r#@?!ur']ULngC^y]K?650r(W[c>Cg";}r\|5V.x);\|XUypB}u3lo1}u0]>05Vzt4JA3Np{ert${~R[]KBUkw^w_LW_g~T
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: ad 48 f7 83 7d 9a f7 b7 5f 3c c0 69 93 29 d4 b9 2f 9f 86 24 df d9 a5 70 6f 9b cc e6 7d a6 ac c9 67 cc f9 d6 a4 10 f3 9e 8b 67 f9 d5 33 39 05 9f 8a 9d a0 71 91 c0 1b 4e 1b fd 00 5f 0d a1 f4 35 3a 42 ff 24 d2 9b 78 e7 14 28 45 3d 1d e5 3d 1a bb 5a 31 e5 f7 90 27 5c ab 6c 0f 47 79 59 14 68 cc 25 74 5f 3a 42 f7 a1 a3 d0 fb 2a 50 02 f1 bb ff 91 a7 53 bf 23 f9 d6 f8 1b c4 b0 a1 ad 8f 32 85 98 ee e2 b8 f8 c1 2a b4 21 fe ce 6f 5b 8a 98 b1 9d a8 a1 6a 61 a3 87 01 0a d5 87 66 80 90 bb a1 10 4a bb 7a 37 98 1f 3a 3f e4 ff f5 3d 1b 05 7a 81 ae 8a b0 c6 c7 94 2a 7d 62 27 73 e6 87 3c d5 6e ab c7 d3 3b 8f 33 9a 04 1b fa 79 1b da 87 17 f2 c5 92 a9 a1 02 41 61 30 e8 b7 e0 12 ef dd c1 d3 d0 25 b0 9b c0 c6 47 3b ff 1b f5 0c 6c c7 0b 0b f5 e3 7a 11 08 41 8e e4 25 f6 cb 32 86 Data Ascii: H}_<i)/$po}gg39qN_5:B$x(E==Z1'\lGyYh%t_:BPS#2!o[jafJz7:?=z*}b's<n;3yAa0%G;lzA%2
2024-04-25 13:30:36 UTC	254	IN	Data Raw: 93 57 19 ba 0c 49 72 6b 71 be 6e 7e 25 44 72 2c c3 8b c9 e0 c0 23 bd ba 83 7b 37 8f 7f c9 9b cb 2f 53 44 86 b8 04 d2 75 9c 7f ff 8c 31 ee ed 2d 21 92 03 29 89 23 93 bf 55 b1 54 f6 96 d0 98 bb b8 ad e7 d6 42 56 28 64 20 e0 a6 03 b4 fa b0 5a e5 ea b2 0a 8b a5 fe 89 da cc a2 91 22 00 ec 07 dd 29 84 d8 c4 29 14 a9 c5 65 69 f3 b2 4c 7f 0a 2b 95 ef 14 9e 68 e7 4b a5 fa 3c a8 f6 dd 2e fc b5 16 cc 99 e7 12 2f e7 8d 31 b3 05 1b 2d 5a 67 73 99 e5 8c cd 56 99 64 b0 7a c0 72 a6 07 ad 9c 5a 6d e1 64 ed e0 29 6d 96 31 68 ab 19 86 4b 82 f4 1c 77 ce 69 13 03 61 07 a7 05 b5 ea 1a 19 d3 73 15 2a 25 b2 7c a1 9d 15 18 57 e9 dc ae c0 a6 44 26 09 2f 33 0c da 98 26 8b 16 a9 ad 1c 21 32 b9 30 f9 16 ab 34 e9 5c a5 6d 9a d5 aa 7f 0b ee d7 33 d2 f8 95 b2 d0 00 49 64 b6 01 0d 0a Data Ascii: WIrkqn~%Dr,#{7/SDu1-!)#UTBV(d Z"))eiL+hK<./1-ZgsVdzrZmd)m1hKwias*%\|WD&/3&!204\m3Id
2024-04-25 13:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49765	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	654	OUT	GET /static/img/product/update/icon.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	796	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 4090 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=7401 Content-Disposition: inline; filename="icon.webp" Vary: Accept etag: "1ce9-5e5da4743cab8" last-modified: Wed, 10 Aug 2022 03:02:24 GMT CF-Cache-Status: HIT Age: 60502 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aNLlXlDuItFSVwZPhoI9trmuquoqdjQBIBwW9y1EDp98HpbUnBbQJkkMdKzS93nanVkZZNv3t%2F9WWpK5JCF8uFFsDiBlOwJZM8la5EHqgIXmt1k58NPQAPGLlGY57WwFeBLiexo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046ffdc12e3-ATL
2024-04-25 13:30:36 UTC	573	IN	Data Raw: 52 49 46 46 f2 0f 00 00 57 45 42 50 56 50 38 4c e6 0f 00 00 2f 31 c0 59 10 ff 07 39 00 db 44 92 42 7b cc d0 c9 35 71 fd 17 40 4f e6 24 33 96 74 d0 04 e4 da 76 23 29 5f 76 cd d5 cc 33 49 10 28 d9 90 03 7b 02 20 00 58 f6 68 97 24 eb 43 8e 24 49 91 14 5d 53 d3 c7 24 d1 e9 2f 07 ff 78 a0 a1 2a e7 bf 0e 00 4c 75 88 24 c1 8c 29 68 45 42 e1 06 07 84 e4 80 0d 39 99 34 a6 86 c2 39 59 90 50 64 98 81 0e 91 10 30 c5 14 27 31 04 02 43 40 20 60 c2 92 4c 01 61 08 04 d2 d5 c6 ae 50 a5 d2 b1 20 64 58 8b 70 13 b9 d8 21 07 4d b8 89 1c 52 89 4d 58 65 1e 12 ab ac 17 59 4e b2 1e 53 54 a1 ca 7a 11 99 50 21 17 39 64 12 45 a2 08 1d da c4 21 0a 80 00 71 7d d8 a4 30 88 40 04 c6 14 08 e2 60 af 26 0f c8 03 7b 13 65 42 9e 56 c7 d2 ba d4 75 df 71 f0 6c 96 b2 09 18 b5 83 10 96 de a4 ae Data Ascii: RIFFWEBPVP8L/1Y9DB{5q@O$3tv#)_v3I({ Xh$C$I]S$/x*Lu$)hEB949YPd0'1C@ `LaP dXp!MRMXeYNSTzP!9dE!q}0@`&{eBVuql
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: a9 bb 7b fb 6a 7d 5f f9 15 d4 dd dd d6 7b 17 ee ee 2e 37 e1 2d 99 19 66 a8 fb 01 02 cc 90 13 60 68 80 3f 09 90 88 fe 43 90 24 b9 6d 33 e3 00 80 e9 00 22 15 9f e0 59 db 26 d5 ad ac 6d 3b bc 54 b5 78 f5 66 7f b5 70 63 98 8a 19 ed ea 2d 70 6f 2d 2d d2 84 ad 29 5c 5c cc bc 19 b8 98 99 3c 22 33 87 bc 05 f2 ad 31 25 85 21 32 05 99 a2 08 8f 88 fe 43 90 24 37 6e 33 f0 41 f1 00 41 12 00 9d 3c 61 c0 9f 3c 96 4c 4d 19 34 66 da dc 05 27 40 af d7 1e a5 15 13 ba e6 4f f1 3b 39 2f 8f 9e 6a ce 1b a7 05 e1 4c d3 25 d5 72 7c f7 8c 5d 99 19 9a 4d 57 79 c8 ee 33 e6 01 6b ba 6b 0a 57 b5 1d 31 26 1b d3 f1 4b 26 4f c2 af a9 d7 99 90 f3 d1 a3 43 e7 9d a0 38 fb 78 84 5d 85 cb 02 f6 4a 3a 32 40 8c d0 b8 27 7a 0c f8 19 47 98 0c 90 96 1d fb 04 a8 a1 9d 48 8c a4 a7 1d 62 2d 06 5d 95 Data Ascii: {j}_{.7-f`h?C$m3"Y&m;Txfpc-po--)\\<"31%!2C$7n3AA<a<LM4f'@O;9/jL%r\|]MWy3kkW1&K&OC8x]J:2@'zGHb-]
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 65 aa ca 44 69 9d a4 3f 12 ba 0c 25 ae e5 d8 a0 6e f4 cb a8 5e f6 66 a1 43 de 66 61 d2 c6 ae 9f b1 b6 ef ab 79 43 a8 aa 38 7d 28 e2 e6 17 72 43 d4 2a 8e de 4b 4a 6b c8 ac ec d9 9d d1 35 fd dc 74 c4 4d 89 2a 75 7d 48 9a 41 9f b7 e9 d2 e3 be 4c b7 c6 36 17 0e e1 c6 f6 24 32 e5 77 67 f3 8f 1f da af 82 ea e5 fc 2a 38 14 3e f6 e0 63 3f 7e fc c9 a7 f2 59 fb d0 c7 0e e7 ef f4 e6 27 fc 0c 33 c8 27 f3 bc 39 ef 97 f7 37 bf 60 2a 70 35 49 93 fa e2 3f 3f f3 8e 2d ae cd 47 b1 8f df 11 8f b0 4f 9e 76 ba 03 0c cc 72 dd bf 6e 1f 2b c4 3a 90 76 b7 e1 09 a2 ae 1d d6 2b b7 de 32 b6 4c e5 59 36 a2 ae cd 75 98 39 ab 67 73 8a 7e c3 99 67 75 b4 81 d9 af dd 6d 02 00 62 46 58 d9 f9 cf 99 b7 74 7b dd 36 5f 07 52 18 9f 07 eb dc ef 2d fc 4e e0 5a 0e 0e 57 7d ec 71 de c2 ff 00 06 3f Data Ascii: eDi?%n^fCfayC8}(rCKJk5tMu}HAL6$2wg8>c?~Y'3'97`p5I??-GOvrn+:v+2LY6u9gs~gumbFXt{6_R-NZW}q?
2024-04-25 13:30:36 UTC	779	IN	Data Raw: 62 dc 63 e2 63 10 cb c9 26 9d 9a 37 44 af a0 2b 02 34 90 c5 41 c8 69 82 22 03 a2 98 3c 57 f7 16 5a e4 04 98 58 17 7a 16 07 4a fa 4a c5 a2 d3 cf 4d 67 96 00 58 77 bb 73 56 50 54 4b 31 6b ae eb f3 36 9d b2 94 a4 7b 3b 9b 62 00 0c a5 d6 6d 1a 74 88 db d6 e5 ca aa b3 b9 0c eb 16 c1 fa f4 e5 c9 61 c8 73 9d 57 6e 47 0f d8 3f ba 65 30 39 1c c9 4e bc e8 b3 2f d6 2a ea 0d d9 ce b4 e0 f9 4b d6 5c 77 3d 49 bb 78 91 95 27 af b8 ba 4f 55 eb ca a7 98 38 bb 7e 83 e3 5c ef e0 f6 a1 e5 75 96 1b a5 0e 9d 37 3a ce 95 d4 2d dd f0 1c cf f1 3c b4 1c 0b c0 f1 90 07 7c 9e d1 d1 f0 98 6c 52 71 f9 4d 8c 5e 45 73 b7 c6 cd 18 2d b2 8d 46 03 3d af a1 7e 33 b9 ee 16 a3 d5 ba f5 11 44 8e 5b c7 e2 68 b5 8c d6 ff 4f ab 96 19 0a b7 1b 4b df 2f 2e 34 cf 8b cf 3a 13 f1 1c 11 9f ef 16 d6 52 Data Ascii: bcc&7D+4Ai"<WZXzJJMgXwsVPTK1k6{;bmtasWnG?e09N/*K\w=Ix'OU8~\u7:-<\|lRqM^Es-F=~3D[hOK/.4:R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49764	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	667	OUT	GET /static/img/product/thanks-for-choosing/card.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	798	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 6768 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=9372 Content-Disposition: inline; filename="card.webp" Vary: Accept etag: "249c-5e5da49b1772a" last-modified: Wed, 10 Aug 2022 03:03:05 GMT CF-Cache-Status: HIT Age: 59367 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LpoeRkUsbpZtKVO9uzogZSMzr32MkWOkiKRAS2TqxjtMpIdNcJPk3X9aPVPGjLgQuvHynuUmFnGqDMQjyZt%2BuBKTgA7ID99SMgLQFSGaVd1LWglyb5SUgCjC5EKn%2FexBBHix5WU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046fba27bdb-ATL
2024-04-25 13:30:36 UTC	571	IN	Data Raw: 52 49 46 46 68 1a 00 00 57 45 42 50 56 50 38 4c 5b 1a 00 00 2f 71 c1 18 10 1f 07 bd b6 6d 53 cf 79 fa 18 db fa 65 b7 9d 12 d2 86 6d db c9 bd fb ac a8 08 b8 b5 6d ab 56 f6 7d 0f 77 77 d7 02 28 81 aa 69 81 08 22 b7 e8 bb bb dc bb 17 e4 c8 b6 55 2b fb 7f dc dd 7d 0c 19 90 31 29 30 a5 c8 c0 dd dd 9f cb d9 6b fe 05 24 09 0d c8 1d 26 01 22 31 90 04 84 69 00 31 c1 6d 6e 73 9b db 00 00 b7 01 00 a9 44 40 29 00 00 4a 01 10 63 cb 6d 3f 88 bf 41 88 96 c8 dc 06 00 00 90 61 09 d3 06 00 a0 04 08 7f 14 45 b3 00 00 00 f0 c7 12 66 06 00 a0 14 dc 16 63 0b a0 14 00 ff b3 4c 48 00 00 fe e8 4a e1 0f ad 14 0c 43 1d 80 af 49 0d e0 36 c0 e7 b8 02 70 9b db 00 61 da 48 6c 92 c4 d8 72 db 6b 3f 03 f8 8c 8d 72 bf e3 25 2f bd 0f 0b ae ca 43 2b 75 1c 13 59 29 55 a9 e2 ca 8d 6c 41 92 f9 Data Ascii: RIFFhWEBPVP8L[/qmSyemmV}ww(i"U+}1)0k$&"1i1mnsD@)Jcm?AaEfcLHJCI6paHlrk?r%/C+uY)UlA
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: a4 32 a8 94 f0 29 27 2e 4a a9 43 ce 44 0e ea 41 e7 19 45 82 1b a5 1e 54 64 38 81 f8 ff 7f 3e 78 90 94 ae 79 be f6 6d df 22 fa 0f 51 92 a4 ba cd ac b4 e2 ce 1c 85 9f 0a e4 0f 3c 4b db 3f a9 8d fc 7f 9d 19 19 b9 c8 5d 6e d8 65 04 2b 36 ac d8 72 08 1c 81 4e 40 2b 29 c2 65 21 b0 3c 48 35 cf b3 5b 76 4d 9e ba 85 ca 92 6c 0b 31 78 80 34 88 52 b5 25 b9 da b3 ca e9 d9 14 e2 4c de ef 77 26 f0 99 77 9f d7 f3 7a 45 f4 1f a2 24 49 75 9b 59 69 e1 ce 1c c1 6f 8b fc c1 17 ff 01 d7 ff fb cf ff b8 66 9b 1e 41 82 55 42 69 1e 40 c5 3c 00 a0 62 76 e0 da 42 dd 04 c0 7f eb 95 76 f2 bf 6f aa 6d d2 71 49 22 88 b8 e5 c1 4f 6f 2c e5 7e 31 17 20 74 98 64 5d 5f c5 83 68 90 64 2d 47 b7 f9 c5 ea bd a5 9b 3f 0b dd d8 73 78 8b 05 de de 95 66 14 5a 4f 05 24 41 02 44 21 82 e5 7e 04 c3 83 Data Ascii: 2)'.JCDAETd8>xym"Q<K?]ne+6rN@+)e!<H5[vMl1x4R%Lw&wzE$IuYiofAUBi@<bvBvomqI"Oo,~1 td]_hd-G?sxfZO$AD!~
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: a9 2c 6e 54 b9 ea 42 63 97 0e c3 46 47 75 b7 a1 22 aa db bb 2a 22 d2 08 a2 12 0e 66 a1 bb 53 e4 ae 60 13 68 5d f0 e9 e3 38 db 73 1f af 85 fc 7c 2c 62 ba 1d b6 0d c7 95 38 c9 19 c6 67 70 f6 cf da 02 8c e5 0c 43 a0 99 af 62 b7 1b 79 c9 6a 9e e6 9d 60 9e 3a 73 b8 69 39 0d 2c 8b 60 c7 fa a6 18 f6 c4 70 2b 72 8e 39 46 b2 ca 26 d3 fe 6c 92 e6 32 4b 88 52 fa eb 47 75 4a 6b 1b a5 2e d6 a0 08 d8 4a ec 9a 49 e2 b8 24 48 db 2e 2b ca dc c4 e6 a2 d3 95 fe 8f 59 94 f2 94 fd 5e 9c 44 a3 af 7f 7b 71 1a 49 37 db 7f d3 15 7b 1d 30 5d 9e 76 54 07 ee 74 29 5e bc 54 95 08 8d e5 22 a7 d2 2b 9e 51 7a f5 83 a0 73 60 29 8a 55 07 f6 f2 e6 16 58 e5 2e e7 a1 d3 7c 5d f4 44 e8 ec 69 80 a3 3a 78 6d c6 dc 73 8f d6 e4 50 8f f9 b3 b6 29 b3 63 a5 54 59 72 b6 e3 8e cf 1c 39 6b 0e b1 ef 8d Data Ascii: ,nTBcFGu"*"fS`h]8s\|,b8gpCbyj`:si9,`p+r9F&l2KRGuJk.JI$H.+Y^D{qI7{0]vTt)^T"+Qzs`)UX.\|]Di:xmsP)cTYr9k
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 3b 96 9c b2 ed ad 9b c0 d7 23 3b ed 6d ed 0f 0d 8e cb 20 b5 20 59 ea d7 29 ed 59 66 23 81 f4 29 22 82 08 23 41 82 91 b0 d7 97 c8 0d 29 59 ab b4 2e 27 d9 5b 6f 5f 5e 6e de eb db df 68 b5 ac 7d f9 b2 6d 24 b2 9e 45 c9 4a 27 c3 ab 33 4b 89 c1 4a 1f 55 71 7d 7e 27 fa f1 93 9c eb 3d aa 78 78 b7 89 3e 84 ab 24 28 a9 c1 6a 6d b0 2f bf ab da 11 51 4b a2 2a 12 e3 c9 b7 e6 0d 5d 5b b2 f7 f4 b9 bd 67 09 d0 34 da 2e 01 ee 3d 79 e4 56 bd 03 2c 8a 0c ad 91 88 14 f7 08 8a 9c 1b b7 6e 17 96 fb 08 1d b7 97 45 2d 5b dd 3e 03 a7 84 d5 90 3f 45 44 6d dd 15 ff 7b ba 79 af 15 c0 e5 26 e7 3a 4c ac 7c 1a 4e 64 26 c2 34 c4 b0 d0 78 3f c4 b3 71 a1 c7 21 ae ef 36 d2 08 aa f7 d4 b5 9c 4a 55 60 35 5f 53 1b fc ef 69 58 2f 00 cf f1 4f f0 bf 27 4b b1 a2 34 01 d4 4a 41 32 48 ba 90 5e 1f Data Ascii: ;#;m Y)Yf#)"#A)Y.'[o_^nh}m$EJ'3KJUq}~'=xx>$(jm/QK*][g4.=yV,nE-[>?EDm{y&:L\|Nd&4x?q!6JU`5_SiX/O'K4JA2H^
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 19 1f 9a 66 a7 f7 70 fc 32 87 28 25 6e bb e1 51 2d a5 62 23 0c 8c a9 cc e0 ba df eb 17 07 bf b5 53 7e cc 2e fe 29 57 de f8 43 f9 f3 e9 50 48 9e 16 71 70 f6 83 54 e6 2b 3e cb df f0 67 ef bf d5 69 84 53 3f bc ef b6 d6 d0 55 6c 37 d7 d6 a9 db ea 5a b4 06 70 c7 72 08 91 77 9b cd b6 c4 44 61 0f 2d 74 d1 36 69 38 56 2d 3a e6 f5 9f 00 84 c8 fb b7 ec 5a e5 fd 07 c9 81 62 7f d7 f3 77 ef 52 32 09 31 bf 3c fa 12 78 ad 49 b4 85 c3 61 9f 48 71 6c 70 d8 e7 c5 a5 43 21 a8 74 bd cd 21 56 57 84 d2 d9 da 4a 83 2a 4c c2 31 6b 9a c1 a9 01 80 63 9a 5c a5 ce 95 42 9d 59 38 77 b2 ce 8d ad 5c 9d 44 44 4e 31 2f 66 bf d4 94 6d cb 21 00 c4 60 70 f7 d1 98 65 fa 70 83 54 d9 b3 5d f4 62 95 a1 05 9b 4d c2 66 0b 57 fa 87 83 f6 5f a1 97 c0 36 d1 62 21 9d 1a 48 3e e8 67 ba 6f 10 ca e7 e7 Data Ascii: fp2(%nQ-b#S~.)WCPHqpT+>giS?Ul7ZprwDa-t6i8V-:ZbwR21<xIaHqlpC!t!VWJ*L1kc\BY8w\DDN1/fm!`pepT]bMfW_6b!H>go
2024-04-25 13:30:36 UTC	721	IN	Data Raw: 27 97 4f 17 a6 04 2c 59 49 15 d2 b9 82 c7 22 53 9c 63 58 51 26 ed 50 61 2a 27 53 f9 8c 08 7c 37 4b e6 b5 ee a8 86 69 19 88 ed 30 d0 f9 8a 31 11 ec 4e 53 42 62 88 cc 77 45 44 3a bd 56 93 1c b2 5b 02 0b 4e 24 9b 86 aa c9 1a 79 ad 3b 7a 3f e7 de 28 4d 13 92 d6 90 0c 6f 98 8d 70 22 16 96 54 b5 b0 05 d8 cc 00 c0 00 14 a2 66 4e 50 db a5 ca 18 bb 0b 86 16 47 70 f2 14 8d cb 62 ff 9f 86 96 a2 6f ce c4 d2 80 c3 00 75 1f 26 98 97 45 da 4f 4b 2a 43 e2 a7 02 0f 39 95 16 92 94 a4 bd 28 c8 7a 99 69 e4 0b d3 22 53 e0 94 9f 33 f7 73 46 1d 07 f8 7e f9 4c ac 73 fa 42 c5 d8 5d 80 0d b8 ec 00 ec 11 59 c4 4c b0 3d 97 2d d8 ae 57 22 9d ae 6e 0a 8b 24 1e ff 01 fb 39 73 c4 86 1f 99 66 9e e1 59 81 1c 79 87 c9 f4 11 c1 d5 25 00 1b 8c e7 23 02 2c 00 9e 45 84 b8 6c 30 c9 4a 85 39 09 Data Ascii: 'O,YI"ScXQ&Pa'S\|7Ki01NSBbwED:V[N$y;z?(Mop"TfNPGpbou&EOKC9(zi"S3sF~LsB]YL=-W"n$9sfYy%#,El0J9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49768	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	643	OUT	GET /static/img/logo/logo.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	685	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Tue, 02 Aug 2022 22:43:42 GMT etag: W/"1a57-5e549d924e380-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 40644 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=31qchHTN0Ug1Cgqm9Ij6ZV1tABBbN6eusXLPz88GyzKlkM8oLU64p99oAFPGSATxlvlv3uj0G7uP9uW6Sn2nuAeChRyJVZXWAxzWu1Bwn33Jnvb%2BxaY9N9j2ErU70%2B6dgu2WihA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046fa1c1359-ATL
2024-04-25 13:30:36 UTC	684	IN	Data Raw: 31 61 35 37 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 32 34 20 32 30 30 2e 30 31 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 33 64 36 32 62 62 3b 7d 2e 62 2c 2e 65 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 62 7b 66 69 6c 6c 3a 75 72 6c 28 23 61 29 3b 7d 2e 63 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 31 34 34 61 62 33 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 33 70 78 3b 7d 2e 64 7b 66 69 6c 6c 3a 23 66 61 66 61 66 61 3b 7d 2e 65 7b 66 69 Data Ascii: 1a57<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1024 200.01"><defs><style>.a{fill:#3d62bb;}.b,.e{fill-rule:evenodd;}.b{fill:url(#a);}.c{fill:none;stroke:#144ab3;stroke-width:3px;}.d{fill:#fafafa;}.e{fi
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 22 20 67 72 61 64 69 65 6e 74 54 72 61 6e 73 66 6f 72 6d 3d 22 6d 61 74 72 69 78 28 31 2c 20 30 2c 20 30 2c 20 2d 31 2c 20 2d 34 2c 20 2d 32 32 32 33 2e 36 29 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 37 37 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 30 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 38 35 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 30 2e 30 31 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 38 37 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 30 2e Data Ascii: " gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.77" stop-color="#fff" stop-opacity="0"/><stop offset="0.85" stop-color="#fff" stop-opacity="0.01"/><stop offset="0.87" stop-color="#fff" stop-opacity="0.
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 30 2c 30 2c 31 2c 34 38 30 2c 31 31 39 2e 38 61 31 37 2c 31 37 2c 30 2c 30 2c 31 2c 32 2e 36 32 2c 39 2e 35 32 2c 31 38 2e 33 38 2c 31 38 2e 33 38 2c 30 2c 30 2c 31 2d 38 2c 31 35 2e 33 38 2c 33 34 2e 37 39 2c 33 34 2e 37 39 2c 30 2c 30 2c 31 2d 32 30 2e 39 35 2c 35 2e 39 31 41 33 37 2e 35 31 2c 33 37 2e 35 31 2c 30 2c 30 2c 31 2c 34 33 38 2c 31 34 37 2e 35 61 32 35 2e 37 35 2c 32 35 2e 37 35 2c 30 2c 30 2c 31 2d 31 30 2e 37 2d 38 2e 36 32 2c 32 30 2e 33 31 2c 32 30 2e 33 31 2c 30 2c 30 2c 31 2d 33 2e 38 31 2d 31 31 2e 37 35 68 31 35 2e 36 33 61 31 31 2e 32 2c 31 31 2e 32 2c 30 2c 30 2c 30 2c 34 2e 33 31 2c 38 2e 36 32 2c 31 37 2e 32 33 2c 31 37 2e 32 33 2c 30 2c 30 2c 30 2c 31 30 2e 35 2c 33 2e 30 35 2c 31 36 2e 38 37 2c 31 36 2e 38 37 2c 30 2c 30 2c 30 Data Ascii: 0,0,1,480,119.8a17,17,0,0,1,2.62,9.52,18.38,18.38,0,0,1-8,15.38,34.79,34.79,0,0,1-20.95,5.91A37.51,37.51,0,0,1,438,147.5a25.75,25.75,0,0,1-10.7-8.62,20.31,20.31,0,0,1-3.81-11.75h15.63a11.2,11.2,0,0,0,4.31,8.62,17.23,17.23,0,0,0,10.5,3.05,16.87,16.87,0,0,0
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 32 2e 37 34 2c 32 32 2e 37 34 2c 30 2c 30 2c 30 2c 36 2e 32 39 2d 31 34 2e 35 33 68 31 36 2e 38 34 76 2d 2e 30 39 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 36 37 34 2e 39 34 2c 31 34 39 2e 32 36 48 36 35 38 2e 38 38 76 2d 31 30 30 68 31 36 2e 30 36 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 37 32 33 2e 38 37 2c 31 35 30 2e 35 35 41 33 33 2e 34 35 2c 33 33 2e 34 35 2c 30 2c 30 2c 31 2c 36 39 39 2e 30 39 2c 31 34 31 61 33 34 2e 30 37 2c 33 34 2e 30 37 2c 30 2c 30 2c 31 2d 39 2e 36 38 2d 32 35 2e 32 34 76 2d 32 61 34 32 2c Data Ascii: 2.74,22.74,0,0,0,6.29-14.53h16.84v-.09Z" transform="translate(0 0.01)"/><path class="a" d="M674.94,149.26H658.88v-100h16.06Z" transform="translate(0 0.01)"/><path class="a" d="M723.87,150.55A33.45,33.45,0,0,1,699.09,141a34.07,34.07,0,0,1-9.68-25.24v-2a42,
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 22 20 64 3d 22 4d 38 35 33 2e 33 37 2c 37 38 2e 38 34 6c 2e 34 38 2c 38 2e 31 34 61 32 35 2e 37 39 2c 32 35 2e 37 39 2c 30 2c 30 2c 31 2c 32 30 2e 38 36 2d 39 2e 35 32 71 32 32 2e 33 35 2c 30 2c 32 32 2e 37 34 2c 32 35 2e 31 39 76 34 36 2e 35 37 48 38 38 31 2e 33 39 56 31 30 33 2e 37 61 31 34 2c 31 34 2c 30 2c 30 2c 30 2d 33 2d 39 2e 39 31 2c 31 32 2e 36 31 2c 31 32 2e 36 31 2c 30 2c 30 2c 30 2d 39 2e 36 37 2d 33 2e 32 34 2c 31 35 2e 34 39 2c 31 35 2e 34 39 2c 30 2c 30 2c 30 2d 31 34 2e 35 32 2c 38 2e 36 37 76 35 30 2e 31 34 68 2d 31 36 56 37 38 2e 38 34 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 39 34 35 2e 33 36 2c 31 35 30 2e 35 35 41 Data Ascii: " d="M853.37,78.84l.48,8.14a25.79,25.79,0,0,1,20.86-9.52q22.35,0,22.74,25.19v46.57H881.39V103.7a14,14,0,0,0-3-9.91,12.61,12.61,0,0,0-9.67-3.24,15.49,15.49,0,0,0-14.52,8.67v50.14h-16V78.84Z" transform="translate(0 0.01)"/><path class="a" d="M945.36,150.55A
2024-04-25 13:30:36 UTC	591	IN	Data Raw: 31 2e 32 38 20 31 35 31 2e 38 31 20 39 39 2e 39 38 20 38 32 2e 35 38 20 31 31 38 2e 33 33 20 31 35 31 2e 38 31 20 31 33 34 2e 33 34 20 31 35 31 2e 38 31 20 31 35 36 2e 35 36 20 35 37 2e 30 31 20 31 33 39 2e 39 37 20 35 37 2e 30 31 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 64 22 20 70 6f 69 6e 74 73 3d 22 31 33 39 2e 39 37 20 35 37 2e 30 31 20 31 32 35 2e 31 37 20 31 32 38 2e 33 39 20 31 30 36 2e 39 35 20 35 37 2e 30 31 20 39 32 2e 39 32 20 35 37 2e 30 31 20 37 34 2e 35 33 20 31 32 38 2e 32 35 20 35 39 2e 35 39 20 35 37 2e 30 31 20 34 32 2e 39 38 20 35 37 2e 30 31 20 36 35 2e 31 39 20 31 35 31 2e 38 31 20 38 31 2e 32 38 20 31 35 31 2e 38 31 20 39 39 2e 39 38 20 38 32 2e 35 38 20 31 31 38 2e 33 33 20 31 35 31 2e 38 31 20 31 33 34 2e 33 34 20 Data Ascii: 1.28 151.81 99.98 82.58 118.33 151.81 134.34 151.81 156.56 57.01 139.97 57.01"/><polygon class="d" points="139.97 57.01 125.17 128.39 106.95 57.01 92.92 57.01 74.53 128.25 59.59 57.01 42.98 57.01 65.19 151.81 81.28 151.81 99.98 82.58 118.33 151.81 134.34
2024-04-25 13:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49766	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:35 UTC	668	OUT	GET /static/img/product/thanks-for-choosing/clean.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 2040 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=3238 Content-Disposition: inline; filename="clean.webp" Vary: Accept etag: "ca6-5e5da49c030b2" last-modified: Wed, 10 Aug 2022 03:03:06 GMT CF-Cache-Status: HIT Age: 56770 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PFD%2FJ40IqxwWX9EXGsjoNLmjxen7qDdDaEy%2F66bdeJ0sRYOHvCc%2BC8fGWyldNISSnnZfQ2R7qvfZF%2BkC9fKuNLuOewHy1i9KfZEQ8pXthrCvRgbqtX7BCbbwkPU30SCoT%2FpHVk8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb046fd62507e-ATL
2024-04-25 13:30:36 UTC	565	IN	Data Raw: 52 49 46 46 f0 07 00 00 57 45 42 50 56 50 38 4c e4 07 00 00 2f 8b c0 18 10 ff c7 a0 6d 1b 41 86 f0 b8 9f f5 5d 7a 1c 04 02 49 22 a3 ee 3e 9a 0c 23 20 8d 13 20 fd f6 5f b6 57 0b 28 72 db b6 49 3a 4f a1 bf 81 f5 07 20 04 00 20 08 80 00 00 62 83 20 08 00 40 08 08 c0 06 21 00 c4 01 02 0f 05 1b 7c 40 20 ce 24 d8 00 00 1d 4a e2 b8 10 84 03 04 b1 01 10 00 20 1c 38 40 08 c2 13 b2 13 02 01 08 67 82 89 12 6d 00 41 8a f3 7d a1 28 8a cc 0f 46 11 14 41 f1 1f 44 03 52 e0 0b 00 87 c8 82 17 85 61 04 83 81 d1 c1 21 18 18 46 31 30 f2 52 31 28 8a 20 f8 16 3f 96 63 2d 10 8c a2 18 04 85 11 18 41 90 20 d7 72 07 5c e9 08 27 32 c2 51 90 b6 01 d3 f9 97 7d 2d 44 44 62 3d 6a db b6 a9 79 a2 e7 97 df b8 0d 0e 83 d7 bd 4d 39 20 d8 a0 83 3b 04 77 0d d4 82 cb 2b d8 5a 72 cf d3 e9 1e 47 Data Ascii: RIFFWEBPVP8L/mA]zI"># _W(rI:O b @!\|@ $J 8@gmA}(FADRa!F10R1( ?c-A r\'2Q}-DDb=jyM9 ;w+ZrG
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: ab 5c 59 79 c5 02 39 43 12 b8 b4 34 e6 43 8f 85 b4 cf 6e a9 6c f8 ac de fb 9c 59 3c 94 86 41 a1 04 28 90 4a 0e 27 d6 14 ca 63 1b f4 57 43 d5 08 42 65 30 48 03 b8 c0 1e ad d1 6c 5d 45 0e 0b 99 1a e1 34 3d 4d 51 8b e5 b0 34 0d 2e a8 01 bc 34 e0 1c bc d6 61 c1 e8 8b 44 49 70 c1 18 36 04 db 20 ef 37 87 56 1e 98 39 58 d9 f1 81 3c dd 0a b6 e7 67 8c 0c 29 35 d2 2b 01 0a 74 34 3c 86 d0 21 8a 21 5c 98 83 86 b1 d5 0b 24 1b 42 4a 7e ef 0a 8c 3e 12 99 de 00 2c e7 4d c7 bd f5 08 9c 96 18 1e 8e bf a7 04 90 14 80 31 70 80 c9 c2 86 e7 31 aa ca ab a4 a9 5c c0 10 2b 0c b2 8a ec 25 db af d0 d1 d1 a1 85 e8 ff 51 79 b0 16 81 05 8f e6 c4 2b 01 44 bc 73 d5 9d ad 16 64 e0 61 60 d6 8f 34 84 a6 b7 18 e4 44 3c 2c b9 bc b8 d4 f9 8a b3 7e 59 bf 94 36 f4 4f 94 2b ec 4c 94 8c be e7 e0 Data Ascii: \Yy9C4CnlY<A(J'cWCBe0Hl]E4=MQ4.4aDIp6 7V9X<g)5+t4<!!\$BJ~>,M1p1\+%Qy+Dsda`4D<,~Y6O+L
2024-04-25 13:30:36 UTC	106	IN	Data Raw: f0 1d c8 1a 5c 05 da 65 4a 17 37 33 74 90 57 1c aa 9f a0 f5 ea c7 fd d3 40 c3 8c 29 51 b5 01 b4 4c 72 b3 9a 9c 30 d0 33 8b 3a 55 14 8e 27 ff c5 e8 98 65 0a a7 e2 c9 a0 6f e6 37 8c 26 6f 3c e8 9c c4 3c 7e 8e b8 31 1c f4 4e f8 ea 6a f9 b8 2d 77 06 e8 9f 49 a9 65 fe 68 b6 67 7e e4 9f c4 7f b9 b3 37 65 25 84 c3 bf a4 01 Data Ascii: \eJ73tW@)QLr03:U'eo7&o<<~1Nj-wIehg~7e%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49771	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	669	OUT	GET /static/img/product/thanks-for-choosing/norton.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 3666 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=4364 Content-Disposition: inline; filename="norton.webp" Vary: Accept etag: "110c-5e5da4a125bda" last-modified: Wed, 10 Aug 2022 03:03:11 GMT CF-Cache-Status: HIT Age: 57925 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VaqEcrCLZJbGJ6ARk3OnsTk2hSMYKajS%2F14P2WNXn7RjV3w4KUQ1eq6uaogfa3kM6p2PGYy2NMMkBpzKNwtaHaGBu8RcKojTGV6E3jOucvsU2tY3OBrAqOfAHZ2wGW%2BTb5bGI%2Fg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04a39311361-ATL
2024-04-25 13:30:36 UTC	567	IN	Data Raw: 52 49 46 46 4a 0e 00 00 57 45 42 50 56 50 38 4c 3d 0e 00 00 2f 8b c0 18 10 e7 07 3b 92 24 c7 4a f5 cc ec 13 68 ad 6c c0 04 fc c7 8d f7 87 d6 1a f6 ae 51 46 c0 8e 64 5b b5 d2 eb 9c 87 bb bb 04 44 e2 e4 71 f9 72 77 ce 86 1b 49 92 62 ab 86 1e 33 83 07 4f 7a b6 3c bb bf 05 ff eb 2c 32 ec cd c0 dd b6 ed f8 72 ff de e7 fd 7e d9 b6 35 db bb ad d5 ae a9 a9 a9 cd 9c fa 03 9a 6c 6b b3 6d db fd 8c b8 0e 00 e0 1f dc a9 49 5e 36 9b 50 5c 52 33 35 41 ed 8e 95 4b d2 7b 6a 73 64 bb b0 af 99 fd b9 34 ac cd f5 a3 22 f8 93 2e 55 63 78 5d 0b cd ae cd e2 8b 50 31 99 ef d5 64 37 6d 34 fd 8e a6 f2 68 22 ce ee 2a 45 34 d9 4d ad 88 36 9a 6a a2 a9 56 11 b5 22 df 40 a1 88 6e 76 93 2b ac 2b ea a8 88 0a 58 2a 7a e5 fc 7f 0e 3f fa e6 7f ec 7b fd 9a f4 df d1 d2 fa a6 68 14 71 8d a6 12 Data Ascii: RIFFJWEBPVP8L=/;$JhlQFd[DqrwIb3Oz<,2r~5lkmI^6P\R35AK{jsd4".Ucx]P1d7m4h"E4M6jV"@nv++Xz?{hq
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 74 f3 ec d3 82 2a c7 cd d6 32 f6 1c e7 b7 9c 9f ba 5b f5 e9 f5 67 07 79 cc 65 ff e5 fc 7d f9 ce 49 fd e1 e7 a3 27 6f 7f ef 98 ed 80 cf d8 ed e0 c3 e9 63 9a 35 d6 e7 b2 f2 69 ea e0 9f c2 e7 63 c3 62 e1 1b fc c8 dc d9 6d 05 af 3d bb c1 ed cb 0f ce 27 c1 e2 a6 c0 43 c3 f3 d3 2f 8e 8e af 4b 27 57 83 fb e3 4b 9d ff 5c ec 57 70 04 02 04 ff d9 44 44 c4 04 50 bd c7 bb b6 6d 6b 9a 6d db b6 ee d3 74 5e 7a 5a 27 77 77 39 7c 08 2e ac 2e 54 71 a7 14 87 ca d1 42 0d c2 8a d4 46 3a ec 09 bd 48 8f e3 92 5f 11 fd 97 e0 48 92 22 49 96 bb 7b d7 4c 55 d9 90 3f a0 45 6d 9b 21 49 fa 63 6c db b6 6d db b6 6d 1b cd 1c db ca 8c 52 57 76 66 55 56 bb d4 b6 6d ad c6 b6 67 af ba 22 b2 7b 51 b3 bc 88 e8 bf 03 47 92 9c a6 d6 28 67 f0 dd c1 fe 00 ff 47 0b 13 1d 3f 0f 47 19 b7 e5 27 a1 6a Data Ascii: t*2[gye}I'oc5icbm='C/K'WK\WpDDPmkmt^zZ'ww9\|..TqBF:H_H"I{LU?Em!IclmmRWvfUVmg"{QG(gG?G'j
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 88 65 73 79 0f cc b1 6c d6 a9 7d ce 8e a0 cd b1 8e a1 62 fb fc 53 84 13 33 36 32 0c e9 c8 39 f8 43 e3 35 92 6d ff 9b d9 66 46 26 76 6f d9 b4 79 87 23 c3 50 0e 9d fc bd 6a 9d f7 f3 5e 06 00 6b 4a fe de 3c 1a 4a e2 9d bf af 02 c0 22 97 12 39 ba 08 e0 8f b4 96 28 d8 61 50 8c d9 58 02 2e db ce 9c f8 c3 9e 89 e7 9d c0 e5 95 b3 0a e3 62 d2 26 a7 62 d6 5a bd 7e cb 01 c7 3f f0 bb 8f 6f 0d 06 c7 d9 59 6b 77 1e 74 70 74 3c b2 7b e3 c2 d3 f0 ff bd 78 e6 9d f3 fd d0 ef 6b 72 e6 77 42 b7 aa 6d 6b f6 cf 3c f7 9d 50 bd 72 d9 2e cf 02 52 be 0b 46 f5 7b ff aa 2a e4 15 d8 e3 48 56 5e 7e 41 41 41 7e de 5d 4a d5 d2 e7 6a be f9 56 6d 34 d8 5f 64 46 05 07 9a 94 6a ac 56 5a fc 83 0b ae 9d bd 76 ed 58 fd 5a 67 1b 76 ec 86 46 d8 9d d4 68 b3 86 17 dc 34 1a a5 46 a3 e5 75 9e e6 7b Data Ascii: esyl}bS3629C5mfF&voy#Pj^kJ<J"9(aPX.b&bZ~?oYkwtpt<{xkrwBmk<Pr.RF{*HV^~AAA~]JjVm4_dFjVZvXZgvFh4Fu{
2024-04-25 13:30:36 UTC	361	IN	Data Raw: ea 54 e8 08 a4 38 03 c6 9c 9b 96 fa 43 ad 75 e1 36 c2 3c 3d 39 d2 95 55 dd ab ca 37 dc 05 0e 98 8b 7a b5 6e 8d a8 e7 9d 0b 91 30 e6 78 8f 64 28 3e 92 0d 2a 56 61 24 fa d4 19 5f e1 94 9a 82 4e 15 a8 ab ce 01 aa 98 6d 0e c3 41 c8 03 cf d8 64 d0 90 7a 5e b6 8f 8e c5 46 41 17 53 9c ac 38 49 63 6b 68 fa a4 12 1c 1c 37 ef a5 5b 95 cf e5 5d a8 2b 95 4c b9 f4 8a 33 26 f2 f4 a8 1e 10 a3 5d 75 93 cd 07 54 57 e7 bc 33 a8 9e 17 63 50 15 fd 78 7d 48 9a 5c 71 74 37 2d 90 e8 b4 06 aa 98 59 e9 e0 e2 ec 01 ec 85 52 a9 74 02 98 8b ca 83 07 40 56 29 fb 00 5c c4 80 42 18 ab 85 87 52 29 0d 6b e1 e1 21 61 58 3d 2f dc c0 b1 98 53 8a ee e1 f9 79 59 c4 57 8e dc 10 41 a7 64 31 ab 36 c4 81 bd e5 f3 b2 22 6d 83 d8 a8 d1 6b 2d 41 e1 b1 e1 41 26 5e a7 36 62 cc aa 0c e1 77 ed 2f 9f 77 Data Ascii: T8Cu6<=9U7zn0xd(>*Va$_NmAdz^FAS8Ickh7[]+L3&]uTW3cPx}H\qt7-YRt@V)\BR)k!aX=/SyYWAd16"mk-AA&^6bw/w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49772	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	666	OUT	GET /static/img/product/thanks-for-choosing/bbb.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	796	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 2684 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=3991 Content-Disposition: inline; filename="bbb.webp" Vary: Accept etag: "f97-5e5da499b012a" last-modified: Wed, 10 Aug 2022 03:03:04 GMT CF-Cache-Status: HIT Age: 40643 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5DMw970MzNOQKQIoZ1JhmggctomUa2gfCOPbhVG1rJZu9Szp2zwJ2XyNbMlaVmGRJpSCa%2BFAAThTWjfEiu3fU3tU%2Bk9Q76gRVS8WHcgg1PQ1VXlKyGValXdPtPMuVUUyXwe9O2A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04a4d521389-ATL
2024-04-25 13:30:36 UTC	573	IN	Data Raw: 52 49 46 46 74 0a 00 00 57 45 42 50 56 50 38 4c 67 0a 00 00 2f 8b c0 18 10 f7 c7 90 91 24 41 85 72 5c ef 2f b2 33 f3 0e 02 d9 14 7f f1 45 90 6d 53 84 1d f7 f6 08 03 96 cd d0 ff 2f 1e 51 e4 b6 6d 83 dc 3a a9 6f e0 7d 1d 80 01 0c c3 00 c0 30 14 c5 32 c7 d8 73 00 a0 00 a0 67 19 0f ba 96 85 a1 00 00 50 4f 20 11 87 53 0c 06 d0 ae 37 20 90 bf e8 5a b6 22 84 b2 f0 31 00 00 3e 86 a2 00 c3 c7 50 ec 3d de 09 86 21 18 07 43 30 0c c3 10 02 41 10 8c 83 60 18 c1 c1 10 84 c0 08 8c 20 08 0c 15 b2 ae d2 60 e4 d6 c7 81 1c a8 f7 90 82 22 0e 26 be 29 08 f7 67 a8 bf 92 61 5f 41 20 f5 16 77 a0 8a 20 8e 40 20 79 7f ef 18 22 22 c3 f0 84 6d fb e2 44 fe ff dd d9 8d db ca dd dd dd 5d 57 b6 f3 b7 ad c6 75 c7 04 77 4d 70 6b c1 9d c6 2d 1d 5c 13 1c 06 77 32 8d 05 ab 0a 52 73 6f 12 a8 Data Ascii: RIFFtWEBPVP8Lg/$Ar\/3EmS/Qm:o}02sgPO S7 Z"1>P=!C0A` `"&)ga_A w @ y""mD]WuwMpk-\w2Rso
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: ca 7d 51 d1 da 89 9a c1 5e eb 18 92 4d 19 48 72 3b 03 c7 01 c3 b8 d3 0a 94 d8 f3 29 4c 09 65 0b 06 48 32 1a 02 49 9e 04 b9 85 c6 34 83 cd 66 63 26 48 86 84 da 50 4c a6 eb c9 01 58 fe b0 d1 0e 0b d9 00 ab 9b e9 ed e4 82 11 68 24 69 54 a4 1b fc 1d 07 67 40 67 f8 d3 b9 00 09 99 c6 90 ad 4c 00 60 15 0e c8 42 0c a1 94 4c d6 93 43 00 60 22 1a c9 25 14 b9 59 09 49 1e 96 02 e3 2c 83 22 b1 f0 d3 a3 a1 0f fd 4e 06 ec 38 15 23 02 b0 53 6f dc d8 d8 60 26 48 06 87 d8 8e ea 43 ff fa 06 ed b0 90 0d b0 ba 59 bb 13 d9 8c e1 25 28 32 80 1c 93 39 1e 8b 46 d4 b4 f9 e6 af c0 ab cd e4 35 5a 06 2e a1 8a 5e be c3 43 03 73 79 68 ac f7 c7 92 88 5c d2 00 d2 82 da 91 21 eb 08 52 9b 4e 23 8d 6e 96 e6 8a 89 35 51 ca 64 06 93 5c f3 e9 da 8f 05 7c 5b d8 e7 0b 44 da ea 02 1d 2c c7 42 a9 Data Ascii: }Q^MHr;)LeH2I4fc&HPLXh$iTg@gL`BLC`"%YI,"N8#So`&HCY%(29F5Z.^Csyh\!RN#n5Qd\\|[D,B
2024-04-25 13:30:36 UTC	742	IN	Data Raw: 15 19 41 d7 df d0 c4 8b 8d 44 fc 0a 5f 6e 31 31 54 5c 73 e2 79 28 f1 dc 31 0b d6 60 8a cf c5 ce 6e 6f fd 1a 62 a3 79 d4 88 58 27 ef 41 06 31 de d1 1d e8 c0 71 64 17 47 ac b0 a3 52 bc 98 78 d4 66 3b 43 d2 f1 d4 27 dc 02 c5 30 fd 45 e0 bb 7b 2c 6b 64 0a b5 f3 45 00 89 60 0e c8 05 e8 c9 4f 93 3b 3f c9 8e 2c 80 27 df 2d 80 35 56 1a fa 4a 4d e3 b5 2f 58 05 92 34 da 48 8b 8b 6a b7 9d 34 19 75 a4 5c 4d 51 14 25 41 2f 9a 8c 24 0d 92 40 ea f5 a4 de 68 14 45 a3 4e 30 49 2c 5d 51 58 d4 ab 2e b5 7a 17 2b 0b 0f b5 a4 0f 9f 05 c0 c9 a7 4f c4 ed 1d 34 6b dc 39 7b 3c 0c 31 bc 23 90 5b 71 86 73 d9 99 bf 9a 77 2c fd 1b 46 72 35 ae 5f 3f b9 b9 b9 33 57 9f 3c ef 07 d9 76 a5 6c 74 bc a9 f4 6c 6a 76 61 71 71 e7 60 71 71 3e 35 bb ae 45 10 d9 c3 2c dc 2b 10 49 ec 78 b1 71 84 d6 Data Ascii: AD_n11T\sy(1`nobyX'A1qdGRxf;C'0E{,kdE`O;?,'-5VJM/X4Hj4u\MQ%A/$@hEN0I,]QX.z+O4k9{<1#[qsw,Fr5_?3W<vltljvaqq`qq>5E,+Ixq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49773	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	669	OUT	GET /static/img/product/thanks-for-choosing/macfee.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 4112 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=4916 Content-Disposition: inline; filename="macfee.webp" Vary: Accept etag: "1334-5e5da4a0392b2" last-modified: Wed, 10 Aug 2022 03:03:10 GMT CF-Cache-Status: HIT Age: 52891 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m9a%2BwfvgAzU4BkDnJHDxb%2FQtyIWDbbmrTA8W3XzYupvsFAjU%2FKvQ309LX4Hwefm396nTqhuv%2ByJbQDrE08JmCsH2CQva%2BKxitZdasFleUTH9BNVbVjO19hvH%2FQI8%2FifuRKgL2J8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04a5aca457d-ATL
2024-04-25 13:30:36 UTC	559	IN	Data Raw: 52 49 46 46 08 10 00 00 57 45 42 50 56 50 38 4c fc 0f 00 00 2f 8b c0 18 10 e7 07 37 b6 6d 57 cd ba 17 ef 21 23 24 42 52 13 ea 3f 57 1f de 9b f7 2e a6 09 b8 b5 6d ab 71 f6 d3 97 86 21 32 e6 dc 85 2b 70 e4 42 dc 32 33 db d2 e0 ff 8e 23 d9 56 95 be ef e2 be 72 e2 21 ff 2a f2 60 e5 f2 de 83 23 db b6 69 6b d5 d9 7b bf f7 6d db 8c 1c 1a 4d fa bd f8 7d 50 66 34 e1 65 df 66 66 db fb e0 be 75 00 90 44 12 1e 11 2c 02 02 1c 2c 2c 1c 2c 2c 02 2c 14 0e 16 0a 0f 0b 85 42 11 f0 0b 85 43 80 43 80 87 87 47 40 40 74 6d c1 c2 c3 c1 5f 03 f0 f0 88 10 10 e0 5d 4d 34 76 c6 88 d1 18 c6 81 98 06 fa 30 50 a9 79 db 2f db 54 f8 eb b0 bd 63 da 1e 31 da 8e 30 a9 e2 a7 35 99 3e 6c 0a f4 0b 22 95 af ec cb fc ab 2b b2 2e 30 48 b4 f4 47 f6 13 bf e9 8f ef f8 20 df 60 24 d1 da 8a fc 0f 2c Data Ascii: RIFFWEBPVP8L/7mW!#$BR?W.mq!2+pB23#Vr!*`#ik{mM}Pf4effuD,,,,,,BCCG@@tm_]M4v0Py/Tc105>l"+.0HG `$,
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 01 81 c0 57 a0 eb 0a 06 04 86 01 c1 20 0f 29 20 18 30 08 e6 f1 b2 75 1c da 7d 62 3c 1e 15 55 53 e2 c3 28 2f bb d1 a6 5a 3b 04 d9 36 db fc b5 7f 86 88 48 8e 36 b6 f6 ff 5f 9f e6 61 ee ee ee ee ae 67 fa 10 b6 87 b0 33 df b9 1f bb bb bb 20 03 ba dd d6 55 e7 ee de f6 a6 93 0e bf f5 f8 ff 4b 68 c3 35 37 24 0a 09 f9 24 81 77 08 5c f9 87 25 a1 21 9e 00 49 e0 22 2d 11 fd 9f 00 da fb ff 1f 72 9d 9d ba 57 76 af 72 57 db ed b1 6d db b6 6d 33 b6 35 c7 c6 7f 16 de cd 66 73 55 2b d6 22 ef a3 79 26 a7 d9 5f 50 c5 d6 64 3b 49 44 ff 27 80 a2 ab 6d 8f da 48 bd f7 de 7b ef dd 97 c9 45 ff c3 96 f1 15 e0 46 49 84 5e c7 83 89 85 78 14 ba b0 07 1c b0 35 cb 5a 13 11 d1 ff 09 e8 f8 d7 fa 9e 4b 8f 7d f7 87 3f 3f 75 66 d8 fc e7 c6 2f 52 f9 da 65 7d 7f 79 c6 0f 7e bf 81 f9 0f 57 fe Data Ascii: W ) 0u}b<US(/Z;6H6_ag3 UKh57$$w\%!I"-rWvrWmm35fsU+"y&_Pd;ID'mH{EFI^x5ZK}??uf/Re}y~W
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: b1 06 ee 7e 8b b1 e4 4a 4a 53 96 2e d9 73 ce 2f 1d 24 24 a7 97 e6 80 cd 6e cb 7a ba dd 9e d6 a1 73 30 74 06 02 61 59 02 73 d5 6a 3b e3 52 9a 65 5c 4a ee 38 11 f0 4b d7 50 19 71 4e 2a c4 e1 bc 25 28 6b 12 16 1c 74 79 87 f3 96 3d 08 6b 0b 6f 7d f4 04 45 43 45 ae bf cf 5a af 54 0f 39 18 48 76 a8 3e 48 58 13 5f 23 65 99 31 e4 76 18 70 90 3b 8d cf b2 00 e3 da 62 47 3a 04 7b 86 2e d7 d3 d5 c3 83 75 49 6e c3 6e 8f 94 ab 10 95 d3 d9 a0 a4 56 85 a6 65 db a0 69 68 f7 5a ba 35 c7 da 8c 34 32 80 3a b4 85 b7 4b da 19 9e 33 f4 4f 02 cd 40 54 d2 25 69 d6 a3 92 0e 41 54 ce 27 89 47 7c 40 42 19 68 6c 86 42 53 41 29 0d 83 be 88 6f 36 2a 0f 50 4a ed c0 bc b4 40 a5 4f 8a c0 d5 da 82 13 53 a1 d0 ba ab 69 fc 34 4d 49 ca 49 92 9b b5 82 26 b8 8d 35 e4 91 96 30 07 25 4d 37 b0 1e Data Ascii: ~JJS.s/$$nzs0taYsj;Re\J8KPqN%(kty=ko}ECEZT9Hv>HX_#e1vp;bG:{.uInnVeihZ542:K3O@T%iAT'G\|@BhlBSA)o6PJ@OSi4MII&50%M7
2024-04-25 13:30:36 UTC	815	IN	Data Raw: b8 28 fc be 43 88 c5 44 e2 d8 45 85 ff 02 13 55 c0 69 db f2 f5 55 d8 6c 1f d8 a3 14 62 04 df a5 01 e2 34 d4 34 14 1e 54 74 ec 87 6b 6b 07 f4 db 05 3b bf ac 98 0b de 67 b5 94 0a dc 5e fb b5 b4 2f 9d 6c 58 6e 5d 19 17 9b b3 d3 5f 3b 75 a5 d6 8f 8c 6c 28 94 94 13 0a 85 e2 9e 63 38 21 cb b2 6d fe 96 c3 20 ae d7 a2 dd d0 38 a8 cf 1e 60 6b 77 3f 17 30 ad 63 1f 5c 10 59 29 fc f9 94 24 a0 47 5a c5 fa 54 d2 6c 17 e6 81 a0 62 7c 83 7d 55 5a 2c 47 de a5 2f ac 6d 43 8e ee 05 cb c6 ae 9c 9a 3b 65 f0 f0 75 b9 b9 b9 6b fa ab 9d b9 b9 b9 03 d3 2e f3 b7 1e 81 f9 72 21 9e 78 63 71 7c 4a 5a 83 e1 89 f4 d8 eb 85 34 0a bd 95 3f 95 fe 03 65 58 30 36 c0 d5 3c 0c bd be 40 49 ca c1 cd 6b 3a 3d 69 1f 0f f9 02 24 f6 2a 1e d6 35 7e e6 ac f6 09 83 ef 7d 3d 48 bd 57 3a bd db 19 07 c1 Data Ascii: (CDEUiUlb44Ttkk;g^/lXn]_;ul(c8!m 8`kw?0c\Y)$GZTlb\|}UZ,G/mC;euk.r!xcq\|JZ4?eX06<@Ik:=i$*5~}=HW:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49774	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	667	OUT	GET /static/img/product/thanks-for-choosing/sign.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 760 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=1498 Content-Disposition: inline; filename="sign.webp" Vary: Accept etag: "5da-5e5da4a2900ba" last-modified: Wed, 10 Aug 2022 03:03:13 GMT CF-Cache-Status: HIT Age: 44307 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u1cqDj7sitUaaH6epbNAWe%2F2PLeG90IeSxIfLC1Mwb1mdalbjzFcXbLYiqo3rEPZH5wwaHW8FKpA4AG%2BXcqA%2BUnOjl%2BSzYJDi8jFWkmP3qAEpQKwlzUF%2FRKV9nrBtKpnKaS0RXI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04a79feadb3-ATL
2024-04-25 13:30:36 UTC	567	IN	Data Raw: 52 49 46 46 f0 02 00 00 57 45 42 50 56 50 38 4c e3 02 00 00 2f 26 c0 36 10 47 a3 24 92 24 a7 fd 6b 3c 01 87 0e 7d 80 59 84 82 b6 51 a0 fa d7 c4 e3 04 0b 28 20 28 6a db 06 32 93 f1 47 34 24 7b 9d ae 22 49 52 ac a9 83 c7 fc f9 c4 3c ff 1e 9e 8a 63 ec e9 37 38 20 d6 bf 23 2a f2 32 60 94 38 02 9c 70 05 28 70 c1 13 00 5c 01 c0 0d e0 07 00 c0 17 e0 0e 70 01 00 35 3e 00 7c 1b 1c 40 eb 38 cc dd 88 a8 a8 e9 80 61 08 86 61 ec 10 8c f9 01 10 84 11 1b 84 09 1b 0c 23 21 18 89 84 21 ac e8 61 24 04 41 18 f1 87 b1 c1 10 12 3b 8c 0d c2 84 06 c2 8a 09 2b 84 09 82 1c d2 6d 5b 33 24 a9 6a da b6 6d db b6 6d bb 0b ef ff 0a 9d 1d b8 a3 5f 33 2b e2 8b c8 fc 22 fa 0f c9 91 24 45 92 c5 6d 68 21 61 aa be 10 13 27 fd 74 b1 b7 3a 37 6c 43 7f 11 19 52 ce cb e1 34 8b e2 ed 8b 9a b7 1d Data Ascii: RIFFWEBPVP8L/&6G$$k<}YQ( (j2G4${"IR<c78 #*2`8p(p\p5>\|@8aa#!!a$A;+m[3$jmm_3+"$Emh!a't:7lCR4
2024-04-25 13:30:36 UTC	193	IN	Data Raw: fa 32 44 89 ea 4d 96 92 e2 16 96 27 b2 72 d9 b5 99 ac 12 43 5e 22 bf 35 43 35 ad 24 54 d8 9e a1 1e 17 09 e4 75 b0 4e bc fd fe 8e d6 0c bd b4 fa a0 9a 0c dd 98 80 a2 4c 6d a6 98 88 b2 e4 75 8a 3b c7 b2 34 7d d5 9c 01 b8 94 a8 0e c2 53 6e 3f 84 c9 ad cc 80 e0 ca 2a 90 b0 11 c4 b6 0b 3f 4f 1e 91 b6 1e 90 1e 06 e1 1e d0 c3 3d ed 20 16 f6 b6 10 a4 1a 56 7d 58 2f c1 3a 93 ca 19 91 52 a2 ac 16 80 e6 c0 36 02 cc 60 09 68 a2 6b 63 01 39 da fb 21 44 6d 1b d4 ee 02 6d c2 02 d4 5e 55 d8 d2 cd 2a 75 2a 21 a5 94 d6 f7 89 fb 27 2c d3 f8 06 a9 ac 6e ec ea c9 e8 35 36 aa cc a5 bf 74 08 00 Data Ascii: 2DM'rC^"5C5$TuNLmu;4}Sn??O= V}X/:R6`hkc9!Dmm^Uu*!',n56t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49776	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	669	OUT	GET /static/img/product/thanks-for-choosing/day_50.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	736	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/png Content-Length: 2403 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=3758, status=webp_bigger etag: "eae-5e5da49de6712" last-modified: Wed, 10 Aug 2022 03:03:08 GMT CF-Cache-Status: HIT Age: 40643 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I0Ol6SFiv1afnDGCfIpyF65QMha39FTQKH3Vu2r2Utx9d1dZYmJ9%2B69kmpHGZADWvCFzLhEVeF9vtmNeywgeseIW3PjAsNZB8KYFS36tr43TzbRUFxFl9Fud8p8ymKjzqEeS4OY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04ab8bcadd8-ATL
2024-04-25 13:30:36 UTC	633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 64 08 06 00 00 00 c4 e8 63 5b 00 00 09 2a 49 44 41 54 78 da ed 9a 0b 94 4d 65 14 c7 ef dc 19 af 92 c7 d0 d0 34 6a 22 91 1e 68 52 4a d2 4b 4a 5a ab 35 2a af 50 29 bd 86 f2 18 22 0b 23 8c 47 2a 94 92 42 e9 c1 90 47 88 28 45 b3 62 59 6b 86 21 79 ab 30 de 0c 63 18 33 5e fd c7 fa cd f2 75 9c eb 5e f7 5e 8f 6b 9d bd d6 6f dd 73 5f e7 7c fb db fb db 7b 7f e7 ec b0 b4 b4 34 d7 79 92 c7 c4 eb e2 1e de ff 24 3e 13 8b 44 d0 25 42 04 5b ca 88 24 d1 51 98 d2 4a b4 10 c9 62 80 c8 15 41 13 f7 79 b0 c2 2c 8b 12 87 a1 f0 7a ef 88 c9 e2 de 8b a9 c8 d5 e2 79 31 51 cc c0 55 de 15 ef 8b 3f c5 74 51 8f df 1e 15 bd c5 f5 30 4c 9c e0 bb 27 c4 7c b1 4e 8c 15 23 c4 34 91 2e e6 89 0e 22 4a f8 2c 61 e7 b0 46 ea 33 Data Ascii: PNGIHDR2dc[IDATxMe4j"hRJKJZ5P)"#G*BG(EbYk!y0c3^u^^kos_\|{4y$>D%B[$QJbAy,zy1QU?tQ0L'\|N#4."J,aF3
2024-04-25 13:30:36 UTC	1369	IN	Data Raw: 07 c5 0c f2 d1 0e 3b 45 a2 c4 4c ac 51 28 fb f0 fb 8f 2d 89 71 9c a8 8b cf ef 25 9c 46 70 11 5f a5 2c 6e 59 9d ff 67 8b 70 d6 c3 12 61 ca 4b 62 80 25 db ff 85 8b ee 32 15 29 4a a9 d0 8a 1f 65 a1 f5 70 23 d4 3e 82 c5 a6 88 ee 94 2a 7f 63 ad 0c e1 97 60 9d 68 2c b1 5b 34 23 48 6c b7 04 96 9b 50 b2 85 e1 2d df 88 76 22 ef 94 22 58 61 8e 88 e4 64 af 33 60 53 9e c5 47 53 f0 f3 13 62 8f 58 2f 02 16 ac bb 98 f2 25 81 a4 f8 a6 d8 60 0d f3 ac cb 18 b1 13 b7 ce 70 1b e5 40 24 c7 29 16 25 8a e0 f7 33 98 b5 68 16 79 3a 4a 04 4b 06 93 83 5a 8b 78 b1 86 eb 58 65 2e 63 29 90 f2 28 4e d4 e2 15 c9 13 a6 54 64 41 4e 13 35 45 18 33 95 2f ac 72 13 21 fb 13 fc 3a 9c cf 4b e3 16 1f 62 59 3e 3f 2d 54 0d 25 c5 3f 62 05 41 24 d9 b7 7d 14 0a f0 e7 03 1c df 81 05 0a 65 0b 03 8b 16 Data Ascii: ;ELQ(-q%Fp_,nYgpaKb%2)Jep#>*c`h,[4#HlP-v""Xad3`SGSbX/%`p@$)%3hy:JKZxXe.c)(NTdAN5E3/r!:KbY>?-T%?bA$}e
2024-04-25 13:30:36 UTC	401	IN	Data Raw: fc 79 86 58 9b da ea 6e 66 b9 82 70 1b 27 ee cf 85 83 21 7d 08 24 11 c6 f9 33 b1 fc 42 d6 dd ea 80 9f b3 e3 06 8d 08 91 8f 98 cf 2f 98 a5 40 a4 8d f8 d2 85 90 a7 c6 12 a2 73 83 dd f9 90 c9 c9 e3 59 e4 85 32 90 ec 6e 95 18 5c 25 01 9a b3 f0 ed ac 6e 96 e4 a3 c4 53 ac 83 dc c0 3b 1f bc cb 78 d1 96 e3 0d 3c 2f 59 43 51 d9 83 47 ca e5 8d f2 e5 28 a1 7d 19 16 4c 67 21 8f 13 b7 f1 9b a9 28 6f ec 57 ce bf 22 55 c4 4c cb 2c ef 67 81 fb 22 47 2c fb 9a 4c 5c 77 d5 85 ee 0e da 28 5a 9b 15 28 4a 98 a5 ce 58 66 3f 99 5c b0 d9 cc 13 96 73 b5 44 89 8b d2 af 95 46 89 ff 22 19 bc 12 8f 28 26 50 47 ad b7 c9 11 0d 58 dc 55 c9 d0 93 d9 eb a3 a4 7f 12 16 b9 f8 a4 d3 41 e7 74 d0 39 1d 74 67 5f 23 4e 07 9d d3 41 17 ec 0e 3a 5c cb e9 a0 73 3a e8 9c 0e ba cb bd 83 8e c5 1e fa 1d Data Ascii: yXnfp'!}$3B/@sY2n\%nS;x</YCQG(}Lg!(oW"UL,g"G,L\w(Z(JXf?\sDF"(&PGXUAt9tg_#NA:\s:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49775	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	678	OUT	GET /static/img/product/thanks-for-choosing/drw-win-icon_77.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/page/product/update/update.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:36 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/webp Content-Length: 320 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=682 Content-Disposition: inline; filename="drw-win-icon_77.webp" Vary: Accept etag: "2aa-5e5da49ed303a" last-modified: Wed, 10 Aug 2022 03:03:09 GMT CF-Cache-Status: HIT Age: 57407 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bplvl%2B2ISt7q4ZKZ7T42z58VBXbuoxHkCsEd9kbMqZy1knEPuAz4p92g3Qu2fvJzvE3N8TRy0wUc2WZiMi8b6MQBsF8vu9kQbiRUxrLHOhvwOHemdcXTnqOaeSrGtoEBquBdmOs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04acba04521-ATL
2024-04-25 13:30:36 UTC	320	IN	Data Raw: 52 49 46 46 38 01 00 00 57 45 42 50 56 50 38 4c 2c 01 00 00 2f 1a c0 19 10 67 c2 a0 6d 24 47 a1 f4 fc 31 3d 80 6b c9 17 12 04 d9 36 15 b8 3f c2 31 c7 a0 91 24 45 ef df 1e da 38 e6 99 9e 7f 82 49 9a 6a 3b 06 97 22 10 00 41 44 42 16 c4 00 09 10 91 00 01 b0 eb 24 91 63 19 05 80 24 76 1a 74 c4 62 11 49 59 24 16 db 1a 89 2d 12 60 69 00 3b a6 22 b2 aa 74 ec 1a 1d b1 ff 4f 13 20 39 86 c0 96 63 89 01 81 36 db 62 b1 58 00 04 c0 bd df f5 1b 20 c9 b6 ad aa e1 e0 ee 1e 77 77 77 c5 76 32 ff 09 dd 5f 8f fb 8b 5e 2a 8d 88 fe 4f c0 4f ac f2 5f 80 95 3d b7 fc 19 07 5e b5 07 d8 72 6a 3c 01 cb 3e c5 47 80 25 97 f4 15 76 db e5 90 c8 13 8f de 2c ea d6 a1 f0 82 7d 5f 4d 85 94 8e 2a e6 18 7b 5f 97 8d 48 6e bc 72 2c a9 33 36 57 05 05 74 ef 80 ef a6 74 09 70 99 55 c0 fe 14 7b aa Data Ascii: RIFF8WEBPVP8L,/gm$G1=k6?1$E8Ij;"ADB$c$vtbIY$-`i;"tO 9c6bX wwwv2_^OO_=^rj<>G%v,}_M{_Hnr,36WttpU{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49782	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	376	OUT	GET /static/img/common/icon_french.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	690	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:45 GMT etag: W/"13a-5e708939e453b-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46946 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F7uSjqwtVBpiQDNtUgF%2FvZlcrHbruKsNp0SoWlRGu6Tm%2BZ979htHdr6bHpOoBFaI4J9YnibUzXmHzcHvDz3SymTYtFXTx114dvDZOpsQvk6j%2B6BhGrcUobmq%2BT1HHeWrLcBP%2Fv8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d0f2e44e8-ATL
2024-04-25 13:30:37 UTC	321	IN	Data Raw: 31 33 61 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 30 30 20 32 30 30 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 66 69 6c 6c 3d 22 23 30 30 35 35 61 34 22 3e 3c 2f 72 65 63 74 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 31 30 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 66 69 6c 6c 3d 22 23 66 66 66 66 66 66 22 3e 3c 2f 72 65 63 74 3e 0d 0a 3c 72 65 63 74 20 78 3d 22 32 30 30 22 Data Ascii: 13a<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 300 200" width="28" height="28"><rect x="0" y="0" width="100" height="200" fill="#0055a4"></rect><rect x="100" y="0" width="100" height="200" fill="#ffffff"></rect><rect x="200"
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49780	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	383	OUT	GET /static/img/icon/icon_arrow_1f2238_12.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	692	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:42:55 GMT etag: W/"2bb-5e70897c01dc2-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46946 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0CRI2v0GD4aZjjEQfmfdu5PZBc179dh49%2Ba4ZVI7i22QPQx4aRgcKBvzm2n108mouIEvTLDjvpw70bbt%2BJTaEf0SD380LxQsyNZ%2B5HRH%2F6icU%2BsTB4w9Qpe%2FUkBGvVDpwRrhVw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d0e66b0b5-ATL
2024-04-25 13:30:37 UTC	677	IN	Data Raw: 32 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 32 70 78 22 20 68 65 69 67 68 74 3d 22 31 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 35 2c 32 20 43 35 2e 35 31 32 38 33 35 38 34 2c 32 20 35 2e Data Ascii: 2bb<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="12px" height="12px" viewBox="0 0 18 18" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <path d="M5,2 C5.51283584,2 5.
2024-04-25 13:30:37 UTC	29	IN	Data Raw: 30 30 30 30 30 29 20 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 00000) "/> </g></svg>
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49781	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	377	OUT	GET /static/img/common/icon_germany.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	696	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:46 GMT etag: W/"21a-5e70893ad3d43-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46946 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=60nUmAAH%2BXyqBQFxL38KeSE3IV0%2F69u5CqYod2QHU5coj6O%2FgJGfKKo%2FhaiAkSZmhI%2B%2FyiYGl9OCyhi2Lu78RkUTiu50le%2B6SFVD4s21EvCTXP1tBqyeyfY%2FyzVAoWfLSdApds8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d0c2b1877-ATL
2024-04-25 13:30:37 UTC	545	IN	Data Raw: 32 31 61 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 31 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 36 2e 32 38 32 32 30 39 20 31 30 31 37 2e 37 31 37 37 39 31 68 31 35 31 39 2e 30 33 38 30 33 36 56 37 2e 35 33 38 36 35 48 36 2e 32 38 32 32 30 39 76 31 30 31 30 2e 31 37 39 31 34 31 7a 20 6d 31 35 32 32 2e 38 30 37 33 36 32 20 32 2e 35 31 32 38 38 34 76 2d 33 2e 37 36 39 33 32 35 20 33 2e 37 36 39 33 32 35 7a 4d 30 20 31 30 32 34 56 30 68 31 35 33 31 2e 36 30 32 34 35 34 56 31 30 32 32 2e 37 34 33 35 35 38 48 30 Data Ascii: 21a<svg viewBox="0 0 1541 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M6.282209 1017.717791h1519.038036V7.53865H6.282209v1010.179141z m1522.807362 2.512884v-3.769325 3.769325zM0 1024V0h1531.602454V1022.743558H0
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49779	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	371	OUT	GET /static/svg/logo/pdf_logo.svg HTTP/1.1 Host: pdf.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	683	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Fri, 26 May 2023 06:15:03 GMT etag: W/"9f3-5fc92a854c79b-gzip" vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1218 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=urc9lKXLnxBXwsUSpWXxLYOU9H%2FKHlji1ZyKkYK0%2FG%2F85pxlf2ZF8n3s46IqZ09cAdZ2hgCGhPgk2iH1k%2BQqR7PTQpt56evHX%2B5HyPcJ8n50PYXatWrMQ9JUCUWMWKVvJG%2BOIFs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d086a44e3-ATL
2024-04-25 13:30:37 UTC	686	IN	Data Raw: 39 66 33 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 35 36 20 32 35 36 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 30 31 38 31 66 65 3b 7d 2e 61 2c 2e 62 2c 2e 63 2c 2e 65 2c 2e 66 2c 2e 67 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 62 7b 66 69 6c 6c 3a 75 72 6c 28 23 61 29 3b 7d 2e 63 2c 2e 64 2c 2e 65 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 2e 63 7b 69 73 6f 6c 61 74 69 6f 6e 3a 69 73 6f 6c 61 74 65 3b 6f 70 61 63 69 74 79 3a 30 2e 31 3b 7d 2e 66 7b 66 69 6c 6c Data Ascii: 9f3<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 256 256"><defs><style>.a{fill:#0181fe;}.a,.b,.c,.e,.f,.g{fill-rule:evenodd;}.b{fill:url(#a);}.c,.d,.e{fill:#fff;}.c{isolation:isolate;opacity:0.1;}.f{fill
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 36 34 2c 30 48 31 39 32 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 36 34 56 31 39 32 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2d 36 34 2c 36 34 48 36 34 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 30 2c 31 39 32 56 36 34 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 30 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 37 30 2c 36 48 31 38 36 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 34 2c 36 34 56 31 38 36 61 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2d 36 34 2c 36 34 48 37 30 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 36 2c 31 38 36 56 37 30 41 36 34 2e 30 36 2c 36 34 2e 30 36 2c 30 2c 30 2c 31 2c 37 30 2c 36 5a 22 2f 3e 3c Data Ascii: 64,0H192a64.06,64.06,0,0,1,64,64V192a64.06,64.06,0,0,1-64,64H64A64.06,64.06,0,0,1,0,192V64A64.06,64.06,0,0,1,64,0Z"/><path class="b" d="M70,6H186a64.06,64.06,0,0,1,64,64V186a64.06,64.06,0,0,1-64,64H70A64.06,64.06,0,0,1,6,186V70A64.06,64.06,0,0,1,70,6Z"/><
2024-04-25 13:30:37 UTC	499	IN	Data Raw: 2d 31 35 2e 32 31 2c 36 2e 38 34 2d 31 35 2e 36 36 2c 31 35 2e 35 38 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 66 22 20 64 3d 22 4d 34 39 2e 32 32 2c 31 38 34 2e 35 35 63 34 2e 34 37 2d 31 33 2e 37 33 2c 31 39 2e 33 36 2d 34 32 2e 38 31 2c 36 35 2e 33 34 2d 34 32 2e 38 39 61 35 2e 33 37 2c 35 2e 33 37 2c 30 2c 30 2c 31 2c 35 2e 33 31 2c 35 2e 33 32 6c 30 2c 32 2e 32 33 61 35 2e 34 39 2c 35 2e 34 39 2c 30 2c 30 2c 30 2c 39 2e 31 2c 34 2e 31 33 6c 33 36 2e 37 2d 33 32 2e 31 38 61 37 2e 30 37 2c 37 2e 30 37 2c 30 2c 30 2c 30 2d 31 2e 30 39 2d 31 31 2e 34 63 2d 31 30 2e 38 35 2d 36 2e 33 2d 33 30 2e 33 37 2d 31 37 2d 34 37 2e 30 38 2d 32 32 2e 38 32 61 34 2e 32 39 2c 34 2e 32 39 2c 30 2c 30 2c 30 2d 35 2e 33 32 2c 35 2e 37 32 68 30 61 36 2c 36 2c 30 Data Ascii: -15.21,6.84-15.66,15.58Z"/><path class="f" d="M49.22,184.55c4.47-13.73,19.36-42.81,65.34-42.89a5.37,5.37,0,0,1,5.31,5.32l0,2.23a5.49,5.49,0,0,0,9.1,4.13l36.7-32.18a7.07,7.07,0,0,0-1.09-11.4c-10.85-6.3-30.37-17-47.08-22.82a4.29,4.29,0,0,0-5.32,5.72h0a6,6,0
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49783	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	375	OUT	GET /static/img/common/icon_japan.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	687	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:47 GMT etag: W/"20e-5e70893bc2993-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 3072 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SG8HpK6OIDko5m6q7IYlMdxYG8xgmmwM58yaY%2FGLIpSpGgEiYnqd82DvpeRgvVXAptW51HgHIH7YuAChZznW8QSAqoHqWKvaTGezBWJILYfh1sI%2FaHg6Go4SY56C%2Bn%2BzeZp3LIU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d3f446749-ATL
2024-04-25 13:30:37 UTC	533	IN	Data Raw: 32 30 65 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 34 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 30 33 39 32 31 36 20 31 30 31 36 2e 34 37 30 35 38 38 68 31 35 31 37 2e 31 37 36 34 37 56 37 2e 35 32 39 34 31 32 48 31 30 2e 30 33 39 32 31 36 56 31 30 31 36 2e 34 37 30 35 38 38 7a 20 6d 31 35 31 39 2e 36 38 36 32 37 34 20 33 2e 37 36 34 37 30 36 56 31 30 31 36 2e 34 37 30 35 38 38 76 33 2e 37 36 34 37 30 36 7a 4d 33 2e 37 36 34 37 30 36 20 31 30 32 34 56 31 2e 32 35 34 39 30 32 68 31 35 32 39 2e 37 32 Data Ascii: 20e<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.039216 1016.470588h1517.17647V7.529412H10.039216V1016.470588z m1519.686274 3.764706V1016.470588v3.764706zM3.764706 1024V1.254902h1529.72
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49784	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	376	OUT	GET /static/img/common/icon_russia.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:49 GMT etag: W/"229-5e70893d9e2f2-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18927 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=583rLRe5Uu4nNCtDncoK1ONKPhIKhvdMP1QHOvPiPayFkl0m%2BbgiB0Hdl7TNw4UB1jzk%2FyUBPCme2iipFuQDsELoaN6QOyA1qwf4c3SFXFPx9Ti%2FhQKLIyzsJfFUzgb7%2BqdZHOA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d3ec807ca-ATL
2024-04-25 13:30:37 UTC	560	IN	Data Raw: 32 32 39 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 34 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 30 35 31 35 33 34 20 31 30 31 37 2e 37 31 37 37 39 31 68 31 35 31 39 2e 30 33 38 30 33 37 56 37 2e 35 33 38 36 35 48 31 30 2e 30 35 31 35 33 34 76 31 30 31 30 2e 31 37 39 31 34 31 7a 20 6d 31 35 32 31 2e 35 35 30 39 32 20 32 2e 35 31 32 38 38 34 76 2d 33 2e 37 36 39 33 32 35 20 33 2e 37 36 39 33 32 35 7a 4d 33 2e 37 36 39 33 32 35 20 31 30 32 34 56 30 68 31 35 33 31 2e 36 30 32 34 35 34 56 31 30 32 32 2e Data Ascii: 229<svg viewBox="0 0 1544 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M10.051534 1017.717791h1519.038037V7.53865H10.051534v1010.179141z m1521.55092 2.512884v-3.769325 3.769325zM3.769325 1024V0h1531.602454V1022.
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49785	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	377	OUT	GET /static/img/common/icon_america.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	691	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:40 GMT etag: W/"27db-5e7089344368d-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56041 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FU5vbJk3saNPxZ5dg5rVSZFrUvKavxwxbaUHLo5Mkc0WY9OYAcM5WtDuV3RJj7ow7QIbkuWGkYa%2BN74bFbXNxHT8eXCBoht%2F%2F%2BI4%2FeEv4bTERuKWGADsnt4mxfFq1oazeX0n7m4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d3d9bad76-ATL
2024-04-25 13:30:37 UTC	678	IN	Data Raw: 32 37 64 62 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 32 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 37 2e 35 34 37 39 31 32 20 31 30 31 37 2e 37 31 30 30 37 34 68 31 35 32 30 2e 39 30 34 31 37 36 56 36 2e 32 38 39 39 32 36 48 37 2e 35 34 37 39 31 32 76 31 30 31 31 2e 34 32 30 31 34 38 7a 20 6d 31 35 32 33 2e 34 32 30 31 34 37 20 32 2e 35 31 35 39 37 76 2d 33 2e 37 37 33 39 35 36 20 33 2e 37 37 33 39 35 36 7a 4d 31 2e 32 35 37 39 38 35 20 31 30 32 34 56 30 48 31 35 33 34 2e 37 34 32 30 31 35 76 31 30 32 34 48 Data Ascii: 27db<svg viewBox="0 0 1542 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M7.547912 1017.710074h1520.904176V6.289926H7.547912v1011.420148z m1523.420147 2.51597v-3.773956 3.773956zM1.257985 1024V0H1534.742015v1024H
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 35 35 30 2e 39 39 37 35 34 33 68 31 35 32 37 2e 31 39 34 31 30 33 76 37 37 2e 39 39 35 30 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 33 31 35 2e 37 35 34 33 68 31 35 32 37 2e 31 39 34 31 30 33 56 33 39 33 2e 37 34 39 33 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 43 32 32 30 34 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 37 33 39 35 36 20 38 30 2e 35 31 31 30 35 37 68 31 35 32 37 2e 31 39 34 31 30 33 76 37 37 2e 39 39 35 30 38 36 48 33 2e 37 37 33 39 35 36 7a 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 3e 3c 2f 70 61 74 68 3e Data Ascii: h><path d="M3.773956 550.997543h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path><path d="M3.773956 315.7543h1527.194103V393.749386H3.773956z" fill="#C22045"></path><path d="M3.773956 80.511057h1527.194103v77.995086H3.773956z" fill="#FFFFFF"></path>
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 2e 38 33 37 38 33 38 7a 4d 34 36 32 2e 39 33 38 35 37 35 20 34 38 38 2e 30 39 38 32 38 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 33 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 38 2e 38 30 35 38 39 36 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 33 36 31 2e 30 34 31 37 36 39 20 33 31 2e 34 34 39 36 33 31 6c 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 Data Ascii: .837838zM462.938575 488.09828l3.773956 12.579853h13.837838l-11.321868 8.805896 5.031941 12.579853-11.321867-7.547911-11.321867 7.547911 5.031941-12.579853-11.321868-8.805896h13.837838zM361.041769 31.449631l3.773956 13.837838h13.837838l-11.321868 7.547912
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 31 32 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 32 35 39 2e 31 34 34 39 36 33 20 32 36 30 2e 34 30 32 39 34 38 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 33 48 32 37 36 2e 37 35 36 37 35 37 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 37 2d 31 30 2e 30 36 33 38 38 32 2d 38 2e 38 30 35 38 39 36 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 36 20 33 2e 37 37 33 39 35 36 2d 31 33 2e 38 33 37 38 33 37 2d 31 31 2e 33 32 31 38 36 38 2d 37 2e 35 34 37 39 31 32 68 31 33 2e 38 33 37 38 33 38 7a 4d 32 35 39 2e 31 34 34 39 36 33 20 33 37 36 2e 31 33 37 35 39 32 6c 33 2e 37 Data Ascii: 12 3.773956-12.579853-11.321868-8.805896h13.837838zM259.144963 260.402948l3.773956 12.579853H276.756757l-11.321868 7.547912 3.773956 13.837837-10.063882-8.805896-11.321867 8.805896 3.773956-13.837837-11.321868-7.547912h13.837838zM259.144963 376.137592l3.7
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 38 7a 4d 35 34 2e 30 39 33 33 36 36 20 33 31 2e 34 34 39 36 33 31 6c 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 31 20 35 2e 30 33 31 39 34 31 2d 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 38 2d 37 2e Data Ascii: 12.579853-11.321867-7.547911-11.321867 7.547911 5.031941-12.579853-11.321868-8.805896h13.837838zM54.093366 31.449631l3.773956 13.837838h13.837838l-11.321868 7.547912 5.031941 12.579852-11.321867-7.547911-11.321867 7.547911 5.031941-12.579852-11.321868-7.
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 36 20 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 32 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 38 2e 38 30 35 38 39 36 68 31 33 2e 38 33 37 38 33 37 7a 4d 35 31 33 2e 32 35 37 39 38 35 20 34 33 36 2e 35 32 30 38 38 35 6c 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 32 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 32 20 35 2e 30 33 31 39 34 31 20 31 33 2e 38 33 37 38 33 37 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 36 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 Data Ascii: 7838l-11.321867 8.805896 5.031941 12.579853-11.321867-7.547912-11.321868 7.547912 3.773956-12.579853-11.321867-8.805896h13.837837zM513.257985 436.520885l3.773956 12.579852h13.837838l-11.321867 7.547912 5.031941 13.837837-11.321868-8.805896-11.321867 8.805
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 30 39 2e 34 36 34 33 37 33 20 33 31 38 2e 32 37 30 32 37 6c 35 2e 30 33 31 39 34 31 20 31 32 2e 35 37 39 38 35 33 68 31 32 2e 35 37 39 38 35 33 6c 2d 31 30 2e 30 36 33 38 38 32 20 37 2e 35 34 37 39 31 31 20 33 2e 37 37 33 39 35 36 20 31 33 2e 38 33 37 38 33 38 2d 31 31 2e 33 32 31 38 36 38 2d 38 2e 38 30 35 38 39 37 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 37 20 35 2e 30 33 31 39 34 31 2d 31 33 2e 38 33 37 38 33 38 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 68 31 33 2e 38 33 37 38 33 38 7a 4d 33 30 38 2e 32 30 36 33 38 38 20 34 33 31 2e 34 38 38 39 34 33 6c 35 2e 30 33 31 39 34 31 20 31 33 2e 38 33 37 38 33 38 48 33 32 37 2e 30 37 36 31 36 37 6c 2d 31 31 2e 33 32 31 38 36 37 20 37 2e 35 34 37 39 31 32 20 33 2e 37 37 33 39 35 36 Data Ascii: 09.464373 318.27027l5.031941 12.579853h12.579853l-10.063882 7.547911 3.773956 13.837838-11.321868-8.805897-11.321867 8.805897 5.031941-13.837838-11.321867-7.547911h13.837838zM308.206388 431.488943l5.031941 13.837838H327.076167l-11.321867 7.547912 3.773956
2024-04-25 13:30:37 UTC	1319	IN	Data Raw: 20 33 2e 37 37 33 39 35 35 2d 31 32 2e 35 37 39 38 35 33 2d 31 31 2e 33 32 31 38 36 37 2d 37 2e 35 34 37 39 31 31 68 31 33 2e 38 33 37 38 33 38 7a 4d 31 30 35 2e 36 37 30 37 36 32 20 33 31 34 2e 34 39 36 33 31 34 6c 33 2e 37 37 33 39 35 35 20 31 32 2e 35 37 39 38 35 33 68 31 33 2e 38 33 37 38 33 38 6c 2d 31 31 2e 33 32 31 38 36 37 20 38 2e 38 30 35 38 39 37 20 33 2e 37 37 33 39 35 36 20 31 32 2e 35 37 39 38 35 32 2d 31 30 2e 30 36 33 38 38 32 2d 37 2e 35 34 37 39 31 31 2d 31 31 2e 33 32 31 38 36 38 20 37 2e 35 34 37 39 31 31 20 33 2e 37 37 33 39 35 36 2d 31 32 2e 35 37 39 38 35 32 2d 31 31 2e 33 32 31 38 36 37 2d 38 2e 38 30 35 38 39 37 48 31 30 30 2e 36 33 38 38 32 31 7a 4d 31 30 34 2e 34 31 32 37 37 36 20 34 32 38 2e 39 37 32 39 37 33 6c 33 2e 37 37 33 Data Ascii: 3.773955-12.579853-11.321867-7.547911h13.837838zM105.670762 314.496314l3.773955 12.579853h13.837838l-11.321867 8.805897 3.773956 12.579852-10.063882-7.547911-11.321868 7.547911 3.773956-12.579852-11.321867-8.805897H100.638821zM104.412776 428.972973l3.773
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49786	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	659	OUT	GET /static/img/icon/icon_arrow_1f2238_18.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:42:56 GMT etag: W/"2ec-5e70897cedf1a-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18927 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiBY%2BRmDlbu3EXM5KijgnFTeoyCwdSUyqlQ41cxRQz4OC8LEaNHWa8Ytsp6pilIkoSgpZqOl%2FbQH99nPByclb6TOPJFcR2F0cJA%2FRpVuNwddMh8rvqAC3oID%2BiTO7F9RJQPMOmw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d6d4f139a-ATL
2024-04-25 13:30:37 UTC	681	IN	Data Raw: 32 65 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 31 38 70 78 22 20 68 65 69 67 68 74 3d 22 31 38 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f Data Ascii: 2ec<?xml version="1.0" encoding="UTF-8"?><svg width="18px" height="18px" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g stroke="none" stroke-width="1" fill="none" fill-rule="eveno
2024-04-25 13:30:37 UTC	74	IN	Data Raw: 65 28 2d 34 35 2e 30 30 30 30 30 30 29 20 74 72 61 6e 73 6c 61 74 65 28 2d 39 2e 30 30 30 30 30 30 2c 20 2d 37 2e 30 30 30 30 30 30 29 20 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: e(-45.000000) translate(-9.000000, -7.000000) "></path> </g></svg>
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49787	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	651	OUT	GET /static/img/common/icon_china.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	692	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:41 GMT etag: W/"55f-5e70893533665-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46947 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFtwzMWhQoR7w1THDB7eWj6U5YSx%2BywISFcjCiCUUlDq5eIIEHENNB%2FVHCRR%2BWSYn8KR9XIzXTY0eHqJVDinJQTIcXACeNTOzdtxqz4bswhXDMe2boZ5x%2FwiBPsIKXgEg%2BaG%2Bn0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d698d675c-ATL
2024-04-25 13:30:37 UTC	677	IN	Data Raw: 35 35 66 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 36 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 31 2e 33 32 31 38 36 37 20 31 30 31 37 2e 37 31 30 30 37 34 68 31 35 32 30 2e 39 30 34 31 37 37 56 36 2e 32 38 39 39 32 36 48 31 31 2e 33 32 31 38 36 37 76 31 30 31 31 2e 34 32 30 31 34 38 7a 20 6d 31 35 32 34 2e 36 37 38 31 33 33 20 33 2e 37 37 33 39 35 35 76 2d 33 2e 37 37 33 39 35 35 20 33 2e 37 37 33 39 35 35 7a 4d 35 2e 30 33 31 39 34 31 20 31 30 32 34 56 30 68 31 35 33 33 2e 34 38 34 30 33 76 31 30 32 34 Data Ascii: 55f<svg viewBox="0 0 1546 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M11.321867 1017.710074h1520.904177V6.289926H11.321867v1011.420148z m1524.678133 3.773955v-3.773955 3.773955zM5.031941 1024V0h1533.48403v1024
2024-04-25 13:30:37 UTC	705	IN	Data Raw: 37 39 2d 32 38 2e 39 33 33 36 36 31 2d 33 32 2e 37 30 37 36 31 37 20 37 2e 35 34 37 39 31 32 20 32 31 2e 33 38 35 37 35 2d 32 36 2e 34 31 37 36 39 31 2d 31 37 2e 36 31 31 37 39 34 2d 32 38 2e 39 33 33 36 36 31 20 33 31 2e 34 34 39 36 33 32 20 31 33 2e 38 33 37 38 33 38 7a 4d 36 35 32 2e 38 39 34 33 34 39 20 31 37 37 2e 33 37 35 39 32 31 6c 2d 31 35 2e 30 39 35 38 32 33 20 33 30 2e 31 39 31 36 34 37 20 32 33 2e 39 30 31 37 32 20 32 33 2e 39 30 31 37 31 39 2d 33 33 2e 39 36 35 36 30 32 2d 35 2e 30 33 31 39 34 31 2d 31 35 2e 30 39 35 38 32 33 20 33 30 2e 31 39 31 36 34 37 2d 35 2e 30 33 31 39 34 31 2d 33 33 2e 39 36 35 36 30 32 2d 33 33 2e 39 36 35 36 30 32 2d 35 2e 30 33 31 39 34 31 4c 36 30 33 2e 38 33 32 39 32 34 20 32 30 32 2e 35 33 35 36 32 37 6c 2d 35 Data Ascii: 79-28.933661-32.707617 7.547912 21.38575-26.417691-17.611794-28.933661 31.449632 13.837838zM652.894349 177.375921l-15.095823 30.191647 23.90172 23.901719-33.965602-5.031941-15.095823 30.191647-5.031941-33.965602-33.965602-5.031941L603.832924 202.535627l-5
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49789	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	676	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_wdf.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 9674 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=14627 Content-Disposition: inline; filename="thanks_box_wdf.webp" Vary: Accept etag: "3923-5e5da4ab615eb" last-modified: Wed, 10 Aug 2022 03:03:22 GMT CF-Cache-Status: HIT Age: 60503 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3JnaRKcyHtfqaGPuyzFXOagXuVoI08kUWT2uBw03Znz4Xb3ciDqgK%2FvTcRT79tFx%2BsW%2Bo2osmS9X15EEodTrPgCD8NsFkcAc5vnMd5%2Bl3Y7%2BobJhXHsp3IN1uGrWevcs4hvbvk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d9dd507da-ATL
2024-04-25 13:30:37 UTC	554	IN	Data Raw: 52 49 46 46 c2 25 00 00 57 45 42 50 56 50 38 4c b6 25 00 00 2f 63 40 1b 10 4d 38 6c db 46 92 20 ef ee ed 23 5f ff 05 cf 53 43 44 ff 27 80 43 76 93 c9 0d 82 ca ed ed ff 17 c8 cb 72 c8 a3 7a 26 1b 61 91 28 6e a0 e6 18 8a 00 52 88 83 a8 d0 32 ed 90 dc 77 01 0d 44 01 54 21 01 da 56 59 b8 6d 64 db 55 46 c4 88 fe 4b 23 f4 1e 8e 8e 90 b7 21 b4 e0 c6 91 24 45 0a ad 8e 99 ef cc fd ff 5b 8e 2d b4 99 d1 6a ad e0 c6 b6 ad ba 59 62 96 de bc 48 5c 8a fa 2f c0 14 9e c8 0c 6f 7e 64 9e fe 4f 00 a2 9c 7d 2e fc 4e 64 22 77 f9 7a a6 11 02 c0 aa 34 ca fd 5a 1a e5 fc 9d 72 af 14 9a 56 b4 a2 14 e0 fc 2e 07 79 ef 6b 63 de 58 37 5b 5a 2e 9b 9b 1b 4f 5b 9b b6 37 06 1a 35 59 62 7d 28 ac bf bb 75 63 dd 6c d9 64 7e 7d ce 5b 99 16 20 aa d6 5d e4 e4 3f 86 56 5a d0 64 3a 91 89 68 01 62 Data Ascii: RIFF%WEBPVP8L%/c@M8lF #_SCD'Cvrz&a(nR2wDT!VYmdUFK#!$E[-jYbH\/o~dO}.Nd"wz4ZrV.ykcX7[Z.O[75Yb}(ucld~}[ ]?VZd:hb
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 7e ee 1f bf 4c 00 b6 67 db 15 49 92 73 ce 89 48 aa ec 2c 6a 66 9a 86 61 5a 66 66 66 66 66 66 fe 04 66 f8 b4 cc cc cc cc 3c cc d8 3c 5d 5c 99 91 19 74 ce 87 ae 6e 0d fc 81 d7 cc 38 0e c7 84 21 cc 5c 0b a5 74 d8 e9 51 1a 96 77 63 54 2a f7 a6 b4 cc 9c ae 19 43 98 79 b8 34 1e 4a f3 f0 94 34 10 da 81 fa 64 a6 52 ae 26 cd b4 d4 ea 92 55 4e 43 99 19 5b bd a5 92 6c d9 b6 ad ba 91 b4 f7 3e f7 3d 59 b2 cc 98 c5 cc 8c 3d c8 51 0d a9 c6 54 0f aa 25 f8 c9 cc 0c c9 cc b6 23 42 96 fc de 3d 67 7b 8e 6c 5b b5 6d db b6 52 ca a5 f6 31 16 33 73 6c 2d e9 b6 18 5b a5 ad c1 8e 31 33 33 33 8d de 4a 86 5c db d6 f2 64 bf f8 d4 93 91 e0 50 01 8b 19 d5 30 a6 0c 0a a0 c2 b8 bb eb 04 18 5a b8 2d 3e f3 0b 9f ab 30 f8 e7 cf 67 bf 09 66 c8 48 0b c3 01 02 3d 0c c7 a6 85 46 69 62 45 7b ae Data Ascii: ~LgIsH,jfaZfffffff<<]\tn8!\tQwcT*Cy4J4dR&UNC[l>=Y=QT%#B=g{l[mR13sl-[1333J\dP0Z->0gfH=FibE{
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 9d 12 af 64 2c 8b 62 a3 ac 97 8b ba 3a ed 87 d0 27 06 57 6e f8 72 a3 a7 25 d6 83 ef 75 b7 48 97 eb 15 39 56 e9 bd 1e 76 8b 6b 7e af a6 54 75 20 84 09 69 3b 25 15 86 40 12 f4 84 c2 15 5b 7c 48 af c1 d2 02 1a d3 80 d5 12 cb a4 be d6 43 f9 53 32 21 ac 96 70 71 11 0e 17 05 82 88 22 22 4a 4d 87 ba fd 1d dc 3c 78 20 45 51 46 22 a9 64 60 ad 8d e9 9c 24 cd 37 ad 6a fd a2 9a 76 e3 4a 37 fc 9a 89 72 cb ab 69 ca d2 97 7e c3 d1 dd a2 0c 69 30 6e 84 ee 9f 21 3e f3 3e e6 d1 cf e8 9c cc e2 c6 42 25 0c 11 c3 74 77 5c e5 17 eb 08 d6 98 52 62 a8 63 30 34 39 2f 6a 44 0b 4f 8d 5b d6 f2 8f 63 a5 5e bd 2e 96 ef f0 b2 dc 00 4f 42 c4 38 ea 74 5c 72 f3 e0 48 d3 58 6c 37 d6 78 38 a2 db 07 be 79 50 16 15 a8 a4 10 44 f0 84 8a 80 18 aa 9d 32 10 a3 ab 1e 53 18 e8 fa 02 16 c2 aa 34 13 Data Ascii: d,b:'Wnr%uH9Vvk~Tu i;%@[\|HCS2!pq""JM<x EQF"d`$7jvJ7ri~i0n!>>B%tw\Rbc049/jDO[c^.OB8t\rHXl7x8yPD2S4
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 1c e0 a9 97 72 21 85 60 2c 8e 60 8a bc 4e 43 2e 0b bc 34 9d 4c 8b 04 61 71 0d c8 88 45 b5 fd 51 db 8b 09 85 29 82 25 47 78 a5 12 a2 86 f5 49 4b 40 93 0a 7c 40 31 0e ec 90 aa cd 95 62 88 28 74 44 68 38 f4 f7 88 52 70 61 50 f7 af 28 93 56 fc 1b d0 08 2c 05 ac 64 69 21 dc d5 cb 41 51 11 a1 ba 34 3a 84 4a d5 54 11 70 77 c7 91 25 a9 49 ad 8b f5 1f 7d 34 54 af 89 00 d6 98 06 78 80 1e ac a8 96 86 0b 53 81 21 14 65 2d 0f 48 51 d0 ad 86 98 84 84 97 52 01 73 35 21 2e 46 b0 01 86 c2 62 a8 9e bd 9a 54 20 df a8 2b 2a 59 e2 08 cc 8a 0a 3c a4 63 62 af 49 07 3b 61 ab 85 cf cd 54 15 f8 04 86 14 df 31 88 47 e4 c3 aa e5 fe 8c 27 fd 04 7e aa da 35 70 ab 51 8e 5a 60 2a e4 37 82 a1 54 5f 2a 66 d9 a5 8a 47 59 c3 a9 29 1c 4b 2b 04 aa 04 10 db d1 bf 16 01 6a 18 f7 a0 4e 08 94 28 Data Ascii: r!`,`NC.4LaqEQ)%GxIK@\|@1b(tDh8RpaP(V,di!AQ4:JTpw%I}4TxS!e-HQRs5!.FbT +Y<cbI;aT1G'~5pQZ`7T_*fGY)K+jN(
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 7f 1b b3 8a 18 a1 b8 44 a8 e7 47 65 40 a9 7a 4b ac 23 b0 a8 2a 57 05 b0 1e 50 02 8c 00 66 09 58 5c 26 13 d8 8f 30 57 03 55 45 23 81 01 0e 41 95 81 a3 9f c8 30 8d f4 3c d2 15 5e e3 fe a7 8a 6d aa d5 00 33 62 32 56 cc ff d3 83 aa 8a 9e 1d 4d 4b e8 46 30 46 b0 dd c0 2c 0e b0 9c 35 80 a9 c0 ba c0 30 60 96 a0 52 ab bc 06 57 83 a2 1a 1c 78 a5 0b c8 8a 43 a9 21 11 d2 9c 8b 2b 50 56 64 8d c3 8f 18 c7 fa d1 64 e0 1c c1 d5 3d 2f 01 f5 fd 98 a0 eb 6f b7 e2 ea 41 cb e3 59 bc 27 3e 05 ef 88 d7 43 4b 7c 61 e7 a3 de cc f5 6f 9f 03 f7 1f db b6 6d cb c4 85 9c 0f 08 dd 98 9c 13 48 d5 de 8f 2e 14 59 40 bc 87 27 c0 24 88 40 a4 ac 97 d3 b1 0a 12 05 47 97 05 ce e1 99 ef 86 cf c1 f7 b6 c6 27 ff fb 7c f4 2b f6 7e 7d 52 a0 03 53 00 80 40 88 21 71 48 19 97 88 51 73 16 7e a8 78 46 Data Ascii: DGe@zK#*WPfX\&0WUE#A0<^m3b2VMKF0F,50`RWxC!+PVdd=/oAY'>CK\|aomH.Y@'$@G'\|+~}RS@!qHQs~xF
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 02 4d 04 5a 1c 2f 95 81 20 50 2b c3 aa bb f1 37 7b 9d d7 33 8f f1 eb 75 c6 52 1a 32 11 33 52 90 01 00 11 c0 08 c4 40 40 18 01 ed 3a a8 10 f1 38 bd c5 fc e7 2b 85 4e f5 f5 9f 4a 09 b0 20 09 00 a0 20 84 8c c1 85 98 30 f8 14 67 36 4e 69 00 c0 81 01 fd 7e 4f 86 5b 5b c3 67 ad be 3a de 18 fb 30 3a 12 a4 99 d9 b6 1d 13 9d 26 00 aa 40 c4 9a 0d 62 2c 81 09 6d 71 a3 11 de 3f 07 32 7d 89 bd f8 c3 4c 0b a6 f0 31 46 ff 0a 23 de 86 38 08 92 4d 7e 17 00 74 47 53 72 e9 6f 56 be c6 98 13 79 3b a0 ce 38 1d 0e 61 eb cc 9c f3 63 bf fd ba cd 30 9b 1b 31 15 4c 23 86 7a 56 37 d4 83 44 44 c0 3b ce 80 47 0c a7 81 14 f8 8e 56 ca 75 0f e0 1b c6 b2 02 88 76 68 30 f0 e0 8f e1 e4 bf 8b 4d 29 23 19 70 0d 00 1c 4c d4 0b 79 44 7b bc 6a 8a 34 ed d3 3a 7a 2b 04 d5 05 44 e4 f4 99 d7 19 6f Data Ascii: MZ/ P+7{3uR23R@@:8+NJ 0g6Ni~O[[g:0:&@b,mq?2}L1F#8M~tGSroVy;8ac01L#zV7DD;GVuvh0M)#pLyD{j4:z+Do
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 7c a7 06 5d 56 27 80 d2 56 3d 45 0b c2 e3 c0 1d 44 70 69 2a 52 14 ae 2c b6 8b c2 70 32 72 1e 64 ff 9f d4 36 f4 95 a1 ab 46 3d 7e ee 65 9b e3 67 8d c7 e3 42 5f d2 71 51 0c 90 f1 3b e2 43 62 7a a3 9f 46 f8 65 75 07 76 b5 c6 fb 70 e3 a7 17 b7 87 ef fb d0 fd 75 d7 87 38 f2 1a 00 c0 00 68 b7 0b ac ee 30 06 86 12 40 0c 58 31 cd 76 b9 c5 b6 db de 4a 68 c6 7f fe 67 27 e3 5a 8d b8 0a 8f de 3d 8b 3d 31 79 f6 f2 e2 e4 87 97 97 27 93 49 0d b5 f1 dc d1 68 84 de ec 07 21 bc 24 df 12 c5 6b 8c b9 c2 03 be ae eb 1c ad c2 ae ca 15 4e 0c 7c 43 81 05 1b bc 69 32 ae 30 ff ac 9a bf 25 e0 ef 08 e2 d8 f5 23 78 60 68 86 bd 4e 79 fb 76 59 98 72 3b e8 00 40 5d d8 e3 e4 06 0b 2d 7e 7f 73 6d f3 26 5c 78 1d 14 f7 fc 6d bc 75 d8 fb d6 a0 2b f9 46 fd f1 39 71 b9 83 50 54 ba 97 f5 01 ac Data Ascii: \|]V'V=EDpi*R,p2rd6F=~egB_qQ;CbzFeuvpu8h0@X1vJhg'Z==1y'Ih!$kN\|Ci20%#x`hNyvYr;@]-~sm&\xmu+F9qPT
2024-04-25 13:30:37 UTC	906	IN	Data Raw: 57 62 fc 8e 58 57 9a 3f f8 53 20 6d 15 79 af d0 e2 90 1e f4 e3 28 02 9a 54 aa 2a b0 63 c4 11 13 98 45 d2 74 53 c9 d6 df 06 8a 02 a8 00 a2 c2 fc ca 58 c7 37 61 e9 20 ce 5e ca ce ca 75 38 00 55 b9 0c 6f 84 73 af 83 b3 f2 56 58 9c 0f 1a 03 a3 86 9d 40 98 a0 28 62 19 dc 10 29 bd 93 8c b8 d3 5d 3c db b7 28 2c 84 0e 44 49 ca a2 cc 2b 90 e5 59 b6 39 be 1a f9 b9 43 e8 8c ae c3 b5 38 bb 78 25 7e f2 dc 7f af 6d 9e 9d ac 67 af 81 b3 72 f2 2b f0 ba 78 dc e8 c4 ab 24 03 b4 a1 cb a4 7c c9 78 a1 1a ac c5 1b 9d 1c fc 71 bf bd 2a 2c 90 41 4e 35 54 32 60 9a 92 aa a2 28 aa 92 7d 19 2e cd 42 ae c1 da e2 f3 ff fb c2 d2 95 78 33 e4 59 e7 47 97 2e 9c c8 2f 5c 01 59 5a d4 e5 ec d5 70 29 7f 6c b6 49 67 3f fe 6b fd cd a1 34 2a ea 32 46 b8 86 94 50 11 b9 6f 29 da 13 c2 2a c1 1a 37 Data Ascii: WbXW?S my(TcEtSX7a ^u8UosVX@(b)]<(,DI+Y9C8x%~mgr+x$\|xq,AN5T2`(}.Bx3YG./\YZp)lIg?k42FPo)7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49788	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	676	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_365.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	821	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 5304 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=13631 Content-Disposition: inline; filename="thanks_box_365.webp" Vary: Accept etag: "353f-5e5da4aa7587b" last-modified: Wed, 10 Aug 2022 03:03:21 GMT CF-Cache-Status: HIT Age: 55004 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p68yE%2BnFsqWSVTmobupVRV5o2xi5Cnw%2BlRQ1qWk%2Fnn%2BkLUFxLvsf7Ap1wCONMr7LNgmjI7TCtt3QYqlDM15XmicaU0%2FDu%2FU7ja9wMxDuj8YoZnc%2BUgJqCYtwlJhsndRpyPC%2B920%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04d8b3a53e7-ATL
2024-04-25 13:30:37 UTC	548	IN	Data Raw: 52 49 46 46 b0 14 00 00 57 45 42 50 56 50 38 4c a3 14 00 00 2f 63 40 1b 10 ef 07 bb b6 25 c5 ca ad 6a 1b dc 1d 7e 89 94 84 08 81 20 88 c1 dd cb ba d2 80 64 db 92 22 e5 ff cc b2 56 dc 19 32 84 39 9b b7 75 b0 01 77 8d c8 cc 88 80 1d 49 92 63 a5 7b 76 4f df bd f7 fe 1e 1a 33 70 02 57 f9 c3 00 5c d1 5a cb 95 33 b0 02 01 20 58 dd ec 7d b1 80 6b b0 b1 33 d8 5b 03 3e 9b 01 00 80 ff 0c 83 00 d0 00 0a 50 e1 82 20 60 14 66 90 8b 0c 33 dd 64 a8 0c 93 ae 12 b8 65 d8 2b 80 7b 00 9b 0c 5b 4c d7 2b 80 23 91 47 10 27 a6 00 50 03 90 22 b2 c8 de f6 98 5e 56 f0 0a 93 d9 34 13 95 66 54 ae 8a db 60 59 11 2f 92 e0 3f 00 63 22 d7 2d a6 fa b2 96 40 86 75 2d be 7c 7f 16 d1 54 98 0a 2b bc 15 5a 12 d1 48 34 b2 5a 58 4d b4 24 de 0a ab 85 b7 2c ac b2 9a 89 46 a2 91 68 a4 25 d1 92 fc Data Ascii: RIFFWEBPVP8L/c@%j~ d"V29uwIc{vO3pW\Z3 X}k3[>P `f3de+{[L+#G'P"^V4fT`Y/?c"-@u-\|T+ZH4ZXM$,Fh%
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: c5 39 3b bb 77 73 7a e3 fd a0 7a de 11 ea 5f 5c 3a 1e 7f 24 bf d9 de 9d 0d 2e 96 05 b1 8e da 1a 78 fe cf 5a f1 2f c1 ea 4e d6 67 1e 97 09 ea e0 a2 f3 fc 0e 5e 2e 9f 49 3e f3 78 7d e1 fa fb 5b dc 9e 7a 7a 3c 70 8a ad 81 95 3a ab 72 0c 96 61 50 26 f5 71 75 ef f2 e9 c4 d1 4a c4 e7 b1 bd f3 5b 57 d7 03 eb 08 04 92 f6 f7 9e 21 22 12 5a da da fe b9 69 a3 5d ec e7 c1 4f 4d ef c9 0d f4 00 6b 8c b7 10 89 45 6e dc d3 f6 5b f4 a1 73 b6 7d 8f fa b9 90 c4 98 78 2f 00 4d 49 94 41 62 66 a4 3f 92 88 66 14 d1 7f 07 6e db 46 92 34 f0 5e 73 39 53 ec 23 b0 61 db ae c8 89 ad 7d 65 a0 b1 30 cc df 63 21 82 e5 58 b6 bb ff 3a 36 2e 51 0e 21 68 27 b8 eb 41 83 bb bb 04 92 40 0c 49 c6 9d e3 7b 90 b0 9d 30 10 01 86 30 db d1 e3 b2 6a 55 51 f4 96 df 25 5d d5 bd ba aa ba 57 59 77 57 57 Data Ascii: 9;wszz_\:$.xZ/Ng^.I>x}[zz<p:raP&quJ[W!"Zi]OMkEn[s}x/MIAbf?fnF4^s9S#a}e0c!X:6.Q!h'A@I{00jUQ%]WYwWW
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: cf a7 4c 33 c5 9b 8e 22 73 56 dc c8 f4 a1 f9 c2 97 e9 d7 17 17 e3 77 81 f0 c1 03 ee a5 5b 03 09 ef 31 93 8f 13 0e ef ef 5c 83 39 cd bd 6c 0c eb eb a3 65 5f 4c 7c e6 8f 69 b2 ea d0 25 45 e9 ba 35 74 98 d4 c3 e4 f9 c7 fc a6 69 0e 5a b1 b6 83 87 1c 5e 89 ad d6 30 91 f8 9a 4e 1f 98 c4 17 fb 71 9f a6 cb e1 5e 26 0f cb ef 4f 99 26 6f 5d 5e bb 7e 6e a2 72 28 6f 9a 7d 78 de e4 33 95 2e 70 07 91 ea 03 f3 95 2f 69 9f a2 8f c5 f7 cd eb 61 42 ea d9 ff da 8a b5 eb e7 2f 60 83 eb 74 49 41 a6 c9 a7 78 42 26 3a b8 d2 07 ef e5 17 3e 1b 7d 34 a4 7e 6e 46 ce 90 6b ed 97 d9 f5 90 17 64 83 6c 62 dd 8a 8e 1c 04 25 dd 17 e5 fd 3f be a8 f7 5f 80 40 74 58 89 15 9e 97 16 c8 f3 e4 75 1b 98 f5 73 59 20 7d c5 2d e8 04 eb 18 b9 52 68 bf d6 9d dd a7 47 5f 5f 98 01 86 91 0e 19 9a 20 34 Data Ascii: L3"sVw[1\9le_L\|i%E5tiZ^0Nq^&O&o]^~nr(o}x3.p/iaB/`tIAxB&:>}4~nFkdlb%?_@tXusY }-RhG__ 4
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 9f 59 89 87 e0 70 c3 64 07 d7 87 3d 39 d3 6a 1d 67 32 2f f5 68 ab 77 1c 8c 24 4f 46 f7 b9 ed bb 77 10 e3 72 b2 c6 1a 34 50 5e 6d b9 bd fc ee c5 97 0a c6 7b 8d d1 5a c9 70 81 84 00 78 cd de 11 9a 34 65 70 6e 06 53 5d eb 38 35 15 79 d7 cd a8 e3 38 75 b3 7a 2e 06 d4 4d cd cd c1 95 e6 be 1d af 27 14 45 90 65 41 88 03 95 a8 ea 07 34 08 e4 5f 69 5f d2 1a 29 1a e3 1d 1f 1c a7 94 c9 71 52 80 e0 f5 ad bb f6 3b 12 d8 b4 35 94 4f a8 40 dd 29 44 3c 4f 35 b1 ee 69 ec 84 20 12 71 6e e0 dc 16 9e 7b 5d 57 b4 11 90 a0 8b 12 a7 81 5e fc dc 15 f1 41 c1 85 c2 31 de 71 f6 f8 20 98 4e 0a 8c b4 c0 10 6c 26 06 86 0c 18 8c 67 23 a7 c2 5c ec d6 46 23 91 48 34 32 c3 1b 8d 36 2e f4 04 70 b8 6e df 4e 3b 01 28 85 44 9b 96 0b ff cf d5 db 45 7c e1 38 80 4d 0e 8c 14 e2 71 8a cd 62 3c 24 Data Ascii: Ypd=9jg2/hw$OFwr4P^m{Zpx4epnS]85y8uz.M'EeA4_i_)qR;5O@)D<O5i qn{]W^A1q Nl&g#\F#H426.pnN;(DE\|8Mqb<$
2024-04-25 13:30:37 UTC	649	IN	Data Raw: c7 5e 13 40 67 10 6a 85 88 f2 0a 71 56 85 28 c4 aa 4a 6e b0 03 1f 11 a4 63 43 ba 68 23 14 89 44 48 6f 25 cf 7d ef bf ff f3 e7 7f f3 fd 82 46 c8 60 7a 83 64 ab be 94 cb 4f 86 c8 f5 de 56 46 8f 8c 87 d4 50 28 44 76 a2 91 d6 88 cd 71 9c cd d9 36 91 91 eb da d1 64 32 c9 13 0a a9 2d df 8f 2e bb 02 48 36 b6 f5 19 f6 71 67 e6 87 78 cc 19 9a 24 55 aa 5a 0c 07 9a e3 17 8c 53 27 0c 43 32 0c 83 bf cd bb ba ae 13 f1 fb 89 07 2e a3 1b 49 9e 27 55 e1 b2 f2 e8 f7 c2 3f fb cf 27 a3 67 eb 3b d2 b2 fc 7d cd ff 67 2c 4d 6c 35 04 53 53 0b 74 3c c8 56 db 15 e5 77 c4 c4 92 bb d0 48 7c 20 9f 4d 3c 40 4c 22 91 40 8c cc 30 89 e5 e2 69 b8 34 1a 86 b7 ea 7b df 8f fe 42 7a fa a9 e6 fa 15 1f ff 58 55 7f b4 23 4e cb 70 f7 96 9c 2a 86 a9 9e 3e 63 a6 64 2d 5e 38 5b e2 2c 29 6c 69 95 96 Data Ascii: ^@gjqV(JncCh#DHo%}F`zdOVFP(Dvq6d2-.H6qgx$UZS'C2.I'U?'g;}g,Ml5SSt<VwH\| M<@L"@0i4{BzXU#Np*>cd-^8[,)li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49791	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	676	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_wfh.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 8946 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=13565 Content-Disposition: inline; filename="thanks_box_wfh.webp" Vary: Accept etag: "34fd-5e5da4ac515c3" last-modified: Wed, 10 Aug 2022 03:03:23 GMT CF-Cache-Status: HIT Age: 35805 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kfpxdUwUf7Ej2o7WhM7g22nj7OyQLY14%2FybZe5eABOrQujVAStovR%2Bto%2F44ZjZbwVREmM0lH5HS2TYUUTyYCT4pPM2XLQq1ZkSZdcEmf9su9t1dAmKONLdJC%2F1sBZ%2FTQfaDAe6U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04deafd4517-ATL
2024-04-25 13:30:37 UTC	554	IN	Data Raw: 52 49 46 46 ea 22 00 00 57 45 42 50 56 50 38 4c dd 22 00 00 2f 63 40 1b 10 4d 30 6a 1b 49 d2 a6 76 7f e9 e5 0f b8 0f 0c 11 fd 9f 00 be e2 6a 36 21 81 67 cc 34 e6 86 4d 05 7d 6f 9e 72 71 11 54 fc 85 72 04 84 d4 a2 a0 25 32 11 b0 95 2c 5c 47 b2 6d 5a fd 6c e4 1f dd d5 e7 ab 6b 3e 3b 06 37 6a 24 49 52 58 6b ef ff 5f d7 d6 9e 45 11 14 7d 14 6d 41 b2 6d db 74 b5 62 db 36 8a af 98 91 fe 37 c2 c9 ca 57 d1 e6 e8 ff 04 00 20 01 00 00 bc 82 af 44 26 3d 01 ff 12 e2 c5 7f 00 00 8d e6 db 27 d1 a8 38 86 9a e5 8b 0f ac ee ae 23 92 27 9a e9 8d 9e 2b 4b ca 5e 72 0c 00 91 04 04 01 41 0e c1 f8 04 a2 d8 d6 6f 44 d0 db 06 80 f3 80 6a c0 30 60 98 12 4d 29 9e b3 ec 43 da e4 b3 9e d6 3d 00 67 9e ef 99 0c 58 06 2c 73 00 7d 85 ef 41 6f 34 9f 7a 08 c0 d5 e0 9a df 09 e5 36 b8 17 b8 Data Ascii: RIFF"WEBPVP8L"/c@M0jIvj6!g4M}orqTr%2,\GmZlk>;7j$IRXk_E}mAmtb67W D&='8#'+K^rAoDj0`M)C=gX,s}Ao4z6
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 9f 72 28 49 52 d5 cc f1 dc 43 04 45 4c 52 f9 02 82 00 b6 ac d1 72 42 75 af 28 f6 70 c4 04 35 05 c3 04 43 1c 15 8e 7c 84 fc 23 b4 12 45 72 eb b2 aa 04 b3 38 4c 5a e3 60 19 19 5c 9b b9 f3 70 dc 80 3a e0 00 00 10 82 84 79 82 84 a3 4c 51 26 88 28 12 8e 7e 8a 38 42 86 0d 9a d6 20 be 4a 9e 3a c1 fc 61 89 16 ac 99 36 cb fd 46 ce b5 75 bc 51 47 08 b0 22 09 05 ab e5 48 98 21 68 5d 40 30 c2 51 52 50 12 88 28 86 09 fe 0b e4 4d 34 43 68 11 34 e6 3e 31 6c 6d c0 63 bf 1e 34 50 28 58 81 20 52 10 14 52 27 c9 02 15 f1 49 0c 55 8a 1e 05 91 40 91 aa 23 66 5e 0d 7e f8 f0 5f 39 ff df 92 4a da 04 ed b9 85 c0 ce 66 3c 34 a1 06 e0 2b 20 02 5f 02 44 90 a0 2d 15 c2 ee 24 c1 91 51 a9 0b 94 04 6a 8a c4 1c 93 14 fd 1c 89 4a 26 42 34 8d a0 fc 44 9f 94 60 66 ce 72 9d b2 3a 48 e3 75 5f Data Ascii: r(IRCELRrBu(p5C\|#Er8LZ`\p:yLQ&(~8B J:a6FuQG"H!h]@0QRP(M4Ch4>1lmc4P(X RR'IU@#f^~_9Jf<4+ _D-$QjJ&B4D`fr:Hu_
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: c6 2a ef 62 f0 66 38 18 e4 4b e0 1e 70 c1 eb e0 4d ce a0 5c f2 c7 b6 5c 42 bc 1f ae 0b 8f 81 bf 11 3f b8 11 5c 53 fc ef a6 af 3e 81 78 0f 71 32 8b 78 b8 73 f2 f5 c5 4d c5 bb e1 e5 f0 f7 1a 97 d3 b8 0a 75 55 b8 3e 7c 4e 3e 01 ae 0e 57 10 f7 84 7f d0 b8 99 e2 b6 f0 07 b6 f4 0c 7a f6 eb 5d 3c 88 39 ed 23 20 0a 59 2f 95 18 78 d5 90 32 06 99 c6 96 1f e3 2f d7 e0 a9 f0 24 38 84 7a 03 f5 ff cf 84 b7 c1 4b a1 ff be 20 bf 71 03 f8 d8 ad c5 d5 c4 8d e1 32 8c 9b 10 f7 82 2f 3c 0e 16 c9 e3 4e 5d 3d 0b be fe 12 8f db 06 ef a6 6e 02 0d 30 1b 10 42 88 a4 c5 31 0a 20 9d 3d 1d de 09 bf 03 bb c0 fc c9 10 f3 da dd 96 b1 14 e4 4a 9d 90 b6 2c 6b 46 f9 cd c4 a1 e0 5e f4 e9 a3 f6 83 db 13 b7 23 5e 04 c1 22 f9 28 38 3a 09 f2 e6 e2 f5 70 33 58 fd f9 ee d9 69 d9 5d 0f 35 d0 02 5e Data Ascii: *bf8KpM\\B?\S>xq2xsMuU>\|N>Wz]<9# Y/x2/$8zK q2/<N]=n0B1 =J,kF^#^"(8:p3Xi]5^
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 82 fb 62 46 d1 8e 10 61 36 e1 88 11 6d ca 82 cd 70 f6 64 58 04 70 c1 03 52 e0 8c 72 50 46 80 72 6f 07 70 56 24 a0 dd 41 a4 01 0c ac 86 1d 73 18 43 94 0d bd eb 85 4a 21 e2 0d 8d 1c 58 0c 4e 04 00 10 26 1a 1e 60 d6 c9 e8 29 54 4c a1 32 c2 2d 95 d3 bf 68 d6 68 39 1d 5a 1d 36 df f1 82 fa c8 20 d6 f3 32 c8 78 23 22 d6 f5 97 51 0e 3a 00 b9 ae 22 bc 7c 87 b7 83 a9 a8 02 03 90 c3 80 b5 1d 20 a9 06 00 9c 6c 79 3e 54 85 1e ec ff cf 9a f1 ff 1a 6d 9b c9 02 00 10 5d cc 1c a2 69 2c 6e 83 4c b1 14 84 60 0d 3c 07 cb 18 e5 e2 d0 5d 9a ba d5 b0 b9 17 9b 44 94 f0 45 0d 3e d1 25 22 58 1d c2 28 43 0a 01 e4 72 00 e0 a8 4d 89 54 4b 14 81 35 5f 87 09 5f 1f 50 01 68 d5 07 d4 d8 00 00 c8 07 79 e4 e6 29 29 8c 01 e3 70 09 eb d0 c5 35 60 b1 f2 d1 46 0e 2a c2 06 69 30 73 98 19 23 9f Data Ascii: bFa6mpdXpRrPFropV$AsCJ!XN&`)TL2-hh9Z6 2x#"Q:"\| ly>Tm]i,nL`<]DE>%"X(CrMTK5__Phy))p5`F*i0s#
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 42 40 55 64 4f ca 40 bb 58 dc fc e4 23 63 db cb 4c 3a 19 11 e1 73 c2 23 94 67 12 94 e0 aa c6 f1 32 fe 14 5b 9c 87 5b 99 ce 02 62 e4 3c 00 a8 98 d3 85 1e 03 d8 8d e0 42 6f a3 93 04 8a 85 da d2 91 ae 4f e4 9c f3 56 c9 55 8e 29 d4 0a b0 00 0b 90 9e a0 7e a3 c6 5f de 1a 46 38 15 48 f8 45 50 82 29 14 86 06 e6 ac 46 9f 85 ce 22 c9 62 68 84 7a 8c c3 2c f2 49 46 6c 98 e3 b6 0e 00 8c 82 20 60 97 52 74 24 52 43 49 83 44 01 f0 86 2c 6d 41 c4 92 de 32 ca cc 2e 26 7c 4b a1 0c 85 8d af 64 01 23 6a b7 2e a1 6d 36 85 09 89 14 23 1a 86 a3 5e b8 27 b6 ef 98 11 9e 59 a2 d7 9c 10 a3 a0 02 c0 a8 d1 0b 68 60 17 45 c4 38 bc ab be 67 52 7e 10 52 00 80 93 2b fb c2 29 03 58 cc b4 09 d5 32 a1 d0 84 ec b1 73 35 24 ef 23 7a ee 44 d2 58 d1 0d 74 97 50 f4 01 04 55 fd 29 9c 2e 8c 61 68 Data Ascii: B@UdO@X#cL:s#g2[[b<BoOVU)~_F8HEP)F"bhz,IFl `Rt$RCID,mA2.&\|Kd#j.m6#^'Yh`E8gR~R+)X2s5$#zDXtPU).ah
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: a5 a6 45 6f ee 88 0a 59 5b 88 9a 59 76 84 91 a8 c4 73 d5 8d 9b d9 6c cc 4a 58 f0 b2 1c 4b 0c 5e 82 7b 54 3c c3 07 3b 3e c5 13 c9 c9 62 32 5f b8 12 60 dc 6e b2 f8 5c c0 2d 00 40 0c 37 96 5c 5b 3d 4a b7 3c cd 26 f4 ee a2 f5 b0 84 e7 85 cb 08 33 42 10 48 40 06 94 70 85 0d 6a e1 cb ac 5b 14 14 67 a0 64 0b c8 c4 c6 88 9f 2a fd 28 c2 f3 a0 7d 24 4a 31 36 25 46 75 1c 92 e5 60 d6 41 0c 5e 63 21 11 04 3c 03 78 0c 31 bc d2 07 8c 09 23 47 5f 07 80 da bb 77 24 60 d8 02 c0 04 be 3a 00 86 00 20 08 0e 00 02 a1 42 c7 59 96 2f 15 52 ca 00 a5 80 b3 05 6e d6 0d 02 bf 88 52 8f b4 77 18 6b 22 d6 95 31 46 e4 cc 38 ca 38 0a 71 32 34 1d 78 8a 91 05 63 3d 58 a5 0c 0a 83 4c 21 26 8c 29 f4 1c dd c2 a9 00 30 6d 48 ac 1d 0c 00 40 5f 1d 60 35 d7 07 5c 3f 38 0b c8 e5 90 cb c9 00 52 0a Data Ascii: EoY[YvslJXK^{T<;>b2_`n\-@7\[=J<&3BH@pj[gd*(}$J16%Fu`A^c!<x1#G_w$`: BY/RnRwk"1F88q24xc=XL!&)0mH@_`5\?8R
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: fe f1 a7 85 ca 33 22 68 1a 89 7f 3e 8b df 81 fe ea 57 22 29 84 87 3d ee 1a 13 3c 75 da cb ab 09 91 a8 da 3e f0 e6 92 5c 06 65 50 42 68 cb 4b 5f 80 24 90 66 03 77 8b 08 dc 34 8a 05 97 81 db 26 50 c2 b3 94 7a 00 49 d8 06 18 d5 c0 21 f4 d0 7b bf fc be c3 ee 0f fd 09 45 df d3 78 93 e6 f2 60 04 ff e6 90 a8 ed ef ff 82 64 8d c4 9d 85 e7 50 5a 6c f1 8f 6f 11 bc f9 cb 77 39 f9 8d 2c 21 82 6c 89 31 bc 9e 22 28 01 29 bd 7c 1e c2 ca 15 16 eb 84 e1 82 37 e1 42 d8 06 f0 06 7c 1b 00 eb 00 2a 62 36 a8 11 dd de a2 a7 0e 91 26 92 b9 46 3f 9c ae 7d 7e 18 fa 80 4a f8 80 2b 01 a9 80 ce 65 66 ba 6c 51 3f e1 f7 9e b9 6c ff b4 bf 9a 7a f0 63 a2 04 00 e1 11 bd 74 d1 97 63 cc 8b 50 36 29 92 20 33 97 78 4f 72 a0 96 c5 9f 7b d3 c9 e0 e0 07 79 b7 c8 08 c1 18 f0 8b d2 2d e4 f3 01 65 Data Ascii: 3"h>W")=<u>\ePBhK_$fw4&PzI!{Ex`dPZlow9,!l1"()\|7B\|*b6&F?}~J+eflQ?lzctcP6) 3xOr{y-e
2024-04-25 13:30:37 UTC	178	IN	Data Raw: cf 1b 8a 12 16 0b 5c c8 00 28 02 00 18 9a 2a 22 41 92 d6 29 ad 20 52 50 43 61 a6 a4 07 c6 ae 7e 13 73 c7 38 ae 26 e9 39 93 f6 17 8b 59 df 0f 64 11 00 8a 01 10 b8 01 00 42 18 cc b4 ca 4e 04 2b 39 4d 30 f9 d6 9b 9c 33 94 e4 5d 71 56 09 5a 98 cb 46 30 4b f0 55 e0 18 a3 1f 38 33 c3 58 08 5b 8f 0f 14 25 a4 eb aa ac 19 46 cb 26 49 09 8a 82 29 b4 4d 49 d1 44 6f 09 95 9f 44 e3 68 58 6c ae 47 00 04 11 c1 bd 0f d0 fd 11 ae 5f 26 a9 0b b4 60 d2 29 83 1d 13 12 1d 47 90 ff f6 39 34 9a 0f 6b a2 77 86 f2 16 a4 7e 3e 2c 46 50 27 c8 30 97 0c 00 Data Ascii: \(*"A) RPCa~s8&9YdBN+9M03]qVZF0KU83X[%F&I)MIDoDhXlG_&`)G94kw~>,FP'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49790	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	679	OUT	GET /static/img/product/thanks-for-choosing/special_offer_box.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 7886 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=8503 Content-Disposition: inline; filename="special_offer_box.webp" Vary: Accept etag: "2137-5e5da4a381802" last-modified: Wed, 10 Aug 2022 03:03:14 GMT CF-Cache-Status: HIT Age: 51413 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAck%2BzxTKDVHc7M79MlRJsjhdfEcx5cBeUXmXhlIk9HAx3st2JCV2ENTvNpfZd23LoUpVe5XYvUZaQiiNVW5bvAAGE2RYLtbFJy7BHu7TigCKlyA6fHJaqJEWqbSdpfToZqmanM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb04dfd0f44f6-ATL
2024-04-25 13:30:37 UTC	558	IN	Data Raw: 52 49 46 46 c6 1e 00 00 57 45 42 50 56 50 38 4c b9 1e 00 00 2f 9d 40 1b 10 f7 07 49 db 9e 06 4a 80 10 98 b1 77 5d ce e3 05 5c 7a 60 ef e1 29 74 5f b7 5d 4a 80 24 d7 80 65 db 96 21 e9 86 23 aa 6d 7d da 9a ff 18 7a 06 b6 bb 13 11 89 c0 83 5d db 76 da e8 3d b1 94 0c 33 43 21 53 c1 7c 4d 97 d3 c7 54 c1 cc 8c b2 ad 07 50 04 01 40 98 dc 0b 26 4d 9b fb da f2 d2 92 a3 7f e0 1b 64 aa fe 80 ec 0e 95 44 72 77 77 aa 05 00 18 e9 bf 81 48 02 46 fa 66 a4 37 00 78 75 0c 9f 01 b0 6d a4 77 46 9a 04 40 c8 48 83 00 d8 01 c0 a5 91 9e 38 86 87 c0 f0 5a 12 15 b4 c8 b7 cf 89 0c 60 45 a6 1e 2d 35 10 6f a9 f8 e3 66 7a a8 9c a8 3c 00 7c 6d e7 6d 40 43 ac 13 f2 96 74 40 06 a0 03 58 1e 70 25 e6 87 1a 0d e2 5f 31 ff 8d e1 89 7a 55 e3 c0 55 45 1d 7a e2 1d ce 4d cb 6c 64 c2 99 8c 44 6a Data Ascii: RIFFWEBPVP8L/@IJw]\z`)t_]J$e!#m}z]v=3C!S\|MTP@&MdDrwwHFf7xumwF@H8Z`E-5ofz<\|mm@Ct@Xp%_1zUUEzMldDj
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: ea f0 ab cc be 62 b2 47 0a 9d 1d 72 bc 61 ed d7 bc 9f bd b4 9d 1e fb 94 5e 5a 08 ce e3 20 cf 78 13 0b aa f8 73 6e 02 a5 09 3e 4e 9a 9d 22 9a 34 3b 91 e5 b4 b0 75 47 ed 07 19 9f 1d 75 e7 9e 99 b3 7b 7e 55 be be bd 54 4f 3e b7 57 ad eb d1 38 4e 16 4f 7f a7 a6 c6 fe 2a 64 f5 97 2f fa 71 ab 76 ed 7f ef 7b 58 b4 2c 43 cd 20 61 83 9e 21 e2 47 e0 b1 b9 2f 16 12 27 7b 7e f4 e0 88 dd 5d ed d9 e9 63 f7 72 4e 7d 3c f8 b9 59 1d 4d ff 2d ac 8f e4 23 42 da 23 1d 24 93 24 13 00 60 65 2d 5d 37 7c 7f e8 29 1e 51 0e 81 a4 2d f4 5f 44 04 db f0 53 4d e5 f1 da ff d7 69 9c 6d 9b 2d a5 57 65 09 1b 81 a4 e5 05 ee 3d bd 27 08 a6 20 23 4d aa 85 80 38 40 06 89 ab b9 c0 54 49 90 66 71 49 b0 30 58 f4 e9 bd f7 99 f4 3e 95 0e e2 aa 22 3d 18 73 f5 ee 0b 90 b8 aa 7f fb b7 7f 7b cb f9 07 Data Ascii: bGra^Z xsn>N"4;uGu{~UTO>W8NO*d/qv{X,C a!G/'{~]crN}<YM-#B#$$`e-]7\|)Q-_DSMim-We=' #M8@TIfqI0X>"=s{
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 66 e6 e9 74 cf f1 79 d5 90 00 83 bd 9d 97 ba 48 2e 19 6f 68 69 d6 f7 d0 64 b0 af a2 3b 59 da de 83 c9 4a aa 4d b9 68 f5 62 b6 3c 69 d7 ca 93 ea 67 01 b8 6f e2 6f f9 9e 3b 32 79 9e 96 b8 5d d2 7f fb 31 53 ef 43 8c 34 ac c1 90 8f 59 30 e3 a1 ee a6 05 b6 1a b8 74 b3 80 24 8d c2 79 08 57 95 2c ab b5 3c 04 00 db 2f 3f d1 2e 23 b0 96 d4 7c 29 6d ad ef ab 4b dd 5d 71 17 95 cc 5e cc 95 25 4b ec ac 79 dd ca 67 81 bb fe 65 94 ee 1f bc 67 9c 27 3d 3c cc 3b 2a 4d ac 82 c8 77 6a 4b fd 70 16 cd 70 ce ce 79 5f 17 c7 87 9d 99 a9 5c 1d 3b c6 ba d7 f9 5c a9 73 23 0d 25 6d 69 87 9a c5 7e 6c 0d b0 af 82 da 8c ee e5 58 34 4b b9 86 16 90 08 61 ef 5a b2 0c b9 2b d1 ed 82 72 48 45 2e e4 5c 49 87 cd e9 1e cb 3b 58 c1 ed 7f 6b bb ef 5f f0 de e1 b1 be 7e a8 66 10 d5 4b 9c a9 a6 94 Data Ascii: ftyH.ohid;YJMhb<igoo;2y]1SC4Y0t$yW,</?.#\|)mK]q^%Kygeg'=<;*MwjKppy_\;\s#%mi~lX4KaZ+rHE.\I;Xk_~fK
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: da 1a 97 54 99 d8 2e 6d ab a4 de ba ec cb 61 01 6d 2a c4 e7 a9 f6 45 8c 29 8a 30 22 c9 52 53 c8 6c 82 c3 5d 2c 85 61 03 36 53 b6 9b 2d 11 99 6a 59 bb 23 18 5b d2 29 26 08 40 c6 cd 4f 64 6c ed 4e cb c3 99 57 d0 6f 45 17 13 59 83 2d 1f 48 6c 4a de 7d 1e d0 12 7b f7 f3 3e 22 42 d4 df f2 6c 59 1d 76 60 e8 f8 48 c9 34 59 13 02 80 a6 0a 54 4e ba 39 6a 97 d5 b0 9c 94 e6 aa d9 1c 2e 9a d0 40 68 82 1d 37 ce e7 0b 96 ec bd 47 0e 19 54 aa 0d 0c a1 d7 63 35 98 c9 99 40 10 00 00 35 d6 9b ca c0 2a 7f 63 6f c9 e3 a2 dd a4 b9 d5 fc 91 58 54 19 a4 83 d0 24 78 0a 83 6e 2b 54 1c c4 03 06 95 6a 9b e2 6a b0 18 b4 11 3c d1 64 e7 95 6d a5 91 c8 54 84 f8 bc c7 60 9a 95 cf 56 35 fe 85 2e 55 11 36 40 84 2a 1c e8 1c f6 98 60 67 ae c0 4a 25 c2 76 7a ac 06 13 01 e5 1a d7 3e db 4a c7 Data Ascii: T.mamE)0"RSl],a6S-jY#[)&@OdlNWoEY-HlJ}{>"BlYv`H4YTN9j.@h7GTc5@5coXT$xn+Tjj<dmT`V5.U6@*`gJ%vz>J
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: b3 5b 86 3b 3b 8c d8 7a 44 fb 74 75 40 87 01 f8 4f 3e a2 e0 ec e7 f0 9a 4b 6e 1f 63 08 16 4f 43 30 9e 1f de 2d 56 48 92 de dd 76 34 38 f7 5e 2f 62 1a ac 5b 8a 69 07 a0 7c f5 41 44 f2 87 5e 75 12 f9 f3 03 83 e9 52 41 2f a7 53 a4 72 24 76 72 e7 19 16 06 31 97 b9 3e f1 c5 93 9f ac 0a c8 48 fa 93 3f fe b0 0e 45 ce 6f 5c 86 cd e2 e6 1a 6f 6f f6 64 9e 7d 5a bc 5b bc 20 89 df 16 d7 88 0f 96 0b 77 73 f6 f3 e4 1f 6f e8 2e a5 fb 8f 6f b0 e2 af d7 09 06 18 74 b1 f4 89 ba cc c8 ed fa 44 50 06 60 5e ec 06 60 c1 0d 2c cc cc 85 a8 33 f0 82 8a 58 60 66 ee af 2c ef dc a1 f9 64 49 df a1 51 6b 57 51 da 6b 13 53 05 51 1d 67 9d 26 e3 f6 ae a2 b4 36 72 13 5f 2f 7d ca d2 d7 f4 d1 c2 0a 2c ea ef 18 64 07 a4 2b f4 a0 2e b8 b4 d7 65 52 18 74 e3 75 37 40 25 1d 8f 83 aa 15 51 85 57 Data Ascii: [;;zDtu@O>KncOC0-VHv48^/b[i\|AD^uRA/Sr$vr1>H?Eo\ood}Z[ wso.otDP`^`,3X`f,dIQkWQkSQg&6r_/},d+.eRtu7@%QW
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 25 58 a7 73 a9 f2 ed 76 0d 71 ff 91 a3 3a 67 3a 3e a0 67 96 1c 22 f2 eb dd 25 55 05 96 fd dd 65 4b 63 35 d4 a6 82 bd 03 c2 c5 ed 59 25 a3 b5 e0 a0 fc 18 68 f6 c2 b9 14 a6 a9 dc b5 dd f4 23 53 1b 1f 7c df 0f df 7b f8 6c e7 4b 44 60 e8 33 71 00 e5 7a 77 b8 b5 59 d7 58 e4 32 18 32 cd 16 94 a8 d9 11 9c b7 7a 96 49 e3 e0 f4 8c 6c 90 c7 c2 c7 e0 36 c3 1b 5a 3a 74 19 a0 fe 8e ef be 44 e2 5a e3 bc 6a e7 41 c4 72 40 4b ab c3 ba d1 b1 0e 11 33 0f b4 81 20 9c 20 82 d1 0e b1 78 c4 3c 10 5f 8c bd 93 0d 59 c8 0f 0b b6 cc 0e 1b 19 32 80 c3 3f fc 3e 9f a5 97 5e a6 cb a8 fa c8 70 ad a1 80 c2 cd 7d 3d 5d 95 32 40 14 41 ec 1b 06 26 c0 a9 48 a4 3d c3 67 76 89 c8 21 42 32 5e b4 56 46 07 cd be d1 b5 a1 5d d1 04 3f f8 de f7 3b 74 c8 b2 f3 80 48 10 76 87 fb 96 14 81 9b 49 1f c1 Data Ascii: %Xsvq:g:>g"%UeKc5Y%h#S\|{lKD`3qzwYX22zIl6Z:tDZjAr@K3 x<_Y2?>^p}=]2@A&H=gv!B2^VF]?;tHvI
2024-04-25 13:30:37 UTC	483	IN	Data Raw: ff ad 2a 8a 97 8f fd b8 83 b1 7b ec 0c 70 0c 81 9c 60 9d d8 f4 73 cf 90 11 5a 9e 9f 9a 93 1e 1e 98 a7 88 75 c4 20 00 a0 aa 92 38 4a 51 cd 19 45 44 98 44 a2 af 47 19 2b 17 4c 4e 49 ad f7 24 33 95 bc ae 4a c6 8f 7f 44 af f3 df ff f6 0f 7a 8d 89 f8 5a 81 fe 38 db 10 5d d8 85 05 46 c3 5e 82 58 80 ec 4c 44 ae 75 39 7b 9a f4 a9 e7 e6 61 6a 39 be 4c 71 71 9e 16 0b 4f 06 80 0a f9 d2 2c 8e 22 54 13 31 d6 23 fb d0 b8 d6 23 22 5b 2e e8 09 66 5b 32 f8 47 6f 88 5a 0f ff 26 ff 30 f5 1a f3 37 57 7b fd bd a7 96 3a 04 8e 7c 37 34 f1 d6 d2 d3 22 43 44 7d ea 79 98 9e 62 79 1f 19 7d 39 72 f2 88 ff a4 1b 52 50 f9 52 58 0e ea c3 7d b1 8a a4 09 78 1f 34 05 e6 82 c8 81 37 48 44 b8 e4 5f 0d ee 10 4c 86 45 7f d3 32 3c 13 bc 7b b9 ad 43 8f 04 73 4c b7 aa cf a5 5f a7 ff dd 53 3a d2 Data Ascii: *{p`sZu 8JQEDDG+LNI$3JDzZ8]F^XLDu9{aj9LqqO,"T1##"[.f[2GoZ&07W{:\|74"CD}yby}9rRPRX}x47HD_LE2<{CsL_S:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49792	31.13.88.13	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	375	OUT	GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	1608	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: OIlAxCmR79nrM/Ez4ygGlg== Expires: Mon, 14 Apr 2025 06:22:11 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: 2xR30nnS5hIxWPnfuaoDdcll+Wnx+yVWdX/f5ZTm6rd83Oqz3qbdN8OAazbEVIWmSv4QkOoughvh1wudgIvYhQ== Date: Thu, 25 Apr 2024 13:30:37 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=14, mss=1277, tbw=3410, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 299
2024-04-25 13:30:37 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-25 13:30:37 UTC	298	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 03 00 00 00 28 2d 0f 53 00 00 00 60 50 4c 54 45 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 7c 25 1c ba 00 00 00 1f 74 52 4e 53 00 f0 fc 01 fe 21 c5 5c 34 f5 e1 fa e6 76 ab 1b 32 a8 f8 e8 29 14 d9 ee a0 fb 7e de fd eb 1e 43 49 7d 1d 00 00 00 5b 49 44 41 54 78 da 95 cd 47 0a c0 30 0c 44 51 b9 a5 f7 de e7 fe b7 0c 8e b1 b1 03 59 64 76 ff 21 10 7d 2f 6a c3 16 39 c6 00 62 40 f9 9d a4 c8 84 d7 75 01 94 e4 ad c2 b3 b9 d1 c1 c0 a8 33 d0 0f 1a 00 90 34 Data Ascii: PNGIHDR(-S`PLTE\|%tRNS!\4v2)~CI}[IDATxG0DQYdv!}/j9b@u34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49793	31.13.88.13	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:36 UTC	403	OUT	GET /rsrc.php/v3iEpO4/yv/l/en_US/tQNtwFBP_EQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	1759	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8RPG/6T7SCT74bqaH/rDJA== Expires: Thu, 24 Apr 2025 20:47:12 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: WychVhhAVGY8GkT8mFoTt9ujomiQJ+cag6I2YkkAhQcPUwrZ3Bdib8GU4rHVTS3uJIRMCgHAAJpLXULJ86+A1w== Date: Thu, 25 Apr 2024 13:30:37 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=14, mss=1277, tbw=3411, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 547271
2024-04-25 13:30:37 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-25 13:30:37 UTC	16035	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 54 68 69 73 7c 7c 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 73 65 6c 66 7c 7c 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 5f 5f 6c 69 73 74 65 6e Data Ascii: /FB_PKG_DELIM/"use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listen
2024-04-25 13:30:37 UTC	16384	IN	Data Raw: 6e 75 6d 65 72 61 62 6c 65 3d 64 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 3b 64 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 3b 22 76 61 6c 75 65 22 69 6e 20 64 26 26 28 64 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 64 2e 6b 65 79 2c 64 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 63 26 26 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 2c 63 29 3b 64 26 26 61 28 62 2c 64 29 3b 72 65 74 75 72 6e 20 62 7d 7d 28 29 3b 62 2e 69 6e 68 65 72 69 74 73 4c 6f 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 61 2c 62 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 62 26 26 62 2e 70 Data Ascii: numerable=d.enumerable\|\|!1;d.configurable=!0;"value"in d&&(d.writable=!0);Object.defineProperty(a,d.key,d)}}return function(b,c,d){c&&a(b.prototype,c);d&&a(b,d);return b}}();b.inheritsLoose=function(a,b){Object.assign(a,b);a.prototype=Object.create(b&&b.p
2024-04-25 13:30:37 UTC	16384	IN	Data Raw: 69 63 74 22 3b 76 61 72 20 67 3d 7b 50 52 45 56 49 4f 55 53 5f 46 49 4c 45 3a 31 2c 50 52 45 56 49 4f 55 53 5f 46 52 41 4d 45 3a 32 2c 50 52 45 56 49 4f 55 53 5f 44 49 52 3a 33 2c 46 4f 52 43 45 44 5f 4b 45 59 3a 34 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 6e 65 77 20 45 72 72 6f 72 28 61 29 3b 69 66 28 62 2e 73 74 61 63 6b 3d 3d 3d 76 6f 69 64 20 30 29 74 72 79 7b 74 68 72 6f 77 20 62 7d 63 61 74 63 68 28 61 29 7b 7d 62 2e 6d 65 73 73 61 67 65 46 6f 72 6d 61 74 3d 61 3b 66 6f 72 28 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 64 3d 6e 65 77 20 41 72 72 61 79 28 63 3e 31 3f 63 2d 31 3a 30 29 2c 65 3d 31 3b 65 3c 63 3b 65 2b 2b 29 64 5b 65 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 62 2e 6d 65 73 73 Data Ascii: ict";var g={PREVIOUS_FILE:1,PREVIOUS_FRAME:2,PREVIOUS_DIR:3,FORCED_KEY:4};function a(a){var b=new Error(a);if(b.stack===void 0)try{throw b}catch(a){}b.messageFormat=a;for(var c=arguments.length,d=new Array(c>1?c-1:0),e=1;e<c;e++)d[e-1]=arguments[e];b.mess
2024-04-25 13:30:37 UTC	16384	IN	Data Raw: 59 28 62 2e 73 61 6d 70 6c 65 5f 77 65 69 67 68 74 29 2c 73 63 72 69 70 74 3a 61 2e 73 63 72 69 70 74 2c 73 69 74 65 5f 63 61 74 65 67 6f 72 79 3a 62 2e 73 69 74 65 5f 63 61 74 65 67 6f 72 79 2c 73 74 61 63 6b 46 72 61 6d 65 73 3a 5a 28 61 2e 73 74 61 63 6b 46 72 61 6d 65 73 29 2c 74 79 70 65 3a 61 2e 74 79 70 65 2c 70 61 67 65 5f 74 69 6d 65 3a 59 28 61 2e 70 61 67 65 5f 74 69 6d 65 29 2c 70 72 6f 6a 65 63 74 3a 61 2e 70 72 6f 6a 65 63 74 2c 70 75 73 68 5f 70 68 61 73 65 3a 62 2e 70 75 73 68 5f 70 68 61 73 65 2c 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 3a 62 2e 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 2c 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 5f 72 65 66 3a 62 2e 72 65 70 6f 72 74 5f 73 6f 75 72 63 65 5f 72 65 66 2c 72 6f 6c 6c 6f 75 74 5f 68 61 73 68 3a 28 Data Ascii: Y(b.sample_weight),script:a.script,site_category:b.site_category,stackFrames:Z(a.stackFrames),type:a.type,page_time:Y(a.page_time),project:a.project,push_phase:b.push_phase,report_source:b.report_source,report_source_ref:b.report_source_ref,rollout_hash:(
2024-04-25 13:30:37 UTC	1500	IN	Data Raw: 61 73 65 45 76 65 6e 74 45 6d 69 74 74 65 72 22 2c 5b 22 45 6d 69 74 74 65 72 53 75 62 73 63 72 69 70 74 69 6f 6e 22 2c 22 45 72 72 6f 72 47 75 61 72 64 22 2c 22 45 76 65 6e 74 53 75 62 73 63 72 69 70 74 69 6f 6e 56 65 6e 64 6f 72 22 2c 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 2c 22 75 6e 72 65 63 6f 76 65 72 61 62 6c 65 56 69 6f 6c 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 24 32 3d 6e 65 77 28 62 28 22 45 76 65 6e 74 53 75 62 73 63 72 69 70 74 69 6f 6e 56 65 6e 64 6f 72 22 29 29 28 29 2c 74 68 69 73 2e 24 31 3d 6e 75 6c 6c 7d 76 61 72 20 63 3d 61 2e 70 Data Ascii: aseEventEmitter",["EmitterSubscription","ErrorGuard","EventSubscriptionVendor","emptyFunction","unrecoverableViolation"],(function(a,b,c,d,e,f){var g;a=function(){"use strict";function a(){this.$2=new(b("EventSubscriptionVendor"))(),this.$1=null}var c=a.p
2024-04-25 13:30:37 UTC	14884	IN	Data Raw: 6e 74 65 78 74 2c 65 2c 7b 6e 61 6d 65 3a 22 45 76 65 6e 74 45 6d 69 74 74 65 72 20 22 2b 63 2b 22 20 65 76 65 6e 74 22 7d 29 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 65 2e 65 78 70 6f 72 74 73 3d 61 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 46 61 6c 63 6f 43 6f 6e 73 65 6e 74 43 68 65 63 6b 65 72 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 64 29 7b 63 61 73 65 22 73 74 72 69 6e 67 22 3a 65 3d 61 5b 53 74 72 69 6e 67 28 64 29 5d 3b 72 65 74 75 72 6e 21 65 3f 21 31 3a 65 3c 3d 62 3b 63 61 73 65 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 67 28 61 2c 62 Data Ascii: ntext,e,{name:"EventEmitter "+c+" event"})};return a}();e.exports=a}),null);__d("FalcoConsentChecker",[],(function(a,b,c,d,e,f){"use strict";function g(a,b,c,d){var e;switch(typeof d){case"string":e=a[String(d)];return!e?!1:e<=b;case"number":return g(a,b
2024-04-25 13:30:37 UTC	16384	IN	Data Raw: 29 7b 76 61 72 20 63 3d 62 2e 70 72 65 76 3b 63 26 26 28 63 2e 6e 65 78 74 3d 61 2c 61 2e 70 72 65 76 3d 63 29 3b 61 2e 6e 65 78 74 3d 62 3b 62 2e 70 72 65 76 3d 61 7d 74 68 69 73 2e 24 32 3d 61 3b 74 68 69 73 2e 69 73 41 63 74 69 76 65 28 29 26 26 74 68 69 73 2e 24 31 39 28 29 7d 3b 64 2e 6d 61 72 6b 49 74 65 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3f 74 68 69 73 2e 6d 61 72 6b 49 74 65 6d 41 73 43 6f 6d 70 6c 65 74 65 64 28 61 29 3a 74 68 69 73 2e 6d 61 72 6b 49 74 65 6d 41 73 46 61 69 6c 65 64 28 61 29 7d 3b 64 2e 24 32 32 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 72 28 61 29 3b 76 61 72 20 62 3d 74 68 69 73 2e 24 31 3b 62 26 26 28 62 2e 6e 65 78 74 3d 61 2c 61 2e 70 72 65 76 3d 62 29 3b 74 68 69 73 2e 24 31 3d 61 3b 74 68 69 73 2e 24 32 Data Ascii: ){var c=b.prev;c&&(c.next=a,a.prev=c);a.next=b;b.prev=a}this.$2=a;this.isActive()&&this.$19()};d.markItem=function(a,b){b?this.markItemAsCompleted(a):this.markItemAsFailed(a)};d.$22=function(a){a=r(a);var b=this.$1;b&&(b.next=a,a.prev=b);this.$1=a;this.$2
2024-04-25 13:30:37 UTC	16384	IN	Data Raw: 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 71 75 65 72 79 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 71 75 65 72 79 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 2e 24 36 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 24 36 2e 61 70 70 6c 79 28 6b 28 74 68 69 73 29 2c 61 72 67 75 6d Data Ascii: .apply(k(this),arguments)};a.query=function(b){return a.prototype.query.apply(k(this),arguments)};a.registerCallback=function(b,c){return a.prototype.registerCallback.apply(k(this),arguments)};a.$6=function(b,c,d){return a.prototype.$6.apply(k(this),argum
2024-04-25 13:30:37 UTC	14884	IN	Data Raw: 20 62 7c 7c 68 28 30 2c 31 31 38 30 32 29 3b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 73 74 72 69 6e 67 22 29 69 66 28 61 3e 62 29 72 65 74 75 72 6e 20 31 3b 65 6c 73 65 20 69 66 28 61 3c 62 29 72 65 74 75 72 6e 2d 31 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 30 3b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 29 69 66 28 61 3e 62 29 72 65 74 75 72 6e 20 31 3b 65 6c 73 65 20 69 66 28 61 3c 62 29 72 65 74 75 72 6e 2d 31 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 30 3b 74 79 70 65 6f 66 20 61 3d 3d 3d 74 79 70 65 6f 66 20 62 7c 7c 68 28 30 2c 31 31 38 30 32 29 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: b\|\|h(0,11802);if(typeof a==="string"&&typeof b==="string")if(a>b)return 1;else if(a<b)return-1;else return 0;if(typeof a==="number"&&typeof b==="number")if(a>b)return 1;else if(a<b)return-1;else return 0;typeof a===typeof b\|\|h(0,11802);return 0}function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49795	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	391	OUT	GET /static/img/product/thanks-for-choosing/clean.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/png Content-Length: 3073 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=3238 Vary: Accept etag: "ca6-5e5da49c030b2" last-modified: Wed, 10 Aug 2022 03:03:06 GMT CF-Cache-Status: HIT Age: 56771 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XPriujmfgZYGXYil5bWJNL5%2Bsm9gJAMOsnLbRz8Z6zz%2BmRr91tIlxZfQX0eefcz6jRugAnTj9ZBZOH%2BF%2BurVjOsWsMLVbV3he4SOond9xtys4ewCrsFx2bZ0BF92GMmcP%2FJ0%2B8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb050389617f7-ATL
2024-04-25 13:30:37 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 64 08 03 00 00 00 63 09 28 e3 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 00 50 4c 54 45 00 00 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 1d 8a 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 1d 8a 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a Data Ascii: PNGIHDRdc(gAMAaPLTE
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 9a 9a 9a 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 1d 8a 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 49 3b ce bc 00 00 01 00 74 52 4e 53 00 88 ff cc ee dd 99 aa 55 22 66 bb 44 01 01 0c 6c 07 bf 4f eb 25 f8 7c 92 f4 a5 09 f0 29 dc f5 c4 63 84 af 43 fa ea 48 fe c5 23 e4 6d 5b 0f Data Ascii: I;tRNSU"fDlO%\|)cCH#m[
2024-04-25 13:30:37 UTC	1075	IN	Data Raw: 9b 10 ac 01 df 22 cf 94 cb ee 26 9f 91 c3 10 b4 6f 0f a4 92 93 11 f2 6b ee 81 a0 4d eb 43 d5 f5 bb 10 c1 fb e4 05 54 d5 7b 51 0f 33 3e 4c 55 34 0c 40 5d f4 bc 8b 2a dc 33 19 40 37 d4 c1 db 5a 48 f1 34 df 89 ba 19 3d 98 ce 31 fc 53 a8 a3 6b 86 53 59 cb 79 97 a1 ae 06 7c e7 bb a4 8c b9 ee 46 d4 dd ec 2b 86 12 51 bf fe a3 9b d0 11 14 47 dc f2 ee 41 03 3a ff 0d ef d4 a9 53 a7 7a 58 f1 24 3a 8a dc d5 f7 2e 78 08 1d c3 1f 13 cc 7c 60 ef 7e d4 47 57 94 bd bc cd 60 e9 89 b5 eb 50 4f 4b 93 cf bf b0 83 3d 8b 7f f3 d0 b3 5d 11 b4 f5 1b 36 6e dc 7f f0 31 ab 75 c7 56 3e c7 a9 7d db fe b1 fb be 75 eb 37 ae 5c 83 a0 6c 5b be 69 d7 21 ae 65 fe 73 9b 37 ad 5a 8d a0 bc c0 af eb 08 82 f2 0a d7 96 79 95 1d d7 23 28 87 b9 a6 f4 86 bd ec b8 ba fe 31 07 8e 1e c3 89 80 63 fe c9 Data Ascii: "&okMCT{Q3>LU4@]*3@7ZH4=1SkSYy\|F+QGA:SzX$:.x\|`~GW`POK=]6n1uV>}u7\l[i!es7Zy#(1c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49796	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	367	OUT	GET /static/img/logo/logo.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	693	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Tue, 02 Aug 2022 22:43:42 GMT etag: W/"1a57-5e549d924e380-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 40645 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ngMzp%2Fj5zimxslMxODZOtXEDEpKQ2NY%2BKJaPe57CGofHafOEofTdKvCf4IX%2FAcJR4al7rG8TKAevXN22y3IzwR%2BHgSnIEJO%2B%2B1ZFMSGAlvvCZJpIeXlA08BT8kYLUOShS6I7wA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0504cf5453d-ATL
2024-04-25 13:30:37 UTC	676	IN	Data Raw: 31 61 35 37 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 32 34 20 32 30 30 2e 30 31 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 33 64 36 32 62 62 3b 7d 2e 62 2c 2e 65 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 62 7b 66 69 6c 6c 3a 75 72 6c 28 23 61 29 3b 7d 2e 63 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 31 34 34 61 62 33 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 33 70 78 3b 7d 2e 64 7b 66 69 6c 6c 3a 23 66 61 66 61 66 61 3b 7d 2e 65 7b 66 69 Data Ascii: 1a57<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1024 200.01"><defs><style>.a{fill:#3d62bb;}.b,.e{fill-rule:evenodd;}.b{fill:url(#a);}.c{fill:none;stroke:#144ab3;stroke-width:3px;}.d{fill:#fafafa;}.e{fi
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 2d 32 34 33 35 2e 36 38 22 20 67 72 61 64 69 65 6e 74 54 72 61 6e 73 66 6f 72 6d 3d 22 6d 61 74 72 69 78 28 31 2c 20 30 2c 20 30 2c 20 2d 31 2c 20 2d 34 2c 20 2d 32 32 32 33 2e 36 29 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 37 37 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 30 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 38 35 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 30 2e 30 31 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 38 37 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 20 73 74 6f 70 2d 6f 70 61 Data Ascii: -2435.68" gradientTransform="matrix(1, 0, 0, -1, -4, -2223.6)" gradientUnits="userSpaceOnUse"><stop offset="0.77" stop-color="#fff" stop-opacity="0"/><stop offset="0.85" stop-color="#fff" stop-opacity="0.01"/><stop offset="0.87" stop-color="#fff" stop-opa
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 35 2c 32 30 2e 38 35 2c 30 2c 30 2c 31 2c 34 38 30 2c 31 31 39 2e 38 61 31 37 2c 31 37 2c 30 2c 30 2c 31 2c 32 2e 36 32 2c 39 2e 35 32 2c 31 38 2e 33 38 2c 31 38 2e 33 38 2c 30 2c 30 2c 31 2d 38 2c 31 35 2e 33 38 2c 33 34 2e 37 39 2c 33 34 2e 37 39 2c 30 2c 30 2c 31 2d 32 30 2e 39 35 2c 35 2e 39 31 41 33 37 2e 35 31 2c 33 37 2e 35 31 2c 30 2c 30 2c 31 2c 34 33 38 2c 31 34 37 2e 35 61 32 35 2e 37 35 2c 32 35 2e 37 35 2c 30 2c 30 2c 31 2d 31 30 2e 37 2d 38 2e 36 32 2c 32 30 2e 33 31 2c 32 30 2e 33 31 2c 30 2c 30 2c 31 2d 33 2e 38 31 2d 31 31 2e 37 35 68 31 35 2e 36 33 61 31 31 2e 32 2c 31 31 2e 32 2c 30 2c 30 2c 30 2c 34 2e 33 31 2c 38 2e 36 32 2c 31 37 2e 32 33 2c 31 37 2e 32 33 2c 30 2c 30 2c 30 2c 31 30 2e 35 2c 33 2e 30 35 2c 31 36 2e 38 37 2c 31 36 2e Data Ascii: 5,20.85,0,0,1,480,119.8a17,17,0,0,1,2.62,9.52,18.38,18.38,0,0,1-8,15.38,34.79,34.79,0,0,1-20.95,5.91A37.51,37.51,0,0,1,438,147.5a25.75,25.75,0,0,1-10.7-8.62,20.31,20.31,0,0,1-3.81-11.75h15.63a11.2,11.2,0,0,0,4.31,8.62,17.23,17.23,0,0,0,10.5,3.05,16.87,16.
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 33 32 2c 31 33 33 61 32 32 2e 37 34 2c 32 32 2e 37 34 2c 30 2c 30 2c 30 2c 36 2e 32 39 2d 31 34 2e 35 33 68 31 36 2e 38 34 76 2d 2e 30 39 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 36 37 34 2e 39 34 2c 31 34 39 2e 32 36 48 36 35 38 2e 38 38 76 2d 31 30 30 68 31 36 2e 30 36 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 37 32 33 2e 38 37 2c 31 35 30 2e 35 35 41 33 33 2e 34 35 2c 33 33 2e 34 35 2c 30 2c 30 2c 31 2c 36 39 39 2e 30 39 2c 31 34 31 61 33 34 2e 30 37 2c 33 34 2e 30 37 2c 30 2c 30 2c 31 2d 39 2e 36 38 2d 32 35 2e 32 Data Ascii: 32,133a22.74,22.74,0,0,0,6.29-14.53h16.84v-.09Z" transform="translate(0 0.01)"/><path class="a" d="M674.94,149.26H658.88v-100h16.06Z" transform="translate(0 0.01)"/><path class="a" d="M723.87,150.55A33.45,33.45,0,0,1,699.09,141a34.07,34.07,0,0,1-9.68-25.2
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 38 35 33 2e 33 37 2c 37 38 2e 38 34 6c 2e 34 38 2c 38 2e 31 34 61 32 35 2e 37 39 2c 32 35 2e 37 39 2c 30 2c 30 2c 31 2c 32 30 2e 38 36 2d 39 2e 35 32 71 32 32 2e 33 35 2c 30 2c 32 32 2e 37 34 2c 32 35 2e 31 39 76 34 36 2e 35 37 48 38 38 31 2e 33 39 56 31 30 33 2e 37 61 31 34 2c 31 34 2c 30 2c 30 2c 30 2d 33 2d 39 2e 39 31 2c 31 32 2e 36 31 2c 31 32 2e 36 31 2c 30 2c 30 2c 30 2d 39 2e 36 37 2d 33 2e 32 34 2c 31 35 2e 34 39 2c 31 35 2e 34 39 2c 30 2c 30 2c 30 2d 31 34 2e 35 32 2c 38 2e 36 37 76 35 30 2e 31 34 68 2d 31 36 56 37 38 2e 38 34 5a 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 20 30 2e 30 31 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 61 22 20 64 3d 22 4d 39 34 35 2e 33 36 Data Ascii: class="a" d="M853.37,78.84l.48,8.14a25.79,25.79,0,0,1,20.86-9.52q22.35,0,22.74,25.19v46.57H881.39V103.7a14,14,0,0,0-3-9.91,12.61,12.61,0,0,0-9.67-3.24,15.49,15.49,0,0,0-14.52,8.67v50.14h-16V78.84Z" transform="translate(0 0.01)"/><path class="a" d="M945.36
2024-04-25 13:30:37 UTC	599	IN	Data Raw: 31 35 31 2e 38 31 20 38 31 2e 32 38 20 31 35 31 2e 38 31 20 39 39 2e 39 38 20 38 32 2e 35 38 20 31 31 38 2e 33 33 20 31 35 31 2e 38 31 20 31 33 34 2e 33 34 20 31 35 31 2e 38 31 20 31 35 36 2e 35 36 20 35 37 2e 30 31 20 31 33 39 2e 39 37 20 35 37 2e 30 31 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 64 22 20 70 6f 69 6e 74 73 3d 22 31 33 39 2e 39 37 20 35 37 2e 30 31 20 31 32 35 2e 31 37 20 31 32 38 2e 33 39 20 31 30 36 2e 39 35 20 35 37 2e 30 31 20 39 32 2e 39 32 20 35 37 2e 30 31 20 37 34 2e 35 33 20 31 32 38 2e 32 35 20 35 39 2e 35 39 20 35 37 2e 30 31 20 34 32 2e 39 38 20 35 37 2e 30 31 20 36 35 2e 31 39 20 31 35 31 2e 38 31 20 38 31 2e 32 38 20 31 35 31 2e 38 31 20 39 39 2e 39 38 20 38 32 2e 35 38 20 31 31 38 2e 33 33 20 31 35 31 2e 38 31 Data Ascii: 151.81 81.28 151.81 99.98 82.58 118.33 151.81 134.34 151.81 156.56 57.01 139.97 57.01"/><polygon class="d" points="139.97 57.01 125.17 128.39 106.95 57.01 92.92 57.01 74.53 128.25 59.59 57.01 42.98 57.01 65.19 151.81 81.28 151.81 99.98 82.58 118.33 151.81
2024-04-25 13:30:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49794	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	377	OUT	GET /static/img/product/update/icon.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	731	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/png Content-Length: 4641 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=7401 Vary: Accept etag: "1ce9-5e5da4743cab8" last-modified: Wed, 10 Aug 2022 03:02:24 GMT CF-Cache-Status: HIT Age: 60503 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mmnKtx%2Fm3mvihU7iHglPAXB0LPJNjd8ul43gexdNHV3UfGgrcuzTr08GZ2AKZAM32WUerDI01ojq6T2PSuHpdiqdJk5oX6vHMTQIXR36tjzxRsaxgP3xBjlrvcvjM0DC3ohLyio%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0504c3a1d78-ATL
2024-04-25 13:30:37 UTC	638	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 01 68 08 03 00 00 00 22 83 58 a6 00 00 03 00 50 4c 54 45 ff ff ff 08 8d e1 fd fe fe 09 8d e1 f2 f9 fd f9 fc fe f0 f8 fd fe fc fc ff ff ff e9 f6 fd 19 95 e3 22 99 e4 43 a8 e8 ee f7 fd d5 ec fa 15 92 e3 3b 59 98 3c 5a 98 3a 58 98 3b 58 98 79 8e b9 3a 59 98 5b b4 eb e4 f2 fc 9c d1 f3 f8 fb fd 0c 8f e1 a3 b1 ce 46 63 9e 3f 5c 9a 8d 9e c3 0e 90 e2 f5 fc ff e9 ec f3 fa ea e8 bd c7 dd 5b 74 a9 fe f8 f9 f1 f3 f8 9a aa ca 3c 59 98 d2 d9 e8 e0 78 6b d2 3e 2b d2 3f 2b d2 3d 2b d1 3e 2b d3 3e 2c d1 3d 2b d3 3f 2b d2 3e 2a d2 3e 2c e6 91 86 d3 44 31 d9 5d 4c d5 4d 3b f0 bd b8 e8 9a 90 eb a2 9a db 62 53 d5 47 35 e2 7e 72 fd f6 f5 fb ee ec e4 8c 81 e3 85 79 ed b3 ac eb a9 a3 f4 d2 ce f3 cc c6 df 74 68 fc Data Ascii: PNGIHDR2h"XPLTE"C;Y<Z:X;Xy:Y[Fc?\[t<Yxk>+?+=+>+>,=+?+>*>,D1]LM;bSG5~ryth
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: d7 55 43 da e0 ec fc e8 e7 f0 fa ff 70 ce ff 94 ce f2 4c c1 ff 4d 68 a2 f6 f7 f9 5d c8 ff 76 d1 ff 90 a1 c5 54 c6 ff a2 df ff a9 d7 f5 b9 df f7 4d ad e9 3e a6 e7 b0 e4 ff d4 f0 ff 53 b0 ea 91 da ff a3 d5 f4 dd f3 ff eb f8 ff 64 ca ff 0a 8d e1 50 c3 ff 6a cd ff c1 e2 f7 cc e7 f9 7e c4 ef ad d9 f5 38 a3 e7 f2 fb ff 30 9f e6 c5 e4 f8 c4 eb ff bd e1 f7 bc e9 ff de ef fb 86 c7 f0 2b 9d e5 68 b9 ed b4 dc f6 74 bf ee f5 fb fe 34 a1 e6 99 dd ff 58 c6 ff 4b c1 ff 4c c3 ff 4d c2 ff 4c c2 ff 4d c3 ff 85 d5 ff a8 e1 ff c8 a3 3e d2 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 0e cf 49 44 41 54 78 da ec d5 cd 6e b2 40 18 05 e0 73 1c 31 61 66 80 1d 52 36 de ff bd 74 5b 35 69 5c 34 11 25 9a 86 7f d6 5f ac 50 6b cb 80 26 36 5f 9a f0 ec c6 78 78 7f 32 01 8c 46 0f 61 59 b8 Data Ascii: UCpLMh]vTM>SdPj~80+ht4XKLMLM>tRNS@fIDATxn@s1afR6t[5i\4%_Pk&6_xx2FaY
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 19 01 9b 72 0a 82 2d 8d 80 9f 91 c4 44 1a 0b 24 08 a7 a2 27 0c dc 75 b6 0f 9a e5 85 67 1a 31 91 c2 d3 90 03 78 5e 1e 60 b4 15 00 2f 98 36 c4 c4 70 0c 22 3a 8d 76 a1 0a 0b d2 31 30 4c 79 f2 70 62 22 1d 62 a5 bb ce 92 d2 46 d1 c3 c5 62 99 4e 4c 64 80 25 3c 9a dc 11 13 1e 16 2d 76 08 19 56 0a 12 70 9e 1b 6d a3 e8 c7 cf 0a d4 6a 18 cb 75 a8 2d 9e 33 86 6d a9 5e 7d c8 c3 90 6e 75 9f a5 38 92 90 ca 42 c1 28 bc 70 3c bc 42 ad ee a7 c0 84 4e 18 02 52 98 62 9c c2 22 ce bc 84 0d 6d 41 4e 43 4f 00 20 8a 06 84 22 a0 67 98 97 6b b2 1d e5 48 0f af ab 54 dd be 54 2f d7 c2 5d e1 bf 23 c3 d2 12 0d d2 0d 41 1a 4f 18 23 27 53 71 c1 96 96 24 87 6d 84 6e a3 2e 64 73 c3 d8 2c da 05 c8 09 2b 31 26 ca 09 f8 e5 5a f0 e4 b9 05 61 25 46 32 b9 bd e8 27 88 70 0a f7 5e 0f 67 66 44 bb Data Ascii: r-D$'ug1x^`/6p":v10Lypb"bFbNLd%<-vVpmju-3m^}nu8B(p<BNRb"mANCO "gkHTT/]#AO#'Sq$mn.ds,+1&Za%F2'p^gfD
2024-04-25 13:30:37 UTC	1265	IN	Data Raw: 7c 9f 56 e0 66 96 61 c6 c8 5a 96 e0 be c1 0f 7c 19 4e 04 3d d7 80 a1 4a 34 df 4a 81 c3 45 cb 26 e6 4b 98 ba 63 84 ec 5c 0d 8f de 0f 69 c6 dc 90 35 4d 51 25 2b a5 10 b6 c9 9f 08 8b 93 0a a1 a6 c6 8f 1e 35 4d c6 ca f4 53 95 22 45 56 51 b7 6c 33 ac 80 62 42 54 ba c1 eb 29 63 27 0a ee 52 cc 5f 11 34 62 1d ab ec 4d 54 34 cd ea 7e 39 cb 7a b5 70 cc d8 b1 90 04 42 b1 24 29 a0 40 93 7d 8a 26 c9 90 fc 2a 90 a0 34 ac 41 2e a1 22 52 44 aa f9 d1 a5 f1 e0 04 94 26 cc a9 1a 66 10 ac c8 8a 2c 6b 25 d6 84 11 a9 aa 62 7c 45 e9 7a 0c 76 be 28 c1 88 a2 b4 a6 69 90 46 a8 49 a3 37 da d2 92 52 28 27 9f 48 c5 62 81 45 01 e2 a3 52 d6 99 24 9f 5f 84 01 d0 6c 69 49 8a 25 9f 0c 6b 50 e9 f9 b7 b2 92 2c f5 89 7e bf c8 7a 07 56 34 46 4c 29 0e 2b 31 05 94 14 54 8c 2d 9a 38 5a 60 9c 02 Data Ascii: \|VfaZ\|N=J4JE&Kc\i5MQ%+5MS"EVQl3bBT)c'R_4bMT4~9zpB$)@}&*4A."RD&f,k%b\|Ezv(iFI7R('HbER$_liI%kP,~zV4FL)+1T-8Z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49798	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	390	OUT	GET /static/img/product/thanks-for-choosing/card.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/png Content-Length: 7545 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=9372 Vary: Accept etag: "249c-5e5da49b1772a" last-modified: Wed, 10 Aug 2022 03:03:05 GMT CF-Cache-Status: HIT Age: 59368 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ju5npvBq%2BgbFZk%2FUOzhCZ9hq4AfxPFJobFwL9Eqplmwguee4NsjyGYD%2FVIAcosuUPuR%2F7MOl8OdWea4h%2BAPdN%2BCUvynkAX8QAC2YCnO6tMPw9w85VKsef2EsirYgdTBNucdZp6Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0505d9e1389-ATL
2024-04-25 13:30:37 UTC	628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 72 00 00 00 64 08 03 00 00 00 ac 02 4b 09 00 00 02 ac 50 4c 54 45 ff ff ff f7 f7 f7 bc bc bc b8 b8 b8 a9 a9 a9 8a 8a 8a 91 91 91 c9 c9 c9 da da da a1 a1 a1 90 90 90 53 53 53 6f 6f 6f 8f 8f 8f 7c 7c 7c aa aa aa 84 84 84 93 93 93 bb bb bb f1 f1 f1 ce ce ce ff ce 6c c1 e6 bb d8 d8 d8 f6 cb ae ba 7c 06 ff a3 00 ec 7f 00 e8 72 00 ee 8b 00 e2 22 00 ef 0c 03 f9 83 83 fb ac a9 fe f4 e9 ff b6 16 fe cc 85 ff 97 00 ff 9c 00 fe a2 00 71 44 2f 91 5c 23 f5 f9 fe ed ed ed f9 f9 f9 b9 b9 b9 f0 f0 f0 b2 b2 b2 eb eb eb e1 e1 e1 cb cb cb d7 d7 d7 dd dd dd e7 e7 e7 d2 d2 d2 c1 c1 c1 a4 a4 a4 8e 8e 8e 76 76 76 51 51 51 f0 77 13 97 97 97 f0 94 00 a6 a6 a6 f0 98 40 ff 9f 00 6b b6 f2 59 b1 f9 45 a3 ea 0c 98 d7 21 7d c4 03 Data Ascii: PNGIHDRrdKPLTESSSooo\|\|\|l\|r"qD/\#vvvQQQw@kYE!}
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 57 59 91 58 85 d0 7e 7b c6 7b 79 c9 6b 20 1e 1d 04 04 04 1c 01 10 db 0d 8a cd 0d 80 cb 00 7a d6 37 94 e2 66 af e8 97 c3 f1 c7 d4 f9 e0 d1 fd ec de f2 58 53 f3 40 28 f1 30 00 52 0a 17 9b 00 5d 36 45 41 41 3e 40 ff ff c4 00 00 67 0d 0b 6d 03 25 82 59 72 9e 31 65 99 76 88 af 99 a9 c4 ed f6 fe 11 e3 b6 7b 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 1a 7b 49 44 41 54 78 da ec 99 eb 52 db 48 1a 86 83 12 2c 9b 10 1c cb 54 cd 45 c4 58 d6 59 86 da ca 7d 4c e6 0e 36 1b 1c 43 86 99 9a 3f ba 09 b5 5a 32 f1 41 8a 69 20 1c 64 14 b8 be 7d bb 25 9f c0 50 fb 77 ab fc b4 dc 3a 38 15 db 8f 3f 5e 7d 92 5f ad 59 b3 66 cd 9a 35 6b d6 ac 59 b3 66 cd 9a 35 6b d6 ac 59 b3 66 cd 9a 35 6b 5e bd da d8 08 30 b0 cc 09 f2 7d ac 67 fb 01 28 8e 8a 79 35 c1 d2 06 e6 ff 6f 24 2d 7e ff 32 Data Ascii: WYX~{{yk z7fXS@(0R]6EAA>@gm%Yr1ev{tRNS@f{IDATxRH,TEXY}L6C?Z2Ai d}%Pw:8?^}_Yf5kYf5kYf5k^0}g(y5o$-~2
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 28 95 11 a2 f2 16 a3 27 27 47 7e e3 f6 db 62 b0 40 f9 ed 11 0d 8f 70 e4 89 72 e4 ca dd e5 cf cb 07 e8 5e 54 4e 48 53 ad c8 b2 0c e5 b4 ac ca 6a c7 c3 6e 07 c1 02 59 ba de 3b eb 49 86 1c 9d c5 d2 78 2c c5 e3 a2 ca e3 3c 58 bc 32 a0 5c b9 33 4e 92 b1 9b 24 89 9b 38 dd 24 89 33 07 ce 81 97 24 1d f9 13 57 de 98 7f 9b 18 5a 6d 95 72 c2 9d 07 a6 d5 a0 24 a0 f5 a4 27 d0 7d 7f aa 5c 8f 15 dd 91 d5 b2 34 d0 e9 5c 79 cb b6 3b ae 61 95 ad d4 94 6d ed a3 a9 5b d5 9d 54 73 4c d3 33 c3 1d 1e 2c 7e 6b d4 76 e8 68 38 f2 a1 bb 8e e2 8e 37 78 4d c1 f8 50 17 7d 79 5d ab d7 5b f5 ba 86 d5 46 0b ea b1 11 1a 85 72 df cf 18 69 96 c0 66 29 57 1e 9e 2c 07 cb f5 41 25 ed 92 e3 27 ca c1 af 7b 28 7f 7b f9 e0 41 f9 fd 82 72 5f 2e 95 2a a5 92 5f 2e 79 7c 0b 0f 9c a2 3a f1 58 27 a6 11 Data Ascii: (''G~b@pr^TNHSjnY;Ix,<X2\3N$8$3$WZmr$'}\4\y;am[TsL3,~kvh87xMP}y][Frif)W,A%'{({Ar_.*_.y\|:X'
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 3a 4b ca bb 5e 77 b5 f2 8e fc b7 c0 63 7f e5 ca a7 f7 74 20 7d 56 e5 54 96 8d d0 30 2c db b6 42 cb a4 d4 41 96 1b b6 61 59 06 65 a6 4c ed fd fd d4 dd c7 97 b0 df b6 42 c7 ca 95 2f 3b 5f ba f8 dc c6 b3 2c ff 40 41 c0 27 4a 50 d4 7c 93 d0 20 f0 b1 49 f9 61 a6 8e fa 18 58 16 79 f9 1e 0b ee a9 88 71 b0 7f 70 70 7e 7e 71 b1 7f 71 70 8d 7d 31 96 82 e5 c1 7b 40 9e 7b 0f 77 4b c1 e2 37 9b 4d 2a 3e 7e 01 c1 4e 8c d2 16 92 05 b3 1d a6 10 85 17 44 3f bb d8 56 55 f5 5f aa 5a 54 f9 0b 77 b6 44 5f ee 07 b9 74 8f a7 cb 4c b9 80 ee d6 0a e5 28 6b 8a 24 e7 34 02 6a d9 66 18 04 14 8e 9c 76 c8 a8 63 d1 10 19 1f 06 14 10 d9 6e ac ba 93 f8 7d 67 5e e3 db 67 80 67 f9 63 c8 f2 0e 8b 47 8f c8 30 96 94 e7 ce 17 95 17 b4 ed 54 76 da 6d fe a7 b9 7f 55 20 94 8b 51 64 39 f8 05 d9 f9 Data Ascii: :K^wct }VT0,BAaYeLB/;_,@A'JP\| IaXyqpp~~qqp}1{@{wK7M*>~ND?VU_ZTwD_tL(k$4jfvcn}g^ggcG0TvmU Qd9
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 81 7c 9f 22 07 d9 4f 18 7d 32 72 39 bd 83 38 4e 91 8b bc 98 1b 77 c4 5c 4e cc dd 1f cf 8e df e7 9d 71 8a 1c b7 76 6c d9 f5 81 5c 78 f2 44 90 25 86 5c b2 29 1c 4f 53 1d 3e 44 5e a1 c8 2d 43 0b 91 2f 2e f4 74 f3 c6 8d 1b a3 8c 37 d5 e8 ed 3b cc e5 c0 1b a6 0b 89 28 9f c8 96 eb 40 61 be b8 de dd af bf 82 a2 28 4f 8d 8d a5 32 99 54 aa 0f 39 78 f7 bb 7c eb 94 f8 d6 ea f6 ea fa d6 fa e1 f6 65 c8 77 f7 de ed 1c 20 bf df 3c db 7b bf 73 8a 3c 7c 47 e8 89 cd b0 63 a3 ec 3f 81 3c 95 1a 9b 48 01 79 a3 d1 84 d1 19 f2 4b 15 7d 09 f5 10 79 14 a2 ae 00 a3 0b a2 90 1b cf e6 81 fc 5e 2e 27 e4 72 79 e5 5e 94 e5 8e ad 50 e4 45 04 b9 a6 50 de 14 39 40 c1 e5 4a 84 bc 49 5d 9e 25 7a 88 bc cf e4 b1 9b d0 e8 2d 26 70 ff 72 a8 45 91 4f 3e f8 f7 64 d1 b5 f9 0c 27 70 99 3c 11 33 90 Data Ascii: \|"O}2r98Nw\Nqvl\xD%\)OS>D^-C/.t7;(@a(O2T9x\|ew <{s<\|Gc?<HyK}y^.'ry^PEP9@JI]%z-&prEO>d'p<3
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: a6 b5 a6 78 fa 47 c9 ff 58 f1 5b 2d dd 68 07 35 cf 48 c3 e5 9d 76 2d 42 4e 8a 33 93 61 bd 1c f6 23 ac 60 ec 47 0e ba 6a 49 b6 65 ca 98 d5 d1 45 a0 93 89 ad 5a 91 cb e1 cc c6 8f 91 cb b5 e8 f1 f9 ec 29 5a 65 de 9c 9f 33 e7 71 7c da 7c 6e ea 73 95 4a 65 ee ba a9 4f 7e 01 97 e3 a5 e8 23 13 b4 71 e0 4f 88 63 71 88 f5 4c 3a 95 49 a5 33 a2 0b e4 13 28 c6 bf 02 e5 7b f9 3c e6 79 08 7a 51 16 c4 82 27 04 41 a0 16 3a 1f bd c4 70 1d c9 9b d8 f7 9c 8d e5 15 52 dc e8 21 df f8 cc 5d 59 de 58 7a e9 7c 46 47 97 d6 e5 74 ee 89 e3 ee 4e 0f b9 43 e2 2c 4d c0 b9 da 88 d5 48 02 a3 30 58 1c 51 77 d4 45 39 db d1 80 bc e3 a0 eb 56 2c 13 45 8e 3e 3e 51 b1 dc 64 45 e2 8c 5f f1 a6 54 7f cd f7 57 10 31 53 a5 ce ca d4 94 8e 48 c7 7b ee 16 89 c0 58 7c f8 97 08 3a b6 11 9a eb f9 5c 7f Data Ascii: xGX[-h5Hv-BN3a#`GjIeEZ)Ze3q\|\|nsJeO~#qOcqL:I3({<yzQ'A:pR!]YXz\|FGtNC,MH0XQwE9V,E>>QdE_TW1SH{X\|:\
2024-04-25 13:30:37 UTC	72	IN	Data Raw: 9c 10 f9 ef c9 23 9f 34 39 41 f3 78 ae a7 4e b7 13 bc 3f b2 4e fe 5f 1a fc dc 3e d0 40 03 0d 34 d0 40 03 0d 34 d0 40 03 0d 34 d0 40 03 0d 34 d0 1f 51 ff 03 f3 63 1f 2b 47 50 3c 65 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: #49AxN?N_>@4@4@4@4Qc+GP<eIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49797	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	392	OUT	GET /static/img/product/thanks-for-choosing/norton.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	733	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/png Content-Length: 4240 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=4364 Vary: Accept etag: "110c-5e5da4a125bda" last-modified: Wed, 10 Aug 2022 03:03:11 GMT CF-Cache-Status: HIT Age: 57926 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kCk6aMEv6h1LFYfuTRh6wYfRkNxTWKJ9sDggoVLywqgdwkHctgY%2FMg4saIbem1k4KSUHV3S%2FPnmjzwt26Qrbj23UrqCW5YPPuUrTMmLMYh8iNUZ9dlpMQ7RVFt4u3JBKFOuoJL4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0506887ad51-ATL
2024-04-25 13:30:37 UTC	636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 64 08 03 00 00 00 63 09 28 e3 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 00 50 4c 54 45 b5 ad 94 0d 10 19 ad a3 8d 3c 3c 3c 83 71 38 75 74 74 ff fa 5c c8 bd a3 55 54 54 93 63 0f a3 9d 3a 50 50 4f 4b 4b 57 08 07 07 c1 cd e2 a8 7c 10 ff d2 28 ff e8 41 73 72 72 df bd 72 ab 97 41 50 55 5e ff b6 0d 02 01 01 b0 bb d3 89 88 84 b3 c3 e3 c1 c1 c1 fb da 80 fc dd 83 d5 d3 cd fd c1 2c fc cc 5e 08 08 0d ec b6 19 00 00 00 e1 e1 e1 bd c3 d5 e3 ac 0f 09 09 09 3d 3d 3d fd d7 70 37 38 46 ac ad b0 43 43 43 20 20 20 4f 51 57 14 17 1f 0d 0d 0d e5 e1 cf fa c2 38 14 14 19 0f 0f 12 15 16 19 fe b4 12 fb ca 4c 9a 9a 9a 5b 5b 5c 69 69 69 fd c2 38 f9 ca 59 61 60 60 37 35 30 48 48 48 fd bb 29 fd be 31 Data Ascii: PNGIHDRdc(gAMAaPLTE<<<q8utt\UTTc:PPOKKW\|(AsrrrAPU^,^===p78FCCC OQW8L[[\iii8Ya``750HHH)1
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a c9 bd 89 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9e 9c 96 9a 9a 9a 00 00 00 3f 27 0b be a3 1d ae 7c 0f 1d 1b 00 5a 47 0c eb b4 0a 61 61 64 ff c8 1b da b0 20 e9 b5 3e ff e5 0b ff f6 ae e2 e2 e3 b8 a2 1c 84 71 13 ff de 17 fe bc 0a 2d 27 07 a7 9c 18 ef af 17 ff aa 09 ff b3 01 ff b3 0e 76 5f 0b ff b2 18 ff af 0c ff b1 0e ff b4 16 ff b2 0f ff b3 14 ff b5 15 ff ae 04 ff b1 0c 04 04 04 ff ad 01 ff b3 11 ff a6 00 ff b0 0a ff b7 1c ff aa 00 ff af 06 ff b6 1a ff b6 1b ff b5 19 ff b5 17 00 00 00 9a 9a 9a 36 71 60 d6 00 00 00 d1 74 52 4e 53 2a fb 17 55 ac d2 7f a2 a2 f4 71 d0 9f 99 94 bd d2 97 41 e2 df ef e2 47 c9 75 a6 fa 55 65 dd 7c 87 81 fb e3 68 e4 8b d1 8f 79 1d fd 67 5a 7b d9 e2 16 4d 72 34 a5 Data Ascii: ?'\|ZGaad >q-'v_6q`tRNS*UqAGuUe\|hygZ{Mr4
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 60 b6 dd 14 07 c4 e4 00 45 a5 40 5a b5 26 37 1c 48 4a d5 68 52 b6 21 20 b5 2e 45 5b 0f cf 57 53 16 09 4e 40 a5 84 04 c7 31 3c 65 96 03 f0 b1 27 6d 8c 00 aa c8 b2 67 a3 01 09 a4 0d 8e 0b 07 88 8b 88 29 35 c5 26 e6 50 21 0e 51 f8 9e c4 00 54 50 f8 b6 94 3a bd e7 75 a6 de ea ce 57 95 6a 51 e5 d4 98 9b 48 10 2c 4e eb 20 f0 23 08 a2 08 32 a6 4a a0 a0 89 1f a3 00 0a e5 32 8d 4a 3c 13 00 ca f1 bc 02 a3 61 54 68 12 89 28 1c 0a a1 24 b0 83 b3 2c 95 b4 41 80 85 62 62 c2 81 26 d3 48 19 9f ec bc d0 d4 24 04 51 75 4c 1a 70 90 2a 00 6a f2 fc b7 09 b5 e4 9e 0a 95 8a f8 48 28 44 90 4c 14 64 22 4f 50 12 3f 55 15 79 ec 9c 0c c5 03 3a 2d 10 13 13 4a e5 22 24 51 91 89 aa 4c 83 e7 bf da 80 56 1d 72 34 c1 44 23 d7 3d a5 a3 8a 20 c8 21 3d 60 04 68 3f d0 ac 05 ec f1 b0 6f 00 0e Data Ascii: `E@Z&7HJhR! .E[WSN@1<e'mg)5&P!QTP:uWjQH,N #2J2J<aTh($,Abb&H$QuLp*jH(DLd"OP?Uy:-J"$QLVr4D#= !=`h?o
2024-04-25 13:30:37 UTC	866	IN	Data Raw: 66 fd e3 72 60 7e 02 ce d3 4b cf 4a 92 73 a1 0d d8 25 2f 8f b5 4c 1c b6 74 c9 cb 08 99 dc 02 80 bc bc a7 ae e7 7a dc 65 35 ba d8 0e 39 a9 33 3c ef aa 2c 70 49 03 1d aa cc 32 5e e9 d8 2a 79 29 7d 0b 82 23 b3 cf 0c 48 67 5f 0a 01 b6 66 64 ac 17 d5 56 3e 4c cd 08 7c c7 5f 1c 32 b8 20 bf f6 da a4 79 4f 00 b7 04 ee de 04 60 55 c6 51 e0 95 8c 0c 7f cf fb 4d 0b 24 49 1a 92 c1 c3 6a 0d 9b b9 0c 82 09 b3 79 75 ee 5c 71 72 8c 3a 71 4f f2 d1 fa d6 a9 32 d8 cd 14 5e 87 cc 9c a5 3d dc 75 3e c6 a8 13 f7 14 4f e0 be b9 33 e0 e6 71 77 60 a6 43 66 d1 83 6d d2 60 f7 5b 10 4c 34 40 60 d3 eb 21 08 c0 08 f4 50 50 ae da bc eb c4 4d eb ee 97 da 1d bf 85 1b bd 12 9a 4d 50 78 c8 d9 2a b5 39 5f 00 90 a0 6b a6 5c c0 6c 35 99 4c 39 40 44 73 33 d5 00 d6 7c c0 9e 0a ec 34 99 9a 9b 80 Data Ascii: fr`~KJs%/Ltze593<,pI2^y)}#Hg_fdV>L\|_2 yO`UQM$Ijyu\qr:qO2^=u>O3qw`Cfm`[L4@`!PPMMPx9_k\l5L9@Ds3\|4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49799	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	389	OUT	GET /static/img/product/thanks-for-choosing/bbb.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	733	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/png Content-Length: 3882 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=3991 Vary: Accept etag: "f97-5e5da499b012a" last-modified: Wed, 10 Aug 2022 03:03:04 GMT CF-Cache-Status: HIT Age: 6038 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v0qhbBWjHJ563gWJt%2BrmfaTY4VRe4NxITf84qaEXSZOQbablNJqYCw76t4ncv%2FTbmUn7VKjFMeb0Mv5hVa8evqGm7%2FW2meXGthTDf9bWptYpWtuoWNpW2P56HctRnz864Ewwnr0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0506b01ad58-ATL
2024-04-25 13:30:37 UTC	636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 64 08 03 00 00 00 63 09 28 e3 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 02 fd 50 4c 54 45 00 00 00 4e 7a 8a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 Data Ascii: PNGIHDRdc(gAMAaPLTENzZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZy
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 9a 9a 9a 9a 9a 9a 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 9a 9a 9a 02 5a 79 9a 9a 9a 9a 9a 9a 02 5a 79 02 5a 79 4a f0 22 fd 00 00 00 fe 74 52 4e 53 00 01 02 02 04 04 06 07 07 09 09 0d 0d 0f 0f 10 10 12 13 14 16 16 18 19 18 1c 1d 1c 1d 1e 1f 1e 1f 21 21 25 25 26 26 28 28 2a 2b 2d 2e 31 31 33 33 34 35 34 36 37 38 39 3a Data Ascii: ZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyZyJ"tRNS!!%%&&((*+-.11334546789:
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: a5 17 b4 2c 13 b3 1f fb e9 24 7e 59 89 02 22 cc 1d 8f 38 92 f7 b2 b8 f9 80 27 35 18 a6 40 84 98 9f 86 ad 18 7f 81 93 96 87 a9 55 cf 2e 5d 53 a9 d4 4e 8b ae bd 9b 96 89 89 00 5e 43 3b 72 40 11 11 26 a4 18 02 cb 1e 6f 40 dc f8 96 4e 38 6c 31 e4 01 04 eb c7 a3 81 7e bf 15 74 05 c6 fe a5 ed 39 e3 49 a5 7a 43 50 b3 32 23 bd 3d 0d dd 67 82 88 e4 43 38 a4 0b e6 ef 46 dc c8 46 f2 39 31 bd 00 c3 5c 57 ed 27 4a b2 d5 81 82 7e 1b 0e dc d0 32 06 93 a7 4e 9d 3a 77 85 ee 4b 62 b6 51 8e b8 c3 62 61 9c 3b 7c 0f 7d 43 a4 d3 73 97 88 81 78 15 5f 29 e0 4b f4 e8 dc c4 b3 e4 84 75 73 33 69 08 4e 57 32 a6 91 c5 07 5d ba 36 05 de d4 d7 d5 7f 0d 80 a9 85 45 4f 53 d5 98 10 48 7b c9 0a 80 45 d1 37 10 a2 b7 21 a6 1f e4 49 f2 c9 03 48 9e f2 e8 8e 8e 86 1c 8b 2a 19 33 9a a4 25 88 20 Data Ascii: ,$~Y"8'5@U.]SN^C;r@&o@N8l1~t9IzCP2#=gC8FF91\W'J~2N:wKbQba;\|}Csx_)Kus3iNW2]6EOSH{E7!IH*3%
2024-04-25 13:30:37 UTC	508	IN	Data Raw: 96 87 e9 bd 1e dd ba dd e2 52 df 59 76 eb 63 5c 26 e6 20 f0 3a da b3 23 8a 99 61 7f d3 08 58 fe 64 23 e2 ed 5b 3b 23 d2 72 a8 12 82 cd 93 31 40 ff f3 85 dd 81 71 d7 b4 3d 67 bc 54 fe d7 52 89 19 e5 b3 c6 c8 63 16 98 59 3e 84 43 bb 61 c1 1e c4 8f 6a 2c 9f 13 33 0a f1 99 db ea 70 e6 64 3b 1d e4 f1 f9 11 c0 75 2d 63 f0 f9 b4 69 d3 e6 b9 e8 41 fd e3 60 07 e7 c2 e8 7b 2c 88 f7 c0 a6 1f dc 98 75 7a 04 22 7e 0c c4 ab 58 9c 8f 2d cc ca 0b 93 ce b3 33 7c e6 65 f0 50 9c a9 64 4c 63 cb 0f bb 75 37 06 9a d5 d3 ab f7 3a 00 33 4b cb 1e 66 aa 31 a1 90 c2 b8 2f 00 cb 92 6f 21 9c d8 81 d8 fe 90 27 c9 a7 4a 48 5e cd 00 8c 39 01 39 96 54 32 66 0c 4b 4b 71 90 85 5b 7d 9e ae f0 f9 f6 2f c6 a4 7d b7 63 bd 5f ac bc ac 3c 02 c5 78 c9 e3 eb 53 1c ff 5d f6 29 39 39 70 b4 24 d8 6f Data Ascii: RYvc\& :#aXd#[;#r1@q=gTRcY>Caj,3pd;u-ciA`{,uz"~X-3\|ePdLcu7:3Kf1/o!'JH^99T2fKKq[}/}c_<xS])99p$o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49800	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	662	OUT	GET /static/img/product/products_icon/wfh-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	803	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 1948 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=2389 Content-Disposition: inline; filename="wfh-60.webp" Vary: Accept etag: "955-5e5da4e19cabe" last-modified: Wed, 10 Aug 2022 03:04:19 GMT CF-Cache-Status: HIT Age: 59373 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C3g9vSy2D8gPKhtS6%2Btog6XIDgDolNio0o5vxNYjcXLpPLQaSpCrNyMDVxCpXmprqgjVqpseRkU4k42%2B9QJTM12CBPztBGaXnFhEFtn3FqEjgnzoAywP%2B05Iw58N%2BZIKBPHhsGA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb050ae047bd6-ATL
2024-04-25 13:30:37 UTC	566	IN	Data Raw: 52 49 46 46 94 07 00 00 57 45 42 50 56 50 38 4c 88 07 00 00 2f 3b c0 0e 10 e7 07 b9 b6 1d 47 ca 93 54 06 0f 3b 0e 89 b1 24 6d 4f 0a e3 4d 9b 92 94 06 e4 c8 b6 55 55 7b 5f 7b b8 8d 20 ff 40 60 fa b3 70 77 79 7a ef 3d db 75 6c bb 69 74 25 2f 33 e3 d7 b6 b8 15 6e 11 db 05 33 59 96 e0 08 00 58 48 ca 60 f7 6c db b6 6d a3 b5 d9 df 03 ae bd 1f 5c 69 96 2c 6d db b6 8d 24 63 04 00 00 ec 01 7a 00 0b 80 0d 80 06 68 01 7a 00 43 88 be 52 77 d2 78 2e ac df 29 54 28 ac 19 4d f6 6a 99 75 69 9e 2d 7f 79 36 f3 6b fd dd cb 24 2e 59 75 bd fb 26 f4 31 52 e8 93 30 ff 98 3a e2 f7 be 36 95 65 5f 7c 1b 46 36 b0 d6 0c c8 a2 3a 9d 4f b9 6e 96 50 1d 99 88 82 ea ca 44 54 40 5a 80 30 07 49 03 63 0a 90 ff 35 61 89 0f cd b9 7d 11 87 97 ff df 4d d7 c1 d3 0f c0 ef 2b 5c 9f 37 a9 b6 ae 7e Data Ascii: RIFFWEBPVP8L/;GT;$mOMUU{_{ @`pwyz=ulit%/3n3YXH`lm\i,m$czhzCRwx.)T(Mjui-y6k$.Yu&1R0:6e_\|F6:OnPDT@Z0Ic5a}M+\7~
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: e9 86 fd 6f 87 8f 40 08 04 2d 78 02 b1 08 9d 90 ff ba 99 65 c2 9f 72 24 6f 4a af f5 97 4d 9f d6 21 15 b6 59 15 31 63 89 28 6c 93 96 65 2b 59 4c 12 89 08 d3 c8 b7 46 31 b5 46 19 91 b2 28 98 a0 33 c6 0a 86 9c a6 51 6d 8d c8 12 a3 b3 2e 44 3e e5 67 2e 15 3b 3f 7c 34 51 62 ad af 2a 9e b2 c0 d2 28 7b b2 2b ce 0e 5b 2a 27 cf ac 5b 27 ac af 8d 77 b6 03 65 69 cb f3 43 8a f3 eb da ea e1 4a 3e ae 9f 96 0b 42 03 45 17 61 9a 16 fa 9f f3 fd 4c b8 70 93 f5 53 53 8f 7f f5 da 9c ff 4e 7f 1f eb 75 7b 78 7f 3d ce 0d 8e 97 0e fb bd da fd 6c 3e cf bf db af eb d3 ee f3 62 75 fc 7f 1e 5e 1e d5 eb 9e 63 78 1f 07 d6 cf 6e 62 e1 c1 ba de b1 6d ff 78 5f a3 d3 cb d7 ec ff 7c 7b 1d 6d c2 06 5a d8 b6 9d 91 a4 6a ab aa 5a 35 2e 4c a1 3b a9 6c 8d 6d db b6 6d db 76 c6 b6 6d db b6 6d db Data Ascii: o@-xer$oJM!Y1c(le+YLF1F(3Qm.D>g.;?\|4Qb({+['['weiCJ>BEaLpSSNu{x=l>bu^cxnbmx_\|{mZjZ5.L;lmmvmm
2024-04-25 13:30:37 UTC	13	IN	Data Raw: 9a 0c ff 43 95 46 b3 9f 99 26 c3 df d1 Data Ascii: CF&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49801	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	662	OUT	GET /static/img/product/products_icon/wrc-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 2064 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=2385 Content-Disposition: inline; filename="wrc-60.webp" Vary: Accept etag: "951-5e5da50819748" last-modified: Wed, 10 Aug 2022 03:04:59 GMT CF-Cache-Status: HIT Age: 4842 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=joqtMnjIFnTas3fJbrrN6kU0w3elCUE8iAuwI%2BHynE5b18lb%2BRBIHTQhvu%2B4uljpRyEfMMZwQtapUyW4%2BbIdm3qemRjuaO7%2FGPoxJ3RkdTREatU9Ca6eaHxR2nXaG23ih9HlxIA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb050cd4912e9-ATL
2024-04-25 13:30:37 UTC	565	IN	Data Raw: 52 49 46 46 08 08 00 00 57 45 42 50 56 50 38 4c fb 07 00 00 2f 3b c0 0e 10 ff 27 31 b2 6d d5 8a ce de d7 de c3 21 0c 92 22 05 02 77 66 9e 9d 7b 24 0d 48 02 c0 26 52 a2 2d ee 70 e6 c6 3b f9 19 ff 70 77 67 ac 69 d3 c0 8e 64 5b b5 b2 b6 9c 7d de c3 9d 4f 02 20 09 c8 3f 0a 22 70 39 b2 45 92 6d db a6 f6 cc df b6 55 b5 6d db 76 5c 47 5b d2 05 27 5d b0 51 b3 6d db 7e 21 00 19 15 48 40 2c 30 5b b1 02 33 26 59 9a 59 52 ea e6 96 c4 1a 8b c5 27 a6 25 98 2e 2d 57 b0 ff 8d 10 d8 59 90 16 21 b3 04 6f 44 7d 63 e9 ce fa 47 16 a6 ee 24 15 68 38 7c 9a 25 98 bb 66 e4 6a f1 21 92 a7 58 0d 1e 5b 05 bc bb 5a a6 a5 6e 36 83 7b 70 0f 51 53 42 fe b0 9e 31 e0 e4 56 a4 ca 47 69 9c cc 8c bb 4d f4 e5 9a 8f 99 62 52 c8 de 76 9c 43 a4 64 69 b3 b3 8c f8 74 79 71 cd 33 47 ff cb 39 d5 86 Data Ascii: RIFFWEBPVP8L/;'1m!"wf{$H&R-p;pwgid[}O ?"p9EmUmv\G[']Qm~!H@,0[3&YYR'%.-WY!oD}cG$h8\|%fj!X[Zn6{pQSB1VGiMbRvCdityq3G9
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 2e c2 5a 6a 8a 88 ca 4a 4c af 64 e4 76 6f 31 d0 fb f9 d6 a1 ad fe fa d2 8e cf 78 2b 73 9c 27 bc 62 21 c4 fb 20 91 65 96 c1 b2 45 21 70 73 9d 5f ed fe 37 fc fd 7d 2d af 35 6b 91 aa fb d5 3f 71 74 6e 39 19 72 2f 60 eb 17 43 ae 0c bc a8 58 56 45 51 d2 8f 7e ce 3d 1c 9c b4 14 a6 2f 2f 67 4f 09 f9 23 b6 c1 5d 96 38 8b bf eb a2 73 79 bb 7d de 32 f8 f0 59 42 1f 31 4e 13 3a f1 f3 a4 da 26 81 3c 21 bf 54 fd ee f9 92 a9 b7 fa 49 3e 32 86 3f be 1f 9f bf 9f be c4 57 3b 5f 32 50 c3 fe ff 74 9b 9d 1a 41 6d 27 7d d2 60 99 cd 72 c8 92 34 ae 6d 63 46 f7 cc b6 6d db b6 da 26 b3 6d db 56 4e 87 73 b2 57 7b f7 fb 45 f4 9f 81 db 46 8a bc 0c c7 f8 06 e2 9f 3e ec 3b 76 e0 30 6e 87 7d 7f c5 ae c3 b5 c5 06 d4 57 57 6e fe 1b b6 9c 15 73 79 22 71 1d 43 d5 a9 d1 a6 37 f7 a2 a1 0e d7 Data Ascii: .ZjJLdvo1x+s'b! eE!ps_7}-5k?qtn9r/`CXVEQ~=//gO#]8sy}2YB1N:&<!TI>2?W;_2PtAm'}`r4mcFm&mVNsW{EF>;v0n}WWnsy"qC7
2024-04-25 13:30:37 UTC	130	IN	Data Raw: 10 a9 a4 e3 b0 0e 33 46 d3 fc dc bf 5a 5a 13 23 64 ca d8 9e 09 00 f1 15 7d fb 28 15 72 29 c8 86 75 58 fa ee cd 17 82 6e f8 82 2b a7 e0 c4 08 b9 36 29 16 11 34 8a be 72 d9 b0 8e 13 16 7d 78 fb bb 9f 2c da 0b 4d 8c e8 1b af d6 a8 95 0a 99 42 32 fe f3 c7 d5 84 09 c3 cb a5 d3 27 0e 8e 53 82 42 1e 36 f3 d3 ab 3f 9f 21 13 2c b4 34 54 2b 1d 39 eb dd 1b e2 af 84 97 8b c7 bd 27 97 ff e7 0b 00 00 Data Ascii: 3FZZ#d}(r)uXn+6)4r}x,MB2'SB6?!,4T+9'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49802	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	643	OUT	GET /static/img/common/index-menu.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/static/css/layout.css?v=1.24 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	816	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 11366 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=12378 Content-Disposition: inline; filename="index-menu.webp" Vary: Accept etag: "305a-6166e81b2385b" last-modified: Fri, 19 Apr 2024 08:02:18 GMT CF-Cache-Status: HIT Age: 51005 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z7HTlirUv9xQU4c5oPw7aE%2BAnVd%2FHRWpMxkV145X33M2tWRY1RZp7F2Mdld4ko%2Fml7zOoQsMzphi3xB7pPSr%2FKC3EuWHPlyafuRuCxWIi%2F2Wn3FfxSKEYUk%2F5vCRV01%2BDqhKY78%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0513f0953bd-ATL
2024-04-25 13:30:37 UTC	553	IN	Data Raw: 52 49 46 46 5e 2c 00 00 57 45 42 50 56 50 38 4c 52 2c 00 00 2f 9f c0 2f 10 e7 07 b7 b6 6d d5 ca b5 ef ee ee fe 7f 29 bf 30 32 da 22 27 75 77 78 7e fd be d3 06 2c d9 b6 4d 3b fb e0 e2 c4 b6 ed 7c 25 bd 4b 07 6d db b8 7c 3e de 90 6c db 36 ed 9c 7b ae df 7b ff c7 b6 9d 52 6a ea 4c 5a ad 92 9d 67 e4 52 ce 6d 6d c7 1e 9d 4f b1 9d ca b6 8d d6 49 c5 1f 60 db 66 e5 a4 4c 65 db b6 33 b6 ed 99 9e ef f7 06 02 00 30 8a 29 30 7c 88 f8 08 fc 10 80 09 cf b7 02 31 85 f2 81 84 ce 1d ab 5d b2 38 79 80 09 bf 85 7d 96 6e 22 ab 9d e4 8d 8f 90 e8 80 3f 3a b7 7a dd a4 57 92 0f c3 7c d5 92 ca fa 5f 2c 9c 02 f8 87 d2 75 94 8f 53 de bb 50 84 22 6d ec 31 40 2c b3 36 a4 24 cd 96 a4 de 88 d6 85 2e bf 68 7d 08 71 11 e6 ad d7 f7 83 f6 27 b7 6d ad 52 43 07 87 26 c5 54 dd 84 57 ef 24 71 Data Ascii: RIFF^,WEBPVP8LR,//m)02"'uwx~,M;\|%Km\|>l6{{RjLZgRmmOI`fLe30)0\|1]8y}n"?:zW\|_,uSP"m1@,6$.h}q'mRC&TW$q
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: c5 4b 0c de 2d ff db 80 2b 39 db e1 d2 13 5b 15 c3 7d f9 b7 70 b1 a8 3a ec c8 e8 f7 07 78 fd 05 fb 2d f9 6a f4 dc b4 1c ff d9 0f e3 66 43 bb 7b 42 9c 90 77 92 ce 1f c0 c2 99 69 84 27 a9 c2 57 da 93 3b 4c c1 6a 55 ff c9 fc f0 87 2a fe 21 b0 f8 4b 18 3c 4a 6b a8 6f 94 b6 d4 32 17 2c c2 2f 68 e0 6b 15 b2 40 6b 7c 2a e7 ee 6b ce 0f a3 cc 04 93 5f 0f cf 01 bd 45 8e 91 21 90 69 16 97 29 60 3e 11 75 c4 0d fd 51 e6 f1 0c 09 5e 48 c2 f3 81 9e 8c fe 69 6b a8 a8 0c 7b 2b 2b 96 32 0b 89 e2 de 52 25 ed e1 a9 94 cc 24 14 99 49 ce 0b f6 4e ac 58 ab af a2 97 84 b5 d8 c0 ed 7f 63 2e d9 c0 27 09 f3 76 29 31 70 61 73 ff 4f 5f c5 a9 6e 57 8e ba 0a 93 38 fc d4 c1 c1 f1 07 25 8e 9e 96 af b2 90 40 d9 0e 53 3a c9 86 5e d2 1d cd 48 bb 17 69 7a 09 1f bc 99 3e 9f 3f 25 6e 4f 12 61 Data Ascii: K-+9[}p:x-jfC{Bwi'W;LjU!K<Jko2,/hk@k\|k_E!i)`>uQ^Hik{++2R%$INXc.'v)1pasO_nW8%@S:^Hiz>?%nOa
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 5f 15 25 75 07 25 db 41 89 21 43 03 d3 b5 8e bc 7d b6 30 bc 33 3b f7 76 b9 80 4b 4a 21 b3 71 cf c2 4d 94 08 b4 a5 c2 0f 0b 23 ee 21 86 83 ce d0 7f 3d 2f f5 ec a5 54 c7 fe ce 54 2d dd 83 f7 d4 ac 42 e3 54 e7 7e 7f 67 d4 fe 5a 74 39 69 d7 a4 0e 3b 94 84 52 44 5d d7 68 a3 d2 57 1c e8 dd 17 4c ce fa fb b9 5c 38 37 3c cf 98 19 ac 28 71 4b e6 8e 02 70 a6 d0 0b 34 d4 e2 5f 7a fe 39 45 f4 6d 30 bd 94 62 85 83 9d 2f d4 30 ee c1 cc b5 cc d0 dc ee 74 1e 0c 80 5b 93 52 39 f8 fe b5 22 cb 61 04 84 43 23 86 ec dd d3 5c 6c 69 da eb 7b 41 c4 cc 2e f9 86 9b 1c 28 5e 18 66 fe 20 4b 77 13 99 d9 af 21 da 22 de e1 c1 72 2e 9b 79 78 11 9c 6f 3d 9f d5 90 ed 26 e0 2a a4 74 8f c1 e8 85 1a 2f 07 ab 75 a7 54 ad 26 a5 02 ec 3b 43 59 9e 70 0a ab d0 99 b3 58 44 48 72 41 fc f0 ec f5 52 Data Ascii: _%u%A!C}03;vKJ!qM#!=/TT-BT~gZt9i;RD]hWL\87<(qKp4_z9Em0b/0t[R9"aC#\li{A.(^f Kw!"r.yxo=&*t/uT&;CYpXDHrAR
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 34 9c ad ee 3a 85 18 e2 f6 a8 27 9d 00 ab 7d 98 7e d0 29 75 e9 1f 9e f9 56 9e 40 69 7c e8 9d 9d 90 65 33 02 72 0d 54 4b a9 f9 ce 0f fd e5 13 5e d6 14 a5 27 a3 f3 2d 23 49 6b 98 7b 20 fa c1 a4 3d d7 ee 80 13 10 28 ef ea 0c 00 d7 57 84 81 56 04 92 ca ea 4b 96 10 80 34 ee 10 0b 01 60 7d b1 5a 3d d6 33 7a 05 11 d3 73 f3 a8 21 ce 2f 18 98 a8 20 e2 59 44 be e5 53 f2 79 0d 1f fc 24 d6 ce 87 fa 86 dd 42 76 79 3d 86 5e 14 02 00 33 c7 11 27 2b 57 86 9e 42 15 44 7e 9a 48 52 6e a8 aa 6d d7 30 da d2 1c 28 b0 72 c5 69 b3 d6 a8 c6 e7 93 c6 fc 9c 4f 22 89 8c 0f ca f0 20 ad 47 e2 5b 86 d5 ac 17 d6 0c 6d 2e 69 1d a5 b5 a1 ee d8 6d 1f 2a c6 30 f5 14 8f a5 8c d5 2b 30 c4 37 9e 42 44 1e 52 a2 e2 19 e2 94 aa 0e 68 02 03 58 4a d8 0d d2 66 8d aa 8d 24 a2 21 79 d6 46 12 71 61 a2 Data Ascii: 4:'}~)uV@i\|e3rTK^'-#Ik{ =(WVK4`}Z=3zs!/ YDSy$Bvy=^3'+WBD~HRnm0(riO" G[m.im*0+07BDRhXJf$!yFqa
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 89 c0 b7 d4 0f 1f 94 bc 55 41 7e 70 25 58 b6 0f 09 44 25 86 28 41 94 92 30 20 c7 3f 38 33 b9 3c fb ef 19 d6 35 ec 07 4b 88 0b 0e 4a 06 41 65 bf 89 fc 26 80 a6 91 84 26 a6 70 dc 93 34 88 ca b7 9c 3c 5a b5 d0 cf c1 25 5b 15 51 5f d0 ba 4c d1 32 4b 6c 13 11 b3 c3 f1 32 0a 88 16 04 f5 87 f7 e9 d6 b4 3e a9 b8 c4 e1 08 7e 19 3d a3 c4 96 07 0f ca 5c 32 09 3c 85 a8 7c 4b d4 a7 2c 29 84 96 82 cb 8c 0a 8a 1b 63 fa a9 ad aa e4 b8 eb 0b 33 30 2f 35 8c 93 46 73 41 67 45 4c 81 b2 2a 09 10 17 4f be 18 0f 6c f9 41 e6 31 23 97 3c 45 58 8c ca b7 44 44 3a b4 04 a2 a3 d6 80 e8 bb bb d6 d1 bb ca df f9 36 47 a3 0a 1a 93 a2 af a2 ba d1 5b 40 bd cd eb ef da ea 49 9e d4 67 d4 9f 4d 2b 5c e2 50 9f 7c 56 df 92 14 1f f9 c1 b5 29 28 d1 5d bf e6 60 3a cc 3d a8 75 e9 b4 c5 58 9f 9c 25 Data Ascii: UA~p%XD%(A0 ?83<5KJAe&&p4<Z%[Q_L2Kl2>~=\2<\|K,)c30/5FsAgEL*OlA1#<EXDD:6G[@IgM+\P\|V)(]`:=uX%
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 6d 00 24 22 7f f9 95 a4 27 32 e8 95 97 8f 96 55 20 4b 07 27 eb 0b 75 45 d3 0b 60 b4 e8 00 eb 24 dd aa a3 e2 0b 80 34 22 c1 30 cf 2f e0 a9 d0 0c 96 67 67 a8 be b0 38 1e 58 a6 8e f3 98 d3 04 ee 8d 52 60 6a 78 9c 40 69 d0 f3 9c 60 dc 70 e3 5d 3b 0d 38 be 81 c2 8e 8e bd 82 74 8c 08 23 90 d9 85 45 41 b6 b9 3b 3d 38 3c 8f 88 8b c8 b8 b6 80 46 9b 8a 27 da f3 8d 02 a1 3b 0a 2a da d9 5c 83 50 32 8f f8 db 58 0a cd a9 19 c1 b4 15 60 9c e8 78 1f 2f f4 c9 4b 7e 31 f9 8e a0 b9 b9 e4 0b 7f ae 7e 79 ee ec 19 5a 33 4b 49 b4 c1 27 96 df 5c 37 dc d7 46 c7 36 92 d1 63 c6 18 20 bd 32 5a 53 a0 8b 9d 00 80 34 d2 11 cf d7 c3 83 6b 17 46 ea 01 19 c9 f0 44 bf 42 21 66 6b e4 2a 57 61 73 40 4d 80 d9 21 36 71 24 0b f0 db 73 0b 76 1c a6 16 82 ef 39 18 18 71 97 e6 65 7d ea e9 38 ee ec Data Ascii: m$"'2U K'uE`$4"0/gg8XR`jx@i`p];8t#EA;=8<F';\P2X`x/K~1~yZ3KI'\7F6c 2ZS4kFDB!fkWas@M!6q$sv9qe}8
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: 05 b6 ec 2b c7 de c5 fb 0e ec 23 1a 80 bd 2d b0 e5 95 8f 15 c1 dd 79 5e 7d 25 01 64 0c 2c 1e 4c 25 14 c9 be 43 5e a9 f0 ab ec 03 f3 d4 39 6b 23 bb 3f 29 be b7 06 80 c7 f7 4a 4f c2 20 32 af 3e 93 5a 84 02 db f4 42 d7 40 84 38 f4 53 b2 4a 2b 3f b8 eb b6 db 11 e1 65 dd 7b d5 5c 83 e3 b5 04 21 56 55 2d 60 a8 c8 43 44 04 97 0e 49 8f 88 75 f8 1b f6 92 af 6c ae f3 d6 2a 14 4f 1c fa 5b a9 47 36 1b 4a 1e a4 00 2b 57 57 52 30 e5 b3 b4 6a 9b e0 07 44 9e 2c b1 53 79 e5 0b e9 f8 6a 39 c7 5f 49 90 32 55 d5 b9 48 04 00 22 83 e0 bc c7 cc e0 4c 03 9b 17 c5 93 8f 2a ba fa 9c 81 18 54 aa 25 4a 2d 84 a1 ab a9 df a4 ee 11 84 89 0b a0 66 2f bc b6 e9 56 e1 fc ca 3d 9a ad 44 1c 19 ce 63 50 cd 24 95 28 c5 80 6b e4 4a 68 06 af 70 23 a0 05 a3 fa b5 67 7a 0c b4 3a 1d 1b aa 32 ba 4f Data Ascii: +#-y^}%d,L%C^9k#?)JO 2>ZB@8SJ+?e{\!VU-`CDIulO[G6J+WWR0jD,Syj9_I2UH"LT%J-f/V=DcP$(kJhp#gz:2O
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: a9 bf af b1 23 7b f8 e0 11 77 e9 06 f3 66 65 2c 17 6f c7 78 04 8a e3 dd 18 5d 5b 49 df da 56 c0 c6 72 33 8b 99 95 f7 fb a9 2a 8f 01 20 18 68 80 87 8f ba 84 99 ef 6f 6c aa 32 57 96 c2 68 c6 7d db 5c 90 53 55 8d d7 a9 b6 15 ca d9 56 58 6a d4 77 60 fb 03 19 7a 89 18 52 f0 7c 4e c1 2f e6 9e d4 47 5d de 1f 40 9e 2b b3 e4 22 7b c1 d3 e1 f6 66 7c 27 9d fe a9 38 c0 f4 4f f9 7b 2d 8e e5 4a 26 60 6b 91 99 cd cc c6 24 0c 4a e3 42 fc 2c 35 94 e3 c4 7b 51 31 f2 53 a0 9c fb 52 82 b5 30 f1 66 c6 95 45 1a e7 16 82 ae 12 84 e6 82 18 bf f6 44 e4 2d ae a2 52 e6 30 b2 dc 44 2a b2 95 87 58 0c 54 4c a8 99 85 38 f7 4d 08 dc a6 42 b9 29 96 db 08 c0 d7 37 85 b8 59 f9 01 44 47 bc e5 22 30 78 3e 54 ad 24 63 3a 1a f5 ab 5c 00 00 30 30 ef 07 f4 66 fe 35 62 1f de 4a 00 6d 0d b3 41 8d Data Ascii: #{wfe,ox][IVr3* hol2Wh}\SUVXjw`zR\|N/G]@+"{f\|'8O{-J&`k$JB,5{Q1SR0fED-R0D*XTL8MB)7YDG"0x>T$c:\00f5bJmA
2024-04-25 13:30:37 UTC	1230	IN	Data Raw: 23 2e 94 6b 63 39 4b 73 c9 49 03 d4 74 3e 51 9d 7a 83 42 cc d8 03 f2 18 5c fd 56 6c ae 5e 43 7c f4 91 43 94 7d 33 f9 64 35 83 2c 61 e3 ec e1 0c 33 5b b6 88 1d 4d 1c cb 45 27 4d 4a 4d 05 8d c8 b1 43 e2 72 76 f3 e9 ea 1b 58 d3 93 53 cc 7a 63 dd e7 92 0c e2 d1 86 30 92 f0 93 06 b4 27 d3 45 c2 22 36 e1 09 55 65 11 46 04 28 2f 39 61 c0 45 ed 9b 76 93 e3 a7 a5 01 cd d4 70 26 8f 99 b4 d3 67 ce 41 d7 7d 01 60 41 c2 19 80 89 1b f1 aa 48 2b c0 44 0c 23 36 ac e4 6a b3 c1 19 64 71 29 57 32 5d 82 15 b0 c6 b4 64 b9 25 62 2c 9b 12 d3 d6 87 03 9a 1c 33 b4 35 37 b2 e0 ed bd b7 1c 3c 7d ee 7a e5 9a f3 65 e4 02 1f b8 73 6f 80 7e 8d d7 9b fd 03 37 6c 61 6d 07 8f 5d 06 5f 63 93 38 32 1a 10 33 b6 e6 2d 1f 8b 84 54 22 d4 5b 4a 13 4b d4 f5 99 1d 98 76 41 67 a7 27 a7 df fb 80 99 Data Ascii: #.kc9KsIt>QzB\Vl^C\|C}3d5,a3[ME'MJMCrvXSzc0'E"6UeF(/9aEvp&gA}`AH+D#6jdq)W2]d%b,357<}zeso~7lam]_c823-T"[JKvAg'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49803	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	662	OUT	GET /static/img/product/products_icon/wdc-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	807	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 2040 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=2368 Content-Disposition: inline; filename="wdc-60.webp" Vary: Accept etag: "940-5e5da4d33990d" last-modified: Wed, 10 Aug 2022 03:04:04 GMT CF-Cache-Status: HIT Age: 55004 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B5T9LSCfK5tH3qRC2LRlPL4wzeWkyXAdcgMdD9zlyUPonmV0OA6oVpDIvzP8EL9TaZegSPNYI6TNDB%2F0%2FqQEU2FtXwz3v%2FLUDDZlwZDW3eKQUpsOf%2BGQm2f4sj5xKCL%2BvBB0LdA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0513d4453ff-ATL
2024-04-25 13:30:37 UTC	562	IN	Data Raw: 52 49 46 46 f0 07 00 00 57 45 42 50 56 50 38 4c e3 07 00 00 2f 3b c0 0e 10 df 07 39 92 24 45 52 56 73 cf 31 a3 40 27 3e 4b 70 76 4f 86 c1 aa 2c 35 e0 d6 b6 ad 5a d9 e7 5c c7 1d 42 0a a0 ff 84 88 06 68 81 41 e6 ee 57 f6 86 5e 5b 6f db e6 03 48 80 6a 4e ef d9 df 03 64 85 0c d2 7f f5 2e d9 26 01 c8 11 05 80 00 aa 97 6d db 18 6d 63 f3 d4 21 da 9b 9a bb 41 93 a6 2e 60 d7 66 db 63 5f 9b cd 00 00 40 1c 80 78 00 e1 00 d2 00 84 00 c8 04 10 0b a0 28 18 ed 38 f0 e2 91 8e bc 1b c0 bf 00 78 21 a3 5c 8d 03 30 76 54 86 c3 39 1a 8e 4a c5 74 34 a4 8b d1 ad 7f c1 64 6c 1a d2 b9 82 2b 50 0e 42 82 2b de 93 8e 74 a4 23 0d 19 48 07 e0 0d e9 99 a4 23 1d e9 28 e7 0c 2e c7 15 8c 86 74 b6 8c 2b b8 82 2d 43 3a d2 df 52 91 c1 65 74 35 36 1b 04 bf 4f a6 db bd e1 a9 56 2d 36 a2 16 5f Data Ascii: RIFFWEBPVP8L/;9$ERVs1@'>KpvO,5Z\BhAW^[oHjNd.&mmc!A.`fc_@x(8x!\0vT9Jt4dl+PB+t#H#(.t+-C:Ret56OV-6_
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: b5 fc 57 03 b7 5e 27 fc 8e a4 b7 c1 c1 de 64 50 08 59 49 52 2b 48 8f 59 5b 7f f2 d6 b1 7f 4f 96 c6 bf 99 24 28 4b ff c5 ed f2 bf 75 0e e9 1b d3 ff 58 87 80 bf cc d2 66 f7 63 e7 2f c2 43 e9 e8 16 23 e8 4b 1f 12 9d 4b 81 d2 ab 55 30 75 d0 e2 0f 58 83 2b 47 ef 1f cf df ce 5f 7f 23 ed fb 17 c7 ce cb d7 fc fb 7e 43 42 e6 c7 b4 5c c3 49 ef 6f ab 0e 6f f7 ed 6e ed 39 79 58 ff bb dd 9a 02 df ae 6e bc 5c 7f 58 00 1f e7 6b be d1 f8 dc 58 48 12 76 77 b2 e4 4e 72 7d 9a be da b9 81 1a ff ff a7 db aa 9d 71 8a a0 8c ce 72 90 b3 13 37 bc c1 6c db 5b 75 d3 d9 5b bb dc d9 b6 6d db b6 6d db b6 b7 87 49 77 ff 7d ba 47 bf 5f 44 ff 27 20 e2 ef da 99 e3 a6 cf f8 63 cc 75 da cf b9 a4 02 95 ea 87 af 84 d5 87 ad 9a 32 62 38 d1 11 53 7f 93 99 db 3b 88 f8 26 f8 1a 83 bd 72 5e 8e 5e Data Ascii: W^'dPYIR+HY[O$(KuXfc/C#KKU0uX+G_#~CB\Ioon9yXn\XkXHvwNr}qr7l[u[mmIw}G_D' cu2b8S;&r^^
2024-04-25 13:30:37 UTC	109	IN	Data Raw: ab b4 d9 a3 5b 97 2e 20 e2 b5 5b 8f a8 56 1d f2 47 92 89 cc 97 bf 18 40 81 82 50 14 00 0a 85 2f 8c 45 da 96 aa d6 9c 0a 8d 6a d1 b8 5c 87 62 91 81 8c 08 92 18 80 d4 48 c8 04 c8 87 98 3f f7 62 50 a0 e8 bf 6d 3a 60 47 c0 36 ed 5a 17 cb 8c 0c 64 45 90 cf c0 ac 0c c4 2c 44 0c 20 00 40 6a 20 15 22 c3 a6 42 00 20 03 31 e2 ef 49 00 Data Ascii: [. [VG@P/Ej\bH?bPm:`G6ZdE,D @j "B 1I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49805	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	661	OUT	GET /static/img/product/products_icon/wu-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	800	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 1848 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=2277 Content-Disposition: inline; filename="wu-60.webp" Vary: Accept etag: "8e5-5e5da5160f6e1" last-modified: Wed, 10 Aug 2022 03:05:14 GMT CF-Cache-Status: HIT Age: 81823 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OY3zCwkgZYv6iVkJb9zTmpRDx7U3UP6ycOBYR21AvXfsi1LsVV4QDIi5P707xzF09vx3hFbwCkWTCCpudxnP%2Bc8cSVGJKXXfUMKLP%2F4LlJd58dAZKtCmof8E%2BGsp5DXUHwxdFpw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb051382fb0c4-ATL
2024-04-25 13:30:37 UTC	569	IN	Data Raw: 52 49 46 46 30 07 00 00 57 45 42 50 56 50 38 4c 24 07 00 00 2f 3b c0 0e 10 f7 07 b9 8d 24 47 52 56 66 f5 ec 69 2d fd b7 ee 5e f7 9b 99 ed 2e e1 06 c4 da 76 db 36 1f 00 41 49 4e ef 7d ff 29 b2 51 ef 09 c0 4f c0 8e 64 5b b5 b2 d6 de c7 de c3 5d ff c9 3f 22 02 70 87 f3 ce 16 38 a2 00 10 54 de 77 b6 ed 56 ef 9a 74 8f 8e 52 6b a3 ee e0 46 6d ad b6 6d db 01 00 80 00 80 20 80 20 80 10 80 10 80 38 00 11 00 71 00 92 00 44 01 c4 01 88 01 dc ee 8a e3 62 b2 41 c9 90 95 2a 60 14 1c d3 99 d8 f3 fa 63 f2 8a d4 01 99 70 53 61 fd bb 53 a8 cd 68 01 be c2 29 14 34 99 29 69 10 22 e9 16 9d 07 d5 48 35 0b a2 02 e5 d3 c0 18 7b 62 23 aa 30 03 a9 30 e8 b3 59 24 d3 04 04 4c c8 04 a8 42 ae f2 93 ce af b4 7e 43 06 4c ff 90 23 14 c1 c0 93 4e 2d 0a 4c a6 04 75 ad eb 3f 33 03 f8 6f 3a Data Ascii: RIFF0WEBPVP8L$/;$GRVfi-^.v6AIN})QOd[]?"p8TwVtRkFmm 8qDbA*`cpSaSh)4)i"H5{b#00Y$LB~CL#N-Lu?3o:
2024-04-25 13:30:37 UTC	1279	IN	Data Raw: 79 3f 20 23 a1 82 39 a1 1b 5a 41 d3 d0 ea aa 9f b8 26 f4 1f 2e 75 81 4b d6 6d 3b d5 8e fc e6 ef e6 39 2d e7 36 6f 3e 30 51 79 d9 d5 54 2b 36 5f 9f ab b9 3d 67 e5 dd e3 d4 f1 35 1f bf 1f ce 6a 1f 76 db a2 9b fd f1 fd b0 7f 50 f8 72 71 98 b7 ad 25 05 40 f8 ef f1 e8 6e 58 3b 9f 5f ab f7 ff fd 89 81 16 6d 6b 87 24 c9 b6 6d ab 6d db b6 6d db 76 97 ad b6 6d db b6 ed 1e b6 6d 45 fc 19 19 d1 6f 33 4f f7 46 f4 df 81 db 36 8e 24 25 17 6f ae f7 3f 18 fc ff 66 af d7 ef 3f 7e fa fc f1 c3 db 7f 7e 3f 4f de 1f 77 b3 03 00 7b e7 d3 1f 5f ff 66 78 dc c5 81 b4 83 bd a3 93 33 70 fa c3 93 df f3 02 09 f2 dd e9 b3 70 81 83 bd 84 b3 ab bb a7 97 e7 e1 37 bd 04 b5 60 b8 ad 63 07 00 5d f7 07 78 f3 cc 39 17 47 09 a7 5f 78 78 f9 82 87 7a 77 05 c0 56 bb 54 d3 fc 70 b3 76 6d 48 ee 3d Data Ascii: y? #9ZA&.uKm;9-6o>0QyT+6_=g5jvPrq%@nX;_mk$mmmvmmEo3OF6$%o?f?~~?Ow{_fx3pp7`c]x9G_xxzwVTpvmH=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49804	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	662	OUT	GET /static/img/product/products_icon/was-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:37 UTC	797	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:37 GMT Content-Type: image/webp Content-Length: 2106 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=2413 Content-Disposition: inline; filename="was-60.webp" Vary: Accept etag: "96d-5e5da4ced490d" last-modified: Wed, 10 Aug 2022 03:03:59 GMT CF-Cache-Status: HIT Age: 60967 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ec13gYuO5ELKiJhJ9IcyD1RT2OGiFQgKLeMZxe5dlq4B813U6EjmVkpKTYGU2QKwyEYburfm1sRF3bAimnSvXna%2Bgt0IwMGtSU864vlXyC06jtvfuvhyKWbMxjFf9U6MMGxWMBI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0514e2e1355-ATL
2024-04-25 13:30:37 UTC	572	IN	Data Raw: 52 49 46 46 32 08 00 00 57 45 42 50 56 50 38 4c 25 08 00 00 2f 3b c0 0e 10 bf 07 b7 b6 6d d5 ca 91 6b ef 7d b7 88 90 2a 7e e3 74 40 ee c4 c4 df fd 5f 3d a7 0d b8 b5 2d 39 52 7e 55 8f 1e b4 d6 e7 e0 13 17 39 e2 91 00 26 29 08 73 35 dd 53 5d f5 21 36 92 a4 48 aa 1e 38 66 f4 e1 4c 78 17 d8 fb 77 e1 98 ef 66 76 b7 a7 5a aa 6d 6b cb 56 4d dc dd dd dd 9b 37 eb 96 b8 07 2e 80 48 23 91 3d ba bb 55 68 90 9c e3 ee ee e9 7c 01 00 a5 05 0a 25 25 28 68 88 2b f1 a2 ba 12 2f 5a 90 d2 08 49 82 34 48 89 2f 2a 21 49 11 c2 3a 71 72 f2 b8 71 68 6d c2 14 d8 2e f2 12 85 db 96 c3 ff 4e 8a b7 3b 8f 9e 4b 51 77 9e c9 8e e6 08 45 3e a1 48 5a a5 0b 71 8d 00 8d 18 05 25 fe 47 c6 d0 a2 8e 25 f7 00 58 4b a5 ca cc 4b 93 a7 b0 36 25 b2 11 c8 07 58 87 d2 52 25 6c 47 bd 2e c3 68 be 14 84 Data Ascii: RIFF2WEBPVP8L%/;mk}~t@_=-9R~U9&)s5S]!6H8fLxwfvZmkVM7.H#=Uh\|%%(h+/ZI4H/!I:qrqhm.N;KQwE>HZq%G%XKK6%XR%lG.h
2024-04-25 13:30:37 UTC	1369	IN	Data Raw: b7 ee c8 ec 54 77 2e 0b 19 4a 1f 39 3e 3d fe d1 d7 3a d6 e7 ad 94 9b b0 2a 34 49 72 94 71 ff 86 21 9e 59 7a 34 58 df 42 48 41 be 8b dc 67 4f f7 23 66 b7 fd e0 c3 96 cc 73 b2 be df 84 b8 c7 1b fc fa 50 3e 82 d9 d5 5c af e1 f1 eb c5 b3 6c d1 3c 68 ad 89 2b 09 45 fd 60 82 05 a7 ae 6d ad 85 d3 35 db b4 df a2 4a 8e 9b 26 ff 38 85 e8 ff 15 1d 72 0c 84 f8 04 c0 4f 00 de 35 2f 3f 55 5c 5f 79 ba 07 b3 07 84 50 57 b3 bb 19 33 b5 bd bf 7f 7a 63 b2 9d a1 89 05 b3 a9 fd 67 f9 f7 17 f7 f7 fd 4f 41 8b b6 b6 e5 69 c4 8f c4 53 42 8a 5b 9a 84 34 54 91 36 75 77 77 c3 06 77 67 70 97 ba bb bb 62 15 ac ee 8a 8d d5 dd dd bd d7 4d 98 e1 ff 99 ab 99 ab ef fd de 88 fe 33 70 db 48 51 da 59 c6 83 4f 18 fd 97 53 17 77 8f f6 84 02 fe 1b 2d 1d da b5 12 f0 28 a5 48 da b5 6f e1 86 a1 1d Data Ascii: Tw.J9>=:*4Irq!Yz4XBHAgO#fsP>\l<h+E`m5J&8rO5/?U\_yPW3zcgOAiSB[4T6uwwwgpbM3pHQYOSw-(Ho
2024-04-25 13:30:37 UTC	165	IN	Data Raw: fc f5 cb b7 8b 67 10 11 d9 47 51 4c 74 8e be 80 b9 30 77 5c 2f 17 d4 a1 ba d7 b8 79 24 37 15 31 9f c4 46 24 1a 71 d3 ac 88 b0 f8 5c 43 01 f2 60 f6 9c 05 0b 61 ce ec 1c 84 54 42 20 37 3e 2c 22 8d 23 49 51 94 46 e7 e4 66 11 42 20 af a9 80 10 00 6a 88 a8 64 ae 49 74 64 44 58 54 56 6e 4e 73 a2 24 4a 1f d1 5c 93 42 62 30 49 c9 6e 86 6c 88 34 04 72 6d 86 84 e4 f8 e8 28 48 4a c8 48 cb fa 1b 24 8d 16 25 c4 44 d3 f8 94 24 23 ce 2a 22 e9 bf 26 1a 01 14 16 64 66 a4 03 50 2c 28 fc 87 d3 fc df 22 00 00 Data Ascii: gGQLt0w\/y$71F$q\C`aTB 7>,"#IQFfB jdItdDXTVnNs$J\Bb0Inl4rm(HJH$%D$#*"&dfP,("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49812	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	392	OUT	GET /static/img/product/thanks-for-choosing/macfee.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	745	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 4776 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=4916 Vary: Accept etag: "1334-5e5da4a0392b2" last-modified: Wed, 10 Aug 2022 03:03:10 GMT CF-Cache-Status: HIT Age: 42004 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i11hc4PZJS7IGEM0dYHyb%2FSRi0n6g9W6ybD2qzxPkXvR%2Bufk%2FmHkHuLbmKgPrUjRuxxikTeDDSTuuv55SQa%2F4cx%2Bx8FWMFNL097Q5Dq0Dn5Lfgt48O%2BPSVL3%2BJP%2By45qagIiisM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0538fe2677d-ATL
2024-04-25 13:30:38 UTC	624	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 64 08 03 00 00 00 63 09 28 e3 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 02 f7 50 4c 54 45 00 00 00 97 96 97 9a 9a 9a 9a 9a 9a 9a 9a 9a 9b 97 97 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 62 74 7c 6c 7a 81 de 36 58 8b 25 39 a3 3c 4d 6c 7a 81 6c 7b 82 6d 7b 82 Data Ascii: PNGIHDRdc(gAMAaPLTEbt\|lz6X%9<Mlzl{m{
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 a5 12 29 8b 16 2b 7d 18 2b 85 00 0d cc 50 66 a2 15 2d ac 14 2c b9 1e 36 b6 1d 35 af 0e 28 af 30 46 b9 48 5a c2 4d 60 95 00 11 9c 08 21 a6 43 51 9a 9a 9a 69 7b 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a 55 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 32 32 00 00 00 00 00 00 79 1d 30 6e 1e 2e 96 13 28 9a 15 2a a9 18 31 fa c2 ca 8c 03 18 92 0a 21 87 30 3c 8d 3e 48 8d 43 4c a8 73 7b ab 7f 85 b5 82 88 cf 7a 89 ea ae b6 cd 61 73 c3 7d 83 c4 6a 77 c3 84 8c 96 86 88 9b 92 94 46 37 cf 62 00 00 00 fd 74 52 4e 53 00 0a ec ef 11 13 f1 e9 db ae 96 82 b3 b8 cf cb a1 a4 8f d7 a9 9c c0 89 78 70 6d 67 25 c5 c7 af 90 a4 7c 20 16 b5 25 43 3d 1a 0a 12 ef ec ff 51 4e 49 56 Data Ascii: )+}+Pf-,65(0FHZM`!CQi{U`122y0n.(*1!0<>HCLs{zas}jwF7btRNSxpmg%\| %C=QNIV
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 86 0c 76 15 02 85 41 a8 72 ef ad cb 56 a0 c4 09 8c c6 d1 d1 02 72 d4 71 0b e5 eb d4 0f 75 a6 5a 9d a5 54 a7 03 53 e0 a8 73 d4 e8 74 f9 60 6a 6a 4d 81 50 a9 30 99 ea 60 2b ee a2 0c 16 67 ae 7d 00 9e 9e 40 81 17 72 5c c0 11 21 ea 64 fd 0e 17 35 c2 47 be 1d 78 00 70 76 61 a3 bc 5d c2 da db e3 58 36 17 c3 47 7a 3a c0 03 61 2c 00 6d 26 57 87 8f 9b a8 e4 a6 57 27 e7 21 81 61 64 3f 4f 59 aa f8 72 b5 23 ca 00 8d b7 56 54 81 4f 9b 12 3e 2a 7c 61 45 b7 d7 dd bd b0 0a a8 c9 56 c9 b1 80 c8 cf 1e ef b7 bf d6 82 dc a2 3a 40 fd ae 07 75 fc 6d 2d 7f e6 25 63 82 8d 68 38 19 79 ea dc d5 70 df 02 01 82 9d 50 22 dc b9 72 ea 20 c9 71 96 83 8d 7a 5d 52 0a a0 dc 41 30 d5 90 0f c3 df 55 f1 f9 c6 78 94 f2 93 4a 60 2b 63 84 8e b3 51 1e 10 30 96 aa 24 c0 3f 80 aa c5 d5 df df bf 24 Data Ascii: vArVrquZTSst`jjMP0`+g}@r\!d5Gxpva]X6Gz:a,m&WW'!ad?OYr#VTO>*\|aEV:@um-%ch8ypP"r qz]RA0UxJ`+cQ0$?$
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 89 72 fc 12 45 85 bc cc 66 45 e9 ee 00 43 06 47 e3 a6 51 78 a6 21 44 51 3a 81 26 da 3d 76 7a a3 32 35 94 b2 76 3e 76 36 25 0a 36 f1 ac 61 31 ee a5 aa 32 df b5 80 f8 f1 9a 53 6f 83 f8 c3 ed 75 a9 a9 b7 6e fe 10 16 c3 0a 10 5c 10 11 e1 0a d1 08 92 89 9d c6 fb aa 74 2a 56 2e 21 9c 9b 8a 62 27 b9 46 1f ad c0 26 92 0c 4b 90 9f ca 69 3a 43 d9 e1 3c bd 69 bd 9e a0 c0 dc bc f5 23 24 1a 96 82 e8 ba a6 28 91 51 0a 71 11 57 14 e5 6a 3c 15 6f 14 64 3b 5b b9 86 78 96 e9 ea a6 4c c6 ce 98 1e a7 e7 af ae 5c a0 d5 74 d8 c4 93 86 df 53 34 ce 90 cc ea ef 83 79 f0 e6 0f c0 fc 62 2b 25 e9 66 6a 3e e6 1b 92 40 44 50 5a 80 18 75 ba 51 07 07 77 35 d2 c6 71 1f 5d e8 9a 49 57 bd 3e 7c b6 42 b2 21 2c 83 eb 72 02 46 b4 a3 93 ac d9 17 b6 91 cc 5b bd b4 86 65 a4 04 be f5 25 98 fb db Data Ascii: rEfECGQx!DQ:&=vz25v>v6%6a12Soun\t*V.!b'F&Ki:C<i#$(QqWj<od;[xL\tS4yb+%fj>@DPZuQw5q]IW>\|B!,rF[e%
2024-04-25 13:30:38 UTC	45	IN	Data Raw: 35 18 96 19 0c 8f 25 e2 6b c1 fc 27 0c 8f 26 8f fc 8d 73 84 11 fe a5 f8 1b 85 3a f2 a1 a2 77 e9 34 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: 5%k'&s:w4IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49813	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	390	OUT	GET /static/img/product/thanks-for-choosing/sign.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	738	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 1130 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=1498 Vary: Accept etag: "5da-5e5da4a2900ba" last-modified: Wed, 10 Aug 2022 03:03:13 GMT CF-Cache-Status: HIT Age: 42004 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jp6uSr8UIsG9hhkjSgbpxank3AJjE%2B0N5ok4SecO0L%2BcJa3Z%2F0ThzIJOHw6No2EtG%2Bkd2zuOWgqLp6PU7wIwo%2B3CaV6j6TSHT9OCKShYip0rxedgdrIdt4XA6SQ56fBQTYyfgL8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0538979136d-ATL
2024-04-25 13:30:38 UTC	631	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 27 00 00 00 dc 08 03 00 00 00 c4 28 48 dd 00 00 01 3b 50 4c 54 45 00 00 00 b8 c3 cb 00 78 d7 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 00 78 d7 00 78 d7 b8 c3 cb b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 00 78 d7 b8 c3 cb b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 00 78 d7 00 78 d7 b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 b8 c3 cb 00 78 d7 00 78 d7 b8 c3 cb 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 b8 c3 cb 00 78 d7 00 Data Ascii: PNGIHDR'(H;PLTExxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2024-04-25 13:30:38 UTC	499	IN	Data Raw: f7 b7 78 ad 01 56 8d c8 d5 2c cc 08 91 93 19 a4 a9 5c 1a 0e 95 73 50 a2 72 25 54 a5 ed a7 eb f1 4b 5a aa 10 2a 27 e4 ef 9d b3 e3 63 e7 4b af df 2c 95 9b 65 f7 97 3d 2f fc f9 43 5e c2 e4 d9 fb c1 dd b7 37 3d de 5f 0c ef 51 f5 00 b0 4b 12 a4 64 b3 f5 ca 23 92 16 3f e9 08 74 e3 59 d1 65 c7 7b af cf 7a bd cf e4 4f e4 24 9f b9 ad f7 86 61 18 86 61 fc 83 86 1e af 14 4f 6b 22 f5 d3 e2 bb 27 fd 08 f0 60 b3 2e 1d 6a d9 38 7c 58 6f af 44 f7 de 86 ee 65 9d ea df 5e 0b f5 1e da 10 aa 7f 7b 25 d4 7b ed d9 0d f5 fe bb 57 e7 fa b7 0f dc fb d4 be e1 fa b7 2c f7 7e 1e aa 4b b8 35 e0 b9 10 6a 16 36 a5 cd d5 5c 77 f4 6f 5f a8 5c 1a 3f a8 9c 83 2b 61 94 20 94 2a 84 43 fe ef 39 be 93 e3 fb 4a ce 77 93 5c bf 17 54 6e 16 d6 15 b7 bf f8 28 21 7a ed df 3e 9b fe cd f4 6f 86 61 18 Data Ascii: xV,\sPr%TKZ'cK,e=/C^7=_QKd#?tYe{zO$aaOk"'`.j8\|XoDe^{%{W,~K5j6\wo_\?+a C9Jw\Tn(!z>oa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49811	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	401	OUT	GET /static/img/product/thanks-for-choosing/drw-win-icon_77.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	732	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 529 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=682 Vary: Accept etag: "2aa-5e5da49ed303a" last-modified: Wed, 10 Aug 2022 03:03:09 GMT CF-Cache-Status: HIT Age: 57409 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlGtjDN2wKn%2BbgWcx9ALbotKNZm1L10bH6UdjX6w8jBUyDvZC0v%2FQKiJhqduUAQF3fPNdj48hXl1hrvICKyVdsqJdpsGasxBmCs88doJqqt3pmDui%2FXVbVb25ZqjanzhAeKMhTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0538c214520-ATL
2024-04-25 13:30:38 UTC	529	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1b 00 00 00 68 08 03 00 00 00 37 bc 7b 08 00 00 00 e7 50 4c 54 45 00 00 00 ff ff ff ff ff fe ff fe fd ff fe fc ff fd fb ff fc f8 ff fa f5 fe fa f3 fe f9 f2 fe f8 f0 fe f8 ef fe f6 ec fe f6 eb fe f5 e8 fe f3 e5 fe f3 e4 fe f2 e3 fe f2 e2 fd ee d9 fd ec d6 fd eb d3 fd e8 cd fc e1 bd fc e1 bc fc df b9 fc de b7 fb db af fb d9 ab fb d8 a9 fb d7 a7 fb d6 a4 fb d4 a1 fa d3 9f fa d2 9c fa d1 9a fa d0 98 fa cc 8e fa ca 8b f9 c8 85 f9 c6 82 f9 c6 81 f9 c1 77 f9 c1 76 f8 bf 72 f8 b9 66 f8 b8 63 f7 b3 58 f7 b1 54 f6 ad 4a f6 ab 46 f6 aa 44 f6 a8 40 f6 a7 3e f6 a5 3a f6 a4 38 f5 a1 31 f5 a1 30 f5 9f 2d f5 9c 25 a7 a9 aa f5 9b 24 f4 99 1e f4 96 18 f4 95 16 f4 95 15 f4 94 14 f4 92 0f f3 90 0a f3 8f 08 f3 8e 06 f3 Data Ascii: PNGIHDRh7{PLTEwvrfcXTJFD@>:810-%$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49815	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	392	OUT	GET /static/img/product/thanks-for-choosing/day_50.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	742	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 2403 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=3758, status=webp_bigger etag: "eae-5e5da49de6712" last-modified: Wed, 10 Aug 2022 03:03:08 GMT CF-Cache-Status: HIT Age: 40645 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q2z4y%2Bk0UHsBj8Yx05QL%2BYP1UITb%2FuJPoNqShPw7zDkUtGWtWrkIn6%2BhfFUVApqjf3ndpyLXcZLi9lBzSWsky8uD9BWMOnG66jJjV4BxiU5wyTivjwUdtXvXwfQdwQfNdBrKy20%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05399b7676c-ATL
2024-04-25 13:30:38 UTC	627	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 64 08 06 00 00 00 c4 e8 63 5b 00 00 09 2a 49 44 41 54 78 da ed 9a 0b 94 4d 65 14 c7 ef dc 19 af 92 c7 d0 d0 34 6a 22 91 1e 68 52 4a d2 4b 4a 5a ab 35 2a af 50 29 bd 86 f2 18 22 0b 23 8c 47 2a 94 92 42 e9 c1 90 47 88 28 45 b3 62 59 6b 86 21 79 ab 30 de 0c 63 18 33 5e fd c7 fa cd f2 75 9c eb 5e f7 5e 8f 6b 9d bd d6 6f dd 73 5f e7 7c fb db fb db 7b 7f e7 ec b0 b4 b4 34 d7 79 92 c7 c4 eb e2 1e de ff 24 3e 13 8b 44 d0 25 42 04 5b ca 88 24 d1 51 98 d2 4a b4 10 c9 62 80 c8 15 41 13 f7 79 b0 c2 2c 8b 12 87 a1 f0 7a ef 88 c9 e2 de 8b a9 c8 d5 e2 79 31 51 cc c0 55 de 15 ef 8b 3f c5 74 51 8f df 1e 15 bd c5 f5 30 4c 9c e0 bb 27 c4 7c b1 4e 8c 15 23 c4 34 91 2e e6 89 0e 22 4a f8 2c 61 e7 b0 46 ea 33 Data Ascii: PNGIHDR2dc[IDATxMe4j"hRJKJZ5P)"#G*BG(EbYk!y0c3^u^^kos_\|{4y$>D%B[$QJbAy,zy1QU?tQ0L'\|N#4."J,aF3
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 94 ae 58 23 8c f7 07 c5 0c f2 d1 0e 3b 45 a2 c4 4c ac 51 28 fb f0 fb 8f 2d 89 71 9c a8 8b cf ef 25 9c 46 70 11 5f a5 2c 6e 59 9d ff 67 8b 70 d6 c3 12 61 ca 4b 62 80 25 db ff 85 8b ee 32 15 29 4a a9 d0 8a 1f 65 a1 f5 70 23 d4 3e 82 c5 a6 88 ee 94 2a 7f 63 ad 0c e1 97 60 9d 68 2c b1 5b 34 23 48 6c b7 04 96 9b 50 b2 85 e1 2d df 88 76 22 ef 94 22 58 61 8e 88 e4 64 af 33 60 53 9e c5 47 53 f0 f3 13 62 8f 58 2f 02 16 ac bb 98 f2 25 81 a4 f8 a6 d8 60 0d f3 ac cb 18 b1 13 b7 ce 70 1b e5 40 24 c7 29 16 25 8a e0 f7 33 98 b5 68 16 79 3a 4a 04 4b 06 93 83 5a 8b 78 b1 86 eb 58 65 2e 63 29 90 f2 28 4e d4 e2 15 c9 13 a6 54 64 41 4e 13 35 45 18 33 95 2f ac 72 13 21 fb 13 fc 3a 9c cf 4b e3 16 1f 62 59 3e 3f 2d 54 0d 25 c5 3f 62 05 41 24 d9 b7 7d 14 0a f0 e7 03 1c df 81 05 Data Ascii: X#;ELQ(-q%Fp_,nYgpaKb%2)Jep#>*c`h,[4#HlP-v""Xad3`SGSbX/%`p@$)%3hy:JKZxXe.c)(NTdAN5E3/r!:KbY>?-T%?bA$}
2024-04-25 13:30:38 UTC	407	IN	Data Raw: 29 ab 1c c3 d2 c3 fc 79 86 58 9b da ea 6e 66 b9 82 70 1b 27 ee cf 85 83 21 7d 08 24 11 c6 f9 33 b1 fc 42 d6 dd ea 80 9f b3 e3 06 8d 08 91 8f 98 cf 2f 98 a5 40 a4 8d f8 d2 85 90 a7 c6 12 a2 73 83 dd f9 90 c9 c9 e3 59 e4 85 32 90 ec 6e 95 18 5c 25 01 9a b3 f0 ed ac 6e 96 e4 a3 c4 53 ac 83 dc c0 3b 1f bc cb 78 d1 96 e3 0d 3c 2f 59 43 51 d9 83 47 ca e5 8d f2 e5 28 a1 7d 19 16 4c 67 21 8f 13 b7 f1 9b a9 28 6f ec 57 ce bf 22 55 c4 4c cb 2c ef 67 81 fb 22 47 2c fb 9a 4c 5c 77 d5 85 ee 0e da 28 5a 9b 15 28 4a 98 a5 ce 58 66 3f 99 5c b0 d9 cc 13 96 73 b5 44 89 8b d2 af 95 46 89 ff 22 19 bc 12 8f 28 26 50 47 ad b7 c9 11 0d 58 dc 55 c9 d0 93 d9 eb a3 a4 7f 12 16 b9 f8 a4 d3 41 e7 74 d0 39 1d 74 67 5f 23 4e 07 9d d3 41 17 ec 0e 3a 5c cb e9 a0 73 3a e8 9c 0e ba cb bd Data Ascii: )yXnfp'!}$3B/@sY2n\%nS;x</YCQG(}Lg!(oW"UL,g"G,L\w(Z(JXf?\sDF"(&PGXUAt9tg_#NA:\s:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49814	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	383	OUT	GET /static/img/icon/icon_arrow_1f2238_18.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:42:56 GMT etag: W/"2ec-5e70897cedf1a-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18928 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YEDVIL6xXBGPB7ihj5xIGhzPUzoI4uuVM29ATiMx1lWZ0YUr8SOTGxOKjdHJd4eH9U71hc0mfBDUQ2zOQve%2FdQUZLIECS3EJ6ZElGBdtk6l9Mqh4thA1PXpcL5VpeZ9FF4usKwU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0539fbb78ce-ATL
2024-04-25 13:30:38 UTC	687	IN	Data Raw: 32 65 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 31 38 70 78 22 20 68 65 69 67 68 74 3d 22 31 38 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f Data Ascii: 2ec<?xml version="1.0" encoding="UTF-8"?><svg width="18px" height="18px" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g stroke="none" stroke-width="1" fill="none" fill-rule="eveno
2024-04-25 13:30:38 UTC	68	IN	Data Raw: 30 30 30 30 30 30 29 20 74 72 61 6e 73 6c 61 74 65 28 2d 39 2e 30 30 30 30 30 30 2c 20 2d 37 2e 30 30 30 30 30 30 29 20 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 000000) translate(-9.000000, -7.000000) "></path> </g></svg>
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49816	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	375	OUT	GET /static/img/common/icon_china.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:41 GMT etag: W/"55f-5e70893533665-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46948 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FMaCOuPNEUJS29V9Y7T9%2FZA3Hk1jU5GfuVjQYbSEmvf9mBaCg7YXgi59cvsHkU0Vm2FRfFc7IxzrCEiUF8434uz5Ul2eGCGv2nikFxsxgFiDumHIwHeGrXddcsy77Wu8cC%2FsmBs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb053acbc4515-ATL
2024-04-25 13:30:38 UTC	683	IN	Data Raw: 35 35 66 0d 0a 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 34 36 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 38 22 20 68 65 69 67 68 74 3d 22 32 38 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 31 2e 33 32 31 38 36 37 20 31 30 31 37 2e 37 31 30 30 37 34 68 31 35 32 30 2e 39 30 34 31 37 37 56 36 2e 32 38 39 39 32 36 48 31 31 2e 33 32 31 38 36 37 76 31 30 31 31 2e 34 32 30 31 34 38 7a 20 6d 31 35 32 34 2e 36 37 38 31 33 33 20 33 2e 37 37 33 39 35 35 76 2d 33 2e 37 37 33 39 35 35 20 33 2e 37 37 33 39 35 35 7a 4d 35 2e 30 33 31 39 34 31 20 31 30 32 34 56 30 68 31 35 33 33 2e 34 38 34 30 33 76 31 30 32 34 Data Ascii: 55f<svg viewBox="0 0 1546 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" width="28" height="28"><path d="M11.321867 1017.710074h1520.904177V6.289926H11.321867v1011.420148z m1524.678133 3.773955v-3.773955 3.773955zM5.031941 1024V0h1533.48403v1024
2024-04-25 13:30:38 UTC	699	IN	Data Raw: 39 33 33 36 36 31 2d 33 32 2e 37 30 37 36 31 37 20 37 2e 35 34 37 39 31 32 20 32 31 2e 33 38 35 37 35 2d 32 36 2e 34 31 37 36 39 31 2d 31 37 2e 36 31 31 37 39 34 2d 32 38 2e 39 33 33 36 36 31 20 33 31 2e 34 34 39 36 33 32 20 31 33 2e 38 33 37 38 33 38 7a 4d 36 35 32 2e 38 39 34 33 34 39 20 31 37 37 2e 33 37 35 39 32 31 6c 2d 31 35 2e 30 39 35 38 32 33 20 33 30 2e 31 39 31 36 34 37 20 32 33 2e 39 30 31 37 32 20 32 33 2e 39 30 31 37 31 39 2d 33 33 2e 39 36 35 36 30 32 2d 35 2e 30 33 31 39 34 31 2d 31 35 2e 30 39 35 38 32 33 20 33 30 2e 31 39 31 36 34 37 2d 35 2e 30 33 31 39 34 31 2d 33 33 2e 39 36 35 36 30 32 2d 33 33 2e 39 36 35 36 30 32 2d 35 2e 30 33 31 39 34 31 4c 36 30 33 2e 38 33 32 39 32 34 20 32 30 32 2e 35 33 35 36 32 37 6c 2d 35 2e 30 33 31 39 34 Data Ascii: 933661-32.707617 7.547912 21.38575-26.417691-17.611794-28.933661 31.449632 13.837838zM652.894349 177.375921l-15.095823 30.191647 23.90172 23.901719-33.965602-5.031941-15.095823 30.191647-5.031941-33.965602-33.965602-5.031941L603.832924 202.535627l-5.03194
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49817	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	662	OUT	GET /static/img/product/products_icon/whk-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/webp Content-Length: 2206 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=3044 Content-Disposition: inline; filename="whk-60.webp" Vary: Accept etag: "be4-5e5da4e915c1e" last-modified: Wed, 10 Aug 2022 03:04:27 GMT CF-Cache-Status: HIT Age: 58561 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysueiz9PbgkSl8pw%2F8LNL1UHoYgf5yF2%2Fj4qXIRDXoQZQW0F5NszOEiJkU36OGl0zAFjj6esE7%2FhP3GVFNYX%2BMxlpEVwLDFHxBmr9oX1mbZuqRmJNVQs%2F9qwfR5AoAo8xkxYEqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb053cad45082-ATL
2024-04-25 13:30:38 UTC	564	IN	Data Raw: 52 49 46 46 96 08 00 00 57 45 42 50 56 50 38 4c 89 08 00 00 2f 3b c0 0e 10 f7 07 a1 91 24 47 52 66 f5 ac 63 71 fc 21 ba ee 7b ff 10 1c b7 6d 24 49 92 5d d3 13 c7 e6 1f de fe e6 ea 80 14 49 92 23 29 22 6b b5 b8 f7 f1 87 77 14 ce ba 52 61 db 36 48 c7 bc 3b 00 10 02 f9 8a e0 0b 03 37 b8 82 70 83 5f 10 84 07 3c e0 06 81 80 30 70 05 61 20 df 34 0c 0c 5c e0 05 3f 10 b8 83 ff 20 c8 47 f4 f9 f1 d7 9c fe a5 4d ba 1d 31 17 3d 9a e4 d4 5c 64 8d c9 98 d5 ab 92 fc e3 24 d5 ab ec b8 91 64 f0 24 ea 98 4a ec 4a 2a cd 58 55 62 1b a3 6b 92 0c 6e 0d ab 82 09 96 24 6b d0 91 4d ad 31 8c 73 6a 74 4f 4d 75 d6 90 92 ba 2d 2b 59 8b 38 35 ac 26 3d 69 8c 15 b7 95 1a 4d b6 c1 52 62 b3 12 db 3d d4 cc ab ee d2 c1 49 f6 6e 5f 3d f3 da ee 95 64 87 1e 9a 54 ba 5e 72 64 7a 9a ac 5a 89 a1 Data Ascii: RIFFWEBPVP8L/;$GRfcq!{m$I]I#)"kwRa6H;7p_<0pa 4\? GM1=\d$d$JJ*XUbkn$kM1sjtOMu-+Y85&=iMRb=In_=dT^rdzZ
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 8c 0f f7 43 aa 47 53 e0 e8 5b ae fc 1c f7 c1 79 13 47 8d 9c 30 67 67 91 2d bf e8 c3 64 80 88 0d 0f a8 aa aa 69 69 68 c4 8d 92 7c d7 bd 59 fd 00 25 08 2a 95 3d a6 5e 70 e7 17 bd 9e 08 92 31 61 55 d4 3f 6a 15 9c 7d bd 30 cf f5 22 03 80 70 42 30 ac 1c be ab d4 5a f8 6a 02 4c 45 d5 0e a8 12 b4 1a cd 3a ef b4 96 bc 1c 0c e0 84 c4 38 d8 6b 97 cb ea bc 35 16 a1 35 b5 ab 02 a5 c1 32 ce d8 b9 c2 17 43 21 0f 32 81 7b ee 2a e1 6d f7 c7 a0 b4 aa 56 55 c0 d3 4f 1b 58 c7 8b e1 b0 0c e2 ad fa ee 2a 60 f5 57 c6 60 2a 5f 13 50 8d d6 e0 a9 c7 4d ac fd 70 12 e2 c1 5b 06 ec 76 32 a6 cb a3 71 5a e5 d3 0e 81 d5 d5 6a 2c f9 88 89 c9 39 9c 8c 10 b2 6b c5 97 8f 0c dc ed 60 72 cf 8e c0 68 75 6d ef bf ec a0 1a 5a 35 9a 74 d4 c8 e4 1c 49 c7 64 69 3b 06 13 07 1d b8 d7 c6 98 cf 64 a3 Data Ascii: CGS[yG0gg-diih\|Y%=^p1aU?j}0"pB0ZjLE:8k552C!2{mVUOX`W`_PMp[v2qZj,9k`rhumZ5tIdi;d
2024-04-25 13:30:38 UTC	273	IN	Data Raw: 98 b7 bf 99 86 91 6a df 11 95 85 9a 46 27 dc 76 58 5d 3b 06 82 92 ad 50 b0 e7 7a 17 6f 7b 3f 03 21 a3 c4 54 61 52 4b c1 13 5f 3b f3 4a 4e 8e eb 04 82 30 04 82 1d 46 1d 28 c9 73 7c 98 09 13 31 f5 aa 88 42 11 16 4d 42 93 df 17 e6 3b 1c 5b a6 66 27 25 67 4f 5a a7 77 e6 3b bf cf 82 f0 58 4f d9 55 55 01 61 b1 04 38 e5 43 71 1e 53 58 fe f9 d2 95 cf a5 c5 e6 bc c2 82 d9 00 1e 5f 3f c4 1f ff f8 c3 e3 08 60 ca fb 72 96 67 4d 3a 9d 89 e1 d9 d2 4f b3 40 3c b1 81 07 7f 24 22 91 00 b3 77 95 bb 8c 0c c7 b1 a6 92 f2 97 63 40 bc 45 83 50 85 7f 1c 14 91 48 29 bb ce dc f8 d5 5d 59 e9 fe b2 6d 4e 5f 80 f4 1f 0a 45 70 58 bc 06 02 3b a6 8d 99 34 69 4c 46 17 08 52 25 8a cb ce 5f 93 7f 53 b1 04 0a 81 1e 43 08 de 5c 5b 23 54 e1 57 ff 5a 4f 13 4d 53 24 49 d1 51 da 86 bf 05 28 fc Data Ascii: jF'vX];Pzo{?!TaRK_;JN0F(s\|1BMB;[f'%gOZw;XOUUa8CqSX_?`rgM:O@<$"wc@EPH)]YmN_EpX;4iLFR%_SC\[#TWZOMS$IQ(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49818	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	650	OUT	GET /images/awards/softpedia-wfh.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	813	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/webp Content-Length: 4970 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=5776 Content-Disposition: inline; filename="softpedia-wfh.webp" Vary: Accept etag: "1690-5e3c46ceb2c00" last-modified: Thu, 14 Jul 2022 14:07:44 GMT CF-Cache-Status: HIT Age: 59369 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2Fe9nFYqvqsYrFdvAKzW%2B8BYPf6IQj3wjhePBmFM6lDaemPARfyv%2FctJZQ2YLfOyQk0jm56w6c61ENuXrl%2BW%2BizuscObM4t3VrJiZyrZ9dxIsxwEEHdgs2yOqwsqkoTTgE3XDbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb053ff5906ee-ATL
2024-04-25 13:30:38 UTC	556	IN	Data Raw: 52 49 46 46 62 13 00 00 57 45 42 50 56 50 38 4c 55 13 00 00 2f f0 00 22 00 ff 07 29 92 24 47 52 54 8f da 93 ff c3 70 30 8e 3f 09 7d 00 56 75 57 56 27 0d c8 91 6d ab 56 ee 7d fe 70 67 44 fe 11 90 05 43 42 20 81 af 5c 5d 0b 72 1b 49 8e a4 8c 9e 59 2d df eb c4 f9 ef 95 16 d3 95 55 35 ff 61 fb b4 14 c5 4d 2a 5a 4c 28 4d c1 a4 49 2b 53 fb df 71 1e 66 42 b5 92 39 e5 30 b5 05 cb d6 34 4d 71 97 d6 b8 5a af 07 4f de b8 a3 6a 59 1f da 36 ae 5a 5b 2d e3 d0 93 fd ff bd 1b 71 43 5e a8 a4 6a 45 ad 54 2b 71 6f de 2d b6 e6 2d 1c cb de ca 8e cf 0b be 7e ec 71 ef dc bf 49 2b 53 1a ba 1b 69 49 48 43 77 33 98 06 53 77 d3 d9 48 1b 4e 49 48 83 b4 34 24 a1 4c 69 48 c3 9d 7f d2 d2 90 84 49 73 68 8a 61 30 bd fb 86 41 68 00 00 e8 00 01 10 00 cd 00 00 00 01 04 40 31 00 80 04 b0 00 Data Ascii: RIFFbWEBPVP8LU/")$GRTp0?}VuWV'mV}pgDCB \]rIY-U5aM*ZL(MI+SqfB904MqZOjY6Z[-qC^jET+qo--~qI+SiIHCw3SwHNIH4$LiHIsha0Ah@1
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 30 33 33 33 6c 0f 33 88 a1 6a 39 b4 9f b0 d0 b2 ec b6 68 18 76 24 b5 b7 83 55 7f fe 99 aa ac d3 bd 3b f1 fd 11 fd 87 e0 b6 8d 24 49 86 f6 ee ed 54 55 4f 1d f3 04 ea b6 6d 2b 6f 9b f3 39 5f 4a 66 7b 0c 29 43 8a cb 35 44 7a 93 50 99 5b 3b 86 40 29 cc 65 0c 1a c2 c9 53 98 5d 34 ca 0e bc 40 7f 05 0a 66 2a 48 72 4c 85 7b cf bd df f7 c9 c9 ff 7d 22 fa 2f 51 92 e4 ba 6d 06 e9 2a ba 1c 02 c8 53 c0 2f 78 7b 00 46 4b b5 6d db 0a c9 80 fa 19 7f c6 2b c8 fb 9b 2f 80 10 e9 ff ff 3f d0 29 b3 7b 6c 59 1f 8f 74 22 fa ef 5a 92 d4 b8 19 ac 5a e7 06 84 84 9e f2 01 fe 73 a6 32 38 1f cf bb 6f aa 74 d2 fb c5 28 db 7c 33 65 37 29 67 ab 17 25 87 e3 d4 e6 e2 19 e8 b7 3b 9e 0d 5d 70 91 a0 6a 9b f4 fc 01 53 83 f0 05 1b d3 61 1b dd 33 61 d5 0d 1d d1 c9 b6 8a 93 64 27 d1 73 43 7b 98 Data Ascii: 0333l3j9hv$U;$ITUOm+o9_Jf{)C5DzP[;@)eS]4@fHrL{}"/QmS/x{FKm+/?){lYt"ZZs28ot(\|3e7)g%;]pjSa3ad'sC{
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 0b b1 f0 8d 58 7b 23 32 7f 6c f4 db 91 f9 f1 88 7d 8b c3 33 e2 99 95 f7 45 d8 fb 51 ce 0f 46 23 1c 8b 18 09 ee b7 07 fb 59 17 be 6d 85 18 7a 3b 06 7e 23 56 be d3 db eb 6f 48 4a 14 7e dc a1 af c5 c0 07 d4 df 1c 66 a3 97 53 01 51 be 6a f2 f3 07 8b 08 7c 83 93 f8 09 ba 0c da fb 6f e6 20 32 3f cc f9 01 7b df b4 92 f8 79 eb 59 f1 13 07 fa ee 43 14 77 77 8d d2 26 43 fd 4a f8 92 c9 cf 58 08 0b df cb 08 4b 5f 3d 80 6d 99 cf 98 71 5f 06 30 0d 9d 95 51 8b 44 dd 0c a1 d4 3a bf 61 22 6e 8e 97 7e fd 57 22 e1 ab f6 fe ed 2d 78 d9 24 a2 f4 75 2e 48 1b c5 a7 c6 7c 9d 56 00 f6 e1 d7 27 0a d9 d0 7f ee e0 1f 4f e7 6c 74 0d a5 84 45 1f 64 9a ac 23 de c9 7c 14 04 12 04 d7 db 76 53 5d 86 04 2b 8b 84 99 f0 aa 4a 3a 15 f2 90 12 7e fd 24 e1 5a 50 c8 25 f7 b4 d5 31 fe dd 99 70 d4 Data Ascii: X{#2l}3EQF#Ymz;~#VoHJ~fSQj\|o 2?{yYCww&CJXK_=mq_0QD:a"n~W"-x$u.H\|V'OltEd#\|vS]+J:~$ZP%1p
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 2d 37 09 f2 48 5f ca 78 16 52 40 98 f9 ca 88 33 3a 0a a0 88 e0 8c 1d 82 5e 25 34 b6 5f da 12 51 b0 73 6c 39 21 02 a4 98 5d ac ed e8 d3 9b eb fe 5f cb 7c 14 35 a8 d6 6f 44 81 fe 4a cc 91 e3 12 9a 03 7a fe 90 53 5a 01 8a cd 63 cc c8 eb 3e af 90 02 12 d9 b3 7f 65 0b e1 0d 4a 2f c8 af 0e 01 28 38 8b 52 02 e0 82 c0 6e dd 8b 61 bd b1 70 99 41 92 04 e4 c4 0b 1d 42 8e f1 34 ed ae 62 1b 9d 38 7a 64 8c 6d f9 20 ca d8 02 51 02 a4 6d 0f 80 29 02 80 51 6d 2a e2 12 20 b1 ed db 2a 6c 9b 6b a9 16 3d 23 e0 34 57 a2 87 9d ee f4 4f f3 ef 79 04 4a c1 c0 43 d9 29 92 0c d9 cc fe 6b aa 48 0a d4 42 8b 59 bc a6 ab 8e 71 d6 4c 9e ae c7 8c b1 31 c3 d7 9d 45 e6 27 fd b0 a6 23 e3 d4 7a 44 a4 1c 00 d4 1c 29 32 46 b9 6a b7 7c a0 9e 11 62 cf 7d 00 fb 8d 54 73 a4 61 8c 75 ba 2d 31 55 71 Data Ascii: -7H_xR@3:^%4_Qsl9!]_\|5oDJzSZc>eJ/(8RnapAB4b8zdm Qm)Qm* *lk=#4WOyJC)kHBYqL1E'#zD)2Fj\|b}Tsau-1Uq
2024-04-25 13:30:38 UTC	307	IN	Data Raw: 67 e4 2c 57 86 84 e5 ce 10 b2 64 0c 27 96 92 e1 70 c4 b9 d8 41 38 60 09 2d 9a d8 49 41 b3 8d 9c a1 a7 b0 7d a5 c3 b9 74 17 1e b0 7b e2 9c 91 03 4f e7 78 cd 12 96 63 47 ca 27 85 fd f4 33 22 fa 59 45 36 c0 ad a3 90 4b bd 39 33 1c 41 44 d4 d5 59 b9 31 90 56 62 af 84 58 e7 0b 61 b5 87 dd 49 9c 7b 0d b9 e1 04 3b 5f 02 b1 96 52 c1 7d 8b f9 06 b2 53 e0 1f 68 49 58 05 b6 43 da 85 3d 45 db f4 0d b4 93 ee cf 08 40 e4 d6 e3 98 28 7e e9 ef 16 a2 65 c6 ee 0e 88 c7 44 ed 80 b8 f1 88 43 08 22 07 7e f3 51 e9 84 dd 85 3f f2 77 e0 80 97 cf f8 5a 6e 20 34 a2 8f 32 12 4b 44 ac c3 22 1a 51 e6 7b bc 46 62 2b 64 ac be 1e 2f 4d 45 be e1 15 06 e7 74 d4 e2 8a 82 73 42 96 59 11 59 1b d7 33 fe 0e 05 17 d2 ee 48 52 df 1a 23 49 be 88 90 a4 0e 5c f2 a2 0f f5 e0 0a ce ac f1 00 37 21 d1 Data Ascii: g,Wd'pA8`-IA}t{OxcG'3"YE6K93ADY1VbXaI{;_R}ShIXC=E@(~eDC"~Q?wZn 42KD"Q{Fb+d/MEtsBYY3HR#I\7!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49819	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	659	OUT	GET /images/awards/softonic_w365_4.5stars.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/webp Content-Length: 2744 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origFmt=png, origSize=3015 Content-Disposition: inline; filename="softonic_w365_4.webp" Vary: Accept etag: "bc7-5e3c46ceb2c00" last-modified: Thu, 14 Jul 2022 14:07:44 GMT CF-Cache-Status: HIT Age: 71210 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ulh%2B6fUfK3pPUoyujNw7QccEtaKmAJUbowUZDfnNuKl8HLJV%2FsODt9UOqXtKOEmfeAjhTytWVGiEEii1r14ky5H5ETVZYDe4yOm31%2B4lmCXYsWiJsLCMk4xb0YCiqhkrm3SNOnI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0547d19458d-ATL
2024-04-25 13:30:38 UTC	559	IN	Data Raw: 52 49 46 46 b0 0a 00 00 57 45 42 50 56 50 38 4c a3 0a 00 00 2f 9f 40 0e 10 f7 e3 20 92 24 45 ea 99 79 06 4f ef 5f 0d f3 77 b5 0d 87 01 18 b1 50 f4 ce dc 76 64 02 be f7 4f 72 dc c6 b6 ad 2a fb 13 d3 80 5b 0f d4 41 ff 44 1a bb bd 37 f7 bd bb 19 45 92 a4 28 1d 2c c3 31 bc ce bf c1 0b 01 39 f8 05 21 21 c4 22 94 00 56 24 42 48 11 fe 4c 50 b1 2c 21 60 c5 42 32 95 90 ff 42 40 09 c9 94 29 a4 48 7f ca 4c 50 a6 90 90 90 90 a0 4c f9 9f b0 4c e5 e8 12 23 02 55 e0 10 78 05 9a c0 23 10 04 16 81 26 90 13 c3 97 48 09 c4 c2 8a 81 95 10 82 29 94 4c 99 8a 85 f5 ff 61 5b ed 2c 6a 4c 13 3a ef 3a 0f 95 76 95 87 ca d2 64 4d 65 4d 17 61 d1 bf 4d 11 94 a4 2e c2 a2 fa ab 2c 54 11 16 75 31 65 51 45 58 35 1f 53 ff 75 5d 4c 59 4d 55 2c 92 89 6e 0f a6 fa 9b f6 67 51 16 1f df 1c a7 c1 Data Ascii: RIFFWEBPVP8L/@ $EyO_wPvdOr*[AD7E(,19!!"V$BHLP,!`B2B@)HLPLL#Ux#&H)La[,jL::vdMeMaM.,Tu1eQEX5Su]LYMU,ngQ
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 2b 41 a4 bc 99 01 4f 5e 7e 3f a9 d5 ff 82 d9 8e 7c 0e e4 25 d9 74 32 d7 9a 88 44 59 05 c0 d2 7f 95 b2 ae 10 d6 88 2f 90 8e b4 11 df 8b 7c 88 d6 73 65 6f 31 b4 45 a9 5a c0 43 45 fb c5 36 00 32 16 5f 20 94 57 cf 2b a1 9f 53 fd 05 f6 11 bd d4 7e 33 65 06 c0 b8 0b 24 2c fc 02 bd 3a 84 dd 23 55 4d 31 70 ea 0b b4 0b 7b c0 23 a3 67 8a b3 b9 04 f3 7e db 14 df 8b ac bc 01 d0 8d 98 4a d9 44 3e c3 cc 1f 20 63 ba 08 fd f9 0a 77 07 0c 27 99 40 5b ab b3 f1 12 eb 09 b4 fe 56 c2 b2 b5 cf 61 24 98 44 b5 c0 e8 3d 45 5d 98 03 c2 2f d1 2b d5 19 e4 01 1f a2 93 32 fb 0c 5d ad e4 21 29 4f 90 92 88 54 79 03 2c 1d ed 4b f9 4d cc 6a 21 b4 63 d6 54 38 dd 44 e2 79 8c d9 56 17 44 44 ba ec 22 e6 03 c6 33 73 29 48 68 66 c7 4e 92 32 7d ac 3f 9c ab 0a f4 3c db 52 10 39 76 8e dd 5e c1 ec Data Ascii: +AO^~?\|%t2DY/\|seo1EZCE62_ W+S~3e$,:#UM1p{#g~JD> cw'@[Va$D=E]/+2]!)OTy,KMj!cT8DyVDD"3s)HhfN2}?<R9v^
2024-04-25 13:30:38 UTC	816	IN	Data Raw: 9d 2d 50 07 70 29 b6 6d 5a a4 0e 00 87 02 80 ed 14 b4 5f 14 92 88 64 41 44 85 24 92 f2 2c e4 03 d4 d3 ad 58 ac b7 ab 21 70 9b ef e2 87 cc 97 2c fb af ef 4d f3 b7 aa b5 eb d9 3d ad f0 13 34 d2 dd 47 7e 0d f4 63 76 7e 08 cc ad 3f ff fa c1 34 bf ab e1 b9 3e 8d 4a 37 06 c2 29 d0 0e 4a 5f 90 ce ee 80 17 df 7d 63 9a 5f d5 9c 8f 03 61 dc 14 40 63 21 bd 16 44 c2 fa 74 62 9a a6 f9 5d cd c5 c7 01 89 d2 3f 0d 66 c2 97 74 94 f9 d7 cf 3f f9 a5 e6 e2 8d 89 f0 63 b2 8f d8 3e 27 af 13 04 af 43 b8 6f 93 7d 24 0a 9d 0f 8d a8 70 da 19 3a 55 56 4b 6e 05 6f 31 c6 71 87 ef b3 a3 e9 20 20 fb 82 f1 38 d8 47 82 c1 34 b2 f7 f1 de 51 ec 7e 70 44 4a d2 27 1d 17 6f 91 d4 87 c6 09 db 43 fc ae b1 08 c5 1e 4e f2 9c f0 3d 22 5c 18 5d 9f ec 61 b3 87 fb f2 01 f8 2f c6 bc 1e 2e b4 6a 79 3c Data Ascii: -Pp)mZ_dAD$,X!p,M=4G~cv~?4>J7)J_}c_a@c!Dtb]?ft?c>'Co}$p:UVKno1q 8G4Q~pDJ'oCN="\]a/.jy<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49820	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:37 UTC	652	OUT	GET /images/awards/si-award-epick5.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	743	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 10207 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=10740, status=webp_bigger etag: "29f4-5e3c46b7cf600" last-modified: Thu, 14 Jul 2022 14:07:20 GMT CF-Cache-Status: HIT Age: 47197 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sEtrqpk2VrOSTXKUBC%2FW977CLwR4AjQ6pWAyooTCyDsESye1PWegBURZ%2BEPj1JmzmB1wEJOIng9OACuI3kATba2eghCZVi26erwkojVFBfafkLx77m%2FAVCNdqXO8xDdD63To7RE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0548bb2b066-ATL
2024-04-25 13:30:38 UTC	626	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 03 00 00 00 99 1e b1 0c 00 00 03 00 50 4c 54 45 00 00 00 2f 1b 00 47 37 18 3a 29 0e 3e 2e 13 3d 2d 11 37 26 0a 6b 55 20 83 68 25 65 50 22 50 3f 1a ff e4 30 74 5c 1f de a4 08 c8 98 0f 84 67 0e 99 77 12 8f 70 12 a4 81 17 61 4d 0b 53 42 0a 6b 56 0e ae 86 11 d2 9f 0f e7 ac 07 b8 8d 11 bf 94 19 dd aa 13 e9 b1 10 ec b3 08 f9 c0 12 f0 b8 0d fe c7 17 f2 bc 13 77 5f 0f e5 b8 2a e2 b2 1d b3 8f 21 8d 73 21 f2 cd 28 ec b6 17 d5 a9 22 ff ce 23 f8 c6 24 f3 c1 1f ee bb 20 c7 a1 25 fe d7 2e f0 bf 28 fb ce 2f f4 c5 2d 3e 39 19 52 4a 20 a9 8e 2a ec c4 33 9b 82 25 7e 6b 1f db ba 34 ff dc 39 f3 d0 36 f9 d4 38 ce ae 33 e4 c4 3e ff e6 43 b0 99 33 ee cb 3e f4 d2 42 ff dd 43 fa d7 41 bf a5 36 5f 55 1f 6d Data Ascii: PNGIHDRPLTE/G7:)>.=-7&kU h%eP"P?0t\gwpaMSBkVw_!s!("#$ %.(/->9RJ 3%~k49683>C3>BCA6_Um
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 14 39 70 0c 2b 5d 01 22 59 01 19 49 04 29 68 07 31 73 06 27 4e 01 0a 29 00 11 38 08 0c 1a 1e 23 21 06 1e 3b 74 93 bd 83 a4 c5 ff ff ff f7 f8 fa ef f1 f5 e6 eb f1 df e2 e9 a7 ba d5 96 ab c8 b6 c9 dd ce d9 e7 ad b4 c6 93 9a b3 83 90 ad 73 83 a4 c5 c8 d5 a1 a9 bc b9 be cf c2 d1 e3 d4 e2 ee d1 d5 dd 55 79 b1 66 86 b3 56 77 a2 48 65 92 57 6e 98 66 76 95 35 55 85 30 55 93 53 5d 84 27 3b 5a 2f 41 71 3e 53 75 4e 8d af 75 7e 97 3e 50 88 35 77 9b 2c a1 de 29 a2 d9 53 4c 24 5b 49 26 61 4e 22 54 43 1b 47 38 19 32 20 06 31 1e 03 2f 1b 00 2f 1c 01 30 1c 00 3a 8d c5 35 00 00 01 00 74 52 4e 53 00 0a 9a 62 85 74 50 df f1 d4 b4 ff ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 9p+]"YI)h1s'N)8#!;tsUyfVwHeWnfv5U0US]';Z/Aq>SuNu~>P5w,)SL$[I&aN"TCG82 1//0:5tRNSbtP
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 03 41 21 91 69 57 d2 ac 92 78 0d 6b 8e b3 75 ae 4a 60 89 b4 b2 14 e4 fc 3e 93 ff 94 59 97 61 cf f9 1b 36 ad ea a3 52 d1 af 29 c3 a6 38 e5 0a 02 95 99 89 05 d9 2a 92 1b 5f f4 6a 7d c7 0c 72 92 4c da 15 73 fe 8d 19 32 67 59 24 1d 00 79 df 91 14 1a fa a1 e4 a8 73 e5 0d 1f 46 71 61 c8 79 b2 df fc d6 45 64 44 69 5d f6 80 96 38 b5 fe 66 36 f4 a6 a3 5b a9 49 81 4a 7e ef 8a 03 03 a2 28 63 9f 8d 23 10 65 4d 75 d1 cd df 8f 30 aa 12 bc 1e df 2d 73 f7 86 ef ce 9b 32 7b 06 f0 05 d0 8c c2 f4 d8 7c c1 94 5a ba 43 70 76 ad b1 31 c6 6f 5b 86 5d 48 bb 59 8a a4 32 19 ef fd a5 db bd 24 18 5e 79 b9 c0 20 90 a8 bf 62 92 ef aa fa f0 84 51 78 03 fd db be 50 35 b9 ce 2b 3e d9 08 5b c5 8e 84 f2 da 74 f2 d9 aa 90 86 fa 20 07 f7 0b ee 5f 70 1d 2b 5c 00 a1 bd 39 96 82 73 e3 36 38 bc Data Ascii: A!iWxkuJ`>Ya6R)8*_j}rLs2gY$ysFqayEdDi]8f6[IJ~(c#eMu0-s2{\|ZCpv1o[]HY2$^y bQxP5+>[t _p+\9s68
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 18 5c 54 ee 42 33 c3 6a 47 17 6c d6 4b 98 f2 da 5e 7f 98 34 cb 69 f2 98 18 8e e1 4d e0 18 08 c0 82 12 16 80 a3 17 b7 ad 9f 74 71 57 01 c4 b7 13 50 fa 32 24 3a 7e 60 60 b9 18 ad c6 b4 ca 9e 8c 2f 49 60 08 4c 6e 78 1d f0 e2 e9 33 9e e5 d4 95 7b 2f 4c 8e 9e 8e 98 b4 98 d2 4c 6f 4c c6 76 3b 05 74 74 77 b5 28 d7 44 56 90 32 c1 e5 37 17 cf 56 7a fb 64 d5 11 e7 a8 fb c1 e2 c0 05 89 d7 82 eb dc 75 db ad 9f 81 00 3b 00 77 c1 9e b8 f9 c6 15 7d 69 93 0a c7 eb 51 e1 c7 89 b2 bb 33 40 17 1d 06 10 17 6f be dc 30 10 95 c2 9a b4 e3 20 46 be d3 b5 6f 9c 19 1b 6c 5f 2f 2b b3 5e 49 2a 72 76 be 9a cb 5c 78 f1 27 1e 73 01 10 57 f3 5c 18 12 e2 89 aa 35 7b 8c 3e dd 06 80 60 b6 54 3c c6 00 79 f1 8e 36 e7 b0 c1 f1 20 65 80 fd b4 b8 68 c1 b6 ae dc ee 4c 92 29 bf d4 66 b2 9d 04 40 Data Ascii: \TB3jGlK^4iMtqWP2$:~``/I`Lnx3{/LLoLv;ttw(DV27Vzdu;w}iQ3@o0 Fol_/+^I*rv\x'sW\5{>`T<y6 ehL)f@
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 22 1b e9 b4 7b 1e 5e e3 c4 e2 b3 e9 52 a1 1c 8f ed 27 5b c9 47 f8 b8 5e 00 c0 fe 8d 3b 25 9a a2 3a ee f9 1e 5b 8b 5c 18 08 6c ca 58 d6 10 14 77 58 e6 9f 49 62 25 94 97 16 7d 00 a8 dc da 40 b8 3f f7 49 13 b4 b2 5c a5 57 7d 96 1c 61 0b 74 de 03 80 fd 58 0c de b2 08 95 38 7d 7a a9 ea aa 7b 45 43 f2 b7 56 bf 59 b5 a6 0a c0 2f a6 9e 63 bf 55 e9 11 95 0a 0e 12 9a ed a6 0c 3b 7f 10 51 0a 64 57 75 eb c8 bc db 7e 16 83 88 08 87 3c 4a c4 87 1d 8a c6 4f 22 24 d3 7d 9c 0f 81 f8 35 1b 6b 87 63 06 ab d7 84 9d 50 4a 5c 7c a9 88 29 fa 8f 87 e2 43 4e 06 b1 26 22 c4 3f bb cd 76 3a 90 11 d0 eb 3b 09 45 be e3 81 8c 60 d9 53 b0 9e 4c 80 b4 3a 61 54 df f9 20 00 06 c9 b7 1f f0 d0 34 a2 bb cf 9f 8e d5 93 c9 eb 55 b6 6e 3d a6 3f 2a 5e db 06 b0 a7 21 70 0e a1 54 ab d1 44 71 6c f9 Data Ascii: "{^R'[G^;%:[\lXwXIb%}@?I\W}atX8}z{ECVY/cU;QdWu~<JO"$}5kcPJ\\|)CN&"?v:;E`SL:aT 4Un=?*^!pTDql
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 6a 89 73 40 20 ad 03 4d 12 be 8b e5 44 80 c2 4a 4a 88 7b 4b 0e 34 03 40 81 33 a3 00 a0 1d a0 8f 10 31 4f 3f 12 30 31 ce 46 30 da b6 18 a5 30 c3 12 7e a4 28 72 bd 6c 99 70 d7 15 18 42 c4 50 5e 02 70 af 57 05 83 54 d4 8c a8 3f f7 54 40 63 99 1c ab 3c a9 19 20 8c cc f2 75 df c1 08 e1 91 0b 40 81 02 df ad 63 44 1a c0 8f 55 da 25 0f 4f fb a5 16 72 b5 a9 c0 b4 71 8a c5 d2 24 9d 5c ed 65 98 f9 08 59 0c 22 30 f8 74 32 f2 60 6a 16 00 4b 0f a0 2b 89 a0 00 cf a7 b5 45 0e 73 e3 d7 98 30 44 76 66 af 3e d2 1d 08 0e c8 a2 ec 74 ab a0 af 98 1b 14 6f e9 e1 d2 a0 74 49 8e 95 c1 90 b8 7b f9 2f b6 14 18 c1 74 63 0c 37 41 6d d8 85 09 00 c3 de a0 d6 25 0a 00 92 9e 0a d3 40 32 7d df 51 81 25 28 68 08 b9 6b a2 8b 33 40 0a be bc b1 03 92 e1 9a c7 29 47 1f 62 9b 45 58 4d a9 21 a6 Data Ascii: js@ MDJJ{K4@31O?01F00~(rlpBP^pWT?T@c< u@cDU%Orq$\eY"0t2`jK+Es0Dvf>totI{/tc7Am%@2}Q%(hk3@)GbEXM!
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 5f 1c a8 d7 20 f4 5d 3a f4 18 41 f9 c1 8b 1a b5 6d 19 80 56 bd 7a f1 a1 0e 96 23 2f 4a c7 bc 1c 5c 3f bd e1 bc e3 06 80 bd 72 db 05 d3 d3 3b 14 61 88 0f f5 3f 18 e2 f6 cb 99 ee 76 0a bf 86 61 a2 5c 8e e5 9a 43 5d 0a a4 a0 26 a4 50 33 11 21 32 ff 94 2f 2c 59 65 28 d1 10 58 4e fd e9 c4 d2 c8 29 76 34 e7 0c 80 61 74 fb d2 7c cc eb 13 9b 8b e1 8a 3c ea e1 6d 24 c1 4a f0 ff 56 da 54 4e 3a a6 5b e4 b4 3c 33 e8 79 61 9d cb 54 c3 c4 61 4e 44 4c f7 e8 06 63 09 e7 f6 c4 63 f2 ba ee 09 43 a2 cb e6 03 27 47 c1 e4 a7 8e d4 70 1a 35 79 fe 69 e3 dc d0 f7 50 20 20 bb 9d 42 a6 32 96 1d 2b 7c 0f 58 6e 86 54 be a5 0b 0a 42 5b 97 94 76 38 12 41 fa 2d 11 78 0c 99 3a 91 60 84 5a bf cf 61 08 0b 67 61 a7 35 86 30 b9 f8 50 15 43 1a 33 fb dc c8 8b 0f c4 b7 b8 02 ef 58 84 ad 92 77 Data Ascii: _ ]:AmVz#/J\?r;a?va\C]&P3!2/,Ye(XN)v4at\|<m$JVTN:[<3yaTaNDLccC'Gp5yiP B2+\|XnTB[v8A-x:`Zaga50PC3Xw
2024-04-25 13:30:38 UTC	1367	IN	Data Raw: 41 c4 6e d5 39 79 86 ae 10 3f 30 3f a7 91 1d 86 36 49 aa 65 78 34 c8 89 80 66 61 89 70 2e 33 20 6e bb 4d 00 21 ac 1d da 62 f8 57 db d6 f6 7c cc 00 76 7f f9 c2 8f 55 4d af f0 24 30 84 2d c0 1e 60 32 34 6e c6 33 e9 38 90 0f 2c 5a 68 da 22 74 d1 2a 71 49 b7 6a aa 47 04 e3 8e 4a a2 37 34 da c1 d6 5f 26 03 f8 bc 55 99 53 7e 66 66 1a 56 16 8a 05 c1 5f f4 51 67 b3 dc 43 0c 57 4d 00 9f 56 e2 e1 7f 0f 11 46 4a 7e fd b8 00 d0 02 5b 2e 8e 4f d5 8b 94 5b 1d 04 ce b8 e7 84 22 bc 21 33 a0 62 e0 26 38 52 cc 68 1c 14 57 55 40 60 80 29 9f 5c fb a7 cc bd 22 07 11 31 ce 04 31 33 42 1d 13 fd b3 90 0c 2c 54 17 01 f2 ad 72 27 24 9d 1e 2d 06 5e 34 e3 dc 66 46 6e 36 35 02 78 0e d2 d8 9c 5c 5f de 94 1d de c4 04 5d 65 22 37 91 fc 89 b7 d6 66 67 1c b4 66 30 45 4a 29 f1 ad b4 1b 75 Data Ascii: An9y?0?6Iex4fap.3 nM!bW\|vUM$0-`24n38,Zh"t*qIjGJ74_&US~ffV_QgCWMVFJ~[.O["!3b&8RhWU@`)\"113B,Tr'$-^4fFn65x\_]e"7fgf0EJ)u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49822	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	660	OUT	GET /static/img/common/icon_follow_twitter.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:42 GMT etag: W/"697-5e70893716cc4-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56041 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R1uhIkyjdqfS59CtzLy8JcN%2FhOLOPCY1ZNeggY1r2uy5QXnkkOkNgOn4yQcZe0ZAzXU5vr3pv2xh8j%2FtRY15HIZrBRMonzwkjH3kjH2PqecdAz3uzBMOqMb2m5l2%2FhhsZFlcUCM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb054ab7e6765-ATL
2024-04-25 13:30:38 UTC	683	IN	Data Raw: 36 39 37 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 33 2e 30 30 30 30 30 30 2c 20 36 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 697<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(3.000000, 6.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:38 UTC	1011	IN	Data Raw: 31 33 2e 31 36 34 34 39 30 33 2c 36 2e 35 32 39 39 37 34 31 31 20 43 38 2e 37 36 39 33 30 38 35 33 2c 36 2e 33 30 30 30 39 32 34 36 20 34 2e 38 34 39 33 36 35 34 38 2c 34 2e 32 30 30 30 39 32 34 36 20 32 2e 32 34 33 33 31 37 37 36 2c 30 2e 39 38 34 38 35 35 37 36 39 20 43 31 2e 37 38 33 36 30 39 37 2c 31 2e 37 37 33 39 30 39 30 32 20 31 2e 35 32 32 36 39 34 33 31 2c 32 2e 36 37 34 37 39 36 36 20 31 2e 35 32 32 36 39 34 33 31 2c 33 2e 36 35 39 35 35 39 39 31 20 43 31 2e 35 32 32 36 39 34 33 31 2c 35 2e 34 39 38 36 31 33 31 37 20 32 2e 34 35 37 36 34 31 31 31 2c 37 2e 31 32 30 32 31 30 38 20 33 2e 38 38 33 33 35 37 33 33 2c 38 2e 30 37 33 39 30 39 30 32 20 43 33 2e 30 31 33 36 33 39 33 37 2c 38 2e 30 33 39 37 33 37 34 33 20 32 2e 31 39 33 36 31 39 35 39 2c Data Ascii: 13.1644903,6.52997411 C8.76930853,6.30009246 4.84936548,4.20009246 2.24331776,0.984855769 C1.7836097,1.77390902 1.52269431,2.6747966 1.52269431,3.65955991 C1.52269431,5.49861317 2.45764111,7.1202108 3.88335733,8.07390902 C3.01363937,8.03973743 2.19361959,
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49821	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	661	OUT	GET /static/img/common/icon_follow_facebook.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	690	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:42 GMT etag: W/"374-5e7089362557c-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18928 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jT%2Fn93oeRUUHnhd6nC53lEPlOFfhSmnm4H4fmNZ3k4Ln7zWucm2iIIZH9V1a4ey%2BejBJlzspa3oAB48keTi85jjghNTkl4Lq%2BmilP%2Bo%2BCMJlMyC2vycXGK9b7E7Q1p0Kp58oiss%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0549fda1385-ATL
2024-04-25 13:30:38 UTC	679	IN	Data Raw: 33 37 34 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 2e 30 30 30 30 30 30 2c 20 34 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 374<svg width="32px" height="32px" viewBox="0 0 32 32" version="1.1" xmlns="http://www.w3.org/2000/svg"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(4.000000, 4.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:38 UTC	212	IN	Data Raw: 39 39 39 39 20 31 38 2e 38 30 33 2c 33 2e 36 32 34 20 31 37 2e 34 37 38 2c 33 2e 36 32 34 20 43 31 34 2e 37 31 32 2c 33 2e 36 32 34 20 31 32 2e 38 31 39 2c 35 2e 33 31 31 39 39 39 39 39 20 31 32 2e 38 31 39 2c 38 2e 34 31 32 20 4c 31 32 2e 38 31 39 2c 31 31 2e 30 38 32 20 4c 39 2e 36 39 31 39 39 39 39 39 2c 31 31 2e 30 38 32 20 4c 39 2e 36 39 31 39 39 39 39 39 2c 31 34 2e 37 30 35 20 4c 31 32 2e 38 31 39 2c 31 34 2e 37 30 35 20 4c 31 32 2e 38 31 39 2c 32 34 20 4c 31 2e 33 32 34 30 30 30 30 31 2c 32 34 20 5a 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 9999 18.803,3.624 17.478,3.624 C14.712,3.624 12.819,5.31199999 12.819,8.412 L12.819,11.082 L9.69199999,11.082 L9.69199999,14.705 L12.819,14.705 L12.819,24 L1.32400001,24 Z"></path> </g> </g></svg>
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49824	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	400	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_wdf.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	741	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 13008 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=14627 Vary: Accept etag: "3923-5e5da4ab615eb" last-modified: Wed, 10 Aug 2022 03:03:22 GMT CF-Cache-Status: HIT Age: 60504 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qJF4Owb7v6foFBG2mVTRiAFqVUK2V4gy49ReC3JtPqcmrn4Q74m%2Bg1wKMmCf8jTkKMJ3CTT%2FTruzULuiefkrUL70jXvJRVP0XZDok%2BMh6oUYFQ59toXFr8TBEPTSIahV%2BeA%2BKI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0570b04b033-ATL
2024-04-25 13:30:38 UTC	628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 6e 08 06 00 00 00 d1 79 b6 32 00 00 32 97 49 44 41 54 78 da ec 99 09 8c 5d 57 79 c7 7f e7 dc fb de 9b 79 b3 db 33 de c7 8e 63 3b 8b 03 76 9c 3d 4d 1c 70 9a 46 44 6d 09 69 0a 84 34 d0 86 a2 2e 2c 02 84 08 6d 29 a2 0b 85 aa 05 35 a8 90 16 b5 94 45 80 14 68 05 44 4d 43 59 12 92 10 48 20 69 e2 24 b6 63 3b 76 bc 8c 67 df de bc fd 2e e7 eb f1 97 5b 5f 4d 5c a9 a6 8c 2a da 72 a4 e3 73 ef d9 e6 fa fb 7f ff ff f7 9d f3 f8 59 f9 e9 2a e6 ec 37 7c 91 9f b0 ac 10 e1 cf 83 8e de 57 1a 1b 4e 20 72 0c 63 c6 81 51 df 4e 09 32 0e 66 1a 23 0b 46 4c 4d 60 01 43 1d 48 f9 59 39 ad 84 3f 19 9c c1 25 48 fa 09 8c b9 dc 57 7c dd e8 eb 15 00 20 08 60 b0 88 a1 61 60 1e 98 35 0a 12 73 20 53 06 33 21 30 8e 61 da 88 Data Ascii: PNGIHDRdny22IDATx]Wyy3c;v=MpFDmi4.,m)5EhDMCYH i$c;vg.[_M\rsY7\|WN rcQN2f#FLM`CHY9?%HW\| `a`5s S3!0a
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 8f 37 df f9 04 cd d8 51 08 0c 3e cb 02 5b 00 e4 94 6c 59 0b 51 2c 38 c9 d0 0f 2c d6 e4 06 4d 52 1d 20 08 0c c6 64 f2 96 b3 47 e7 01 39 42 16 35 6e ce be 9c 9c da 9d 01 e8 99 80 20 48 14 93 36 9b c4 b5 9a 07 a3 81 07 01 c4 a1 52 aa 6c 44 e7 81 ee fb 52 26 37 c5 89 26 1f 88 07 07 26 c1 f9 67 4e e0 df 41 66 44 98 41 64 1a a3 12 5a 5d 9a b4 f7 d7 ff 99 33 28 ff 50 0a b9 fd 8d 3b fb 78 d5 f6 5e 76 5c 78 1e 63 53 4d 5e fd 81 6f 31 56 49 29 86 16 db d9 8b 09 0a 20 19 00 18 2e da d4 cb 8a be 12 8d 76 4a 3b 71 ec 39 5e 63 be 1e 93 3a d4 00 1b 56 74 62 ad 61 7c be 4d 9c aa 99 c0 e4 62 15 58 8b 00 be 41 5e ca 14 c8 23 94 b1 6a 60 31 20 49 42 da 68 10 2f d4 70 4d 0f 42 14 81 73 88 31 39 08 22 18 44 5b 50 46 e7 ec 76 06 70 d9 98 f0 62 a3 c8 e9 bb 8e 01 c6 b3 c6 cf a9 Data Ascii: 7Q>[lYQ,8,MR dG9B5n H6RlDR&7&&gNAfDAdZ]3(P;x^v\xcSM^o1VI) .vJ;q9^c:Vtba\|MbXA^#j`1 IBh/pMBs19"D[PFvpb
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 54 e0 97 2f 5a c1 9f fc ea 26 2e de d4 cf fc 42 8b b5 41 c2 e5 83 96 a8 d2 d0 3d ea 11 ec ba 68 0d 5f fe a3 5d 7c e1 0f af e1 53 77 5c cd c0 ca 01 e6 5c 89 34 2c 12 3b 88 e2 c4 57 47 bd 95 d2 8e 53 65 d9 60 5f 91 52 d1 fa 1a 00 80 21 f7 5e 8b af 46 bf 33 11 47 aa 6c 03 0c a7 40 51 99 41 70 7e 2c 27 08 80 f1 ad cd e1 12 16 39 a4 c9 c3 49 1e 53 d5 3c 4b c9 10 11 93 98 02 2b fb 4b 6c 1b ee f4 c6 eb e5 1b 4f 4d 92 08 14 0c 70 8a a6 f9 07 14 fd c0 93 47 6b bc fd 55 25 7e e9 a2 e5 7c ee e1 51 76 6d 1d a0 bf 2b e4 0b df 1f e3 77 fc 69 bf 1e 0b 37 5d ba 02 49 85 81 40 88 46 a7 f9 e0 1b b7 12 84 96 ef fc db 38 1f bb 7b 8f 1a 6b 79 6f d1 33 aa c1 5b ff fa 49 fe e2 b7 b7 f3 d6 57 9f e7 59 3a ca 6c ad 8d 68 9c 10 4d ab 7b cb 21 a3 33 4d 4a a1 e1 cf 6e df ce bd 8f 9d Data Ascii: T/Z&.BA=h_]\|Sw\\4,;WGSe`_R!^F3Gl@QAp~,'9IS<K+KlOMpGkU%~\|Qvm+wi7]I@F8{kyo3[IWY:lhM{!3MJn
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: ab f8 e6 63 23 bc e9 86 2d ca 9c 7d 47 e7 20 b0 7a fe 7a e6 d0 0c 77 7d fe 09 d6 9f 3b 44 f7 49 00 ab 11 fb bd 84 0d f4 14 59 e7 19 35 3e be c0 b3 fb 7c 7c 3c 67 90 b5 2b 86 38 74 7c ce b3 a2 93 6e cf ac 8f 7f e9 87 3c fd dc 38 dd dd 25 10 c7 99 14 b3 e9 77 bf c5 19 94 03 5e 13 b7 6c 18 ea 60 db 86 2e 0d ee 0f ee 9d a5 da 4e b0 a4 08 96 a0 dc 07 61 76 fd 8e 60 8c 65 d7 f9 03 74 86 96 fb 1e 3c 42 bb d2 c4 39 34 00 0e f5 97 30 01 4c 34 1c a6 18 66 31 4a 6d a0 41 d3 2f d1 03 a3 4b 1d c5 2c 38 63 d0 b5 e2 6b 90 a5 39 82 f1 ef 29 06 bc b7 87 54 1b 31 71 e2 14 88 d8 af 25 3b a9 5b 03 b5 7a a4 ad 8f 45 9e 7d 11 ce 39 65 9f 01 05 ad dd 4e 58 37 58 26 8a 12 a6 2b 2d 04 e7 1d af ac 59 d9 1e 0f 5a 4f 39 e4 9a 6d ab 11 81 d9 5a 8b 75 43 5d 9e f1 3e f6 5d be 51 83 fd Data Ascii: c#-}G zzw};DIY5>\|\|<g+8t\|n<8%w^l`.Nav`et<B940L4f1JmA/K,8ck9)T1q%;[zE}9eNX7X&+-YZO9mZuC]>]Q
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: e0 3b ef fe f6 f3 18 2b 2a 77 21 3a 47 cf 22 38 c1 fc 7b 7b df 1e 65 47 71 de f9 eb ee fb be 73 e7 a1 e7 68 84 d0 0b f4 00 0b 84 00 f3 34 e0 60 9e 82 0d 31 81 c8 7b d6 5e 9f ac 8f 83 93 63 9b 64 d7 4e e2 dd c4 ce ae 77 bd 26 f6 31 de 25 59 0e 5e e7 8f 64 37 ce 71 7c e2 0d f8 38 18 e3 f5 c6 c0 82 71 08 02 4b 46 2f 8c 40 0f 34 a3 19 69 34 73 e7 3e ba bb aa f6 cb ef d4 e9 3a 7d 7b 26 73 47 5c 09 6f 92 d2 f9 54 d5 d5 d5 77 ba bf af be 67 7d d5 0d 05 b1 fe 38 69 86 06 4a a8 37 23 fa 2f 9d c4 60 db fe d7 43 0e e1 4a 18 e5 6c 23 52 92 69 62 e0 52 69 0c fc 7a 1b f0 72 3c 0e 8d 46 ec 42 9e b0 23 93 85 9b d4 04 70 f9 04 e0 48 7b e0 b8 d2 f0 d0 75 f9 6e 7d c2 46 00 63 5a 49 8c 16 c0 e7 3d 51 4e 50 c1 42 da 85 c0 07 2f d0 9a b5 c9 93 0d 49 0c 2a 78 12 85 e6 b1 20 38 Data Ascii: ;+w!:G"8{{eGqsh4`1{^cdNw&1%Y^d7q\|8qKF/@4i4s>:}{&sG\oTwg}8iJ7#/`CJl#RibRizr<FB#pH{un}FcZI=QNPB/Ix 8
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 7c 2f 60 67 ef cd 5e 9b c0 90 d3 40 4b 6e 74 bc 1d a3 9c f7 01 93 51 59 99 63 6d 80 58 91 30 59 5d 67 8c 6b 66 fa 16 5e 94 52 28 95 4a d8 b2 65 0b f6 ec d9 83 e9 e9 69 2c b4 6c de 74 3e 1e f9 c4 75 e8 d7 63 68 45 70 46 43 56 1e 65 1f 9c 24 b2 9d c9 75 e8 3d 41 0c 45 16 80 a9 08 95 52 0e 83 83 45 8c 9e 8a e0 fb 1d be 83 c9 52 d2 f3 12 64 11 48 18 47 85 24 c6 e4 a5 7e e8 2d 15 b9 bf 41 6c d8 b0 01 2f bd f4 12 c5 d8 42 cb 0d d7 5e 8a 2f de 77 31 e2 e9 63 08 95 93 ff ce 24 66 95 2d bc 77 6b fd 65 47 f4 56 64 21 36 f4 3d 0a 7d 39 62 f2 d4 4c c4 f5 8c 0e 9f 0b 19 26 70 a7 19 ac 53 71 0c 15 45 30 da 29 1f a7 3a 0d 7a 55 96 2f 5f 8e 55 ab 56 91 28 4a 29 2c b4 7c e0 9e 1b f1 a9 1d 6b 30 7d 72 0c ca f8 99 8d c3 19 fd 41 31 95 52 de 67 92 43 7c 2f d7 8c 99 91 31 26 Data Ascii: \|/`g^@KntQYcmX0Y]gkf^R(Jei,lt>uchEpFCVe$u=AERERdHG$~-Al/B^/w1c$f-wkeGVd!6=}9bL&pSqE0):zU/_UV(J),\|k0}rA1RgC\|/1&
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 87 bd 7f ff 7e c2 01 0b af 1e 38 00 0b 1c b3 6f ff 01 b4 fd 02 5a cd 06 ea f5 3a e2 28 46 97 85 d1 e0 56 ab 85 f1 56 8c 43 87 0f 63 ce 92 cd 2e 49 8b 45 2b b7 1d b8 eb 34 23 43 bd f4 43 22 c5 bc d5 37 27 db 18 3d d1 e0 46 19 a3 cc dc 0b 21 26 d3 74 0d 47 08 47 38 93 72 ae 6c 74 36 c0 f6 3b ee 40 37 a5 5a 2a e2 e0 ee c3 18 59 b3 16 ba dd 9c 37 90 e8 b8 04 58 bc 64 29 06 0a 35 4c 1c 7f 15 23 2b 46 ba cf 8e 70 b9 5b 29 1d 92 52 21 72 a0 42 83 7c 19 18 b9 cc f4 30 74 d2 0c a1 fa 0a 4c 3a 30 4a 93 53 a4 95 12 59 ac 4d 7a 0f bd 71 e8 e7 49 a3 d9 99 d2 31 6e ea 64 e4 36 97 63 c3 36 fd 88 ac c8 01 58 e7 82 00 47 8f 1c 46 63 7a 0a 93 93 93 24 48 76 d5 d5 09 7c 0d 8d 42 ae 80 4a b5 02 0d 83 e3 e3 27 a1 0a 6d 34 a6 4e 61 f7 ee 1f 63 aa d1 44 1c c7 76 3f 63 c0 38 58 Data Ascii: ~8oZ:(FVVCc.IE+4#CC"7'=F!&tGG8rlt6;@7Z*Y7Xd)5L#+Fp[)R!rB\|0tL:0JSYMzqI1nd6c6XGFcz$Hv\|BJ'm4NacDv?c8X
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 2c 9c 29 ee 45 c4 b6 ee 4c 11 e7 40 02 c7 c2 c7 9a b5 6b e7 b6 3e 69 65 a5 41 09 d4 a7 a7 39 e0 8e f7 de 8d 9b 6e bd 15 fb f7 bc 82 d7 5e 3b 88 76 14 62 a0 7f 00 1b ce 3f 0f ab d7 ae 43 a1 52 c5 ab 6f 1c 86 25 24 b3 1c 3f fa ab 1f c1 97 1f fa 03 94 85 a8 72 4c 1d f5 ce 2b ae e0 f1 e2 35 21 d6 a1 81 fe 5a 09 3a 04 b4 9e 7d 65 55 43 08 11 b6 f9 7c 17 2c 1f c1 fb 2f bd 12 3f 77 de 06 c1 53 d0 5b 82 10 45 c6 e0 92 75 fd 58 bb b2 82 f1 7a 88 7e 65 30 43 fc a6 8c d9 e4 d8 b3 88 87 23 90 6b 78 1d 72 cc 24 27 e0 fb b4 b2 f0 c4 13 4f 32 11 41 10 96 20 dc 08 64 3c 76 ad 9d 69 2d 63 e3 28 62 b2 f5 ad b7 dd 86 6d 57 5e 4d 98 ad ec d8 b1 43 d6 de 1f c7 9f fe cf ff 81 45 8b 16 c9 d2 ee 1e fc e6 27 3e 81 df fd f4 a7 01 20 15 76 cf 15 f9 5c 50 6d eb e8 22 9b 12 3b 13 b5 Data Ascii: ,)EL@k>ieA9n^;vb?CRo%$?rL+5!Z:}eUC\|,/?wS[EuXz~e0C#kxr$'O2A d<vi-c(bmW^MCE'> v\Pm";
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: e2 71 ce a9 ef 73 fc 85 ef 78 07 ae bb ee 3a 9e bb ff 9a 1b b0 72 c5 0a c0 15 be a3 f7 b3 ff f1 73 d8 f5 e3 5d d8 bf 6f 1f 7d a1 07 84 4b b6 5c bc 15 77 dd 75 d7 cf 00 41 7c 0d d3 ce 41 eb 90 e8 0b 0a 35 78 41 31 9b 5f 95 9a f6 9d cb 9c ba db 4d 9d 14 33 46 c5 f8 df e2 ac 4d 4c 4c d0 0f b0 22 08 81 b5 ac 24 b1 9a e2 aa 52 a9 80 a2 4a 8e 4b 56 5c e5 29 ba 1c 88 88 e2 58 1b c2 e7 18 00 ec 2f b1 3d fb ee ab df ff e2 17 f1 3e 59 b5 6c b6 9a 14 91 5a a9 b3 c1 21 7b e7 1f b4 11 68 1f 5b 04 6f bc 0f 26 ce c1 44 0a 7e b9 92 0e e8 64 13 a6 1d 03 70 96 a6 de e5 90 f4 1b c3 05 1e a9 7d ae b0 29 1a 0b 86 9f e0 fb a5 7b ef e5 ac 3e dd a2 b5 ce 80 70 9a 5d 89 a4 93 98 d2 27 b6 24 9b 78 de f3 9e 9b f0 d1 8f df 8f 07 bf fc 65 3c 2c e6 f0 7b ef be 3b 39 6f c7 bc 3d 1c f2 Data Ascii: qsx:rs]o}K\wuA\|A5xA1_M3FMLL"$RJKV\)X/=>YlZ!{h[o&D~dp}){>p]'$xe<,{;9o=
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 8e 34 7e 65 75 9e e1 24 80 f8 e6 07 cb ee d8 3c 88 89 86 c2 58 3d c4 81 f1 26 34 5c 2a ed 19 21 88 d6 3a 2d d7 4f 9f 78 99 eb 4f c3 c1 ca 8a a0 2c cc f5 1c 99 49 31 6b 31 20 c4 7c 0e 83 f3 aa 3e 6a 3e 30 a3 3c 54 a4 d6 a9 09 a3 31 1d 1a c4 1a e8 2b 04 18 2a e7 e0 9d 0d 4f 5d 94 3a 6b a5 54 37 36 ff 3c b1 23 a7 0f e6 33 4d bb 28 c9 4a a1 75 60 69 7c 88 78 e2 d6 67 f9 0d 6e 0a b5 49 0e cc 86 9c 77 52 79 04 96 e3 a1 c1 9e 19 85 22 80 89 50 0b 51 0a 08 e0 e4 7e a4 0c 77 29 6b c8 d8 99 1c ea 2d 05 e5 be 2a d0 6b 2b 8b b3 8a 0f b1 7e fd fa bf cf 01 9b 57 6c cc 8d f8 2c 11 6d f6 1f 6b 89 0e 10 24 6c 43 64 8b 2e e3 7d 48 9b d7 cf cc cc 70 ad dc 38 d1 c5 d5 c6 15 b2 3c 2b 04 e1 1a ba d5 27 e4 f0 6e 8b d2 e0 d7 7a 3e 72 6e 1e 07 1a 01 1a b1 c1 91 96 41 2d f0 10 6a Data Ascii: 4~eu$<X=&4\!:-OxO,I1k1 \|>j>0<T1+O]:kT76<#3M(Ju`i\|xgnIwRy"PQ~w)k-*k+~Wl,mk$lCd.}Hp8<+'nz>rnA-j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49823	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	400	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_wfh.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	744	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 11641 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=13565 Vary: Accept etag: "34fd-5e5da4ac515c3" last-modified: Wed, 10 Aug 2022 03:03:23 GMT CF-Cache-Status: HIT Age: 6039 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FxUeu2o7hj1id7Bku4KPItkRHAV8WBqpfhY82YAsCwi%2FDw%2BAjFgjtlncMFbHlkzvNSF1do23WQiE%2FKgW%2FUXHQPIpoSlLol%2BkzZxo4Bc1F2opDM8rhYYSmXaVN1Jnvx%2B1Rqphidg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb056f97969e9-ATL
2024-04-25 13:30:38 UTC	625	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 6e 08 06 00 00 00 d1 79 b6 32 00 00 2d 40 49 44 41 54 78 da ec 59 0b 4c 95 e7 19 7e fe 73 e7 0e 45 a8 57 44 c1 7b 0b de a6 51 1a b3 a6 5a a7 5d a8 5d 63 e2 74 6d 66 b2 ad 51 67 53 9b 0d 87 ad 6e 5a b1 9d f3 b2 ce b5 ba 58 15 52 99 32 59 d4 2e 2e d3 6a ec d4 45 41 45 45 d3 a0 22 4c 91 23 87 cb 81 c3 39 1c e0 70 2e 7b df 37 fc f9 ed 19 e4 00 42 d3 2d 7d 92 8f ef 3b df ff dd fe f7 79 6f ff 87 e2 74 34 61 00 b0 50 d1 1b de 57 14 65 b8 df ef af 03 e0 d0 e9 74 f7 00 94 d3 ef 46 2a 56 93 c9 fc 10 08 34 5a 2c 96 fa f5 1b 37 f3 21 3c f8 16 50 6c 8e 16 f4 23 4c 6d 30 fc 24 da db fc 5b af 1f 91 51 51 51 20 e1 a3 4b 04 02 08 00 5e 00 f5 34 c6 4e e4 d9 01 d4 52 cd bf 6f 53 5d 47 a4 dd eb e8 f0 34 84 Data Ascii: PNGIHDRdny2-@IDATxYL~sEWD{QZ]]ctmfQgSnZXR2Y..jEAEE"L#9p.{7B-};yot4aPWetF*V4Z,7!<Pl#Lm0$[QQQ K^4NRoS]G4
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 56 8f d1 95 14 63 ac 5c b1 72 75 63 6f 13 11 65 ed 3b 1b fa 64 19 1f 6c de f8 f7 b6 d6 d6 54 d6 bc 73 95 4d b8 68 6d c3 ca 29 b1 80 97 48 f1 f9 10 1b 1b ab 11 a2 91 21 64 b5 b7 b7 0b 71 14 84 61 32 1a 55 0b e1 38 c0 e3 b8 f4 84 34 a9 f1 35 91 16 3a 11 d1 26 fb c5 fa 95 a6 ce 04 a3 92 64 50 d3 19 d3 6c 54 1a cc 66 cb e5 f6 f6 b6 ab 5d 2d a6 dc 69 f4 a0 97 d0 99 75 f8 d1 50 8b 3f 8f 0f 50 54 5e 8b ac 33 56 4c 9b 90 88 ec b4 48 84 29 5e b4 fa 75 88 ea 26 a8 d3 c1 d0 dc dc 8c 73 e7 fe 89 bb 77 cb 11 17 17 87 94 94 14 0c 1f 3e 1c 83 07 0f 86 d9 6c 16 6b 3b 7d fa 34 92 92 92 30 7a f4 68 90 5f e7 79 b2 96 5a 13 fa 42 1a d7 aa 5b 15 82 a4 fe ef b8 c6 fd 7d 20 cc df dd 60 f5 1c ea 3b f0 fa 87 00 2c 45 10 14 8f a7 03 bd 84 1e 08 2c d3 2b c8 7b 68 77 e1 17 7f bd 81 Data Ascii: Vc\rucoe;dlTsMhm)H!dqa2U845:&dPlTf]-iuP?PT^3VLH)^u&sw>lk;}40zh_yZB[} `;,E,+{hw
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 7e 1c 7b f7 ee 65 52 38 09 91 bd 54 6b 51 c9 b9 7e fd 3a d6 af 7f 17 1b 36 ac 47 25 65 80 d4 fd 38 29 5c 82 dc d6 c0 11 22 82 f1 90 60 ae 5d bb 86 fa fa 7a f9 58 eb c5 bd 98 7c e8 ed d9 b3 07 73 e6 cc 41 6a 6a 2a 36 6d da 84 b1 63 c7 90 3b 8b a2 67 23 28 96 5c 25 61 5b 45 58 b3 67 cd 44 dc 53 83 e0 f3 05 38 fe 88 12 cc 98 31 0d ab 56 ad c2 ec d9 b3 d1 e1 69 05 81 15 42 c8 f2 79 bd 62 4d 2b e9 f9 8f 97 2f 17 61 95 5e 2f 15 c2 4a 4b 6f e1 e1 fd 0a 2c 7d 65 01 5e 98 ff 12 f2 8f fc 0d ab 56 ac 40 d1 a5 62 58 c2 2c b8 72 e5 0a 0e 10 99 bb 3f da 8d fa ba 06 94 97 97 e3 9d 75 eb 90 b3 79 33 2e 50 ec 5a b7 ee 5d 1c 3a 54 00 02 c7 3d be 61 90 db 86 bc bc 3c 4e c5 d9 a2 98 40 fe b8 95 3a 08 6a 1c 19 88 2c 4b 82 37 69 e3 20 31 f1 9a 1a 9b 98 69 0f c1 df 28 f2 0d a1 Data Ascii: ~{eR8TkQ~:6G%e8)\"`]zX\|sAjj*6mc;g#(\%a[EXgDS81ViBybM+/a^/JKo,}e^V@bX,r?uy3.PZ]:T=a<N@:j,K7i 1i(
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 60 00 44 40 b2 2c 2d ab 02 ef 2f a3 ab 07 b9 b4 53 02 f8 22 1f 27 9a fa e1 0f 7f 38 00 d2 48 10 6b cd fe 59 f9 10 be 59 91 d6 c9 64 ca 12 5c 32 f2 54 0d c6 e2 89 af df 8c ce d8 29 73 13 e6 07 62 a6 72 f0 c0 c4 8c 6d d2 d3 65 14 16 22 3f 96 7a 96 ec a2 30 d5 fa 8d 63 ad 62 c1 63 4d 96 f9 ed ed 6d f6 5d 3c df 2c 80 32 18 3f 3f 0d 09 0f 37 84 42 20 ff 38 36 5b ef 54 62 e1 e2 d6 42 12 c0 1c 3b 76 1c 2d 34 17 0d d1 6f d3 a9 b3 2d 0d f9 c4 3b 1a 8c b9 50 53 43 6a 30 16 0f 48 bd d2 a6 70 f5 cd b7 38 99 12 d3 f0 6e a7 ba e2 db 92 83 2c 52 43 a2 28 86 87 47 1c 45 e8 0f 06 3c 27 40 bd 9b e9 e7 a6 21 80 87 25 8b 4e b7 8b fb ef 3b c9 e1 2f 37 01 e5 dd 4c 8b d7 90 fd 4d 17 9b 2a ce 48 45 22 de ed d4 a6 21 de b9 b0 d4 cc f3 8b a9 65 29 00 a3 9d 1d 6c 6f 6d e3 d8 d1 23 Data Ascii: `D@,-/S"'8HkYYd\2T)sbrme"?z0cbcMm]<,2??7B 86[TbB;v-4o-;PSCj0Hp8n,RC(GE<'@!%N;/7LM*HE"!e)lom#
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: c1 ce 5e a3 af 25 ea 14 a7 3e a6 18 43 43 90 28 4b 2d e3 e6 4e be 98 e2 a2 b5 84 5e af 2f e0 58 cf 11 8f 42 a4 bc 30 bc a0 9a d1 68 00 51 67 bf 7b e7 0b 4b 91 a0 04 f2 75 48 e2 c8 43 57 5a 62 ad 93 71 98 0b 8c 9f dd 6e ee 43 93 e4 fa 41 4c ea b7 84 3b b1 c2 35 a3 b0 6e 7a 48 92 2e a0 64 be 9d 17 80 38 f0 db 06 e0 cb 1d 48 80 18 0e 43 cb 00 05 20 04 7f ac df 4e b1 e5 3b 50 8b aa 65 11 91 84 be f2 45 06 e7 24 f6 ce ca be 63 0b 78 74 44 da 55 83 f9 6d e5 07 01 ac 4e de 04 64 e7 14 d4 2c 88 e4 1b e3 d0 b7 1f d3 46 1e 1e 96 5c 08 77 cb e6 44 d0 46 b9 c5 89 9e c7 67 1e 3d 80 2f bd a9 f1 c6 98 d0 ad 80 55 5a fc c8 ee 28 d1 f1 76 54 df 1b 34 6e e5 1e 5b 86 30 b5 11 3c 22 d1 a2 8d d4 22 b3 31 00 87 78 de 80 10 91 3c ab f4 c8 d9 73 c8 7c 8c ed 9c 2a 3f e1 e1 a0 51 Data Ascii: ^%>CC(K-N^/XB0hQg{KuHCWZbqnCAL;5nzH.d8HC N;PeE$cxtDUmNd,F\wDFg=/UZ(vT4n[0<""1x<s\|*?Q
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 24 19 4d 92 78 e6 3b 2e 13 79 cd ed f8 da 41 fc fe 43 1d dc 98 58 bc 74 dd 61 50 09 9c 64 f5 5a 49 69 3d 83 c3 6d 49 38 7d ed 3f 48 d5 16 42 27 d2 45 79 8a 40 73 05 24 f7 62 90 e1 8a 1c ae 32 03 1a ea 27 9a b6 48 35 9d 7c 3b 58 5d cd 7d a8 13 39 1e b7 f8 8b 3b 5f b3 cf ad c5 13 87 81 df 79 a0 83 9b 5b 63 8c c6 13 0c fa bd e6 c7 cb e4 23 69 ce b9 f2 98 11 4e ad ad e0 13 27 35 2e df 2a 70 d5 24 58 ea 54 4f b3 93 c3 8e ea 62 bd 88 30 f5 d8 83 07 0a 51 91 62 a2 62 f1 30 6c d7 6c 61 e6 5f 5c 0c 5f b8 89 3a 5d b8 3c 87 0a 4e 9d 38 22 82 68 4b c4 73 33 20 da 56 6d 09 0f 37 d4 3e c9 38 c8 b9 89 32 c9 13 74 85 08 6b 85 25 17 fa bb f0 1f 1e 03 ef f0 d4 d1 04 4b da e0 e2 28 e5 e7 01 aa ca 72 58 7e 96 1e d6 92 68 8d 77 16 eb c3 14 67 8e 1c c4 af 1c 77 b8 7a 99 50 58 Data Ascii: $Mx;.yACXtaPdZIi=mI8}?HB'Ey@s$b2'H5\|;X]}9;_y[c#iN'5.*p$XTOb0Qbb0lla_\_:]<N8"hKs3 Vm7>82tk%K(rX~hwgwzPX
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 3c 4e 9d 3e 80 a7 3e 7e 16 b7 53 8b 22 2f 60 38 3c 54 10 22 00 99 73 12 6d a5 56 0b 08 e4 80 24 f2 88 f5 ae 73 ca 7c e6 01 ca a6 b2 46 5f 14 a1 36 a4 e6 fa b0 b5 ed 0c f0 2f d7 a6 f8 b5 57 d6 f1 89 c7 4f e1 75 ae 5b 8d 46 88 35 e1 d9 e3 03 28 65 90 a6 19 76 a6 06 4b cb cb 38 7d e4 5e 7c f3 d2 26 fe e6 c2 9b b8 3a e9 60 79 29 af cc 98 c2 fa 28 43 96 e5 40 dc 05 92 3e a0 13 19 d7 20 04 b3 45 bb 81 49 06 7b 03 f2 85 ff 75 77 8c c9 52 a2 ca 90 90 c1 20 3c f4 d8 31 9c 39 af 90 4d 0d a4 4a 0a 08 f3 b7 72 87 58 7b 59 17 a0 ca 99 ab 4a 13 b8 31 00 96 9b f2 30 ce 4b 8e 60 d9 bc 15 04 9b 5b ec 64 24 ef 6e 68 c9 98 21 94 87 90 b2 85 6c b6 d3 74 75 18 5b 42 78 bc 27 35 b9 24 b1 2a 9f 62 3c 1d e1 4f ae 10 b2 0c f8 cc 93 27 b0 de ef 60 38 4e b9 da cb d7 90 67 ce 0e 1d Data Ascii: <N>>~S"/`8<T"smV$s\|F_6/WOu[F5(evK8}^\|&:`y)(C@> EI{uwR <19MJrX{YJ10K`[d$nh!ltu[Bx'5$*b<O'`8Ng
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 9e cf 18 a4 e2 97 6f 80 b3 7c ce a0 12 ce fb 7d 19 36 9e 20 c1 58 4b 99 1e 14 44 d2 b2 08 92 20 a8 a2 a8 22 20 b0 02 2a 9c 00 f8 8b 7e 29 84 f0 df 82 71 1f 02 42 21 c8 4a c8 10 b2 bf c1 68 20 6e fd 88 d6 54 48 81 c1 c0 c4 50 62 7c 7c 26 fb 69 b0 f2 c3 c4 50 14 bf 5f 8c 60 74 00 6f 3e 78 27 c5 23 ad 0e a0 25 13 0d aa 09 82 8a a7 7c db cb 75 d6 f8 7d 00 77 86 ac 1e 80 f0 c9 c2 97 27 fa 68 27 5f b6 95 6f f7 59 12 94 71 c5 65 2f d4 81 60 cb 84 6f 1f a5 e8 b8 c5 7f 33 79 f6 53 49 a0 cc 98 b6 3b c8 89 bc 03 01 41 d4 e0 a7 c5 ca 49 af 37 56 d2 51 47 d8 d7 00 72 bb 0f 27 02 ac 7a 07 40 82 71 0f 02 ca 6d 10 72 03 48 a8 f2 b8 5f b3 b6 d7 5c 1d a4 86 02 c5 a3 cc f8 8a 66 d4 3d 3b f8 61 33 be bd b4 36 08 a2 10 49 3b e1 e8 7c 3f 05 71 5f 05 7d 7f bc 7c 86 10 ed 3e 04 Data Ascii: o\|}6 XKD " *~)qB!Jh nTHPb\|\|&iP_`to>x'#%\|u}w'h'_oYqe/`o3ySI;AI7VQGr'z@qmrH_\f=;a36I;\|?q_}\|>
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 25 44 8d 22 a9 24 b7 58 67 b3 45 34 90 5e 26 40 c9 11 e6 ac b4 ce c2 be 1d 53 f4 06 01 d7 ed ae 10 a2 d3 fb 4d 1d a8 da 74 62 a1 dd 6c b2 7f e7 0c cb 1b 2d ea 01 94 09 98 72 2c ce d5 5a ec ac b8 28 f1 59 9c 76 a9 75 23 6a dd 21 0b 55 97 7e 94 e0 69 cd 52 d3 a7 e2 68 16 a6 3c 5a 83 88 2a 30 e3 5a d4 36 43 10 2b 9b a9 ef 9f 18 a6 83 c2 30 5d b1 b9 7e d7 34 53 6e 85 1f d4 1f 01 e0 d8 7e cd 6b c3 0b 6c 60 30 b1 e1 eb 6f f5 b9 e5 d0 14 1e 06 03 58 41 c2 f3 ed 80 c0 18 64 32 21 c5 d9 10 c6 b1 3c f9 d2 09 17 a5 b2 2c d3 34 7b 03 f5 9b 3f 9d b1 59 38 9c 1a 59 07 5d 54 37 a0 93 28 48 86 60 52 97 05 c4 a0 5d 88 53 b7 85 ad 0c 87 67 14 0b 65 45 62 84 56 df 67 6e 7a 86 f9 e9 69 bc c4 67 ad e3 13 a1 d8 5b b1 58 eb 05 20 0a d7 b6 b8 18 86 5c 68 47 cc 5a 03 ba 7e c4 b9 Data Ascii: %D"$XgE4^&@SMtbl-r,Z(Yvu#j!U~iRh<Z*0Z6C+0]~4Sn~kl`0oXAd2!<,4{?Y8Y]T7(H`R]SgeEbVgnzig[X \hGZ~
2024-04-25 13:30:38 UTC	64	IN	Data Raw: 46 6e bc f3 3b 98 e4 56 6c 4f 03 10 0d 7d 42 7f 1d a4 46 3a b2 59 49 8d 3d 5a 24 6b e6 c4 f3 9b 2c 5e d3 06 3e fc cf 6e 1d 0f fe 09 22 cb 74 60 de 9f 26 1f 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: Fn;VlO}BF:YI=Z$k,^>n"t`&IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49825	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	400	OUT	GET /static/img/product/thanks-for-choosing/thanks_box_365.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	730	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 5644 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=13631 Vary: Accept etag: "353f-5e5da4aa7587b" last-modified: Wed, 10 Aug 2022 03:03:21 GMT CF-Cache-Status: HIT Age: 55005 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJnnG42gkK7cXWbOTiup8xj8jOCEl1gCQoWtliJXd9fXHpOJ8bIeFMbYCgJiHjKIkxp3zUO0kEKIObG1WLwz3xgXKVHFP0CRcqCJkpOqNr8atHojD5Zl3twJxjf1hqfs6CIFxmE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb056fe6e136d-ATL
2024-04-25 13:30:38 UTC	639	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 6e 08 03 00 00 00 e6 a7 46 00 00 00 02 fa 50 4c 54 45 00 00 00 fc fc fc ff ff fc f7 fa fe ff ff fa cd de f2 f1 f5 f9 e9 f0 f8 e6 ee f7 e1 eb f8 ed f1 f7 e0 e9 f5 d9 e5 f3 e8 f2 fd e2 ef fd ed f6 fd f2 f7 fd fa fd ff b2 d0 f3 c3 d9 f4 a7 c8 f2 d5 e7 fc c8 de fb 83 b5 f1 6a a0 e1 6f a5 e8 98 c0 ee 90 bc f5 7c ae ed b9 d7 fd bf d4 f0 ab d2 fd 64 9d e6 5c 98 e5 55 94 e3 4d 91 e4 48 8d e3 41 89 e1 32 7f de 3b 86 e2 0f 6b dd 00 60 db 17 70 db 1d 74 dd 25 78 dd 25 79 de 25 79 e0 25 78 dc 24 77 db 24 75 d8 23 73 d5 22 72 d3 22 71 d1 22 71 d0 21 70 cf 21 6f ce 21 6e cb 21 6c c8 20 6b c5 21 76 dd 24 70 ce 20 69 c1 28 7a de 2a 7c e0 2d 7d e0 2b 7d e3 25 77 d4 27 7c d7 1e 65 ba 1f 66 be 1e 63 b6 25 Data Ascii: PNGIHDRdnFPLTEjo\|d\UMHA2;k`pt%x%y%y%x$w$u#s"r"q"q!p!o!n!l k!v$p i(z*\|-}+}%w'\|efc%
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: c6 fc 59 9b ea 39 8a ee 32 85 ed 40 8d ee 5d 9f f2 58 9c f1 4c 94 ee 52 98 ef 46 92 f0 63 a3 f2 6c a8 f2 30 2e 32 ac ac ac 48 48 48 b0 b0 b1 b5 b5 b5 6a 6a 6b a9 a9 a9 57 57 57 89 89 89 62 62 62 b9 b9 b9 a4 a4 a4 83 83 83 8f 8f 8f 72 72 72 7b 7b 7b 9d 9d 9d c4 c4 c5 96 96 96 bf bf bf c9 c9 c9 dd dd dd e1 e1 e1 d0 d0 d0 fe ff ff eb ea e9 e7 e7 e7 e4 e4 e5 ff ff fe fd fd fe ff ff ff fd fc fc fb fb fb fa fa fa f9 f9 f9 f7 f7 f8 f6 f6 f6 f5 f5 f5 f3 f4 f3 f2 f2 f2 f1 f0 f0 d7 d7 d7 ee ee ee d6 7c 32 cb 00 00 00 c2 74 52 4e 53 00 b8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0c ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b7 b8 ff ff ff ff Data Ascii: Y92@]XLRFcl0.2HHHjjkWWWbbbrrr{{{\|2tRNS
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 6a 30 94 98 e4 b8 e7 20 8c 16 c6 c8 ec 04 08 6c 7b 84 68 9f 30 d5 86 cc ca f3 36 09 90 5d 35 bc 18 99 3f ed 10 5c 00 5d 87 b9 9b 48 e2 0c 64 76 66 37 51 45 a5 ff e1 10 37 11 b1 34 be d1 b3 3f 6e 13 5f 55 b9 8f dd 04 23 06 d7 e8 ce dd 24 b7 97 7e 9f 26 86 c1 20 7f ce 26 99 dd 62 61 2b f7 1e 33 41 08 69 26 46 e6 23 76 f3 db 85 dd c5 77 6e 22 49 9c ec ce 46 96 f2 3b c5 c2 4d dc 62 61 a7 70 63 7f e9 9d 67 a2 cc 1a fc 4a 26 bf bb 55 28 de cc 39 e3 b9 6c 15 b6 f7 17 df a5 49 a0 e9 75 34 4c 42 da 8b d9 4c 36 97 df df db d9 ba 51 28 6e ed 65 1d c7 71 01 5c 07 da f9 ad c2 8d dd dc d2 fc 4d 0c e5 bc 5f fc 4e b1 78 1f a7 b8 bd b5 b3 9f 5d 8e 88 36 38 cb 11 e3 ac e4 6f 16 0b db 3b 6b b9 c5 f4 7c a7 4b 6d d8 a3 44 64 f7 c6 7e 3e 9f cb 66 16 d3 0e 38 4e 7b 05 00 2e af Data Ascii: j0 l{h06]5?\]Hdvf7QE74?n_U#$~& &ba+3Ai&F#vwn"IF;MbapcgJ&U(9lIu4LBL6Q(neq\M_Nx]68o;k\|KmDd~>f8N{.
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 08 fd 13 a4 fe f2 e7 47 73 73 62 b1 58 82 24 95 4a 77 97 43 9e dd 8b 45 a2 ee 40 80 b2 58 ad 36 8a b2 14 38 4d 5d 5d dd a7 a6 4f e8 1b 48 b2 41 d5 db d6 1e d6 34 90 b8 76 b8 ad 81 e4 d0 99 0a 7d b8 4d a5 e4 66 73 a2 f7 67 ce 3f 68 53 86 90 94 58 7b ca 67 f2 a2 25 16 6d f1 ec c2 10 10 d8 01 0e 6e 57 77 cf e1 d3 6d fd 24 33 27 69 0b b7 87 43 02 92 c3 66 2a 8e 85 43 75 24 87 ac 55 b6 c3 29 3e 99 a3 f9 4f 1d 9e ed ec f2 e3 49 e6 b5 bb 1c 92 19 8c 36 3b 02 c1 22 04 44 51 94 d5 e4 ed 00 c8 d4 74 52 f2 3d 8b ec ef 6d 6f 6f d7 28 98 0c 5c bb 4d 0a 23 11 86 e0 54 a8 96 84 91 9c 9e ea ee ea 00 ef 45 79 cb 21 67 06 a3 e6 48 20 08 10 ab 0d 23 0a 7e 6c cd 3b f7 76 f7 4c 9f 3a 49 cb d2 b9 c7 5c ed ed 7e 25 8f 24 f9 80 f3 69 a0 5f 72 0d d0 c2 0c a0 a5 a6 31 64 5d fe 72 Data Ascii: GssbX$JwCE@X68M]]OHA4v}Mfsg?hSX{g%mnWwm$3'iCf*Cu$U)>OI6;"DQtR=moo(\M#TEy!gH #~l;vL:I\~%$i_r1d]r
2024-04-25 13:30:38 UTC	898	IN	Data Raw: 01 27 08 64 e4 c5 64 02 1f 7a 97 c6 a5 33 56 82 0c 8d 8c 45 13 a5 14 b6 c1 34 01 04 82 59 00 02 13 76 ed db 07 35 f7 83 7e 59 d2 fe fd 40 01 88 c3 62 3c 96 4a a5 8c cd 7d 83 b0 bc fb d4 2d 95 b2 2b 32 9c 49 1f dd 70 07 69 b3 51 14 85 97 26 85 18 4e cc 00 c2 7a fd b7 e1 59 a4 ec 0b 04 06 3e fe f8 e3 5b b7 3c 13 b2 fa 06 5a cd 76 fe a4 bb 12 64 28 3d 19 0c 96 52 18 6f 30 a0 e4 bb 14 04 02 46 e4 19 6f af ab 80 d9 17 bf f9 21 d6 7e 15 6f f5 c2 c5 0f 2e 1c 18 b4 55 0a c8 cc c8 00 ea 39 8a 2d db 3a a4 68 02 1a f5 0a 00 9e 49 30 f2 f5 87 d7 6f 5d bf f9 75 40 d5 70 f1 d2 e5 4b 17 0e 56 82 98 e3 e9 d1 04 5c b0 b3 90 c2 b6 12 04 5b 29 cd 63 5d 78 e4 fb d0 e2 c2 53 bf 3e f0 8f 4f 3e fb 6c 97 27 76 e0 e2 e5 e9 cb 00 a9 d0 2e 7b 02 43 20 85 d1 da 05 0e 10 a8 22 25 8f Data Ascii: 'ddz3VE4Yv5~Y@b<J}-+2IpiQ&NzY>[<Zvd(=Ro0Fo!~o.U9-:hI0o]u@pKV\[)c]xS>O>l'v.{C "%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49826	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	403	OUT	GET /static/img/product/thanks-for-choosing/special_offer_box.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	733	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/png Content-Length: 8389 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=8503 Vary: Accept etag: "2137-5e5da4a381802" last-modified: Wed, 10 Aug 2022 03:03:14 GMT CF-Cache-Status: HIT Age: 51414 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g8Oa1nPepknlUlzPqdN0Thjuina9IXgTnENC6gUTTFXoQ8vVUJpgYHBnNOYyfaW%2BC87LVUh5BvHWs7V2HhuWk%2BB5WqGJhUTqRxeNBq4eE1H3T5ytNcgoEDi6KVPMuk0CUWXjdss%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb056fbdc07c6-ATL
2024-04-25 13:30:38 UTC	636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 9e 00 00 00 6e 08 03 00 00 00 e1 c9 5a 50 00 00 02 fd 50 4c 54 45 ff ff ff ff fe fb ef f4 fa e8 f1 fa e3 ed f7 c9 dd f2 ba d5 f3 a9 cc f8 2a 87 fb 43 95 fc 96 c2 f9 78 ad f0 66 a5 f4 5a 9e f3 53 98 ef 48 92 ee 32 84 ea 3f 8d ec 24 7d ea 28 83 f3 09 33 58 13 5d 9e 23 70 cf 17 5e a4 24 64 ba 23 5e b4 19 58 a5 1c 5f ab 1e 64 b1 1f 68 b6 17 6f c0 1f 78 c4 1f 76 c3 24 68 bc 27 5e b6 27 59 b4 27 56 b0 1e 4f ad 16 49 a9 0f 42 ae 25 71 a0 31 7b ac 60 93 ba 41 84 b1 4e 8c b6 fc f6 ef bf d3 e4 c8 db e6 d5 e2 ea dd e7 f2 d2 e4 f5 d8 eb f8 f2 fa ff e9 f7 ff e2 f4 ff db f2 ff d0 ee ff c1 e7 fd aa e2 fc 9d dc fd 8b d5 fb 7b d0 fd 70 ca f9 65 c8 f8 60 be f2 54 b3 ed 49 aa e7 40 a2 e2 38 9b e1 32 96 dd 2c 90 d0 20 Data Ascii: PNGIHDRnZPPLTE*CxfZSH2?$}(3X]#p^$d#^X_dhoxv$h'^'Y'VOIB%q1{`AN{pe`TI@82,
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 87 cb 10 5e ba 17 66 bc 1a 63 b9 1a 60 b6 19 5e b4 16 59 b1 13 54 ac 00 30 92 b7 c1 d6 01 41 9f 03 03 03 10 62 b2 08 61 c4 17 67 c8 17 6b d2 87 61 63 f1 5f 00 57 a2 98 3c 99 88 27 8e 7a 73 b0 a2 9a bc c9 18 6f 63 1d 3e 58 2b 24 28 40 40 40 67 67 66 6f 6f 6f a5 a6 a6 52 52 52 75 76 77 80 80 81 93 93 93 aa aa ab b4 b4 b5 bc bc bc af af b0 5d 5d 5d 9f a0 a1 8b 8b 8b 7b 7c 7d 84 84 85 98 99 9a b8 b8 b8 c0 c0 c0 c4 c4 c5 ca ca ca d0 d0 d0 d7 d7 d8 de de de e2 e3 e3 e7 e7 e7 ec ec ec f2 f2 f2 f7 f7 f7 fb fb fb d2 f3 43 ec 00 00 00 dc 74 52 4e 53 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 51 72 4a 2a ff ff ff ff ff ff ff d9 8c d7 8d dc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ^fc`^YT0Abagkac_W<'zsoc>X+$(@@@ggfoooRRRuvw]]]{\|}CtRNSQrJ*
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 57 d2 b8 ab b8 fc 74 73 98 db e9 b6 e3 18 59 70 b2 08 b0 d0 ab 29 93 75 e9 d1 fc f6 27 9e bf b0 0e 80 8d e9 6d 3f 3a e1 c7 e1 e3 9f b5 f9 0c fd ec ca af ce 79 f0 63 df 38 ce e0 cd d9 bb 8d 82 f5 ec bd 61 76 52 57 12 e1 00 4a 10 b2 1f 96 ea b6 da 10 c0 50 4a ed c5 bd d8 be cd e6 51 30 d1 ec ab 3a 1c 86 c3 29 38 79 e7 77 9a 62 11 80 9f e6 e7 00 4e fd ca f0 2d 37 ff 1d e0 9d 86 86 94 31 be e5 b3 95 6a 5f b6 79 df 56 39 be e3 9d 5f fc 9d b7 67 f8 9b 53 5b 2d 3a a4 59 b6 be be 71 72 b2 05 00 da b0 e5 a5 10 ff e1 d8 9f bc d5 4c 60 90 04 fc 9c 12 7e 60 2e 9b 5f 9e 80 c9 1a 6c d9 a6 c9 ed dd f1 9b c3 11 e1 cc 63 e6 cd 47 14 7e 00 c5 cc bd ab 39 21 81 e1 ed 34 c7 ff fa 81 5d de 3f d9 18 bf c2 5d b8 e7 1f bc 72 77 88 8e 7e 08 4e 38 fc 1f d7 18 39 7b 31 46 56 6b 65 Data Ascii: WtsYp)u'm?:yc8avRWJPJQ0:)8ywbN-71j_yV9_gS[-:YqrL`~`._lcG~9!4]?]rw~N89{1FVke
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 4e 94 77 05 a5 76 4a 03 21 a8 de df 18 52 96 45 e4 38 42 34 55 cf e8 8b 90 07 dd d7 bd e9 92 51 60 13 18 bb 45 91 0c 0c c0 f8 cf 30 88 70 00 15 e8 dd ec 45 d6 ab 17 96 de 41 0d ec 82 2f de 27 3a c8 40 46 17 d5 16 bb c7 82 97 99 2c 4f ef 8d 13 51 10 1c de 31 3d 7b fb 7e e0 bb a2 83 40 80 7e 8f 82 28 88 dd e2 93 c4 4c 00 18 bf 2c 0e d0 14 bd bb cd 86 dc c9 7d 5f 92 89 1c 01 50 c4 49 e4 d8 bd 1f b1 37 ab 09 00 f1 cb 22 c0 a6 e8 2d c5 c6 5c 3a 7d 58 75 9d ea b7 0f 38 63 77 98 21 d9 1b 4e 2f 0a cc 80 11 dc d4 f4 f8 6c d9 b2 d3 6b 00 12 ea 11 5c cb da b5 9d 1d 5e 90 b1 3b 82 e1 78 83 e9 8d f6 95 06 98 81 80 0b 36 55 6f 6d 53 1e b0 69 43 ff 6c db b5 db e6 cd db 26 01 38 13 bb c3 31 34 14 de 50 7a a1 fc 5c 20 0c 2c 7a 63 bd c7 02 89 3b 8b 61 55 1c ec 70 77 a3 93 Data Ascii: NwvJ!RE8B4UQ`E0pEA/':@F,OQ1={~@~(L,}_PI7"-\:}Xu8cw!N/lk\^;x6UomSiCl&814Pz\ ,zc;aUpw
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: d9 12 7e 4a 1c 05 46 47 dd a8 73 4e 92 4b 92 04 88 01 c7 52 db 75 7a 1b a3 88 df 4c 00 64 98 10 33 20 40 b6 58 61 08 0f 00 91 d7 57 94 9d 97 1d f2 84 03 06 e3 12 6a fe c3 ff a9 97 2c 2d fb cc c7 d2 b7 df 4b dc 6f 91 4b 93 d6 81 ff 60 96 95 65 08 ad 51 9e cd 11 79 71 c5 34 44 4e a5 25 b9 18 c0 0c 24 28 10 32 28 58 4c f6 e8 c8 9a a8 0a 04 90 05 af b8 72 fe f0 c7 7f 63 09 27 ea a8 d4 35 5a 8d 72 eb e8 6a f0 cd cc 67 2e 75 b1 4f 53 4f 45 a5 27 5a 0d 24 b2 de 5d f7 d3 9d f4 f8 74 c2 ae d3 1b 04 16 db 22 8f 9e 39 14 b0 2e 75 c3 40 46 fb 50 3e 7c e5 a2 5f 43 e6 a9 0f 39 da 5c 6b f6 f9 fa 7e 71 f9 47 a5 67 e2 a8 ec 12 e2 fb ec f7 4b 46 c9 bf fd 96 b8 95 40 ec ee 18 78 47 a2 44 51 89 23 56 3d 4e 81 c1 99 e0 00 fa af 14 3d e4 25 3c 1d 98 58 bf 61 43 cb 0b 03 c0 a6 Data Ascii: ~JFGsNKRuzLd3 @XaWj,-KoK`eQyq4DN%$(2(XLrc'5Zrjg.uOSOE'Z$]t"9.u@FP>\|_C9\k~qGgKF@xGDQ#V=N=%<XaC
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 6a d1 e2 15 95 6f 7f e9 dc d4 94 dc 72 d1 db 39 6a c5 23 8d 1f 7b 81 60 04 51 94 d6 ba f4 cc 61 e4 c8 10 05 65 e0 78 a1 25 26 81 0a 37 8e e1 29 41 84 de 0c 86 50 f4 d8 92 d5 81 36 c2 4c 48 8e 8e ae 0c f1 8b 7d 1b 0f ad 5a 54 a9 f3 c1 73 6f 3f f7 96 73 2f 39 69 f4 c8 95 3f 68 b6 52 49 42 00 a1 cb a2 d0 eb 6d 25 a3 88 11 78 69 c0 78 e2 6a e0 86 4b f2 73 04 c7 00 1c 7d 40 f4 ef 18 9b 01 d8 87 c6 c1 3f 3f 40 cf 75 8f 65 66 13 0c 19 e4 8a 2f ef d3 78 70 45 a5 7a f8 58 e5 6f 5b cb ae 58 b1 58 2b 7e f0 a6 67 37 4a 02 18 e9 36 2b d2 3b cc d6 21 52 51 58 d1 dd 7b b3 43 ac 87 11 12 02 e5 6a 70 80 e1 fd 3e 45 ea 8d 0a f4 35 2b d0 33 84 55 19 c3 9c 01 26 73 e1 17 fb a6 8f 1d f1 94 2a f6 2e 67 54 0e 7f ea e1 e6 b3 af 21 21 31 82 fc 24 d5 a2 bc 9d f4 f4 97 76 b7 57 4c Data Ascii: jor9j#{`Qaex%&7)AP6LH}ZTso?s/9i?hRIBm%xixjKs}@??@uef/xpEzXo[XX+~g7J6+;!RQX{Cjp>E5+3U&s*.gT!!1$vWL
2024-04-25 13:30:38 UTC	908	IN	Data Raw: 5b 08 26 80 55 4d a7 34 22 43 76 50 90 42 d7 12 8c 33 dc 4f 1f d1 df 9c 12 ad 85 56 bc 42 ed 68 63 7a 90 f9 e0 e3 60 51 bf 85 30 4c 4b e6 46 5a 95 00 f6 1f 04 61 32 30 82 64 ba fd c3 b7 47 a6 a0 eb 2f 41 38 b3 b3 ff 0a a2 3c d5 92 61 42 d0 8c c7 9e 67 0f 5e db 13 d3 60 62 19 41 4e 41 41 1b f6 94 cd ad 1f bc a6 48 2f 65 bb ce bb ed 7b 87 87 aa 39 8e 8f 47 d4 a3 67 45 71 e3 34 22 94 53 8f 4c 51 70 72 2d 5d 74 96 4d 5c f8 a1 bc f5 8e 95 2d fb 22 b7 7f 3d 0a 2e 38 3e 4e e4 c1 30 77 00 32 da 44 51 30 c9 79 57 f6 73 23 db 1c 25 5b 0c c5 cf ee b5 d7 c6 3d 6d 0b 59 6c 72 9b 64 1b f5 94 a3 83 a7 c5 6f 3d 17 ac 51 3a ed 15 60 7e 6a 79 ef 15 18 11 10 a2 90 a4 8d 44 16 82 f3 78 0b 91 64 2c 03 c3 64 98 2e be ee 62 96 39 d9 8e 98 b3 38 93 80 28 b3 d6 bf ce 32 72 3d 45 Data Ascii: [&UM4"CvPB3OVBhcz`Q0LKFZa20dG/A8<aBg^`bANAAH/e{9GgEq4"SLQpr-]tM\-"=.8>N0w2DQ0yWs#%[=mYlrdo=Q:`~jyDxd,d.b98(2r=E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49827	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	660	OUT	GET /static/img/common/icon_follow_youtube.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:44 GMT etag: W/"518-5e708938f417c-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 76893 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o4vsnCjRoGopVsd%2FHI4PBlzifNIglRXCIG%2B8569bOY92fw9K8FiVOFl60blvKnni8bdg4obOLdb9JRv6%2B1eE9fH56gqDWEbvLz6kfhqZfKs4odObeFKFvJPaiBrwZ%2B8ObMgGl6o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0571b6eb05c-ATL
2024-04-25 13:30:38 UTC	681	IN	Data Raw: 35 31 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 33 2e 30 30 30 30 30 30 2c 20 37 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 518<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(3.000000, 7.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:38 UTC	630	IN	Data Raw: 39 32 36 36 30 37 20 43 2d 30 2e 30 30 36 31 33 34 39 38 35 32 32 2c 31 31 2e 38 30 39 33 33 30 36 20 30 2e 31 39 30 35 33 35 30 32 37 2c 31 34 2e 30 32 31 38 31 30 31 20 30 2e 35 38 37 39 33 35 34 33 34 2c 31 36 2e 32 30 31 34 34 39 31 20 43 30 2e 39 30 36 32 31 31 31 34 34 2c 31 37 2e 33 35 39 34 39 33 35 20 31 2e 37 39 37 33 36 33 34 31 2c 31 38 2e 32 36 34 34 31 33 38 20 32 2e 39 33 37 37 38 38 36 31 2c 31 38 2e 35 38 37 36 30 36 38 20 43 35 2e 30 34 30 30 35 31 38 38 2c 31 39 2e 31 36 31 32 39 30 33 20 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 43 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 32 31 2e 39 35 39 34 34 34 39 2c 31 39 2e 31 36 31 Data Ascii: 926607 C-0.00613498522,11.8093306 0.190535027,14.0218101 0.587935434,16.2014491 C0.906211144,17.3594935 1.79736341,18.2644138 2.93778861,18.5876068 C5.04005188,19.1612903 13.5121279,19.1612903 13.5121279,19.1612903 C13.5121279,19.1612903 21.9594449,19.161
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49828	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	662	OUT	GET /static/img/common/icon_follow_wordpress.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:43 GMT etag: W/"318-5e708938064cc-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46948 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y1erPdOVw1ioKHnJNEDVb8s1IzToebNvktwlFeR7f3uemfLcmbV3rB83RX3I8AjLJUTToWeHFl8WXnoOwbB%2F7njvN%2BDs%2FIhXSOkF8Gxnr6H%2BGh3tp2x7i28zlUmxCWXzrWgnuXM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb057289307d2-ATL
2024-04-25 13:30:38 UTC	681	IN	Data Raw: 33 31 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 35 2e 30 30 30 30 30 30 2c 20 34 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 318<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(5.000000, 4.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:38 UTC	118	IN	Data Raw: 36 30 39 2c 34 2e 36 30 32 32 34 20 31 39 2e 33 38 34 34 38 36 31 2c 31 33 2e 33 30 35 36 20 31 39 2e 33 38 34 34 38 36 31 2c 32 34 20 4c 32 34 2c 32 34 20 43 32 34 2c 31 30 2e 37 37 30 32 34 20 31 33 2e 32 33 31 39 30 38 31 2c 30 20 30 2c 30 20 5a 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 609,4.60224 19.3844861,13.3056 19.3844861,24 L24,24 C24,10.77024 13.2319081,0 0,0 Z"/> </g> </g></svg>
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49829	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	656	OUT	GET /static/img/common/icon_newsletter.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	690	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:48 GMT etag: W/"36a-5e70893cb19cb-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18928 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e8qi03zVnTGZdRoUULGhmwDsv4iMJ00JQ0JT8d9IarXXRwCp%2FKgd39vVehj83myZWPyfTviIHJanb%2B3fIdGAZQyJS%2FHkKtKXGCQUzhQjbsm7N0rFRjcmDmcpeW%2FOGJW%2BmEfFC1s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb057d959b08e-ATL
2024-04-25 13:30:38 UTC	679	IN	Data Raw: 33 36 61 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 70 78 22 20 68 65 69 67 68 74 3d 22 32 34 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 37 2e 37 31 33 33 30 30 38 34 2c 31 33 2e 39 35 31 37 33 33 36 20 4c 37 2e 36 37 37 34 32 34 39 38 2c 31 33 2e 39 31 39 34 34 35 33 20 4c 31 33 2e 39 34 35 36 35 37 33 2c 38 2e Data Ascii: 36a<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <path d="M7.71330084,13.9517336 L7.67742498,13.9194453 L13.9456573,8.
2024-04-25 13:30:38 UTC	202	IN	Data Raw: 32 30 2e 39 37 32 33 30 30 36 20 43 31 35 2e 37 35 35 37 31 31 34 2c 32 31 2e 30 34 30 34 36 30 37 20 31 35 2e 34 39 39 32 30 35 2c 32 30 2e 39 38 30 39 31 33 39 20 31 35 2e 33 31 35 33 39 38 2c 32 30 2e 38 31 34 37 38 37 38 20 4c 31 30 2e 37 30 33 31 39 36 2c 31 36 2e 36 35 30 33 31 36 36 20 4c 37 2e 37 31 33 33 30 30 38 34 2c 31 39 2e 36 33 39 34 39 34 33 20 4c 37 2e 37 31 33 33 30 30 38 34 2c 31 33 2e 39 35 31 37 33 33 36 20 5a 22 20 66 69 6c 6c 3d 22 23 45 46 46 30 46 32 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 6e 6f 6e 7a 65 72 6f 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 20.9723006 C15.7557114,21.0404607 15.499205,20.9809139 15.315398,20.8147878 L10.703196,16.6503166 L7.71330084,19.6394943 L7.71330084,13.9517336 Z" fill="#EFF0F2" fill-rule="nonzero"/> </g></svg>
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49830	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	659	OUT	GET /static/img/icon/icon_arrow_eff0f2_12.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 08 Sep 2022 06:07:13 GMT etag: W/"2e8-5e8243d9cc12f-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56041 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWDwcMDrQMqYULhepjGz53Mpm6iG1DjFY0wHvSrDawFzIrtZu2k1qmSNWcQSf5%2B9TXnZLyQzp%2B0TtDaiyBVunDBetAN%2BRLk%2BEdDswtbGt0sYCvLIYyur1xRIfz5O08KeWJAx8Hk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb057ec15677c-ATL
2024-04-25 13:30:38 UTC	681	IN	Data Raw: 32 65 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e Data Ascii: 2e8<?xml version="1.0" encoding="UTF-8"?><svg width="12" height="12" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
2024-04-25 13:30:38 UTC	70	IN	Data Raw: 35 2e 30 30 30 30 30 30 29 20 74 72 61 6e 73 6c 61 74 65 28 2d 39 2e 30 30 30 30 30 30 2c 20 2d 37 2e 30 30 30 30 30 30 29 20 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 5.000000) translate(-9.000000, -7.000000) "></path> </g></svg>
2024-04-25 13:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49831	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:38 UTC	622	OUT	GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:38 UTC	762	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:38 GMT Content-Type: application/javascript Content-Length: 12332 Connection: close Last-Modified: Fri, 19 Apr 2024 20:54:07 GMT ETag: "6622d9ef-302c" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2BZcj7c3n1gxAc6oEAkK2W70zSVMXCT4mt9ey4t%2FELwVx%2FoOSLApYIGvrlz8NdJIhAzn5cG%2FjwZ0YZ7jJyCgu3kA%2BhxqZes3wrrGrdweFJqCR7EEYcdencRx24s2JQoIJ53DkXQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb057f8806760-ATL X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 27 Apr 2024 13:30:38 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-04-25 13:30:38 UTC	607	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 22 63 66 2d 6d 61 72 6b 65 72 2d 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 6c 69 63 65 28 32 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 28 6e 3d 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 7c 7c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 6e 2c 5b 63 6f 6e 73 6f 6c 65 2c 22 5b 52 4f 43 4b 45 54 20 4c 4f 41 44 45 52 5d 20 22 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3b 76 61 72 20 6e 7d 66 75 6e 63 Data Ascii: !function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn\|\|console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}func
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 69 6f 6e 20 63 28 74 29 7b 72 65 74 75 72 6e 20 61 28 74 2c 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 65 28 29 2c 74 29 72 65 74 75 72 6e 20 74 2e 63 61 6c 6c 28 74 68 69 73 2c 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 2c 65 29 7b 74 2e 6f 6e 6c 6f 61 64 3d 73 28 74 2e 6f 6e 6c 6f 61 64 2c 65 29 2c 74 2e 6f 6e 65 72 72 6f 72 3d 73 28 74 2e 6f 6e 65 72 72 6f 72 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 4e 53 28 74 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 22 73 63 72 69 70 74 22 29 3b 65 2e 61 73 79 6e 63 3d 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 73 79 6e 63 22 Data Ascii: ion c(t){return a(t,"")}function s(t,e){return function(n){if(e(),t)return t.call(this,n)}}function u(t,e){t.onload=s(t.onload,e),t.onerror=s(t.onerror,e)}function p(t){var e=document.createElementNS(t.namespaceURI,"script");e.async=t.hasAttribute("async"
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 52 29 3b 69 66 28 21 65 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 6e 3d 65 2e 73 70 6c 69 74 28 54 29 3b 72 65 74 75 72 6e 7b 6e 6f 6e 63 65 3a 6e 5b 30 5d 2c 68 61 6e 64 6c 65 72 50 72 65 66 69 78 4c 65 6e 67 74 68 3a 2b 6e 5b 31 5d 2c 62 61 69 6c 6f 75 74 3a 21 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 65 66 65 72 22 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 29 7b 76 61 72 20 65 3d 42 2b 74 2e 6e 6f 6e 63 65 3b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 22 2b 65 2b 22 5d 22 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 65 29 2c 41 72 72 61 79 2e 70 72 6f 74 Data Ascii: R);if(!e)return null;var n=e.split(T);return{nonce:n[0],handlerPrefixLength:+n[1],bailout:!t.hasAttribute("defer")}}function g(t){var e=B+t.nonce;Array.prototype.forEach.call(document.querySelectorAll("["+e+"]"),function(n){n.removeAttribute(e),Array.prot
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 31 2e 30 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 31 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 32 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 33 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 34 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 35 22 3a 21 30 2c 22 74 65 78 74 2f 6a 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 6c 69 76 65 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 78 2d 65 63 6d 61 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 22 3a 21 30 2c 6d 6f 64 75 6c 65 3a 21 30 7d 2c 6b 3d 76 6f 69 64 20 30 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 Data Ascii: 1.0":!0,"text/javascript1.1":!0,"text/javascript1.2":!0,"text/javascript1.3":!0,"text/javascript1.4":!0,"text/javascript1.5":!0,"text/jscript":!0,"text/livescript":!0,"text/x-ecmascript":!0,"text/x-javascript":!0,module:!0},k=void 0!==document.createEleme
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 28 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 74 68 69 73 2e 6e 6f 6e 63 65 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 6f 76 65 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 74 79 70 65 3d 74 2e 74 79 70 65 2e 73 75 62 73 74 72 28 74 68 69 73 2e 6e 6f 6e 63 65 2e 6c 65 6e 67 74 68 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 6b 65 4e 6f 6e 45 78 65 63 75 74 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 74 79 70 65 3d 74 68 69 73 2e 6e 6f 6e 63 65 2b 74 2e 74 79 70 65 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 50 65 6e 64 Data Ascii: prototype.hasNonce=function(t){return 0===(t.getAttribute("type")\|\|"").indexOf(this.nonce)},t.prototype.removeNonce=function(t){t.type=t.type.substr(this.nonce.length)},t.prototype.makeNonExecutable=function(t){t.type=this.nonce+t.type},t.prototype.isPend
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 65 6e 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 72 3d 74 2c 74 68 69 73 2e 62 75 66 66 65 72 3d 22 22 2c 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 2e 77 72 69 74 65 28 74 2c 21 31 29 7d 2c 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 Data Ascii: ototype.enable=function(t){var e=this;this.insertionPointMarker=t,this.buffer="",document.write=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];return e.write(t,!1)},document.writeln=function(){for(var t=[],n=0;n<arguments.length;n++)
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 74 79 70 65 2e 77 72 69 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 6e 26 26 69 28 6e 29 26 26 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 73 79 6e 63 22 29 3f 28 72 3d 65 3f 5f 3a 4c 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 72 2c 5b 64 6f 63 75 6d 65 6e 74 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3a 74 68 69 73 2e 62 75 66 66 65 72 2b 3d 74 2e 6d 61 70 28 53 74 72 69 6e 67 29 2e 6a 6f 69 6e 28 65 3f 22 5c 6e 22 3a 22 22 29 3b 76 61 72 20 72 7d 2c 74 7d 28 29 2c 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 73 69 6d 75 6c 61 74 65 64 52 65 61 64 79 53 74 61 74 65 3d 22 6c 6f 61 64 69 Data Ascii: type.write=function(t,e){var n=document.currentScript;n&&i(n)&&n.hasAttribute("async")?(r=e?_:L).call.apply(r,[document].concat(t)):this.buffer+=t.map(String).join(e?"\n":"");var r},t}(),j=function(){function t(){var t=this;this.simulatedReadyState="loadi
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 6e 74 73 49 6e 50 72 6f 78 69 65 73 3d 21 30 7d 2c 30 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 75 70 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 50 72 6f 78 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 45 76 65 6e 74 54 61 72 67 65 74 3f 5b 45 76 65 6e 74 54 61 72 67 65 74 2e 70 72 6f 74 6f 74 79 70 65 5d 3a 5b 4e 6f 64 65 2e 70 72 6f 74 6f 74 79 70 65 2c 57 69 6e 64 6f 77 2e 70 72 6f 74 6f 74 79 70 65 5d 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 67 65 74 4d 65 74 68 6f 64 73 28 65 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 Data Ascii: ntsInProxies=!0},0)},t.prototype.setupEventListenerProxy=function(){var t=this;("undefined"!=typeof EventTarget?[EventTarget.prototype]:[Node.prototype,Window.prototype]).forEach(function(e){return t.patchEventTargetMethods(e)})},t.prototype.patchEventTar
2024-04-25 13:30:38 UTC	1369	IN	Data Raw: 69 6d 75 6c 61 74 6f 72 22 2c 7b 76 61 6c 75 65 3a 6e 65 77 20 6a 7d 29 2c 74 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 4c 6f 61 64 50 72 6f 67 72 65 73 73 53 69 6d 75 6c 61 74 6f 72 7d 28 29 2c 57 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 74 68 69 73 2e 73 63 72 69 70 74 53 74 61 63 6b 3d 74 2c 74 68 69 73 2e 73 65 74 74 69 6e 67 73 3d 65 2c 74 68 69 73 2e 70 72 65 6c 6f 61 64 48 69 6e 74 73 3d 5b 5d 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 73 65 72 74 50 72 65 6c 6f 61 64 48 69 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 73 63 72 69 70 74 53 74 61 63 6b 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 61 28 65 2c Data Ascii: imulator",{value:new j}),t.__rocketLoaderLoadProgressSimulator}(),W=function(){function t(t,e){this.scriptStack=t,this.settings=e,this.preloadHints=[]}return t.prototype.insertPreloadHints=function(){var t=this;this.scriptStack.forEach(function(e){if(a(e,
2024-04-25 13:30:38 UTC	773	IN	Data Raw: 69 76 61 74 65 53 63 72 69 70 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 2e 73 63 72 69 70 74 2c 72 3d 74 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 6f 3d 74 2e 65 78 74 65 72 6e 61 6c 2c 69 3d 74 2e 61 73 79 6e 63 2c 61 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 69 66 28 21 64 6f 63 75 6d 65 6e 74 2e 63 6f 6e 74 61 69 6e 73 28 72 29 29 72 65 74 75 72 6e 20 65 28 22 50 6c 61 63 65 68 6f 6c 64 65 72 20 66 6f 72 20 73 63 72 69 70 74 20 5c 6e 22 2b 6e 2e 6f 75 74 65 72 48 54 4d 4c 2b 22 5c 6e 20 77 61 73 20 64 65 74 61 63 68 65 64 20 66 72 6f 6d 20 64 6f 63 75 6d 65 6e 74 2e 22 2c 22 53 63 72 69 70 74 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 65 78 65 63 75 74 65 64 2e 22 29 2c 6e 75 6c 6c 3b 76 61 72 20 63 3d 74 68 69 73 2e 73 65 74 74 69 6e 67 Data Ascii: ivateScript=function(t){var n=t.script,r=t.placeholder,o=t.external,i=t.async,a=r.parentNode;if(!document.contains(r))return e("Placeholder for script \n"+n.outerHTML+"\n was detached from document.","Script will not be executed."),null;var c=this.setting

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49835	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	629	OUT	GET /static/page/product/choose-product-discount/choose-product-discount.js HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	755	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: application/javascript Content-Length: 3035 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=3579 etag: "dfb-5fb2b44e5e8d8-gzip" last-modified: Mon, 08 May 2023 09:29:01 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 35807 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dd3qLnH5q92HwB5RjhrJY8%2FpOqw39xI3xX7PUkiiXVYGIRwW58LJSFmIK%2FEHpvH3racVRF%2BQVxG2Lj814IXSxVemCNbdufVXnEOuqZpalQnS%2BOPcBBpSPQMrZktANgRtQ6tZZpI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05dff9b69ec-ATL
2024-04-25 13:30:39 UTC	614	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 24 28 27 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 6c 69 20 2e 63 68 65 63 6b 62 6f 78 27 29 2e 6f 6e 28 27 63 6c 69 63 6b 27 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 27 6c 69 27 29 2e 68 61 73 43 6c 61 73 73 28 27 63 61 6e 63 65 6c 27 29 29 7b 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 27 6c 69 27 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 63 61 6e 63 65 6c 27 29 7d 65 6c 73 65 7b 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 27 6c 69 27 29 2e 61 64 64 43 6c 61 73 73 28 27 63 61 6e 63 65 6c 27 29 7d 0a 69 66 28 24 28 27 2e 73 70 65 63 69 61 6c 5f 6f 66 66 65 72 20 6c 69 27 29 2e 65 71 28 31 29 2e 68 61 73 43 6c 61 Data Ascii: $(document).ready(function(){$('.special_offer li .checkbox').on('click',function(){if($(this).parent('li').hasClass('cancel')){$(this).parent('li').removeClass('cancel')}else{$(this).parent('li').addClass('cancel')}if($('.special_offer li').eq(1).hasCla
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 61 6e 27 29 2e 70 61 72 65 6e 74 28 27 70 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 61 27 29 2e 61 74 74 72 28 7b 27 68 72 65 66 27 3a 27 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 63 68 65 63 6b 6f 75 74 2f 62 75 79 3f 6d 65 72 63 68 61 6e 74 3d 54 4e 47 5a 49 26 73 72 63 3d 74 68 61 6e 6b 70 61 67 65 26 73 74 79 6c 65 3d 6f 6e 65 2d 63 6f 6c 75 6d 6e 35 64 34 38 65 35 65 65 33 64 39 63 65 26 74 70 6c 3d 6f 6e 65 2d 63 6f 6c 75 6d 6e 26 63 6f 75 70 6f 6e 3d 47 46 54 43 50 41 26 70 72 6f 64 3d 35 35 34 30 42 45 34 37 39 34 26 71 74 79 3d 31 27 7d 29 3b 24 28 27 23 6f 77 6e 5f 70 72 69 63 65 20 73 70 61 6e 27 29 2e 68 74 6d 6c 28 27 24 32 33 2e 39 35 27 29 3b 24 28 27 23 77 66 68 5f 70 72 69 63 65 20 73 70 61 6e Data Ascii: an').parent('p').siblings('a').attr({'href':'https://store.wisecleaner.com/checkout/buy?merchant=TNGZI&src=thankpage&style=one-column5d48e5ee3d9ce&tpl=one-column&coupon=GFTCPA&prod=5540BE4794&qty=1'});$('#own_price span').html('$23.95');$('#wfh_price span
2024-04-25 13:30:39 UTC	1052	IN	Data Raw: 7d 29 2e 70 61 72 65 6e 74 28 27 64 69 76 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 70 27 29 2e 63 68 69 6c 64 72 65 6e 28 27 23 61 6c 6c 5f 70 72 69 63 65 27 29 2e 68 74 6d 6c 28 27 24 32 39 2e 39 34 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 73 70 61 6e 27 29 2e 63 68 69 6c 64 72 65 6e 28 27 23 64 65 6c 5f 70 72 69 63 65 27 29 2e 68 74 6d 6c 28 27 24 35 39 2e 39 27 29 2e 70 61 72 65 6e 74 28 27 73 70 61 6e 27 29 2e 70 61 72 65 6e 74 28 27 70 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 61 27 29 2e 61 74 74 72 28 7b 27 68 72 65 66 27 3a 27 68 74 74 70 73 3a 2f 2f 6f 72 64 65 72 2e 73 68 61 72 65 69 74 2e 63 6f 6d 2f 63 61 72 74 2f 61 64 64 3f 76 65 6e 64 6f 72 69 64 3d 32 30 30 31 39 32 38 38 30 26 50 52 4f 44 55 43 54 5b 33 30 30 39 34 38 36 33 32 5d 3d 31 26 50 52 Data Ascii: }).parent('div').siblings('p').children('#all_price').html('$29.94').siblings('span').children('#del_price').html('$59.9').parent('span').parent('p').siblings('a').attr({'href':'https://order.shareit.com/cart/add?vendorid=200192880&PRODUCT[300948632]=1&PR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49834	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	594	OUT	GET /static/page/layout/layout.js?v=1.80 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	750	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: application/javascript Content-Length: 3711 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=9530 etag: "253a-615773dd09127-gzip" last-modified: Sun, 07 Apr 2024 01:02:22 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 38601 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DskdVA2dIebFD5AtgCLHi7rG6cC8TBv6kP2xFnBM71C1OcxpArQ0xAub2cTqp1BZdr2K7CxPAfnwX%2BAb4tWZH8O2qnwidx8MjcEBgE4BS08QXELLe9KfM2usc0robG0eTd5KQ50%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e0b7f673e-ATL
2024-04-25 13:30:39 UTC	619	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 24 28 27 23 68 65 61 64 65 72 2d 6d 65 6e 75 2d 69 6e 70 75 74 27 29 2e 6f 6e 28 27 66 6f 63 75 73 27 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 24 28 74 68 69 73 29 2e 61 64 64 43 6c 61 73 73 28 27 68 65 61 64 65 72 2d 6d 65 6e 75 2d 69 6e 70 75 74 2d 61 63 74 69 76 65 27 29 7d 29 2e 6f 6e 28 27 62 6c 75 72 27 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 24 28 74 68 69 73 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 68 65 61 64 65 72 2d 6d 65 6e 75 2d 69 6e 70 75 74 2d 61 63 74 69 76 65 27 29 7d 29 0a 24 28 27 23 6c 61 79 65 72 5f 6e 65 77 73 6c 65 74 74 65 72 20 2e 70 6f 70 75 70 2d 63 6c 6f 73 65 27 29 2e 6f 6e 28 27 63 6c 69 63 6b 27 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 61 79 65 Data Ascii: $(document).ready(function(){$('#header-menu-input').on('focus',function(){$(this).addClass('header-menu-input-active')}).on('blur',function(){$(this).removeClass('header-menu-input-active')})$('#layer_newsletter .popup-close').on('click',function(){laye
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 64 61 74 61 29 7b 69 66 28 64 61 74 61 29 7b 69 66 28 64 61 74 61 2e 69 6e 64 65 78 4f 66 28 27 61 6c 72 65 61 64 79 20 65 78 69 73 74 73 27 29 3d 3d 3d 2d 31 29 7b 76 61 72 20 73 75 62 73 63 72 69 62 65 5f 74 69 74 6c 65 3d 27 54 68 61 6e 6b 20 79 6f 75 20 66 6f 72 20 73 75 62 73 63 72 69 62 69 6e 67 20 74 6f 20 6f 75 72 20 6e 65 77 73 6c 65 74 74 65 72 21 27 0a 76 61 72 20 73 75 62 73 63 72 69 62 65 5f 64 65 73 63 3d 27 57 65 20 68 61 76 65 20 73 65 6e 74 20 61 6e 20 65 6d 61 69 6c 20 74 6f 20 79 6f 75 72 20 69 6e 62 6f 78 2e 20 50 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 69 6e 62 6f 78 20 61 6e 64 20 73 70 61 6d 20 66 6f 6c 64 65 72 2c 20 74 68 65 6e 20 63 6c 69 63 6b 20 74 68 65 20 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 20 4c Data Ascii: ction(data){if(data){if(data.indexOf('already exists')===-1){var subscribe_title='Thank you for subscribing to our newsletter!'var subscribe_desc='We have sent an email to your inbox. Please check your inbox and spam folder, then click the Confirmation L
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 6e 28 29 7b 69 66 28 24 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 27 29 2e 68 61 73 43 6c 61 73 73 28 27 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 2d 66 61 64 65 69 6e 27 29 29 7b 24 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 27 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 2d 66 61 64 65 69 6e 27 29 0a 24 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 27 29 2e 73 69 62 6c 69 6e 67 73 28 27 2e 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 27 29 2e 61 64 64 43 6c 61 73 73 28 27 73 65 6c 65 63 74 2d 73 69 74 65 2d 6c 69 73 74 2d 66 Data Ascii: n(){if($('.select-site').siblings('.select-site-list').hasClass('select-site-list-fadein')){$('.select-site').siblings('.select-site-list').removeClass('select-site-list-fadein')$('.select-site').siblings('.select-site-list').addClass('select-site-list-f
2024-04-25 13:30:39 UTC	354	IN	Data Raw: 2c 27 61 75 74 6f 27 29 7d 65 6c 73 65 7b 24 28 27 2e 68 65 61 64 65 72 2d 6d 65 6e 75 2d 61 72 72 6f 77 2d 77 72 61 70 20 73 76 67 27 29 2e 63 73 73 28 27 74 72 61 6e 73 66 6f 72 6d 27 2c 27 72 6f 74 61 74 65 28 30 64 65 67 29 27 29 0a 24 28 74 68 69 73 29 2e 73 69 62 6c 69 6e 67 73 28 27 2e 6d 65 6e 75 2d 69 6e 6e 65 72 2d 77 72 61 70 27 29 2e 63 73 73 28 27 68 65 69 67 68 74 27 2c 30 29 7d 7d 7d 29 0a 24 28 27 2e 62 6f 74 74 6f 6d 2d 66 69 6c 74 65 72 2d 63 6c 6f 73 65 27 29 2e 6f 6e 28 27 63 6c 69 63 6b 27 2c 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 7b 65 76 65 6e 74 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 0a 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 0a 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 Data Ascii: ,'auto')}else{$('.header-menu-arrow-wrap svg').css('transform','rotate(0deg)')$(this).siblings('.menu-inner-wrap').css('height',0)}}})$('.bottom-filter-close').on('click',function(event){event.stopPropagation()event.preventDefault()document.querySelec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49836	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	590	OUT	GET /static/js/utils/utils.js?v=1.14 HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	758	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: application/javascript Content-Length: 5861 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=6511 etag: "196f-5efd651105125-gzip" last-modified: Thu, 15 Dec 2022 04:30:45 GMT vary: Accept-Encoding CF-Cache-Status: HIT Age: 40646 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUo6t7Yj9z4U2hSC2LidD4A7tc9necldNvUeAY701ICn6%2B7DyQRuOjFVoCFH7pbIP8EJ%2F6P4X2ylkslG8UTT8C%2BE50jrBZ%2BdjqI1k%2BzFFwz0mvxZPkEORznuf3cRwCkqsdX9hLs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e087a17fb-ATL
2024-04-25 13:30:39 UTC	611	IN	Data Raw: 76 61 72 20 62 72 6f 77 73 65 72 3d 67 65 74 42 72 6f 77 73 65 72 49 6e 66 6f 28 29 3b 76 61 72 20 62 5f 6e 61 6d 65 3d 28 62 72 6f 77 73 65 72 2b 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5b 30 2d 39 2e 2f 5d 2f 69 67 2c 22 22 29 3b 76 61 72 20 62 5f 76 65 72 73 69 6f 6e 3d 70 61 72 73 65 49 6e 74 28 28 62 72 6f 77 73 65 72 2b 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 30 2d 39 2e 5d 2f 69 67 2c 22 22 29 29 3b 69 66 28 62 5f 6e 61 6d 65 3d 3d 3d 27 49 45 27 26 26 70 61 72 73 65 49 6e 74 28 62 5f 76 65 72 73 69 6f 6e 2c 31 30 29 3c 31 30 29 7b 61 6c 65 72 74 28 27 46 6f 72 20 61 20 70 65 72 66 65 63 74 20 65 78 70 65 72 69 65 6e 63 65 2c 20 75 73 65 20 43 68 72 6f 6d 65 20 6f 72 20 49 45 31 30 20 6f 72 20 61 62 6f 76 65 21 27 29 7d 0a 66 75 6e 63 74 69 6f Data Ascii: var browser=getBrowserInfo();var b_name=(browser+"").replace(/[0-9./]/ig,"");var b_version=parseInt((browser+"").replace(/[^0-9.]/ig,""));if(b_name==='IE'&&parseInt(b_version,10)<10){alert('For a perfect experience, use Chrome or IE10 or above!')}functio
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 64 65 78 4f 66 28 22 72 76 3a 31 31 2e 30 22 29 3e 2d 31 3b 69 66 28 69 73 49 45 29 7b 76 61 72 20 72 65 49 45 3d 6e 65 77 20 52 65 67 45 78 70 28 22 6d 73 69 65 20 28 5c 5c 64 2b 5c 5c 2e 5c 5c 64 2b 29 3b 22 29 3b 72 65 49 45 2e 74 65 73 74 28 61 67 65 6e 74 29 3b 76 61 72 20 66 49 45 56 65 72 73 69 6f 6e 3d 70 61 72 73 65 46 6c 6f 61 74 28 52 65 67 45 78 70 5b 22 24 31 22 5d 29 3b 69 66 28 66 49 45 56 65 72 73 69 6f 6e 3d 3d 37 29 7b 72 65 74 75 72 6e 22 49 45 2f 37 22 3b 7d 65 6c 73 65 20 69 66 28 66 49 45 56 65 72 73 69 6f 6e 3d 3d 38 29 7b 72 65 74 75 72 6e 22 49 45 2f 38 22 3b 7d 65 6c 73 65 20 69 66 28 66 49 45 56 65 72 73 69 6f 6e 3d 3d 39 29 7b 72 65 74 75 72 6e 22 49 45 2f 39 22 3b 7d 65 6c 73 65 20 69 66 28 66 49 45 56 65 72 73 69 6f 6e 3d 3d Data Ascii: dexOf("rv:11.0")>-1;if(isIE){var reIE=new RegExp("msie (\\d+\\.\\d+);");reIE.test(agent);var fIEVersion=parseFloat(RegExp["$1"]);if(fIEVersion==7){return"IE/7";}else if(fIEVersion==8){return"IE/8";}else if(fIEVersion==9){return"IE/9";}else if(fIEVersion==
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 65 28 29 3d 3d 3d 22 6a 73 6f 6e 70 22 29 7b 69 66 28 21 61 72 67 2e 6a 73 6f 6e 70 29 61 72 67 2e 6a 73 6f 6e 70 3d 22 6a 73 6f 6e 70 22 3b 75 72 6c 2b 3d 75 72 6c 2e 69 6e 64 65 78 4f 66 28 27 3f 27 29 3d 3d 2d 31 3f 27 3f 27 3a 27 26 27 3b 69 66 28 21 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 28 64 61 74 61 29 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 64 61 74 61 29 7b 75 72 6c 2b 3d 6f 2b 22 3d 22 2b 64 61 74 61 5b 6f 5d 2b 27 26 27 7d 75 72 6c 3d 75 72 6c 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 75 72 6c 2e 6c 65 6e 67 74 68 2d 31 29 7d 75 72 6c 2b 3d 22 26 22 2b 61 72 67 2e 6a 73 6f 6e 70 2b 22 3d 61 6a 61 78 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 22 3b 76 61 72 20 4a 53 4f 4e 50 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 Data Ascii: e()==="jsonp"){if(!arg.jsonp)arg.jsonp="jsonp";url+=url.indexOf('?')==-1?'?':'&';if(!isEmptyObject(data)){for(var o in data){url+=o+"="+data[o]+'&'}url=url.substring(0,url.length-1)}url+="&"+arg.jsonp+"=ajax.jsonpCallback";var JSONP=document.createElement
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 65 6e 74 42 79 49 64 28 22 6a 73 6f 6e 70 22 29 29 3b 69 66 28 47 4c 4f 42 41 4c 2e 63 61 6c 6c 62 61 63 6b 29 7b 47 4c 4f 42 41 4c 2e 63 61 6c 6c 62 61 63 6b 28 64 61 74 61 29 7d 7d 7d 7d 28 29 3b 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 6f 54 6f 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 74 6f 54 6f 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 73 74 79 6c 65 27 2c 27 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 37 30 25 3b 20 6c 65 66 74 3a 39 35 25 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 3b 27 2b 27 77 69 64 74 68 3a 33 39 70 78 3b 20 68 65 69 67 68 74 3a 33 39 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 39 70 78 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e Data Ascii: entById("jsonp"));if(GLOBAL.callback){GLOBAL.callback(data)}}}}();;(function(){var toTop=document.createElement("div");toTop.setAttribute('style','position: fixed; top:70%; left:95%;z-index:9999;'+'width:39px; height:39px; line-height:39px; text-align:cen
2024-04-25 13:30:39 UTC	1143	IN	Data Raw: 63 72 6f 6c 6c 41 6e 69 6d 61 74 65 28 73 63 72 6f 6c 6c 44 75 72 61 74 69 6f 6e 29 7b 76 61 72 20 6d 61 78 48 65 69 67 68 74 3d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 73 63 72 6f 6c 6c 48 65 69 67 68 74 2d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 0a 73 63 72 6f 6c 6c 44 75 72 61 74 69 6f 6e 3d 4d 61 74 68 2e 6d 69 6e 28 73 63 72 6f 6c 6c 44 75 72 61 74 69 6f 6e 2c 6d 61 78 48 65 69 67 68 74 29 0a 76 61 72 20 73 63 72 6f 6c 6c 53 74 65 70 3d 30 2e 30 33 35 0a 76 61 72 20 73 63 72 6f 6c 6c 43 6f 75 6e 74 3d 30 2c 73 63 72 6f 6c 6c 4d 61 72 67 69 6e 2c 73 63 72 6f 6c 6c 49 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f Data Ascii: crollAnimate(scrollDuration){var maxHeight=document.documentElement.scrollHeight-document.documentElement.clientHeightscrollDuration=Math.min(scrollDuration,maxHeight)var scrollStep=0.035var scrollCount=0,scrollMargin,scrollInterval=setInterval(functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49832	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	589	OUT	GET /static/js/common/sprint.min.js HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	698	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:37:26 GMT etag: W/"416b-5e7088422f03a-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 40646 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G1QkYqKHoqFaqIxn%2BGPL1BXQ5rO8EUUzQj6chdG142TSk28gs8s3zVZWOyhZeKyzLk%2FhWu08q0wpy57UoepJl6bTP9CQZRLH9MLwm4utalC4%2FZY%2F0WJwKN3a3zwEbTcwmfPAiPY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e1d8644dc-ATL
2024-04-25 13:30:39 UTC	671	IN	Data Raw: 34 31 36 62 0d 0a 2f 2f 20 53 70 72 69 6e 74 20 76 30 2e 39 2e 32 20 2d 20 73 70 72 69 6e 74 6a 73 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 0a 76 61 72 20 53 70 72 69 6e 74 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 53 70 72 69 6e 74 28 62 29 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 76 61 72 20 67 3d 64 5b 66 5d 2c 68 3d 61 5b 67 5d 2c 6b 3d 68 2e 6c 65 6e 67 74 68 2c 6c 3d 30 3b 6c 3c 6b 3b 6c 2b 2b 29 63 2e 6f 6e 28 67 2c 68 5b 6c 5d 29 7d 2c 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 22 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 20 Data Ascii: 416b// Sprint v0.9.2 - sprintjs.com/licensevar Sprint;(function(){var D=function(a,b){for(var c=Sprint(b),d=Object.keys(a),e=d.length,f=0;f<e;f++)for(var g=d[f],h=a[g],k=h.length,l=0;l<k;l++)c.on(g,h[l])},w=function(){var a="animation-iteration-count
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 62 26 26 62 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 61 2c 74 68 69 73 29 7d 2c 62 65 66 6f 72 65 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 7d 2c 45 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 21 28 31 3c 61 2e 6e 6f 64 65 54 79 70 65 29 29 7b 76 61 72 20 63 3d 61 2e 73 70 72 69 6e 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3b 63 26 26 44 28 63 2c 62 29 3b 66 6f 72 28 76 61 72 20 64 3d 72 28 22 2a 22 2c 61 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 2c 67 3d 30 3b 67 3c 65 3b 67 2b 2b 29 69 66 28 63 3d 64 5b 67 5d 2e 73 70 72 69 6e 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 29 66 7c 7c 28 66 3d 72 28 22 2a 22 2c 62 29 29 2c 44 28 63 2c 66 5b Data Ascii: rentElement;b&&b.insertBefore(a,this)},beforeend:function(a){this.appendChild(a)}},E=function(a,b){if(!(1<a.nodeType)){var c=a.sprintEventListeners;c&&D(c,b);for(var d=r("",a),e=d.length,f,g=0;g<e;g++)if(c=d[g].sprintEventListeners)f\|\|(f=r("",b)),D(c,f[
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 2c 6b 3d 67 3f 66 2e 67 65 74 28 29 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 3f 41 28 66 2c 21 30 2c 21 30 29 3a 66 2e 6e 6f 64 65 54 79 70 65 3f 0a 5b 66 5d 3a 74 28 66 29 2c 6c 3d 6b 2e 6c 65 6e 67 74 68 3b 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 28 29 2c 64 3d 30 3b 64 3c 6c 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 6b 5b 64 5d 2c 66 3b 62 3f 28 66 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 45 28 65 2c 66 29 29 3a 66 3d 65 3b 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 66 29 3b 68 2e 70 75 73 68 28 66 29 7d 4b 5b 61 5d 2e 63 61 6c 6c 28 74 68 69 73 2c 63 29 7d 29 3b 67 26 26 28 66 2e 64 6f 6d 3d Data Ascii: ,k=g?f.get():Array.isArray(f)?A(f,!0,!0):f.nodeType?[f]:t(f),l=k.length;this.each(function(b){for(var c=document.createDocumentFragment(),d=0;d<l;d++){var e=k[d],f;b?(f=e.cloneNode(!0),E(e,f)):f=e;c.appendChild(f);h.push(f)}K[a].call(this,c)});g&&(f.dom=
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 74 4c 69 73 74 65 6e 65 72 28 63 2c 67 29 2c 2f 5c 2e 2f 2e 74 65 73 74 28 63 29 26 26 21 61 28 62 2c 63 2c 67 29 26 26 62 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 71 28 63 29 5b 30 5d 2c 67 29 29 7d 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 62 26 26 62 21 3d 3d 61 7d 29 7d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 66 29 7b 61 2e 73 70 72 69 6e 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 5b 66 5d 2e 66 6f 72 45 61 63 68 28 62 28 61 2c 66 2c 0a 65 29 29 3b 61 2e 73 70 72 69 6e 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 5b 66 5d 3d 63 28 61 2e 73 Data Ascii: tListener(c,g),/\./.test(c)&&!a(b,c,g)&&b.removeEventListener(q(c)[0],g))}},c=function(a,b){return a.filter(function(a){return b&&b!==a})};return function(a,e){return function(f){a.sprintEventListeners[f].forEach(b(a,f,e));a.sprintEventListeners[f]=c(a.s
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 61 72 20 63 3d 61 5b 30 5d 3b 72 65 74 75 72 6e 22 2e 22 3d 3d 63 3f 74 28 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 2e 73 6c 69 63 65 28 31 29 29 29 3a 22 23 22 3d 3d 63 3f 28 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 2e 73 6c 69 63 65 28 31 29 29 29 3f 5b 63 5d 3a 5b 5d 3a 22 62 6f 64 79 22 3d 3d 61 3f 5b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 5d 3a 74 28 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 61 29 29 7d 72 65 74 75 72 6e 20 74 28 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 29 29 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 41 28 61 2e 73 70 6c 69 74 28 22 2e 22 29 29 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 Data Ascii: ar c=a[0];return"."==c?t(b.getElementsByClassName(a.slice(1))):"#"==c?(c=b.getElementById(a.slice(1)))?[c]:[]:"body"==a?[document.body]:t(b.getElementsByTagName(a))}return t(b.querySelectorAll(a))},q=function(a){return A(a.split("."))},t=function(a){for(v
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 65 6f 66 20 61 29 69 66 28 22 3c 22 3d 3d 61 5b 30 5d 29 7b 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 64 3d 2f 5b 5c 77 3a 2d 5d 2b 2f 2e 65 78 65 63 28 61 29 5b 30 5d 2c 0a 64 3d 75 5b 64 5d 2c 65 3d 61 2e 74 72 69 6d 28 29 3b 64 26 26 28 65 3d 64 2e 69 6e 74 72 6f 2b 65 2b 64 2e 6f 75 74 72 6f 29 3b 63 2e 69 6e 73 65 72 74 41 64 6a 61 63 65 6e 74 48 54 4d 4c 28 22 61 66 74 65 72 62 65 67 69 6e 22 2c 65 29 3b 65 3d 63 2e 6c 61 73 74 43 68 69 6c 64 3b 69 66 28 64 29 66 6f 72 28 64 3d 64 2e 6f 75 74 72 6f 2e 6d 61 74 63 68 28 2f 3c 2f 67 29 2e 6c 65 6e 67 74 68 3b 64 2d 2d 3b 29 65 3d 65 2e 6c 61 73 74 43 68 69 6c 64 3b 63 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 22 22 3b 74 68 69 73 2e 64 6f Data Ascii: eof a)if("<"==a[0]){var c=document.createElement("div"),d=/[\w:-]+/.exec(a)[0],d=u[d],e=a.trim();d&&(e=d.intro+e+d.outro);c.insertAdjacentHTML("afterbegin",e);e=c.lastChild;if(d)for(d=d.outro.match(/</g).length;d--;)e=e.lastChild;c.textContent="";this.do
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 2c 6e 75 6c 6c 3d 3d 66 3f 76 6f 69 64 20 30 3a 66 3f 66 3a 61 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 70 2e 63 61 6c 6c 28 74 68 69 73 2c 22 62 65 66 6f 72 65 62 65 67 69 6e 22 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 63 68 69 6c 64 72 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 74 68 69 73 3b 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 28 31 3c 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 29 66 6f 72 28 76 61 72 20 64 3d 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 7b 76 61 72 20 67 3d 64 5b 66 5d 3b 0a 61 26 26 21 63 2e 69 73 28 61 2c 67 29 7c 7c 62 2e 70 75 73 68 28 67 29 Data Ascii: ,null==f?void 0:f?f:a},before:function(){p.call(this,"beforebegin",arguments);return this},children:function(a){var b=[],c=this;this.each(function(){if(!(1<this.nodeType))for(var d=this.children,e=d.length,f=0;f<e;f++){var g=d[f];a&&!c.is(a,g)\|\|b.push(g)
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 7d 2c 21 31 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 74 68 69 73 2e 64 6f 6d 2c 63 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 64 3d 30 3b 64 3c 63 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 62 5b 64 5d 3b 61 2e 63 61 6c 6c 28 65 2c 64 2c 65 29 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 65 6d 70 74 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 22 7d 29 7d 2c 65 71 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 53 70 72 69 6e 74 28 74 68 69 73 2e 67 65 74 28 61 29 29 7d 2c 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 Data Ascii: veChild(this),this},!1)},each:function(a){for(var b=this.dom,c=this.length,d=0;d<c;d++){var e=b[d];a.call(e,d,e)}return this},empty:function(){return this.each(function(){this.innerHTML=""})},eq:function(a){return Sprint(this.get(a))},filter:function(a){v
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 3f 62 2e 69 6e 6e 65 72 48 54 4d 4c 3a 76 6f 69 64 20 30 7d 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 3f 0a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 3d 61 2e 63 61 6c 6c 28 74 68 69 73 2c 62 2c 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 29 3b 53 70 72 69 6e 74 28 74 68 69 73 29 2e 68 74 6d 6c 28 62 29 7d 29 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 3d 61 7d 29 7d 2c 69 6e 64 65 78 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 68 69 73 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 62 3b 61 3f 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 61 3f 28 62 3d 74 68 69 73 2e 67 65 74 28 30 29 2c 61 3d 53 70 72 69 6e 74 28 61 29 29 3a Data Ascii: ?b.innerHTML:void 0}return"function"==typeof a?this.each(function(b){b=a.call(this,b,this.innerHTML);Sprint(this).html(b)}):this.each(function(){this.innerHTML=a})},index:function(a){if(this.length){var b;a?"string"==typeof a?(b=this.get(0),a=Sprint(a)):
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 62 29 7b 69 66 28 61 2e 63 61 6c 6c 28 74 68 69 73 2c 64 2c 74 68 69 73 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 63 2e 69 73 28 61 2c 74 68 69 73 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 21 31 29 7d 2c 6f 66 66 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 74 68 69 73 2e 6f 66 66 28 62 2c 61 5b 62 5d 29 7d 2c 0a 74 68 69 73 29 2c 74 68 69 73 3b 61 26 26 28 61 3d 61 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 22 20 22 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f Data Ascii: nction(d){if(b){if(a.call(this,d,this))return}else if(c.is(a,this))return;return this},!1)},off:function(a,b){if("object"==typeof a)return Object.keys(a).forEach(function(b){this.off(b,a[b])},this),this;a&&(a=a.trim().split(" "));return this.each(functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49833	172.67.68.11	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	630	OUT	GET /favicon.ico HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close last-modified: Fri, 03 Aug 2012 23:30:12 GMT etag: W/"4486-4c664e8d2c900-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 38601 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zeUE3Gikm0PqViz3kTQmvqiFuiGfqBMldFlncaEAQ5BUcLKAaBM0uGE%2BEIw3NT4qVIV%2Fr0nOkwAchKa3GFIsWDIC2%2FYshR4oQGVYINMZ4B2PHgBSHqr97eUt0cYSU4Fo3iBXpYg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e0ff78832-ATL
2024-04-25 13:30:39 UTC	683	IN	Data Raw: 34 34 38 36 0d 0a 00 00 01 00 04 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 ee 25 00 00 18 18 00 00 01 00 20 00 88 09 00 00 96 36 00 00 10 10 00 00 01 00 20 00 68 04 00 00 1e 40 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 80 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 448600 %F % 6 h@(0` %
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a 4e 30 01 b7 5d 39 3f b6 5c 38 96 b7 5d 39 de b7 5d 39 fe b6 5c 38 fe b7 5d 39 ff b7 5d 39 ff b6 5c 38 fe b7 5d 39 ff b7 5d 39 ff b7 5d 39 fe b7 5d 39 ff b7 5d 39 e9 b6 5c 38 a5 b7 5d 39 51 a9 56 34 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a5 55 34 04 b7 5e 3a 61 b7 5d 39 d6 b7 5d Data Ascii: N0]9?\8]9]9\8]9]9\8]9]9]9]9]9\8]9QV4U4^:a]9]
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: c0 6d 45 9f c1 6e 45 fe c1 6f 46 ff c1 6f 46 ff c2 70 47 fe c2 70 47 ff c2 71 47 ff c2 71 47 ff c2 71 47 fe c2 70 47 ff c2 70 47 fe c1 70 47 ff c1 6f 46 ff c1 6e 45 fe c0 6d 45 ff bf 6c 44 ff bf 6b 43 fe be 6a 42 ff bd 69 42 ff bd 69 42 fe be 69 42 ff be 6a 43 ff c0 6c 44 fe c1 6f 46 ff c3 72 48 ff c5 76 4b fe c9 7b 4f ff cc 80 52 ff ce 84 56 ff d0 88 58 fe d2 8a 5a ff d2 8b 5b ff d1 89 5a fe d0 87 58 ff ce 83 55 ff cb 7e 52 fe c8 7a 4e ff c5 75 4a ff c2 70 47 fe bf 6c 44 ff bd 68 41 ff bb 64 3e fe b7 5d 39 f8 b6 5c 38 1c 00 00 00 00 00 00 00 00 00 00 00 00 c1 70 46 58 c2 70 47 fe c2 71 48 fe c3 72 48 ff c3 73 49 ff c3 73 49 fe c4 74 4a ff c4 74 4a ff c4 74 4a ff c4 74 4a fe c4 74 4a ff c4 73 49 fe c3 73 49 ff c3 72 49 ff c2 71 48 fe c2 70 47 ff c1 6f 46 Data Ascii: mEnEoFoFpGpGqGqGqGpGpGpGoFnEmElDkCjBiBiBiBjClDoFrHvK{ORVXZ[ZXU~RzNuJpGlDhAd>]9\8pFXpGqHrHsIsItJtJtJtJtJsIsIrIqHpGoF
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 87 58 fe d0 88 5a fe fa f4 f0 fe fe fe fe fe fe fd fd fe db af 9c fe fe fe fe fe fe fe fe fe d7 9b 76 fe cc 81 53 fe cb 7f 52 fe ca 7d 51 fe df b1 97 fe fe fe fe fe fe fe fe fe dc b1 a0 fe fd fb fb fe fe fe fe fe f1 df d7 fe c0 6c 44 fe bf 6b 43 fe be 69 42 fe bd 68 41 fe bc 66 40 fe bb 65 3f fe ba 63 3e fe ba 63 3d fe ba 63 3d fe ba 62 3d fe b9 61 3c fe b9 60 3b fe b8 5f 3b fe b8 5e 3a fe b7 5e 39 fe b7 5d 39 fe b6 5c 38 fe b6 5c 38 e1 b4 5b 38 07 cb 7e 51 58 cc 80 53 ff cd 82 54 fe ce 83 55 ff cf 85 57 ff cf 86 58 fe d0 88 58 ff d1 89 59 ff d1 89 5a fe d2 8a 5a ff d2 8a 5a ff dc a5 80 ff fe fe fe fe ff ff ff ff f1 e0 d9 fe ca 83 5e ff fe fe fe ff fe fe fe fe e5 bd a5 ff ce 83 55 ff cd 82 54 fe cc 80 53 ff ef d8 ca ff fe fe fe fe fe fe fe ff c9 82 61 ff Data Ascii: XZvSR}QlDkCiBhAf@e?c>c=c=b=a<`;_;^:^9]9\8\8[8~QXSTUWXXYZZZ^UTSa
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 65 ff e0 b6 a0 fe ff ff ff ff fe fd fc ff ea c7 ae fe ff ff ff ff ff ff ff ff da a8 8f fe cf 86 57 ff cd 83 55 ff cc 80 53 fe c6 78 50 ff fb f7 f5 ff fe fe fe fe fb f6 f3 ff c4 75 4c ff c1 6e 46 ff bf 6b 43 fe bd 68 41 ff bb 65 3f ff ba 62 3c fe b8 5f 3a ff b7 5d 39 ff b6 5c 38 fe b7 5d 39 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d3 8d 5c a6 d5 8f 5e ff d6 92 60 fe d8 94 62 ff d9 97 64 ff da 99 66 fe dc 9b 67 ff dd 9d 68 ff dd 9f 6a fe eb c5 a4 ff ff ff ff ff ff ff ff ff eb d2 c8 fe db 9b 67 ff de 9f 6a fe dd 9e 69 ff dc 9c 67 ff d7 9b 76 fe ff ff ff ff ff ff ff ff fc f8 f6 fe ff ff ff ff fe fd fd ff cd 87 60 fe d0 87 58 ff ce 84 56 ff cd 81 54 fe ca 7d 50 ff e9 cd c2 ff fe fe fe fe ff ff ff ff d3 98 7a ff c1 Data Ascii: eWUSxPuLnFkChAe?b<_:]9\8]9\^`bdfghjgjigv`XVT}Pz
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: ff d5 8f 5e fe d3 8c 5c ff d1 89 59 ff cf 86 57 fe cd 82 55 ff cb 7f 52 ff c9 7a 4f fe c3 71 48 ff c1 6f 46 ff c2 71 48 ff c1 6f 46 fe bf 6c 44 ff bd 69 42 ff bc 65 3f fe ba 62 3d ff b8 5f 3a fa b7 5d 39 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 99 65 6a dc 9c 67 ff dd 9f 6a ff df a2 6c fe e1 a5 6e ff e3 a8 71 ff e5 ac 73 fe e7 af 75 ff e8 b2 78 ff e9 b4 79 ff e8 b2 78 fe e7 af 76 ff e5 ac 73 fe e3 a9 71 ff e1 a6 6f ff e0 a2 6c fe de 9f 6a ff dc 9c 68 ff da 99 65 fe d8 96 63 ff d6 92 60 ff d5 8f 5e fe d3 8c 5c ff d1 89 59 ff cf 86 57 fe cd 82 54 ff cb 7f 52 ff c9 7c 50 fe c8 79 4d ff c5 75 4b ff c3 72 49 ff c1 6f 46 fe bf 6c 44 ff bd 69 42 ff bc 65 3f fe ba 62 3d ff b8 5f Data Ascii: ^\YWURzOqHoFqHoFlDiBe?b=_:]9!ejgjlnqsuxyxvsqoljhec`^\YWTR\|PyMuKrIoFlDiBe?b=_
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: c7 78 4d fe c5 75 4b ff c3 72 49 ff c1 6f 46 ff bf 6c 44 b0 bc 69 42 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 9c 68 53 dc 9c 68 eb dc 9d 68 fe dd 9d 68 fe dc 9d 68 fe dc 9c 68 fe dc 9b 67 fe db 9a 66 fe da 98 65 fe d9 97 64 fe d8 95 62 fe d6 92 60 fe d5 90 5f fe d4 8d 5d fe d2 8b 5b fe d0 88 59 fe cf 85 57 fe cd 83 55 fe cc 80 53 fe ca 7d 51 fe c8 7a 4e fe c7 77 4c fe c4 74 4a fe c2 71 48 f8 c1 6e 46 77 b8 68 41 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: xMuKrIoFlDiBhShhhhhgfedb`_][YWUS}QzNwLtJqHnFwhA
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 75 3f 27 05 bb 64 3e 92 bb 64 3e fe bb 65 3f ff bb 65 3e ff bb 64 3e ff bb 64 3e ff ba 63 3d ff b9 61 3c ff b8 60 3b ff b8 60 3b ff b9 62 3d ff bc 66 40 ff c0 6d 44 ff c4 74 4a ff cb 7e 51 ff c8 7a 4e ff ba 62 3d db a9 56 34 30 9d 50 31 25 b7 5e 3a b4 c1 6f 46 fc c4 74 4a ff c0 6c 44 fe b9 60 3b c9 ad 58 36 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 47 2c 08 bd 68 41 b5 bd 69 42 ff be 69 42 ff be 6a 42 ff be 69 42 ff be 69 42 ff bd 68 41 ff bd 67 41 ff bc 66 40 ff bb 64 3e ff bb 64 3e ff bb 64 3e ff bc 67 40 ff bf 6c 44 ff c3 73 49 ff c9 7b 4f ff cf 85 57 ff d2 8c 5c ff c0 6d 45 f3 c0 6c 44 f0 d6 92 60 ff d6 92 60 ff d0 87 58 ff ca 7d 51 ff c4 74 4a ff bb 64 3e fc b5 5c 38 5f 00 Data Ascii: u?'d>d>e?e>d>d>c=a<`;`;b=f@mDtJ~QzNb=V40P1%^:oFtJlD`;X6@G,hAiBiBjBiBiBhAgAf@d>d>d>g@lDsI{OW\mElD``X}QtJd>\8_
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: ff bd 67 40 ff ba 63 3d ff b7 5e 3a ff b7 5d 39 ff b7 5d 39 ff b6 5c 38 98 9c 4f 30 26 00 00 00 00 00 00 00 00 00 00 00 00 d1 89 5a de d3 8d 5c ff d5 90 5f ff d7 93 61 ff d8 96 63 ff d9 98 64 ff df a7 7a ff fe fe fe ff f9 f1 ee ff d5 91 60 ff d9 97 64 ff e6 c3 af ff fe fe fe ff dd a6 7f ff fe fc fb ff f3 e5 df ff cc 80 53 ff cb 7f 52 ff e3 bf ae ff ff ff ff ff d9 a7 8e ff c0 6d 45 ff be 69 42 ff bb 64 3e ff b8 60 3b ff b7 5d 39 ff b7 5d 39 ff a5 54 33 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d3 8c 5c d1 d5 90 5f ff d7 93 61 ff d9 97 64 ff db 9a 66 ff dc 9c 68 ff ec c8 ab ff ff ff ff ff e9 cc bc ff dc 9d 68 ff db 9b 67 ff dd a8 85 ff ff ff ff ff f4 e2 d6 ff ff ff ff ff e4 bf ac ff cf 85 57 ff cc 81 54 ff d4 9a 7b ff ff ff ff ff ec d3 c7 ff c1 6f Data Ascii: g@c=^:]9]9\8O0&Z\_acdz`dSRmEiBd>`;]9]9T3V\_adfhhgWT{o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49838	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	386	OUT	GET /static/img/product/products_icon/wfh-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	744	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 2140 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=2389 Vary: Accept etag: "955-5e5da4e19cabe" last-modified: Wed, 10 Aug 2022 03:04:19 GMT CF-Cache-Status: HIT Age: 59375 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P3YjCwIOypPgb%2FhDyeEjDotVQOkjciJnIAjVTeLbpB4ZaY%2F17HAtoPQ0eu2xg9V%2BSwTmyTjkZWoS%2B%2F9bOfF%2BbEdCYgwmLMTw%2BLy7Y0UMYhKlY4yRT0qzpHkWpO0wOgCKhW%2FctIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e58726745-ATL
2024-04-25 13:30:39 UTC	625	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 02 f7 50 4c 54 45 00 00 00 21 57 70 00 00 00 2c 94 c9 34 9d cf 33 9f d1 50 ba e7 3c aa db 31 98 cf 3f a6 d4 3a a0 d0 47 ab d8 36 a0 d1 5c c0 ea 48 b4 e2 2b 93 d0 2f 9f da 32 a3 da 32 a9 e1 3a b3 e6 46 b9 e7 2c 93 d2 2b 99 d5 17 82 c6 31 a7 dd 37 b0 e4 42 b9 e8 1c 7c b1 51 bf eb 56 c4 ee 66 cb f2 70 d0 f3 54 a8 ce 5c c8 f2 4a af db 58 ba e7 21 85 be 50 b2 df 56 aa d0 5d ba e8 45 af e1 47 b1 e3 43 ab db 43 ac dd 46 b1 e3 51 ad d7 34 a3 d6 29 99 cc 2f 9e d1 28 93 c4 1e 88 bc 0a 74 a7 13 82 b5 0c 63 9c 0b 54 81 c8 dc e4 8d d2 ed 17 78 b0 07 5c 8e 17 69 9c 19 5f 8d 2a 99 cc 22 98 cf 08 4a 75 4b ad d6 9d c8 db Data Ascii: PNGIHDR<<")@gAMAaPLTE!Wp,43P<1?:G6\H+/22:F,+17B\|QVfpT\JX!PV]EGCCFQ4)/(tcTx\i_*"JuK
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: b3 e6 30 a5 de 34 aa e1 33 aa e1 31 a7 e3 2e a1 e0 2c 9c da 2d 9f dc 2d 9a de 28 90 d5 25 89 d3 29 91 d7 27 8b d4 27 8b d4 29 91 d6 2c 94 dc 28 8c d5 28 8b d5 27 8a d4 27 8b d4 29 8c d6 05 1f 33 0a 2a 43 29 91 d7 2c 9c da 2d 9f dc 2a 98 d9 15 69 a5 2a 93 d7 2a 90 d8 27 8b d4 26 8a d4 29 8d d6 2c 94 de 0c 39 57 14 54 82 15 48 6e 2c 9a d2 30 a1 d2 0c 69 9b 00 00 00 02 02 02 0e 5d 8d 12 65 97 30 a0 f1 15 72 b9 26 8a d4 28 97 d8 2a 93 d8 26 8b d4 27 8c d5 2a 93 d7 2c 90 cf 00 00 00 00 00 00 00 00 00 3c 3b 3b 00 00 00 00 01 02 00 00 00 00 00 00 02 0b 11 01 05 09 01 07 0b 2e 5d ed c9 00 00 00 fd 74 52 4e 53 00 03 1a 0c 16 23 3a 2c 4b 60 3a 72 ac 4f 46 68 8c 96 8e 8d 8d 75 93 97 9d 98 99 aa 94 8b 96 93 9b 9d a7 ff a6 fa c5 f6 ea f3 e3 fe fa e0 fd fc fc fd fb ff Data Ascii: 0431.,--(%)''),(('')3C),-i*'&),9WTHn,0i]e0r&(&'*,<;;.]tRNS#:,K`:rOFhu
2024-04-25 13:30:39 UTC	146	IN	Data Raw: 42 a5 84 ac 13 5f 3c 72 e4 be 0b 17 cf 9f f8 f2 d8 b1 63 47 8f c6 f1 dc 6c 73 ee e0 ee 47 77 3e f1 f8 c3 4f 3e b2 73 d7 63 ad 4c 80 b2 64 17 b5 33 b5 00 b9 9a 86 2c c5 23 0c 70 e9 83 5f 4c 7b 20 c6 d5 9b 5f 0c a9 52 2e e3 b4 12 2b 74 95 04 41 20 54 49 bd 7b be 9d 53 6f 8d 6e dd 93 06 5c 1f 71 5d 84 5e 5c da 6c 1d 38 78 e0 fd 4e e6 b8 71 c4 65 a9 49 33 b7 70 d2 5b e0 66 e2 3f 64 6e b1 e2 44 ff ee 3c 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: B_<rcGlsGw>O>scLd3,#p_L{ _R.+tA TI{Son\q]^\l8xNqeI3p[f?dnD<IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49837	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	386	OUT	GET /static/img/product/products_icon/wrc-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	730	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 2376 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=2385 Vary: Accept etag: "951-5e5da50819748" last-modified: Wed, 10 Aug 2022 03:04:59 GMT CF-Cache-Status: HIT Age: 55006 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P2loSpq8PbLIk8hVlMmsdxjH6Rx5MonjI0VvplNurG7onbQ6NfY42h2hfWIVZfXGiJfyq2EvJrsNDLaDJ5UfXprTYM4ofJ15pbi23ZqQFJxr20LA7S2wzBZ2%2FkSemCkpolmx5vk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e5853673b-ATL
2024-04-25 13:30:39 UTC	639	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 00 50 4c 54 45 12 51 87 00 20 6f 00 40 88 09 23 39 33 8c c7 10 50 87 83 a3 cb 3f 5c 84 0b 4f 8e 0f 45 81 48 68 94 38 52 7d b7 c9 dd 0d 2f 4e 4d 81 ba 11 5f a6 70 89 ae 59 8c c5 a0 b8 d2 07 23 3d 60 7e a7 69 85 ae 17 7a d0 52 73 a2 13 6d c1 45 5f 85 10 66 ba 4f 86 c0 06 24 3e 2b 43 69 24 58 98 4c 66 90 7b a0 cc 1d 7d d0 74 93 bb 53 76 a1 53 74 a0 2f 4d 76 6c 95 c3 05 1c 31 57 77 a3 5a 81 b1 03 15 25 15 3d 6b 66 83 ac 35 5d 8e 4d 6b 94 0a 33 58 6d 8a b2 04 1e 3c 18 47 77 15 76 cf 37 54 7f 22 69 ae 0f 3b 6b 22 7b cb 11 57 98 47 ad ed 06 27 4d ba d1 ee 06 1c 2d 60 8d c0 83 9e bf 3e 62 8f 0f 5f aa 4c 6e 9b Data Ascii: PNGIHDR<<")@gAMAaPLTEQ o@#93P?\OEHh8R}/NM_pY#=`~izRsmE_fO$>+Ci$XLf{}tSvSt/Mvl1WwZ%=kf5]Mk3Xm<Gwv7T"i;k"{WG'M-`>b_Ln
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 2f a0 e9 97 ae d4 13 69 ae 22 97 e2 42 bf f7 a9 c8 e9 90 a9 d1 1d 8a d7 f2 f8 fe 0c 51 92 05 51 9d 50 67 8d 55 6c 92 fe ff ff ea ef f7 47 bd f8 a6 c2 e4 75 8c b2 32 a5 e7 34 a9 ee d4 e6 f8 3b bb fa 25 92 e0 12 65 ab 16 72 c1 35 a1 e9 6e 85 ac 17 6b b2 44 c5 fb 5a 73 99 ff ff ff e2 ef fc 1f 78 be 02 3e 7b 22 8d d9 38 a6 ed d3 e2 f2 8d a5 cd 17 76 c2 1f 84 d1 89 a1 c7 6b 83 a9 38 b1 f5 c2 d9 f1 0b 54 9b 78 8f b5 84 9d c4 db ea fa 38 b3 f7 67 7f a5 7f 97 bd 40 c0 fb 70 8a b0 1b 80 ce 1b 7c c8 20 88 d3 c9 df f4 64 7b a1 60 78 9e 14 6f bb 35 ac f4 7b 92 b8 53 72 eb 92 00 00 00 5b 74 52 4e 53 d7 f3 fe 81 fe e7 ee 98 a4 b9 a5 de f2 a9 64 f4 f6 f3 c6 b0 41 db f1 b5 d0 c3 a8 e6 27 c6 9f e8 d2 97 d9 9d df 45 90 34 eb f3 61 e1 ef 58 50 c5 c3 41 16 d7 f0 f0 fe 4b fb Data Ascii: /i"BQQPgUlGu24;%er5nkDZsx>{"8vk8Tx8g@p\| d{`xo5{Sr[tRNSdA'E4aXPAK
2024-04-25 13:30:39 UTC	368	IN	Data Raw: 51 a7 06 7a 67 4a 6f 8a 28 52 8b e9 26 d8 f6 f7 b0 30 4f ff bb 0f e0 1c 9d ae 87 0a 25 91 00 16 d4 d6 0e 01 0c a8 1e d9 03 e7 32 ee d6 ac 98 b9 7f cd 08 7f 0c c8 87 36 97 ce f4 3f b8 42 a5 ea 9c 39 dd ca 01 52 43 a9 8f 5e 30 24 18 2a 0d ef 42 92 99 e4 c4 c4 44 d2 63 ea 3e 33 e3 e9 b2 61 e7 e9 d6 c1 c1 b4 6e b8 8e 93 a2 e4 aa 48 46 0c 2a 8e db c1 64 92 4b 63 62 48 09 ce 3d be 73 cc 60 90 9d f6 ad ad 40 d7 eb a8 0a 95 4a 91 14 fe 84 c9 bc c3 8c db 41 26 17 92 06 60 5c e7 1e 78 e5 3e 77 33 18 64 9e 63 7f da e0 f3 b4 fa 6e 9d 62 40 55 ea 43 66 82 1c 8b 03 54 c5 85 3a eb e0 95 a3 61 90 ef d6 a1 07 8d 5c c7 45 25 dd 41 92 91 48 24 2c 06 50 25 87 a1 83 3f ca ae fc 60 14 0c e2 be db de a8 bb 7b 14 a9 71 85 85 85 49 24 68 a2 42 69 ec 40 76 a5 bd e3 06 97 b1 d6 0a Data Ascii: QzgJo(R&0O%26?B9RC^0$BDc>3anHFdKcbH=s`@JA&`\x>w3dcnb@UCfT:a\E%AH$,P%?`{qI$hBi@v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49841	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	375	OUT	GET /static/img/common/index-menu.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 12378 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: status=not_needed Vary: Accept etag: "305a-6166e81b2385b" last-modified: Fri, 19 Apr 2024 08:02:18 GMT CF-Cache-Status: HIT Age: 61552 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H8SE1u%2Fz0AeENwMG%2BbghmoxSPBGJR79R5hOiRGWi3Ygwa19EUZO2HQu6qRpvIbgtxN7JKo6yh8KbztS0yyoobxCcy5hrPqYbCYZZOXS9ZX4qHXYFil%2Foat0rDDlXET8iwkXyJkI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e6fce12ef-ATL
2024-04-25 13:30:39 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 a0 00 00 00 c0 08 03 00 00 00 b4 e5 98 45 00 00 02 f7 50 4c 54 45 00 00 00 5c 79 75 d7 d7 d9 01 b6 ff 06 05 00 1a 1f 18 2b 88 c9 0e 13 0e 26 8d d5 71 c3 30 37 ac eb 7b 7e 7e 29 94 d6 ae ae ae 09 0d 0d 27 8e d8 41 81 73 11 17 1b 29 a2 d8 27 8f 0f 37 b1 e3 3d 40 01 8e 90 8f 4a 6f 0f a8 ab a9 63 b1 5d 03 03 01 50 bc e9 83 c6 56 16 71 0a 2c a1 e6 64 ce 44 2b ac e5 22 77 be 52 b9 31 34 73 9e 56 4e 4b a8 aa a8 11 53 09 0a 0c 0e 8e d5 2f 56 58 57 91 c0 e2 30 97 e2 48 49 47 46 78 db 3b 9f 21 38 95 27 c1 e7 a8 aa b0 b7 5d 5f 5f 6c 9e 20 bc ad 0c b5 be d2 22 88 c4 c6 c7 c5 7e 65 02 61 69 6a de c6 0a 36 ad e3 ad b1 ae 24 6d bc 35 76 2e 9e b3 c6 6d c2 30 20 9f ee 59 b5 31 2e 9e da 46 bc eb 18 60 c2 53 be e9 3d Data Ascii: PNGIHDREPLTE\yu+&q07{~~)'As)'7=@Joc]PVq,dD+"wR14sVNKS/VXW0HIGFx;!8']__l "~eaij6$m5v.m0 Y1.F`S=
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: ff c8 02 0f a0 00 00 78 fa fd fc ee ff ed 02 00 2f cf 6e cc 13 fa ad 0a 29 a1 f6 ed df 26 ab dd 90 03 2e 8c fb f3 47 5b 87 17 00 45 d1 fe f6 6a 8b b1 2d 19 89 ec 00 64 e9 00 14 7a 3f 6b c7 98 c5 92 8c ab 86 ae e7 54 05 3d e4 68 a9 c3 da f4 c8 9a b4 de de 3a 03 5b af d4 b4 c8 ac f6 ff d4 89 e6 fe 00 72 f4 7a b8 72 82 a2 dc 00 52 da 00 5d e2 00 5f f7 01 6b ef 2a 4d d9 5e 81 5a 02 48 df f0 d1 9f e7 5d 17 71 93 6e 2b 5f 76 03 4e e9 08 cc ff 03 58 ef 3d 6b e4 ca ce 4f ec 85 4b 1c 6f f5 90 a5 ef a7 ba f4 04 1f d0 5b 86 2e b4 00 00 00 7f 74 52 4e 53 00 0f fe fe af 1e 35 38 f4 fe 97 fe 96 fe 59 d5 22 75 fb fd fc cc fe fe 32 fe c8 f9 fe fc 58 fe c7 9f fc fe 56 a7 fe 93 fe fe fa 40 fe fc fc a5 fd d3 77 fe ec fb c5 47 d5 fb fc e9 6f 63 fe fd c4 76 47 e5 df d7 ce fe Data Ascii: x/n)&.G[Ej-dz?kT=h:[rzrR]_k*M^ZH]qn+_vNX=kOKo[.tRNS58Y"u2XV@wGocvG
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: f0 f9 44 59 99 b2 b8 92 51 78 51 1a 22 92 44 a4 bb 34 90 09 85 42 24 24 87 48 c6 6c 00 37 c2 2e d7 4f 4f 9c 3e fd 33 27 f0 68 1f 02 0e 4c c4 5f bf 6e 68 50 05 9b 67 6b 3c 35 8c 8b 8c 43 87 14 41 9e 2b 14 0c bb 40 d8 d5 b1 b1 ad f9 6d db 2d f9 12 a3 c3 a8 25 85 5b 9e 09 b8 95 9d 43 af 31 30 0e 49 c4 4f 98 9a 9f 45 29 53 ec e4 04 fe 77 88 2a 6d d0 68 e3 6c 4f 1c ff 72 f4 87 1f 4e ff cc 73 3c c7 c1 90 c2 d1 f7 53 a7 b2 42 3f 9c 35 79 98 9e 49 d5 03 bd 37 84 20 2f 0e 28 86 ca a9 4e f4 89 80 b7 40 4d 13 9c 5e c3 31 8a 04 8f 4e 6c 2d 2f 6f 6d e9 09 ea 82 6c 1b 07 32 0f 92 5e 99 f8 69 62 1e 9b 97 64 e7 1f 3a 24 1a 4a b4 31 c1 48 e4 eb 51 74 c1 d3 df 7f ff bb 8b 67 70 90 a4 04 f8 3a 15 c1 94 c7 94 43 15 bc 20 f2 41 f1 aa 2e 18 0c 83 20 4b 90 81 1c 37 ec 1d ca 1a Data Ascii: DYQxQ"D4B$$Hl7.OO>3'hL_nhPgk<5CA+@m-%[C10IOE)Sw*mhlOrNs<SB?5yI7 /(N@M^1Nl-/oml2^ibd:$J1HQtgp:C A. K7
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 07 58 fb 22 d5 7d b7 c2 f8 aa 67 7c dc e3 f6 c0 34 2c 70 00 0d d6 87 71 cf da 88 7d 72 52 95 9b 9c b4 f7 f6 f6 1a 40 3a 3f fe 8c 27 31 15 8b a7 a3 4c 04 a4 35 c1 9b fd 1b db 0b 0e 7f 54 f6 53 08 06 a2 d1 40 74 6d 7a 7a 6d d8 58 ca 7c 51 b7 3b df dc 2d e3 a7 4c 0e 0e 93 0a a3 c9 73 0c 82 6e 08 b8 c2 8a 9f 8f 41 ae 8d 8c d8 ed b3 93 60 d6 9e 9f 60 43 10 b1 65 93 49 e8 31 f0 9c 4d a7 a5 bc e0 b0 b4 b1 b1 b0 1d 8d 46 e5 00 01 32 5e 85 2e e0 ca 3a 23 95 97 30 5f d4 e4 ac ed a9 95 95 99 7e 12 20 51 1c b9 cf 50 e5 4e d5 78 dc a6 6e 24 88 7b 5c 9a 03 82 41 ce 3e 7b 7f 76 d6 8e d3 95 2e 98 4c 52 19 5e 39 e2 49 dc 82 e5 06 b4 6d ab db f6 69 fb b6 a3 df e1 90 a4 ab db 17 a4 07 0c 7c cf 85 d5 5b a5 cc 17 0d 46 eb 21 37 c3 b4 72 db 11 92 65 3f a1 a2 bd f9 f0 60 2a e5 Data Ascii: X"}g\|4,pq}rR@:?'1L5TS@tmzzmX\|Q;-LsnA``CeI1MF2^.:#0_~ QPNxn${\A>{v.LR^9Imi\|[F!7re?`*
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 9e 1b 6e fb a1 89 fd fb c3 48 ed 3d 54 8e 09 22 84 8a e0 b3 06 1b 92 8c 16 5a d0 60 e0 5a 4c d7 67 eb 3f c0 2f 8e a9 e0 cd b7 8a 0b d2 cf 08 f1 c0 50 66 1a 59 46 d9 dc ab 0a de a0 65 7b c3 ed 41 66 61 d8 13 18 9b c0 7a cd 4f 17 93 7b f7 17 db b1 1c ee 99 f8 7c 7f 18 ab 17 a8 31 41 bc f9 fd 18 85 77 3e b3 8f 09 d2 ee ef 14 1e 53 c7 46 5a 4c b3 b3 0d ef 2a 82 99 d2 64 dd 75 8d a0 8a e5 00 b2 06 bc dc e0 56 05 a1 76 03 f1 c3 f0 4b cc 8c 3d 06 c1 09 59 70 ef fe a2 76 f0 bb 43 13 9f 87 c3 30 44 52 a9 1f 63 ff f0 fe 30 5b cc 40 90 76 cc 0d 30 74 4c e9 bd 4b f5 b3 a6 86 af 14 c1 96 92 a0 16 1d 50 cc 2d d3 2c 80 b8 89 60 e6 d6 6e 11 94 a7 e6 b1 9e 40 68 ac 27 94 08 2d 4f 30 1e fd 33 fd 45 a0 3b ff 39 c2 05 c5 61 7c 89 c2 f0 f0 d7 e1 b0 b2 81 3f 1e 34 d4 d4 4c 81 Data Ascii: nH=T"Z`ZLg?/PfYFe{AfazO{\|1Aw>SFZL*duVvK=YpvC0DRc0[@v0tLKP-,`n@h'-O03E;9a\|?4L
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 5d f9 3b 5a 5f 7d e7 9d b7 df 7e fb 79 9d 3a 06 a9 d9 61 76 88 47 b3 06 74 42 1c c1 48 87 2a 08 19 1f bd b8 f2 4e be 1c bd e6 23 8a 60 16 63 30 65 4e 39 ec 99 4c 66 29 93 29 a4 22 ab a9 a1 ac ad 24 d8 2e 25 49 0c 43 10 9a 12 01 12 d4 90 e1 18 59 91 da d9 44 7c 47 6b eb 82 53 c0 e4 e7 ea 5d 73 09 4e bb eb cd 5c 2f 63 b3 5f 11 c4 25 99 60 01 87 78 d4 c1 2f b5 dc bc d9 f2 8b 33 68 d6 6d 17 a4 47 34 5f c6 17 b1 41 51 22 28 40 70 35 92 2d ac 72 05 13 67 b3 e7 33 99 ec 46 2a e5 75 94 52 bc 4f 4a c3 45 4a 26 96 13 49 7a 0d bc 08 25 25 69 05 d6 ec 6b 5a c1 88 0f 7e bc 6b 13 82 82 e0 5e ff e6 9b 2b cf f5 3e 77 e5 a3 f5 e7 f1 f9 8e 48 2a a5 a4 b8 b0 da 14 6f 12 96 4c f5 46 ca 2c 3f b2 53 8a 11 be c5 c5 00 71 b9 5d b2 a0 b3 e6 2a 32 5c 98 35 1b f2 26 1e 01 2c 64 52 Data Ascii: ];Z_}~y:avGtBHN#`c0eN9Lf))"$.%ICYD\|GkS]sN\/c_%`x/3hmG4_AQ"(@p5-rg3FuROJEJ&Iz%%ikZ~k^+>wHoLF,?Sq]2\5&,dR
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 9e 28 f8 90 66 37 2a ce cc b5 cc 62 51 bb 44 94 bd 74 45 1b a6 66 80 bb 2f 23 80 9a a5 f9 bd 6d 0e 74 4d 63 d7 29 4e 6f 6b 7e e8 6a 71 b3 83 94 4a 2d 6e cf 77 fd 61 1b e6 8c f3 e9 33 6a 7b b0 f2 a5 90 3b a0 e0 0e 84 da 1e 7b 2c 81 f8 dd 36 5a 5c a9 73 7a 5a 3c ab c5 cb ad f4 51 c3 93 77 15 f5 4e d2 7b cb a5 c7 f7 e8 c5 94 e5 48 57 b5 9d bf e2 47 53 5f 31 38 58 49 07 43 b9 e1 8b 27 1f ae c0 73 1f 66 91 be 3e 1d 3d 3f 89 f3 7f 1a 56 ee 54 8c 75 aa ff e7 b7 f6 ce 35 28 aa 32 8c e3 e7 2c 01 6d 1b 46 66 8c 25 23 86 30 b1 09 81 d9 0d a2 40 a6 86 c4 b2 1b 74 43 01 1d 20 8b 9c 9a 49 b3 fb ee b2 bb a1 8b a9 4b 49 82 4b 64 85 ec 56 46 26 18 e0 50 66 18 ba 84 10 52 56 18 65 e8 54 5a 58 a9 39 56 1f fa 3f ef b9 ef c1 b2 0f 6d 97 e9 07 b2 17 82 7e 3e cf 7b 3f ef 7b fc Data Ascii: (f7*bQDtEf/#mtMc)Nok~jqJ-nwa3j{;{,6Z\szZ<QwN{HWGS_18XIC'sf>=?VTu5(2,mFf%#0@tC IKIKdVF&PfRVeTZX9V?m~>{?{
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: f1 c9 6c a2 1c db ed 9e 75 d5 a3 08 3e e3 41 33 e3 88 98 f3 e8 2a 00 3f 8d e1 32 ad df 32 c9 0f 88 ad 1e 3e 37 6d d2 45 10 8c 79 95 14 cb 28 c9 6a f8 b8 db d5 7e 79 16 cb 9d 54 7d 71 bb 02 c7 e4 de 8a 06 b5 60 ba 5a d0 63 ca eb 5b b5 2a 8f e7 14 c2 f4 5d 49 95 6a b4 a0 04 90 09 6e 0a 14 44 08 b3 0b 36 d0 90 4b 6b a8 8e df f7 f0 eb 9a 9d dd 7c 6e 9c c1 d6 d1 0b bf 00 41 ab d4 50 7b 23 ee 8c ea db d5 d7 a7 9d 0d 4c 0f 34 ac 52 8f b7 14 3d 7d 04 19 71 d9 94 e4 82 32 a1 31 d4 c3 7f ff 7d f7 b0 e5 50 4f eb ed 58 6c 4a ff 11 7b e5 1b 96 be 1c a9 9e a2 b8 55 11 bc 73 31 5a e8 c0 69 43 29 19 6e 96 47 0a e4 57 ca 49 40 8d f9 c1 f0 29 bd 20 71 43 36 62 d8 dd 59 96 4d ad a1 9e 47 be ef 5e b5 ab a7 bb f5 11 96 ae de de 75 15 0d 4b af d1 8c b2 d9 89 12 1a 10 62 c8 35 Data Ascii: lu>A3?22>7mEy(j~yT}q`Zc[]IjnD6Kk\|nAP{#L4R=}q21}POXlJ{Us1ZiC)nGWI@) qC6bYMG^uKb5
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: aa 21 2e 53 aa 7d be 3c 0e 79 e9 1e 70 15 04 d9 9e b9 e8 81 69 d3 d2 fa 28 c5 1f a0 5f 11 04 c3 26 85 d4 86 54 86 dc c5 b3 d1 0c 5f 14 1d 1d 33 b0 a6 70 91 22 e8 b2 dc d9 db 80 fc 56 2d a9 b7 5c b0 04 86 24 38 c7 e2 12 05 f3 cb cb a3 bb 62 21 69 b1 0c 0f 0d 0d 5b ba 2c ed db 62 bb a2 cb cb e5 04 5d 36 3f 15 8b 12 4e 93 c3 00 3d 53 a2 2d 62 e3 02 b9 af 2b be 67 f2 43 0f 3d 84 8d 55 df 3d 84 5b e7 7d da 7e ec e2 34 12 ec 49 a3 9a 92 c9 ae a1 d5 d6 d6 96 4e bf 1a f3 ad eb 59 9f 0c bf 9c c2 35 6b d6 cc e5 25 41 bb 25 83 04 91 5e da 04 0e 43 12 bc 33 40 10 4e 5d 5d 24 d8 25 0b 66 a9 b2 b0 31 d1 10 b1 d1 36 7f 86 cb fc d6 5b 51 56 f3 2c b9 97 bb 7b 1f f1 c6 3d f7 3c c4 9e 7c 79 68 17 40 8a 01 c2 c8 73 d3 6b c1 44 ba a4 57 1b 12 52 4b 1d 71 0c 65 26 27 8f 14 e5 Data Ascii: !.S}<ypi(_&T_3p"V-\$8b!i[,b]6?N=S-b+gC=U=[}~4INY5k%A%^C3@N]]$%f16[QV,{=<\|yh@skDWRKqe&'
2024-04-25 13:30:39 UTC	797	IN	Data Raw: e9 13 77 09 7b a5 a6 98 03 8f bf 07 f6 ab 15 e1 f8 ed b7 df 7e dd df ff 38 17 3c e6 f9 07 d1 7d 7c 56 23 81 0b d4 6f 36 b2 0c df a8 17 1c 69 ac 5f bd 3a 69 47 ff cd 5c f0 c8 f4 b7 0f 0d a5 fc 20 f9 ad 5d bd ba 7e ed 35 bc 22 48 a8 04 2d 38 5d f1 6b ff 13 5c d0 08 f5 33 ce a9 51 83 0c 2b 82 07 8e 82 c3 60 64 64 a4 7f e4 e7 9f 7f fe a9 3f 98 11 9c 37 9a 60 9c 22 78 e0 a0 fc ee 4f a0 11 65 b0 ff eb 60 0a 26 fb db 9d c3 43 7e a3 e0 d0 98 84 63 17 35 1f 87 ca 82 07 5e a8 b7 68 b0 3e bd fa db 60 96 c1 50 a3 df 89 95 35 08 36 d2 47 23 8e 66 ae ae b9 9b 93 04 0f 3c 0f a7 80 e3 b9 4f 07 55 30 df 6f 44 23 13 ed f7 7f dc 08 20 58 5f ff 55 63 b1 24 78 e0 f8 32 cb ea b5 35 c7 59 1b f9 13 f1 ed cf 96 15 c1 14 44 86 fd b4 6e ec f7 3f 27 08 d6 24 25 d5 34 86 cb 82 6f 5a Data Ascii: w{~8<}\|V#o6i_:iG\ ]~5"H-8]k\3Q+`dd?7`"xOe`&C~c5^h>`P56G#f<OU0oD# X_Uc$x25YDn?'$%4oZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49840	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	386	OUT	GET /static/img/product/products_icon/wdc-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 2357 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=2368 Vary: Accept etag: "940-5e5da4d33990d" last-modified: Wed, 10 Aug 2022 03:04:04 GMT CF-Cache-Status: HIT Age: 55006 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b12cY%2FfLn8TnaY2WNHn8z82GKl2FfEwAvsPVRkvPbFsjcypLTzfGIZR3izfu4HtJ4lKdgNP9dNbkHIVpzIDMHKl1go8%2FxDjOTSR6qxRPNRPH52n%2B%2FX%2FnbFIn%2BwR6hDedU9gPo3Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e6898b0e2-ATL
2024-04-25 13:30:39 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 00 50 4c 54 45 86 86 84 53 53 4f cd cd cd 27 65 95 b3 b1 a9 75 a5 ca 24 5e 8e 2d 70 a6 c8 c8 c8 fd ff e7 ad ad a3 b5 b4 a9 ab ab ab 00 00 00 65 ab 54 78 b7 66 12 51 84 20 20 1e d5 cd c8 9b 9b 9b a4 a4 a3 a2 c6 8f 78 78 78 97 97 97 74 b4 5b 5c 99 c0 25 7d c1 82 82 82 8d ba 7a a3 a0 9d d9 d9 d1 76 76 73 ca ca ca 21 64 9a ff ff f6 7c 7c 79 1b 5c 91 d8 d8 d8 35 73 a0 3a 3a 37 24 63 95 98 98 98 34 34 31 00 00 00 00 00 00 d8 d8 d8 ad cd 99 d9 d0 c9 9b 99 92 d6 d6 d6 48 48 45 00 00 00 89 cb 7b cf ce c6 d7 d7 d7 3c 68 8c de db d9 c0 c0 c0 5c 98 c1 f9 f4 e9 42 42 3e ba d4 a4 cc e0 ba d3 d3 d3 d7 d7 d7 85 ba 6d Data Ascii: PNGIHDR<<")@gAMAaPLTESSO'eu$^-peTxfQ xxxt[\%}zvvs!d\|\|y\5s::7$c441HHE{<h\BB>m
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 32 85 85 84 b3 b3 b3 99 e5 84 00 3a 73 25 97 0f 57 b5 44 ea e9 e4 b2 b2 b2 60 b9 4f 2a 9f 12 12 4d 81 33 a5 1c 2d 7a b8 e2 e3 e3 ad ad ad 8e 8e 8e 8c 8c 8c a0 a0 9f 15 51 8e b7 b7 b7 0c 0c 0c ed ec ec f8 f5 f5 e6 e6 e6 5c b6 4a c1 c0 c0 98 99 9a f3 f3 f3 f3 f2 ef af af af c2 c2 c2 bf bf bf 93 92 93 a7 a7 a7 b4 b4 b4 2f a3 17 24 5f 9b d0 d0 d0 b9 b9 b9 e1 e0 e0 2b 7b bc c8 c8 c8 c6 c6 c6 be be bd d6 d6 d6 bb bc bc f9 f9 f8 aa a9 aa dd dd dd c4 c4 c4 2a 67 a2 da da da 3b 77 b0 5e 9f d0 ce ce cd d2 d2 d2 33 70 aa ca ca ca 3e 7b b3 d8 d7 d7 d9 d9 d9 db db db d4 d4 d4 ff ff ff cc cc cc 6b 1e 24 95 00 00 00 5b 74 52 4e 53 ea 4f 27 85 c6 af 2e f9 7a f8 6d 91 e6 8e fd fb f0 6a eb a2 93 f7 ae e7 fa 38 74 b4 fa d6 cd f6 e5 ab fc 4a 54 cb 4c cc d5 bb 76 6b 3e 35 f3 Data Ascii: 2:s%WD`OM3-zQ\J/$_+{g;w^3p>{k$[tRNSO'.zmj8tJTLvk>5
2024-04-25 13:30:39 UTC	359	IN	Data Raw: 70 9c e5 72 b9 d6 8e 68 4b 0e 8e 53 a6 55 54 54 64 0e e1 ce 96 96 be 0b ec cb 06 3d 44 3a 44 90 45 a3 d7 f1 75 42 f0 88 68 4b 4a a8 84 e2 9d 3b cb 00 fe e6 4c 73 67 66 5e 4b 5e 06 fb 0d 03 2d 54 5b ec 3a 48 83 a0 26 13 8a a0 7a bb a8 46 cc e4 cf 9f df 6e 30 9c 2c cc e8 e8 ac cb 6b c9 5d 35 9e 75 ab 40 13 70 8d 46 a7 ed 19 aa a6 a1 e1 60 83 34 2e 2a 2a cb d0 79 f2 d8 b1 ce ce b2 bc 32 b0 ea e5 ac 87 84 c3 5d 63 d5 88 c5 62 bd b7 c6 c6 36 95 50 27 6a d0 30 45 85 59 75 9d e7 41 99 65 75 c7 56 31 0b c2 58 71 60 68 c8 0b 6a dc e3 c1 07 22 3d 1e d2 a2 e6 6b 25 09 51 85 19 b5 55 e9 e9 55 27 f7 5e 78 29 65 d9 72 2e 8f c7 86 e7 85 cc 98 bb 76 a0 f5 6b d7 0f 35 65 9c 34 e5 c0 c6 55 ef 81 8a 36 1e 60 c6 fb 6d 08 67 c5 e1 81 1b 42 43 43 df 9c 37 2f 04 f4 c1 60 33 66 Data Ascii: prhKSUTTd=D:DEuBhKJ;Lsgf^K^-T[:H&zFn0,k]5u@pF`4.**y2]cb6P'j0EYuAeuV1Xq`hj"=k%QUU'^x)er.vk5e4U6`mgBCC7/`3f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49842	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	385	OUT	GET /static/img/product/products_icon/wu-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	727	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 2165 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=2277 Vary: Accept etag: "8e5-5e5da5160f6e1" last-modified: Wed, 10 Aug 2022 03:05:14 GMT CF-Cache-Status: HIT Age: 6040 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wwpmak9A1DukhF05bqIxdyAQZTWmlCZm9eiWgNtuk4x0LM0GDWQNhmHW45kdtaSSL2tv09QB9rSMmgraG9LjFAxArspaJuU2XkppuNcCPKr2G1ck7JipA3206yBpjGGV3DrEmyI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e6bd84535-ATL
2024-04-25 13:30:39 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 02 fd 50 4c 54 45 00 00 00 00 00 00 55 86 ae 00 00 00 00 00 00 3c 68 8a 00 00 00 00 00 00 43 7f af 02 07 0c 31 76 b1 00 00 00 70 a7 d0 41 71 98 00 00 00 00 00 01 43 60 72 00 00 00 6c a7 d4 35 71 a3 00 00 00 4f 69 79 3f 78 a8 13 30 4a 00 00 00 00 00 00 00 00 00 6d a3 cd 60 77 85 07 19 28 7c b1 d8 76 8b 97 6a 83 8f 3b 81 ba 3e 79 a9 2b 72 ae 1b 50 7c 0d 29 3f 51 8a b9 82 97 a4 5f 9b cb 34 6c 9a 84 b7 de 4a 84 b4 0e 2d 45 97 a7 b2 5c 96 c5 68 a6 d6 9f ad b6 7c ae d5 9f ad b6 9c be d6 1d 4d 70 b9 cb d1 81 b4 db 6c a1 c8 1b 4f 75 2b 6a 96 1c 4e 73 19 4b 72 15 49 71 61 95 be 5d 96 bc 52 88 b0 73 9b b6 56 8e b8 Data Ascii: PNGIHDR<<")@gAMAaPLTEU<hC1vpAqC`rl5qOiy?x0Jm`w(\|vj;>y+rP\|)?Q_4lJ-E\h\|MplOu+jNsKrIqa]RsV
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 44 8d bd 3f 8e c3 50 86 b0 3f 8b c0 4a 87 b1 3a 8b c2 3f 89 b9 4d 84 a8 37 88 c0 44 84 b1 4e 82 a1 3d 83 b5 35 85 be 46 7f ad 36 83 b9 32 83 bd 48 7d 9e 38 81 b3 40 7e ad 44 7a a9 30 80 bb 36 7e af 31 7f b6 3f 79 a9 2d 7e ba 44 78 9b 42 77 a3 32 7c b1 35 7a ac 2c 7c b6 3d 76 a6 29 7c b9 31 77 a9 29 78 b2 27 78 b6 3c 72 98 37 71 a3 2c 75 ab 2e 74 a6 21 76 b5 24 75 b1 29 71 a7 20 72 b0 28 6f a3 32 6c 95 1d 70 af 22 6e a8 1d 6d ad 22 6b a2 1a 6b ab 2a 66 91 24 66 9c 18 66 a6 16 66 a7 1c 64 9d 14 61 a2 14 5e 9b 11 5e 9e 11 5b 99 0e 58 98 ce 60 4b 11 00 00 00 93 74 52 4e 53 00 01 03 03 05 07 08 0b 0c 0f 10 13 18 18 18 1c 20 20 23 22 2c 2f 31 33 32 3a 41 42 47 58 5b 5e 63 66 66 66 66 6a 6e 79 78 7a 7c 80 82 91 91 9b 9f 9e a3 b3 b7 be bf bf ca cf cf cf cf d9 dd Data Ascii: D?P?J:?M7DN=5F62H}8@~Dz06~1?y-~DxBw2\|5z,\|=v)\|1w)x'x<r7q,u.t!v$u)q r(o2lp"nm"kk*f$fffda^^[X`KtRNS #",/132:ABGX[^cffffjnyxz\|
2024-04-25 13:30:39 UTC	154	IN	Data Raw: 10 0b a4 aa 88 4d 32 01 2b 86 c4 42 6a 01 c8 43 00 5e 5a 89 49 4b 4a 9b ce 27 9e 84 12 36 62 44 45 e5 d6 e0 b5 0c 90 01 42 2c 84 50 ba bb 11 00 86 86 87 a7 69 14 9b c4 27 25 2c 88 3a 55 7b f5 3d 8b dc f5 78 32 a5 4d a0 30 10 65 63 20 c6 24 63 d8 8b 37 b1 01 ae 1a 0c 95 4b 48 0a c4 3e f6 40 52 5e 50 d4 88 a8 01 61 8a 3c 49 ec fd e8 3b b5 e5 8c 1a 55 5b 2c 18 3d 26 7d a5 a9 51 cc fd ff c7 ff b7 fe 05 e8 a7 50 10 e2 64 8a 4a 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: M2+BjC^ZIKJ'6bDEB,Pi'%,:U{=x2M0ec $c7KH>@R^Pa<I;U[,=&}QPdJIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49839	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:39 UTC	386	OUT	GET /static/img/product/products_icon/was-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:39 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:39 GMT Content-Type: image/png Content-Length: 2407 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=2413 Vary: Accept etag: "96d-5e5da4ced490d" last-modified: Wed, 10 Aug 2022 03:03:59 GMT CF-Cache-Status: HIT Age: 60969 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vhwpUMiJjAz39DDJaaj027PhGxwZFc17ob7qi9HFZrF2IdGjlgUUkPB4y4%2BI4ZZ64sUaxS9I7C%2FZ%2BgyPkzDYyNlrb02cSL2VakUnGvRtaSZR2q0Hd9jFoprgWoZLHL1UbKxcccM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb05e6fe87b93-ATL
2024-04-25 13:30:39 UTC	635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 00 50 4c 54 45 ea 77 1e c3 c3 c3 c6 e4 a3 c6 22 00 ab 25 02 c3 2d 03 ac 43 34 61 78 0c b7 4a 1c d8 63 30 e2 90 7a 6a 95 2b 65 32 01 6f 43 08 a9 5d 59 ad d0 80 6b af 2d a5 1a 00 98 14 01 c5 31 06 71 9c 33 b1 73 1f c6 e6 a4 e1 e1 e1 96 18 00 d2 ed b5 99 9d 9b b5 d5 92 d4 d3 d4 bc bc bc c9 47 2b bb d4 9f d4 d4 d5 71 9d 31 da da da bc 26 02 4a 70 08 9f 1d 02 d6 b3 ad e3 e3 e3 d3 d2 d4 d8 d8 d8 ac ab ae b9 b9 b9 c6 c6 c6 ab ab ab e1 e1 e1 c4 37 08 e1 e0 dc ae d3 80 a8 27 02 40 60 00 ad ad ae bc bc bc 48 6b 08 54 7e 0f cb d0 c6 a1 a9 9f a6 88 57 b8 cc a0 40 61 01 d0 4c 19 49 6d 07 c7 c7 c7 4d 74 0b 90 1f 02 Data Ascii: PNGIHDR<<")@gAMAaPLTEw"%-C4axJc0zj+e2oC]Yk-1q3sG+q1&Jp7'@`HkT~W@aLImMt
2024-04-25 13:30:39 UTC	1369	IN	Data Raw: 68 f4 af 4c c5 d0 b7 f8 f7 fa 5a 88 16 c2 c8 bb ef a4 6e c2 18 00 af d3 82 a6 ce 74 a1 ca 6f f3 d8 cd 7c b1 39 dc 59 04 d0 d0 d1 ee fd ff c7 29 00 65 9d 1a e8 e4 f0 ab d2 7c e0 65 03 cf 3c 02 a8 d0 78 6d a4 26 e2 dc e3 d5 f0 b9 f5 f5 f6 8b b9 54 ba de 92 ed f6 fa eb 85 0c de db e1 e5 73 08 86 bc 4a 34 58 00 3a 5b 00 d8 d5 db e4 e1 eb d4 3f 01 d3 d3 d4 94 c1 5b c1 3f 05 d7 d7 d7 57 83 12 ea ea ea 45 68 04 5d 8f 18 e8 e7 e7 cb cb ca 47 70 05 ef ef ef 4e 75 0c 62 95 1c e9 e9 e9 f2 f3 f3 53 7c 10 ec ed ec e4 e4 e3 e6 e5 e5 de de de dc db dc ff ff ff e0 e1 e1 3e 5e 00 15 ee c4 0c 00 00 00 56 74 52 4e 53 fe f2 f3 f9 46 8e fe fe e7 fe fe 91 fe f4 fe 8e fe a5 c9 ba cb fe e6 b4 f0 f7 dc cc cb ea fe bd 92 4d 77 dd 90 79 fe ed e3 eb ed b8 63 6b 61 61 fd 52 32 60 a4 Data Ascii: hLZnto\|9Y)e\|e<xm&TsJ4X:[?[?WEh]GpNubS\|>^VtRNSFMwyckaaR2`
2024-04-25 13:30:39 UTC	403	IN	Data Raw: 2f 51 e6 2a 58 78 b3 86 e5 5a ad b6 c4 00 74 f0 07 fd 65 a4 c7 68 d6 e3 87 8f ef a1 9f 90 da c0 8e 2d e0 15 4a bd 5e 8f 1b 2c 6d d6 a0 bf e1 90 65 47 f2 ee c6 c4 96 15 35 66 b4 a2 28 da 9a d1 28 f8 f5 5b 4b 1d 06 d6 ad 56 eb 95 f1 de 6e f8 41 2e 87 b4 18 16 7c ee 48 54 f0 17 11 6d a4 c6 c6 fc a9 f9 8d 8d a4 b6 88 d9 96 ff cf 2e 03 6a b5 3a ed be 82 8f 07 2b 97 7b c7 79 63 46 04 33 f6 46 1f 3b 20 78 20 10 50 28 14 81 00 9c 96 bb 65 ec ee 3a a0 54 2b 4d b9 f5 7c 96 d8 80 a5 ef 4e 47 8c 48 2f b9 3e 37 6d ef 81 fc fe d7 89 00 8b b6 84 41 7c 70 03 03 4a 25 37 fe aa 90 4f 96 c7 fd 1c e7 c6 e7 8b af c6 73 95 ca bd 9f fd f2 f9 86 d9 1b 40 80 b5 8c fd 56 eb 4d 80 0f 70 4d b9 2f ea 59 2c 05 0b a9 7f 71 0c c7 05 33 69 69 67 64 9b ac 3f e8 36 ca 34 6a ae 99 9b 5e 99 Data Ascii: /Q*XxZteh-J^,meG5f(([KVnA.\|HTm.j:+{ycF3F; x P(e:T+M\|NGH/>7mA\|pJ%7Os@VMpM/Y,q3iigd?64j^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49847	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	386	OUT	GET /static/img/product/products_icon/whk-60.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	736	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/png Content-Length: 3016 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=3044 Vary: Accept etag: "be4-5e5da4e915c1e" last-modified: Wed, 10 Aug 2022 03:04:27 GMT CF-Cache-Status: HIT Age: 58563 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pj5vPysjH2sY9%2FxluS4JJfimNBxrFz%2BULETtJbqipckxUxdkOrs1hzTpofkLApr3bKf3DxS%2FV4ZgXiCJjvxTtF81V80FxLEsxcYSgRp4cswQBqX03OoklQu9GnGh%2Br0ZQ1v7kGw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb06188bb53cc-ATL
2024-04-25 13:30:40 UTC	633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 03 00 00 00 0d 22 29 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 02 fd 50 4c 54 45 00 00 00 00 00 00 00 00 00 00 00 00 20 1b 00 2a 24 00 51 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 2e 00 47 3c 00 40 37 00 0e 0c 00 00 00 00 00 00 00 00 00 00 39 31 00 4a 40 00 61 53 00 1b 17 00 15 12 00 28 22 00 30 28 00 4f 43 00 30 29 00 3e 36 00 00 00 00 22 1d 00 1d 19 00 32 2c 00 5d 50 00 15 13 00 2d 26 00 59 4d 00 68 5a 00 df c7 00 d7 bd 00 d6 c0 00 24 1e 00 c7 b4 00 c5 ae 00 ff f3 00 e3 ce 00 ff e0 00 Data Ascii: PNGIHDR<<")@gAMAaPLTE *$QE6.G<@791J@aS("0(OC0)>6"2,]P-&YMhZ$
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 8c 7a 00 00 00 00 00 00 00 00 00 00 69 5b 00 a6 8f 00 e7 c9 00 93 80 00 23 1e 00 8f 7c 00 f7 de 00 b1 9e 00 00 00 00 eb d3 00 cf b9 00 bf a3 00 04 03 00 06 05 00 a3 8e 00 81 6f 00 01 01 00 19 16 00 9d 88 00 0d 0b 00 5d 52 00 55 49 00 3d 35 00 0f 0d 00 17 14 00 11 0f 00 1f 1b 00 56 4b 00 27 22 00 4c 42 00 65 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6d 70 07 47 00 00 00 ff 74 52 4e 53 00 06 c6 73 ba bb c8 bc 6b ba c7 b8 b7 b6 ac b0 b1 b3 b2 ae af ad b4 b5 ab aa b9 c1 be bd a9 bf c4 c3 b4 c5 6e 7d c0 c5 cb b7 b7 ba bd c6 bf c1 57 b9 bc be cb b5 Data Ascii: zi[#\|o]RUI=5VK'"LBeVmpGtRNSskn}W
2024-04-25 13:30:40 UTC	1014	IN	Data Raw: 7d fb 89 8c 95 6d ce 80 81 6b 82 2b 24 14 f2 bc 83 a9 5f e3 3d 18 8e 9f 6e d4 72 cc d3 22 6f 3e 7c 86 d7 d4 c7 6f 32 da 4d 39 28 79 59 70 99 c4 be e3 77 f8 cd 45 71 1e 9b 33 d1 48 33 4f 0f a7 3b 70 cc 85 17 5a 68 dd d2 65 38 01 ba f1 26 15 57 bb c4 8d 91 8c 1a 39 d3 47 d4 ea b9 bf 3c 2a 0e c4 be b1 f7 50 6e fc 1f 9a f3 9f 44 ab d5 be 29 58 f9 bb fb 33 20 b1 0b 7f 5c cf 68 b7 f1 63 5f 15 b4 f2 0f 6c 65 15 23 7b e5 0c c6 db 90 4f d5 5e 28 d7 2a b4 65 74 73 73 97 35 ce fc ec 1d d8 65 e1 43 9f c8 98 ca b7 8e 61 fc 03 bb 25 12 a3 4b 2c 8c 6a f7 69 8a c7 f3 df 76 df 28 5a a1 58 3a 6f f5 2b 87 3f fb fc b8 d7 2a 56 b5 c0 6e 2b c6 f3 77 a8 98 da 3d 38 12 de 26 b8 03 11 e8 8b 7b 0d ac e5 5f 28 24 46 e6 ba a6 66 95 8a 37 f6 17 66 a2 20 8a 82 27 3c 73 57 ce b9 84 7a Data Ascii: }mk+$_=nr"o>\|o2M9(yYpwEq3H3O;pZhe8&W9G<PnD)X3 \hc_le#{O^(etss5eCa%K,jiv(ZX:o+?*Vn+w=8&{_($Ff7f '<sWz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49848	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	374	OUT	GET /images/awards/softpedia-wfh.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	733	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/png Content-Length: 5763 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=5776 Vary: Accept etag: "1690-5e3c46ceb2c00" last-modified: Thu, 14 Jul 2022 14:07:44 GMT CF-Cache-Status: HIT Age: 59371 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zvKWVrM1RquyR3ovyRZ%2BelgshTMqfnmCO315aUsEIho41OP12kS6Hh3EdFbrLNoFfNSchDfFT5gJ866RELxZ7bqq5zsfLBvvQhno7%2F8XOcCcxv8LKxqHRlyxNbIHjodtuRE2iMI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb061885e8bb6-ATL
2024-04-25 13:30:40 UTC	636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f1 00 00 00 89 08 03 00 00 00 ca 64 2e 97 00 00 03 00 50 4c 54 45 00 28 73 f1 f3 f7 50 6b 9f b0 bc d4 60 79 a8 70 86 b0 5e 77 a7 40 5e 96 42 5e 95 d0 d7 e5 fc fa fb a1 af cb 07 2e 77 f4 f6 f9 e9 eb f2 f9 f6 f7 10 35 7c 80 94 b9 c4 cd de b8 c3 d8 44 5e 95 33 53 8f dd e1 eb bc c6 da ac b9 d1 9c ab c8 47 5e 94 c0 ca dc 5a 73 a4 0c 32 7a 4c 67 9c a7 b4 cf 1b 3f 82 e4 e8 f0 2c 4d 8b d6 dc e8 94 a4 c4 79 8d b4 ec ef f5 8e a0 c1 15 3a 7f f8 f9 fb 8b 9c be 46 63 9a ca d1 e1 86 98 bb 49 5e 93 4b 5e 92 47 5f 94 66 7d ab 55 70 a2 0e 34 7b 3b 59 93 a9 af c8 b3 b9 d0 4d 5e 91 4f 5d 90 51 5e 8f 53 5e 8f 55 5f 8f 50 5f 91 4e 5f 92 55 5e 8e 57 5e 8e 59 5e 8d 5c 5e 8d 5d 5e 8b 5f 5d 8a 61 5e 8a 62 5e 89 64 5e 89 67 Data Ascii: PNGIHDRd.PLTE(sPk`yp^w@^B^.w5\|D^3SG^Zs2zLg?,My:FcI^K^G_f}Up4{;YM^O]Q^S^U_P_N_U^W^Y^\^]^_]a^b^d^g
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 74 a0 97 93 b0 d8 d7 e2 7d 72 95 6c 83 ae be 9b aa e6 dc e2 d8 b9 c1 f2 ec ef ed e1 e4 ec ec f1 cd b9 c5 f5 f1 f3 f0 c3 c3 f1 c7 c7 d8 63 63 ec b0 b0 db 6d 6d e1 85 85 da 68 68 f7 dd dd fb ec ec ea ab ab f3 cd cd fc f0 f0 d7 60 60 e3 8c 8c df 7b 7b fc f4 f4 dd 76 76 e6 99 99 f4 d3 d3 dc 71 71 e4 93 93 ee bb bb f9 e5 e5 e0 81 81 e8 9f 9f e1 e4 ed f6 d9 d9 fa e8 e8 d2 4a 4a d6 5b 5b ed b4 b4 ef c0 c0 d1 45 45 fd f7 f8 e9 a6 a6 d5 56 56 ce 39 39 cd 3e 3f cc 33 33 cd 3d 3e d3 4e 4e cf 40 40 ff ff ff fe fd fd 20 43 85 4f 21 f1 f7 00 00 13 3e 49 44 41 54 78 da ec d4 dd 6e a2 40 18 c6 f1 07 ba d4 a5 82 41 89 22 51 04 3f 50 ab f6 40 f1 fe 2f a0 d7 d2 5b 78 60 33 38 43 41 49 96 c5 3d 2b bf 13 12 f3 8e f3 fe 31 11 9d 4e a7 d3 e9 74 3a 9d ff 22 f8 dc c4 7b fc 20 d1 Data Ascii: t}rlccmmhh``{{vvqqJJ[[EEVV99>?33=>NN@@ CO!>IDATxn@A"Q?P@/[x`38CAI=+1Nt:"{
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: f6 72 d4 06 7b 4a 4d e0 38 ca d4 7c 79 66 61 bb c3 9c 34 35 5f 6a f2 df 8d c9 92 25 4b 96 2c 59 b2 64 c9 92 ed 66 a9 09 e8 58 50 1b 4c ef 8b 7b 2f b8 77 69 8f 98 3e 93 68 64 04 7e 24 ba 26 d1 8d 6b 37 02 5d 17 87 d2 e2 ee 45 ae dc dc 7d d0 cb 90 d3 e9 7c 15 72 b9 5c af 41 07 df e0 ab 7f 13 6a 68 78 0b 6a 6c 6c 3c d4 c4 e5 76 bb 9b 9b 9b 0f 43 47 a0 b7 df e1 f2 78 3a 3a 3a 8e 43 1f 42 1f 41 9d 9d 9d 9f 08 75 f7 f4 f4 f4 f6 f6 f6 f5 f5 f5 f7 f7 0f 9c f9 94 6f 70 08 1a 1e 1e 1e 1d 1d 1d 1b 1b 3b fb 2d 34 09 4d 4d 9d e3 9a 9e 9e e1 9a 9d 9d 9b bb 00 cd cf 5f 84 16 16 16 2e 5d 86 d0 f3 04 1e 48 00 f8 0a da 45 70 bd 4c b0 27 08 7c 42 26 78 34 26 f0 25 01 4c c4 bb 0d 6e 54 08 06 6e 38 f0 d9 00 f8 9c 0c 30 88 15 81 73 13 04 86 28 18 8a 0c 1e 8c 1d bc c0 80 41 9c Data Ascii: r{JM8\|yfa45_j%K,YdfXPL{/wi>hd~$&k7]E}\|r\Ajhxjll<vCGx:::CBAuop;-4MM_.]HEpL'\|B&x4&%LnTn80s(A
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 04 f0 90 29 e2 71 21 77 38 ad ab ab 41 5d 44 91 9e 02 1c 60 25 76 bb 1f a3 d3 0d 1f f2 90 0b b8 a5 d5 2f f2 d0 eb b5 c9 e4 6b 09 b6 b7 8f c2 9d 00 bc b9 f8 a3 b5 7d 78 1f 6a 16 c0 10 7f 0e 31 c0 4a 0c b0 12 63 5b e2 18 16 28 70 66 01 1e a7 4f 67 51 5c b0 06 fe a6 21 24 48 d8 d1 1d 01 5b e2 12 67 09 0c cb 43 d8 96 26 24 26 ae ea 1a 4e e7 eb b5 3d 22 e6 ef 00 5f b4 c4 f7 25 26 be d6 56 9f c8 a4 f7 01 d8 7e 31 87 7f c1 88 8f 00 cc c4 01 27 29 26 58 8b 09 56 e2 13 08 c5 00 2b f1 a9 35 31 cf 1d 4a 9c 45 b1 11 05 e7 e7 77 f7 2a b3 bd 14 60 78 b5 b8 a1 b8 98 43 7a a7 dc 12 97 ac e8 f4 60 1b 5e 04 bc 76 45 c4 4f 70 5d 54 ec 5f 42 f4 b6 84 77 73 70 09 50 d0 ef 8e a0 4b 42 f0 6f 49 88 b9 86 8f 1d e3 ac b6 ed 25 f8 e8 27 31 62 80 bf 86 f8 19 c4 9c d5 33 0a 9c 39 83 Data Ascii: )q!w8A]D`%v/k}xj1Jc[(pfOgQ\!$H[gC&$&N="_%&V~1')&XV+51JEw*`xCz`^vEOp]T_BwspPKBoI%'1b39
2024-04-25 13:30:40 UTC	1020	IN	Data Raw: d1 2e f6 45 5c 26 70 2c be 5a 09 30 8d 0f 00 44 ec a2 6a 65 0c 06 6e 02 99 6f 0c fa 56 86 b2 34 1e 0c cc 10 40 79 a0 39 fe 34 b1 41 d9 4c 1f 71 cb 90 f7 94 05 da 88 65 ae 36 e2 c2 d6 3a e4 98 c7 ea cd ce 19 cb b2 db b7 b3 90 e6 8e 64 d0 a8 5f 29 cb 25 79 9d b3 e8 54 ea 37 11 8b 96 c3 fb cf 39 4b 9f 12 0b 7f 63 06 fb 25 ab 22 cf 76 8f c3 0c d7 72 75 cb aa ad 67 9b 9b d5 15 d7 e1 d1 b4 bd 7a 75 b9 0f cc 8d 2f 90 0d 8f ae ed 45 f7 d5 91 b5 2b 56 c3 e9 24 be cc 7a 92 25 e6 3c 2d 8a d5 04 af 1b 33 00 90 e5 33 64 5c 64 45 c0 85 c3 74 b7 cd 53 d8 1c 03 7b 56 02 8b a7 83 10 87 00 c0 94 cb 8d 08 63 9e ae 40 92 47 13 91 99 5c 86 d5 81 ab 80 8e 78 46 3c a0 5e 04 8f 7a 0e e6 d4 5b 5c 7b d4 b3 cf 2c ca 9d be 8b a2 c3 ed 94 c6 80 4a 44 8e 7c 8a b1 14 a3 ec 22 8d 26 d7 Data Ascii: .E\&p,Z0DjenoV4@y94ALqe6:d_)%yT79Kc%"vrugzu/E+V$z%<-33d\dEtS{Vc@G\xF<^z[\{,JD\|"&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49849	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	383	OUT	GET /images/awards/softonic_w365_4.5stars.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/png Content-Length: 3015 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: status=not_needed Vary: Accept etag: "bc7-5e3c46ceb2c00" last-modified: Thu, 14 Jul 2022 14:07:44 GMT CF-Cache-Status: HIT Age: 70780 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6J8kXXJM56sR1PF3zoSgz2Wop8ldLzuCSxleNHBS%2Fd12uNw0XJTcYtw8h7ZwBkO9Eu9Aewnb9gMwjSz5NvLlgGY3Kh3QhZ3M4oaR7Euw7zhupV8kLjPPtbvDohIEulOts3nFCB8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb06189d353be-ATL
2024-04-25 13:30:40 UTC	635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 a0 00 00 00 3a 08 03 00 00 00 00 ec a2 3a 00 00 01 7d 50 4c 54 45 56 a5 d6 00 00 00 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 56 a5 d6 ff ff ff 3e 99 d1 4d a1 d4 42 9b d1 54 a4 d7 59 a7 d7 39 96 d0 50 a2 d5 44 9c d2 47 9e d3 52 a3 d5 fd ed 17 4a 9f d3 58 a6 d4 ff f9 00 35 94 ce 67 af db 61 ac d9 95 c8 e6 86 bf e2 52 a4 db 79 b8 df 6c b2 dc 81 bc e1 3a 99 f7 af d5 ed 90 c4 e5 d2 e8 f4 ff ef 13 f7 fb fe 30 91 cd ff f2 0c 47 9e e8 5e aa d8 e7 f2 f9 b9 da ee a2 ce e9 df ef f8 40 9c ef 4d a2 e0 ff f5 04 ff f6 01 3e 9b f2 c0 de f0 a7 d1 ea 71 b4 dd ed f5 fb ca e3 f3 8b c1 e3 7d ba e0 e3 f0 f8 fb fd fe f2 f8 fc 44 9d ea 9d cb e8 28 8d cb f4 fa fd c7 e1 f2 b3 d7 ed 75 b6 de f0 Data Ascii: PNGIHDR::}PLTEVVVVVVVVVV>MBTY9PDGRJX5gaRyl:0G^@M>q}D(u
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 05 80 59 ec 98 5e 82 5d 41 5f 2e 81 fe 1c 18 49 bf a1 a4 94 56 65 eb 4b e0 2a 33 3e bd 00 3b 82 9c a0 95 1b 6f 89 2b eb 05 42 29 52 c2 1a 9b cf 80 c9 0b 18 ee 0a 2a ee e2 ec da 0b 23 60 3f 20 ed 98 3d 4d e4 19 57 00 6b f3 ec 76 56 e2 df db 6d 57 b0 b8 26 d3 00 1a 01 d9 6c 30 14 82 aa ce 09 e3 6a 0f e9 8f 78 56 fa da 3a fd b4 9f 24 e1 f4 b3 04 c9 94 38 3c 0f ed 02 97 d6 0f bc 43 e0 36 a4 0a bf 1d 03 11 3f 3d bb f6 8c 77 3e d5 e2 3c 13 f4 14 f6 08 9d cc 3e 4f d0 73 7d 60 bc 02 52 d6 a6 87 ce 1c da 6e 07 c2 2e fa f2 e9 0a 09 59 76 80 23 46 c7 3d 95 55 99 62 38 bb 70 fe b3 04 c9 aa 53 00 ab 84 29 50 27 68 14 28 0c d5 38 b7 42 f9 64 91 7d 79 03 5c 0e 22 8d 8b 27 73 c6 13 8c 06 10 e2 39 82 da b2 b5 e7 65 a2 99 74 d8 43 f3 38 c3 5c bb ed 90 99 a0 13 ec 2e ae 1e Data Ascii: Y^]A_.IVeK3>;o+B)R#`? =MWkvVmW&l0jxV:$8<C6?=w><>Os}`Rn.Yv#F=Ub8pS)P'h(8Bd}y\"'s9etC8\.
2024-04-25 13:30:40 UTC	1011	IN	Data Raw: e8 58 64 3c 07 4e e6 42 dc c3 d1 8c 4d 79 b9 af ff f0 d9 38 25 aa 4a 48 a0 ce a4 2b d7 d1 a3 be 0e af 8b d2 a4 88 ce b0 e4 88 6a 39 63 5c ba 82 8f 4c 67 88 3e 43 89 28 02 50 23 cd 68 e9 39 c8 0c 37 e4 b9 0a c6 70 70 c6 05 36 60 fa 7b e7 41 0f 68 0f 45 a8 a0 d1 c2 4f e0 b9 83 d9 3e 4f f4 2c c6 54 7b 16 29 38 5c be b9 e0 f3 84 ff df 63 1e a7 25 97 9f 39 c4 7f 07 c7 e7 de 9f a7 c5 8c d3 2c a1 c6 2c d3 17 47 be b8 f1 35 40 61 e1 74 d5 cc 2c d6 b3 0d 3c f9 18 0f a3 d7 d2 06 a3 e1 50 b4 86 54 6e 1c d7 00 33 db 40 57 87 9f 11 a4 fd 02 86 58 c0 5c 99 62 06 66 e3 01 df 3c ae 01 8a 5c 7d 86 0d 82 7c dd 20 b7 99 e0 12 26 f9 38 d8 01 26 66 b7 8f 6b 80 26 fc a6 bd 7c 5e 1a 86 a1 38 7e af 63 71 3f dc 12 76 88 32 a1 92 1c b4 6d e2 4d c8 49 90 f5 d0 31 56 49 36 18 ae 38 Data Ascii: Xd<NBMy8%JH+j9c\Lg>C(P#h97pp6`{AhEO>O,T{)8\c%9,,G5@at,<PTn3@WX\bf<\}\| &8&fk&\|^8~cq?v2mMI1VI68

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49850	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	385	OUT	GET /static/img/common/icon_follow_facebook.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:42 GMT etag: W/"374-5e7089362557c-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18930 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2Bb9Nr8unHtfK8eUYbFf4Nd8Avmdo6PJx4pQUo5HKk%2BwWGhIDR9wQdvf93UpxN21TkVCEt0Cc4HQC112W%2FovWORkhBDqWyzaYEhpYWbX83R82SUDZ11KWfTIjPcxTM1sj%2Bq5KV0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0619afaad6b-ATL
2024-04-25 13:30:40 UTC	681	IN	Data Raw: 33 37 34 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 2e 30 30 30 30 30 30 2c 20 34 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 374<svg width="32px" height="32px" viewBox="0 0 32 32" version="1.1" xmlns="http://www.w3.org/2000/svg"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(4.000000, 4.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:40 UTC	210	IN	Data Raw: 39 39 20 31 38 2e 38 30 33 2c 33 2e 36 32 34 20 31 37 2e 34 37 38 2c 33 2e 36 32 34 20 43 31 34 2e 37 31 32 2c 33 2e 36 32 34 20 31 32 2e 38 31 39 2c 35 2e 33 31 31 39 39 39 39 39 20 31 32 2e 38 31 39 2c 38 2e 34 31 32 20 4c 31 32 2e 38 31 39 2c 31 31 2e 30 38 32 20 4c 39 2e 36 39 31 39 39 39 39 39 2c 31 31 2e 30 38 32 20 4c 39 2e 36 39 31 39 39 39 39 39 2c 31 34 2e 37 30 35 20 4c 31 32 2e 38 31 39 2c 31 34 2e 37 30 35 20 4c 31 32 2e 38 31 39 2c 32 34 20 4c 31 2e 33 32 34 30 30 30 30 31 2c 32 34 20 5a 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 99 18.803,3.624 17.478,3.624 C14.712,3.624 12.819,5.31199999 12.819,8.412 L12.819,11.082 L9.69199999,11.082 L9.69199999,14.705 L12.819,14.705 L12.819,24 L1.32400001,24 Z"></path> </g> </g></svg>
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49851	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	384	OUT	GET /static/img/common/icon_follow_twitter.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	690	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:42 GMT etag: W/"697-5e70893716cc4-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56043 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8U8UZdXwfg6DWQ%2Bu9y2TIIwzuQLI0%2Blr01z46uYITJnI%2BxkNeeID39YW2i07XTidZ1NnXw7eRJLwo2QlyJxiJp4B8Eng2yCIkMREh7ywSv5Edufb9TD8Oizi1%2FqlT58%2BiB746Yg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0619adb6751-ATL
2024-04-25 13:30:40 UTC	679	IN	Data Raw: 36 39 37 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 33 2e 30 30 30 30 30 30 2c 20 36 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 697<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(3.000000, 6.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:40 UTC	1015	IN	Data Raw: 37 34 39 20 31 33 2e 31 36 34 34 39 30 33 2c 36 2e 35 32 39 39 37 34 31 31 20 43 38 2e 37 36 39 33 30 38 35 33 2c 36 2e 33 30 30 30 39 32 34 36 20 34 2e 38 34 39 33 36 35 34 38 2c 34 2e 32 30 30 30 39 32 34 36 20 32 2e 32 34 33 33 31 37 37 36 2c 30 2e 39 38 34 38 35 35 37 36 39 20 43 31 2e 37 38 33 36 30 39 37 2c 31 2e 37 37 33 39 30 39 30 32 20 31 2e 35 32 32 36 39 34 33 31 2c 32 2e 36 37 34 37 39 36 36 20 31 2e 35 32 32 36 39 34 33 31 2c 33 2e 36 35 39 35 35 39 39 31 20 43 31 2e 35 32 32 36 39 34 33 31 2c 35 2e 34 39 38 36 31 33 31 37 20 32 2e 34 35 37 36 34 31 31 31 2c 37 2e 31 32 30 32 31 30 38 20 33 2e 38 38 33 33 35 37 33 33 2c 38 2e 30 37 33 39 30 39 30 32 20 43 33 2e 30 31 33 36 33 39 33 37 2c 38 2e 30 33 39 37 33 37 34 33 20 32 2e 31 39 33 36 31 Data Ascii: 749 13.1644903,6.52997411 C8.76930853,6.30009246 4.84936548,4.20009246 2.24331776,0.984855769 C1.7836097,1.77390902 1.52269431,2.6747966 1.52269431,3.65955991 C1.52269431,5.49861317 2.45764111,7.1202108 3.88335733,8.07390902 C3.01363937,8.03973743 2.19361
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49852	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	376	OUT	GET /images/awards/si-award-epick5.png HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	749	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/png Content-Length: 10207 Connection: close Cache-Control: public, max-age=86400 Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=10740, status=webp_bigger etag: "29f4-5e3c46b7cf600" last-modified: Thu, 14 Jul 2022 14:07:20 GMT CF-Cache-Status: HIT Age: 47199 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H1uCjxWOsEkYwA2JV0FLzKmQ6Vl0XcT6OFVaEv%2FdBfJ8X3%2FJKpVwNGkYkHsuDawXztZW41fwFecFxEBGBp2%2BMj%2FD9mJVUjBschyV%2FGmY%2FL3pfFIryszSLxfysQ1vXiQjKDGPMCk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb061ae6b1d68-ATL
2024-04-25 13:30:40 UTC	620	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 03 00 00 00 99 1e b1 0c 00 00 03 00 50 4c 54 45 00 00 00 2f 1b 00 47 37 18 3a 29 0e 3e 2e 13 3d 2d 11 37 26 0a 6b 55 20 83 68 25 65 50 22 50 3f 1a ff e4 30 74 5c 1f de a4 08 c8 98 0f 84 67 0e 99 77 12 8f 70 12 a4 81 17 61 4d 0b 53 42 0a 6b 56 0e ae 86 11 d2 9f 0f e7 ac 07 b8 8d 11 bf 94 19 dd aa 13 e9 b1 10 ec b3 08 f9 c0 12 f0 b8 0d fe c7 17 f2 bc 13 77 5f 0f e5 b8 2a e2 b2 1d b3 8f 21 8d 73 21 f2 cd 28 ec b6 17 d5 a9 22 ff ce 23 f8 c6 24 f3 c1 1f ee bb 20 c7 a1 25 fe d7 2e f0 bf 28 fb ce 2f f4 c5 2d 3e 39 19 52 4a 20 a9 8e 2a ec c4 33 9b 82 25 7e 6b 1f db ba 34 ff dc 39 f3 d0 36 f9 d4 38 ce ae 33 e4 c4 3e ff e6 43 b0 99 33 ee cb 3e f4 d2 42 ff dd 43 fa d7 41 bf a5 36 5f 55 1f 6d Data Ascii: PNGIHDRPLTE/G7:)>.=-7&kU h%eP"P?0t\gwpaMSBkVw_!s!("#$ %.(/->9RJ 3%~k49683>C3>BCA6_Um
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 03 33 85 0e 32 68 14 39 70 0c 2b 5d 01 22 59 01 19 49 04 29 68 07 31 73 06 27 4e 01 0a 29 00 11 38 08 0c 1a 1e 23 21 06 1e 3b 74 93 bd 83 a4 c5 ff ff ff f7 f8 fa ef f1 f5 e6 eb f1 df e2 e9 a7 ba d5 96 ab c8 b6 c9 dd ce d9 e7 ad b4 c6 93 9a b3 83 90 ad 73 83 a4 c5 c8 d5 a1 a9 bc b9 be cf c2 d1 e3 d4 e2 ee d1 d5 dd 55 79 b1 66 86 b3 56 77 a2 48 65 92 57 6e 98 66 76 95 35 55 85 30 55 93 53 5d 84 27 3b 5a 2f 41 71 3e 53 75 4e 8d af 75 7e 97 3e 50 88 35 77 9b 2c a1 de 29 a2 d9 53 4c 24 5b 49 26 61 4e 22 54 43 1b 47 38 19 32 20 06 31 1e 03 2f 1b 00 2f 1c 01 30 1c 00 3a 8d c5 35 00 00 01 00 74 52 4e 53 00 0a 9a 62 85 74 50 df f1 d4 b4 ff ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 32h9p+]"YI)h1s'N)8#!;tsUyfVwHeWnfv5U0US]';Z/Aq>SuNu~>P5w,)SL$[I&aN"TCG82 1//0:5tRNSbtP
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: f4 fb ae 5f 33 26 03 41 21 91 69 57 d2 ac 92 78 0d 6b 8e b3 75 ae 4a 60 89 b4 b2 14 e4 fc 3e 93 ff 94 59 97 61 cf f9 1b 36 ad ea a3 52 d1 af 29 c3 a6 38 e5 0a 02 95 99 89 05 d9 2a 92 1b 5f f4 6a 7d c7 0c 72 92 4c da 15 73 fe 8d 19 32 67 59 24 1d 00 79 df 91 14 1a fa a1 e4 a8 73 e5 0d 1f 46 71 61 c8 79 b2 df fc d6 45 64 44 69 5d f6 80 96 38 b5 fe 66 36 f4 a6 a3 5b a9 49 81 4a 7e ef 8a 03 03 a2 28 63 9f 8d 23 10 65 4d 75 d1 cd df 8f 30 aa 12 bc 1e df 2d 73 f7 86 ef ce 9b 32 7b 06 f0 05 d0 8c c2 f4 d8 7c c1 94 5a ba 43 70 76 ad b1 31 c6 6f 5b 86 5d 48 bb 59 8a a4 32 19 ef fd a5 db bd 24 18 5e 79 b9 c0 20 90 a8 bf 62 92 ef aa fa f0 84 51 78 03 fd db be 50 35 b9 ce 2b 3e d9 08 5b c5 8e 84 f2 da 74 f2 d9 aa 90 86 fa 20 07 f7 0b ee 5f 70 1d 2b 5c 00 a1 bd 39 96 Data Ascii: _3&A!iWxkuJ`>Ya6R)8*_j}rLs2gY$ysFqayEdDi]8f6[IJ~(c#eMu0-s2{\|ZCpv1o[]HY2$^y bQxP5+>[t _p+\9
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 4c 2f ef 0c 3a 09 18 5c 54 ee 42 33 c3 6a 47 17 6c d6 4b 98 f2 da 5e 7f 98 34 cb 69 f2 98 18 8e e1 4d e0 18 08 c0 82 12 16 80 a3 17 b7 ad 9f 74 71 57 01 c4 b7 13 50 fa 32 24 3a 7e 60 60 b9 18 ad c6 b4 ca 9e 8c 2f 49 60 08 4c 6e 78 1d f0 e2 e9 33 9e e5 d4 95 7b 2f 4c 8e 9e 8e 98 b4 98 d2 4c 6f 4c c6 76 3b 05 74 74 77 b5 28 d7 44 56 90 32 c1 e5 37 17 cf 56 7a fb 64 d5 11 e7 a8 fb c1 e2 c0 05 89 d7 82 eb dc 75 db ad 9f 81 00 3b 00 77 c1 9e b8 f9 c6 15 7d 69 93 0a c7 eb 51 e1 c7 89 b2 bb 33 40 17 1d 06 10 17 6f be dc 30 10 95 c2 9a b4 e3 20 46 be d3 b5 6f 9c 19 1b 6c 5f 2f 2b b3 5e 49 2a 72 76 be 9a cb 5c 78 f1 27 1e 73 01 10 57 f3 5c 18 12 e2 89 aa 35 7b 8c 3e dd 06 80 60 b6 54 3c c6 00 79 f1 8e 36 e7 b0 c1 f1 20 65 80 fd b4 b8 68 c1 b6 ae dc ee 4c 92 29 bf Data Ascii: L/:\TB3jGlK^4iMtqWP2$:~``/I`Lnx3{/LLoLv;ttw(DV27Vzdu;w}iQ3@o0 Fol_/+^I*rv\x'sW\5{>`T<y6 ehL)
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: b5 20 27 12 c6 af 22 1b e9 b4 7b 1e 5e e3 c4 e2 b3 e9 52 a1 1c 8f ed 27 5b c9 47 f8 b8 5e 00 c0 fe 8d 3b 25 9a a2 3a ee f9 1e 5b 8b 5c 18 08 6c ca 58 d6 10 14 77 58 e6 9f 49 62 25 94 97 16 7d 00 a8 dc da 40 b8 3f f7 49 13 b4 b2 5c a5 57 7d 96 1c 61 0b 74 de 03 80 fd 58 0c de b2 08 95 38 7d 7a a9 ea aa 7b 45 43 f2 b7 56 bf 59 b5 a6 0a c0 2f a6 9e 63 bf 55 e9 11 95 0a 0e 12 9a ed a6 0c 3b 7f 10 51 0a 64 57 75 eb c8 bc db 7e 16 83 88 08 87 3c 4a c4 87 1d 8a c6 4f 22 24 d3 7d 9c 0f 81 f8 35 1b 6b 87 63 06 ab d7 84 9d 50 4a 5c 7c a9 88 29 fa 8f 87 e2 43 4e 06 b1 26 22 c4 3f bb cd 76 3a 90 11 d0 eb 3b 09 45 be e3 81 8c 60 d9 53 b0 9e 4c 80 b4 3a 61 54 df f9 20 00 06 c9 b7 1f f0 d0 34 a2 bb cf 9f 8e d5 93 c9 eb 55 b6 6e 3d a6 3f 2a 5e db 06 b0 a7 21 70 0e a1 54 Data Ascii: '"{^R'[G^;%:[\lXwXIb%}@?I\W}atX8}z{ECVY/cU;QdWu~<JO"$}5kcPJ\\|)CN&"?v:;E`SL:aT 4Un=?*^!pT
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: d1 01 8b 2f 1c 8e 6a 89 73 40 20 ad 03 4d 12 be 8b e5 44 80 c2 4a 4a 88 7b 4b 0e 34 03 40 81 33 a3 00 a0 1d a0 8f 10 31 4f 3f 12 30 31 ce 46 30 da b6 18 a5 30 c3 12 7e a4 28 72 bd 6c 99 70 d7 15 18 42 c4 50 5e 02 70 af 57 05 83 54 d4 8c a8 3f f7 54 40 63 99 1c ab 3c a9 19 20 8c cc f2 75 df c1 08 e1 91 0b 40 81 02 df ad 63 44 1a c0 8f 55 da 25 0f 4f fb a5 16 72 b5 a9 c0 b4 71 8a c5 d2 24 9d 5c ed 65 98 f9 08 59 0c 22 30 f8 74 32 f2 60 6a 16 00 4b 0f a0 2b 89 a0 00 cf a7 b5 45 0e 73 e3 d7 98 30 44 76 66 af 3e d2 1d 08 0e c8 a2 ec 74 ab a0 af 98 1b 14 6f e9 e1 d2 a0 74 49 8e 95 c1 90 b8 7b f9 2f b6 14 18 c1 74 63 0c 37 41 6d d8 85 09 00 c3 de a0 d6 25 0a 00 92 9e 0a d3 40 32 7d df 51 81 25 28 68 08 b9 6b a2 8b 33 40 0a be bc b1 03 92 e1 9a c7 29 47 1f 62 9b Data Ascii: /js@ MDJJ{K4@31O?01F00~(rlpBP^pWT?T@c< u@cDU%Orq$\eY"0t2`jK+Es0Dvf>totI{/tc7Am%@2}Q%(hk3@)Gb
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 8f 0c b0 88 b5 6d 5f 1c a8 d7 20 f4 5d 3a f4 18 41 f9 c1 8b 1a b5 6d 19 80 56 bd 7a f1 a1 0e 96 23 2f 4a c7 bc 1c 5c 3f bd e1 bc e3 06 80 bd 72 db 05 d3 d3 3b 14 61 88 0f f5 3f 18 e2 f6 cb 99 ee 76 0a bf 86 61 a2 5c 8e e5 9a 43 5d 0a a4 a0 26 a4 50 33 11 21 32 ff 94 2f 2c 59 65 28 d1 10 58 4e fd e9 c4 d2 c8 29 76 34 e7 0c 80 61 74 fb d2 7c cc eb 13 9b 8b e1 8a 3c ea e1 6d 24 c1 4a f0 ff 56 da 54 4e 3a a6 5b e4 b4 3c 33 e8 79 61 9d cb 54 c3 c4 61 4e 44 4c f7 e8 06 63 09 e7 f6 c4 63 f2 ba ee 09 43 a2 cb e6 03 27 47 c1 e4 a7 8e d4 70 1a 35 79 fe 69 e3 dc d0 f7 50 20 20 bb 9d 42 a6 32 96 1d 2b 7c 0f 58 6e 86 54 be a5 0b 0a 42 5b 97 94 76 38 12 41 fa 2d 11 78 0c 99 3a 91 60 84 5a bf cf 61 08 0b 67 61 a7 35 86 30 b9 f8 50 15 43 1a 33 fb dc c8 8b 0f c4 b7 b8 02 Data Ascii: m_ ]:AmVz#/J\?r;a?va\C]&P3!2/,Ye(XN)v4at\|<m$JVTN:[<3yaTaNDLccC'Gp5yiP B2+\|XnTB[v8A-x:`Zaga50PC3
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 38 0d 4f 17 60 eb 41 c4 6e d5 39 79 86 ae 10 3f 30 3f a7 91 1d 86 36 49 aa 65 78 34 c8 89 80 66 61 89 70 2e 33 20 6e bb 4d 00 21 ac 1d da 62 f8 57 db d6 f6 7c cc 00 76 7f f9 c2 8f 55 4d af f0 24 30 84 2d c0 1e 60 32 34 6e c6 33 e9 38 90 0f 2c 5a 68 da 22 74 d1 2a 71 49 b7 6a aa 47 04 e3 8e 4a a2 37 34 da c1 d6 5f 26 03 f8 bc 55 99 53 7e 66 66 1a 56 16 8a 05 c1 5f f4 51 67 b3 dc 43 0c 57 4d 00 9f 56 e2 e1 7f 0f 11 46 4a 7e fd b8 00 d0 02 5b 2e 8e 4f d5 8b 94 5b 1d 04 ce b8 e7 84 22 bc 21 33 a0 62 e0 26 38 52 cc 68 1c 14 57 55 40 60 80 29 9f 5c fb a7 cc bd 22 07 11 31 ce 04 31 33 42 1d 13 fd b3 90 0c 2c 54 17 01 f2 ad 72 27 24 9d 1e 2d 06 5e 34 e3 dc 66 46 6e 36 35 02 78 0e d2 d8 9c 5c 5f de 94 1d de c4 04 5d 65 22 37 91 fc 89 b7 d6 66 67 1c b4 66 30 45 4a Data Ascii: 8O`An9y?0?6Iex4fap.3 nM!bW\|vUM$0-`24n38,Zh"t*qIjGJ74_&US~ffV_QgCWMVFJ~[.O["!3b&8RhWU@`)\"113B,Tr'$-^4fFn65x\_]e"7fgf0EJ
2024-04-25 13:30:40 UTC	4	IN	Data Raw: ae 42 60 82 Data Ascii: B`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49853	142.250.105.101	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	629	OUT	GET /js/platform.js HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 55979 Date: Thu, 25 Apr 2024 13:30:40 GMT Expires: Thu, 25 Apr 2024 13:30:40 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "d8cc7aca923e8ade" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:40 UTC	418	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6d 2c 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 2c 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e Data Ascii: (function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 0a 7d 2c 64 61 3d 63 61 28 74 68 69 73 29 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e Data Ascii: obal];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),r=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.len
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 61 7d 2c 68 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 69 61 3b 0a 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 29 69 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 6a 61 3b 61 3a 7b 76 61 72 20 6b 61 3d 7b 61 3a 21 30 7d 2c 6e 61 3d 7b 7d 3b 74 72 79 7b 6e 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6b 61 3b 6a 61 3d 6e 61 2e 61 3b 62 72 65 61 6b 20 61 Data Ascii: a},ha="function"==typeof Object.create?Object.create:function(a){var b=function(){};b.prototype=a;return new b},ia;if("function"==typeof Object.setPrototypeOf)ia=Object.setPrototypeOf;else{var ja;a:{var ka={a:!0},na={};try{na.__proto__=ka;ja=na.a;break a
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 0a 72 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c Data Ascii: :function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});r("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 74 69 76 65 20 63 6f 64 65 22 29 3f 77 61 3a 78 61 3b 72 65 74 75 72 6e 20 79 61 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 7a 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 6c 61 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 42 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 41 72 72 61 79 28 61 72 67 75 6d 65 6e 74 73 2e Data Ascii: tion.prototype.bind.toString().indexOf("native code")?wa:xa;return ya.apply(null,arguments)},za=function(a,b){function c(){}c.prototype=b.prototype;a.la=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.B=function(d,e,f){for(var g=Array(arguments.
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 6e 28 61 2c 62 29 7b 46 61 28 6e 75 6c 6c 21 3d 61 2e 6c 65 6e 67 74 68 29 3b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 61 2c 62 2c 76 6f 69 64 20 30 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 61 2e 6c 65 6e 67 74 68 2c 64 3d 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 65 3d 30 3b 65 3c 63 3b 65 2b 2b 29 65 20 69 6e 20 64 26 26 62 2e 63 61 6c 6c 28 76 6f 69 64 20 30 2c 64 5b 65 5d 2c 65 2c 61 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 4a 61 28 61 29 7b 76 61 72 20 62 3d 61 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 41 72 72 61 79 28 62 29 2c 64 3d 30 3b 64 3c 62 3b 64 2b 2b 29 63 5b 64 5d Data Ascii: n(a,b){Fa(null!=a.length);Array.prototype.forEach.call(a,b,void 0)}:function(a,b){for(var c=a.length,d="string"===typeof a?a.split(""):a,e=0;e<c;e++)e in d&&b.call(void 0,d[e],e,a)};function Ja(a){var b=a.length;if(0<b){for(var c=Array(b),d=0;d<b;d++)c[d]
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 73 74 65 72 20 69 63 6f 6e 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 76 61 72 20 54 61 3d 7b 7d 3b 76 61 72 20 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 21 3d 3d 54 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 73 65 63 72 65 74 22 29 3b 74 68 69 73 2e 58 3d 61 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 7a 2e 70 72 6f 74 6f 74 79 70 65 3d 68 61 28 41 2e 70 72 6f 74 6f 74 79 70 65 29 3b 7a 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 7a 3b 69 66 28 6f 61 29 6f 61 28 7a 2c 41 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 55 61 20 69 6e 20 41 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 55 61 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 56 61 Data Ascii: ster icon".split(" ");var Ta={};var z=function(a,b){if(b!==Ta)throw Error("Bad secret");this.X=a},A=function(){};z.prototype=ha(A.prototype);z.prototype.constructor=z;if(oa)oa(z,A);else for(var Ua in A)if("prototype"!=Ua)if(Object.defineProperties){var Va
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 54 68 65 20 66 75 6e 63 74 69 6f 6e 73 20 69 6e 20 74 68 65 20 73 61 66 65 76 61 6c 75 65 73 20 6c 69 62 72 61 72 79 20 61 72 65 20 6e 6f 74 20 64 65 73 69 67 6e 65 64 20 74 6f 20 62 65 20 63 61 6c 6c 65 64 5c 6e 20 20 20 20 6c 69 6b 65 20 6e 6f 72 6d 61 6c 20 66 75 6e 63 74 69 6f 6e 73 2c 20 61 6e 64 20 64 6f 69 6e 67 20 73 6f 20 69 6e 76 61 6c 69 64 61 74 65 73 20 74 68 65 20 73 65 63 75 72 69 74 79 20 67 75 61 72 61 6e 74 65 65 73 5c 6e 20 20 20 20 74 68 61 74 20 73 61 66 65 76 61 6c 75 65 73 20 70 72 6f 76 69 64 65 73 2e 5c 6e 5c 6e 20 20 20 20 49 66 20 79 6f 75 20 61 72 65 20 73 74 75 63 6b 20 61 6e 64 20 6e 6f 74 20 73 75 72 65 20 68 6f 77 20 74 6f 20 70 72 6f 63 65 65 64 2c 20 70 6c 65 61 73 65 20 72 65 61 63 68 20 6f 75 74 20 74 6f 20 75 73 5c 6e Data Ascii: The functions in the safevalues library are not designed to be called\n like normal functions, and doing so invalidates the security guarantees\n that safevalues provides.\n\n If you are stuck and not sure how to proceed, please reach out to us\n
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 61 66 65 55 72 6c 2c 20 67 6f 74 20 27 22 2b 61 2b 22 27 20 6f 66 20 74 79 70 65 20 22 2b 72 61 28 61 29 29 2c 61 3d 22 74 79 70 65 5f 65 72 72 6f 72 3a 53 61 66 65 55 72 6c 22 29 3a 6b 62 2e 74 65 73 74 28 61 29 7c 7c 28 6d 62 28 61 29 2c 61 3d 76 6f 69 64 20 30 29 3b 72 65 74 75 72 6e 20 61 7d 76 61 72 20 6e 62 3d 5b 5d 2c 6d 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 62 28 61 29 7b 2d 31 3d 3d 3d 6e 62 2e 69 6e 64 65 78 4f 66 28 61 29 26 26 6e 62 2e 70 75 73 68 28 61 29 3b 6d 62 3d 66 Data Ascii: afeUrl, got '"+a+"' of type "+ra(a)),a="type_error:SafeUrl"):kb.test(a)\|\|(mb(a),a=void 0);return a}var nb=[],mb=function(){};ob(function(a){console.warn("A URL with content '"+a+"' was sanitized away.")});function ob(a){-1===nb.indexOf(a)&&nb.push(a);mb=f
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6b 29 3a 6b 29 7d 66 6f 72 28 3b 64 3c 63 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 66 3d 63 5b 64 5d 3b 69 66 28 21 73 61 28 66 29 7c 7c 74 61 28 66 29 26 26 30 3c 66 2e 6e 6f 64 65 54 79 70 65 29 65 28 66 29 3b 65 6c 73 65 7b 61 3a 7b 69 66 28 66 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 66 2e 6c 65 6e 67 74 68 29 7b 69 66 28 74 61 28 66 29 29 7b 76 61 72 20 67 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 7c 7c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 3b 62 72 65 61 6b 20 61 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 66 29 7b 67 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 66 2e Data Ascii: .createTextNode(k):k)}for(;d<c.length;d++){var f=c[d];if(!sa(f)\|\|ta(f)&&0<f.nodeType)e(f);else{a:{if(f&&"number"==typeof f.length){if(ta(f)){var g="function"==typeof f.item\|\|"string"==typeof f.item;break a}if("function"===typeof f){g="function"==typeof f.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49854	151.101.12.157	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	533	OUT	GET /widgets.js HTTP/1.1 Host: platform.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	615	IN	HTTP/1.1 200 OK Connection: close Content-Length: 93065 Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT ETag: "824beb891744db98ccbd3a456e59e0f7" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=1800 Content-Type: application/javascript; charset=utf-8 Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Accept-Ranges: bytes Date: Thu, 25 Apr 2024 13:30:40 GMT X-Served-By: cache-iad-kjyo7100044-IAD, cache-pdk-katl1840021-PDK X-Cache: HIT, HIT Vary: Accept-Encoding TW-CDN: FT
2024-04-25 13:30:40 UTC	16384	IN	Data Raw: 46 75 6e 63 74 69 6f 6e 26 26 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 26 26 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 26 26 28 2f 28 4d 53 49 45 20 28 5b 36 37 38 39 5d 7c 31 30 7c 31 31 29 29 7c 54 72 69 64 65 6e 74 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 7c 7c 28 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 72 26 26 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 72 2e 77 69 64 67 65 74 73 26 26 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 72 2e 77 69 64 67 65 74 73 2e 6c 6f 61 64 65 64 26 26 77 69 6e 64 6f 77 2e 74 77 74 74 72 2e 77 69 64 67 65 74 73 2e 6c 6f 61 64 26 26 77 69 6e 64 6f 77 2e 74 77 74 74 72 2e 77 69 64 67 65 74 73 2e 6c 6f 61 64 28 29 2c 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 Data Ascii: Function&&Function.prototype&&Function.prototype.bind&&(/(MSIE ([6789]\|10\|11))\|Trident/.test(navigator.userAgent)\|\|(window.__twttr&&window.__twttr.widgets&&window.__twttr.widgets.loaded&&window.twttr.widgets.load&&window.twttr.widgets.load(),window.__twtt
2024-04-25 13:30:40 UTC	16384	IN	Data Raw: 65 29 29 2c 68 28 6f 2c 6e 29 2b 22 2e 68 74 6d 6c 22 29 7d 2c 65 6d 62 65 64 53 65 72 76 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 7c 7c 5b 5d 2c 6e 3d 6f 3b 72 65 74 75 72 6e 20 65 2e 75 6e 73 68 69 66 74 28 22 73 72 76 22 29 2c 68 28 6e 2c 65 29 7d 2c 65 76 65 6e 74 56 69 64 65 6f 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 75 6e 73 68 69 66 74 28 22 76 69 64 65 6f 2f 65 76 65 6e 74 22 29 2c 68 28 66 28 29 2c 65 29 7d 2c 67 72 69 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 75 6e 73 68 69 66 74 28 22 67 72 69 64 2f 63 6f 6c 6c 65 63 74 69 6f 6e 22 29 2c 68 28 66 28 29 2c 65 29 7d 2c 6d 6f 6d 65 6e 74 3a 66 75 Data Ascii: e)),h(o,n)+".html")},embedService:function(t){var e=t\|\|[],n=o;return e.unshift("srv"),h(n,e)},eventVideo:function(t){var e=t\|\|[];return e.unshift("video/event"),h(f(),e)},grid:function(t){var e=t\|\|[];return e.unshift("grid/collection"),h(f(),e)},moment:fu
2024-04-25 13:30:40 UTC	16384	IN	Data Raw: 6c 76 65 28 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 5b 6f 62 6a 65 63 74 20 50 72 6f 6d 69 73 65 5d 22 3d 3d 3d 6e 26 26 21 65 2e 63 61 73 74 29 72 65 74 75 72 6e 7d 74 2e 50 72 6f 6d 69 73 65 3d 55 7d 2c 55 2e 50 72 6f 6d 69 73 65 3d 55 2c 55 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 72 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 34 37 29 3b 74 2e 65 78 70 6f 72 74 73 3d 6e 65 77 20 72 28 22 74 77 74 74 72 22 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 31 29 2c 69 3d 6e 28 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 72 65 74 75 72 6e 20 69 2e 69 73 54 79 70 65 28 22 73 74 72 69 6e 67 22 2c 74 29 3f 74 2e 73 70 6c 69 74 28 22 2e 22 29 3a 69 2e 69 73 54 79 70 65 28 22 Data Ascii: lve())}catch(t){}if("[object Promise]"===n&&!e.cast)return}t.Promise=U},U.Promise=U,U},t.exports=r()},function(t,e,n){var r=n(47);t.exports=new r("twttr")},function(t,e,n){var r=n(1),i=n(0);function o(t){return i.isType("string",t)?t.split("."):i.isType("
2024-04-25 13:30:40 UTC	16384	IN	Data Raw: 3b 64 65 6c 65 74 65 20 74 68 69 73 2e 62 61 74 63 68 2e 68 61 73 68 5b 74 5d 2c 7e 72 26 26 6e 2e 73 70 6c 69 63 65 28 72 2c 31 29 7d 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 66 72 61 6d 65 73 2e 69 6e 64 65 78 4f 66 28 74 29 3b 7e 65 26 26 74 68 69 73 2e 66 72 61 6d 65 73 2e 73 70 6c 69 63 65 28 65 2c 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 63 68 65 64 75 6c 65 42 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 73 63 68 65 64 75 6c 65 28 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 62 61 74 63 68 2e 73 63 68 65 64 75 6c 65 64 3d 21 31 2c 74 2e 72 75 6e 42 61 74 63 68 28 29 7d 29 2c 74 68 69 73 Data Ascii: ;delete this.batch.hash[t],~r&&n.splice(r,1)}},o.prototype.clearFrame=function(t){var e=this.frames.indexOf(t);~e&&this.frames.splice(e,1)},o.prototype.scheduleBatch=function(){var t=this;this.schedule(0,function(){t.batch.scheduled=!1,t.runBatch()}),this
2024-04-25 13:30:40 UTC	16384	IN	Data Raw: 6c 29 3b 22 76 69 73 69 62 6c 65 22 3d 3d 74 2e 73 61 6e 64 62 6f 78 45 6c 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3f 74 2e 5f 77 69 64 74 68 3d 6e 2e 77 69 64 74 68 3a 28 65 3d 6c 28 74 2e 73 61 6e 64 62 6f 78 45 6c 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 2e 77 69 64 74 68 2c 74 2e 5f 77 69 64 74 68 3d 4d 61 74 68 2e 6d 69 6e 28 6e 2e 77 69 64 74 68 2c 65 29 29 2c 74 2e 5f 68 65 69 67 68 74 3d 6e 2e 68 65 69 67 68 74 7d 29 7d 29 2c 74 2e 64 65 66 69 6e 65 28 22 5f 64 69 64 52 65 73 69 7a 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 65 3d 74 68 69 73 2e 5f 72 65 73 69 7a 65 48 61 6e 64 6c 65 72 73 2e 73 6c 69 63 65 28 30 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 75 70 64 61 74 65 43 61 63 68 65 64 44 69 6d Data Ascii: l);"visible"==t.sandboxEl.style.visibility?t._width=n.width:(e=l(t.sandboxEl.parentElement).width,t._width=Math.min(n.width,e)),t._height=n.height})}),t.define("_didResize",function(){var t=this,e=this._resizeHandlers.slice(0);return this._updateCachedDim
2024-04-25 13:30:40 UTC	11145	IN	Data Raw: 6e 65 72 2d 73 63 72 65 65 6e 2d 6e 61 6d 65 22 29 2c 6c 69 73 74 4f 77 6e 65 72 55 73 65 72 49 64 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6c 69 73 74 2d 6f 77 6e 65 72 2d 69 64 22 29 2c 6c 69 73 74 49 64 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6c 69 73 74 2d 69 64 22 29 2c 6c 69 73 74 53 6c 75 67 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6c 69 73 74 2d 73 6c 75 67 22 29 2c 63 75 73 74 6f 6d 54 69 6d 65 6c 69 6e 65 49 64 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 75 73 74 6f 6d 2d 74 69 6d 65 6c 69 6e 65 2d 69 64 22 29 2c 73 74 61 74 69 63 43 6f 6e 74 65 6e 74 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 74 61 74 69 63 2d 63 6f 6e Data Ascii: ner-screen-name"),listOwnerUserId:t.getAttribute("data-list-owner-id"),listId:t.getAttribute("data-list-id"),listSlug:t.getAttribute("data-list-slug"),customTimelineId:t.getAttribute("data-custom-timeline-id"),staticContent:t.getAttribute("data-static-con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49858	142.250.105.147	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	678	OUT	GET /cse/static/element/8435450f13508ca1/default+en.css HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	863	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/css Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="prose-team" Report-To: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]} Content-Length: 41700 Date: Thu, 25 Apr 2024 13:30:40 GMT Expires: Thu, 25 Apr 2024 13:30:40 GMT Cache-Control: private, max-age=31536000 Last-Modified: Wed, 10 Jan 2024 16:43:07 GMT X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:40 UTC	392	IN	Data Raw: 2f 2a 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 35 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 0a 0a 2f 2a 20 74 68 65 20 47 53 65 61 72 63 68 43 6f 6e 74 72 6f 6c 20 43 53 53 20 43 6c 61 73 73 65 73 0a 20 2a 20 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 3a 20 74 68 65 20 70 72 69 6d 61 72 79 20 63 6c 61 73 73 20 6f 66 20 74 68 65 20 63 6f 6e 74 72 6f 6c 0a 20 2a 2f 0a 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 20 7b 0a 20 20 77 69 64 74 68 3a 20 33 30 30 70 78 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 20 64 69 76 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 73 74 61 74 69 63 3b 0a 7d 0a 0a 2f 2a 20 53 6c 69 67 68 74 20 72 65 73 65 74 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 70 72 65 76 69 65 77 Data Ascii: /** Copyright 2005 Google Inc. All rights reserved. // the GSearchControl CSS Classes * .gsc-control: the primary class of the control /.gsc-control { width: 300px;}.gsc-control div { position: static;}/ Slight reset to make the preview
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 2d 77 72 61 70 70 65 72 2d 63 73 65 20 7b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 63 6f 6e 74 72 6f 6c 20 69 6e 70 75 74 73 0a 20 2a 20 2e 67 73 63 2d 73 65 61 72 63 68 2d 62 6f 78 3a 20 74 68 65 20 63 6f 6e 74 61 69 6e 65 72 20 74 68 61 74 20 68 6f 73 74 73 20 74 68 65 20 74 65 78 74 20 69 6e 70 75 74 20 61 72 65 61 0a 20 2a 20 2e 67 73 63 2d 69 6e 70 75 74 3a 20 74 68 65 20 74 65 78 74 20 69 6e 70 75 74 20 61 72 65 61 0a 20 2a 20 2e 67 73 63 2d 6b 65 65 70 65 72 3a 20 74 68 65 20 73 61 76 65 20 6c 69 6e 6b 20 62 65 6c 6f 77 20 73 61 76 61 62 Data Ascii: t-family: Arial, sans-serif; font-size: 13px;}.gsc-control-wrapper-cse { width: 100%;}/* control inputs * .gsc-search-box: the container that hosts the text input area * .gsc-input: the text input area * .gsc-keeper: the save link below savab
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 67 6e 3a 20 72 69 67 68 74 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 32 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 7d 0a 0a 2e 67 73 63 2d 62 72 61 6e 64 69 6e 67 2d 74 65 78 74 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 0a 2e 67 63 73 63 2d 62 72 61 6e 64 69 6e 67 2d 74 65 78 74 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 66 6c 65 78 2d 67 72 6f 77 3a 20 31 3b 0a 7d 0a 0a 2e 67 73 63 2d 62 72 61 6e 64 69 6e 67 2d 69 6d 67 2d 6e 6f 63 6c 65 61 72 2c 0a 2e 67 63 73 63 2d 62 72 61 6e 64 69 6e 67 2d 69 6d 67 2d 6e 6f 63 6c 65 61 72 20 7b 0a 20 20 77 69 64 74 68 3a 20 35 31 70 78 3b 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 6f 74 74 6f 6d 3b 0a 7d 0a 0a 2e Data Ascii: gn: right; font-size: 11px; margin-right: 2px; color: #666;}.gsc-branding-text:first-child,.gcsc-branding-text:first-child { flex-grow: 1;}.gsc-branding-img-noclear,.gcsc-branding-img-noclear { width: 51px; vertical-align: bottom;}.
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 2d 62 75 74 74 6f 6e 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 34 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 70 78 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 20 63 65 6e 74 65 72 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 76 32 2f 63 6c 65 61 72 2e 70 6e 67 27 29 3b Data Ascii: -button { display: inline; text-align: right; margin-left: 4px; margin-right: 4px; padding-left: 10px; background-repeat: no-repeat; background-position: center center; background-image: url('//www.google.com/cse/static/css/v2/clear.png');
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 33 30 70 78 3b 0a 20 20 77 69 64 74 68 3a 20 37 30 25 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 74 6f 70 3a 20 35 25 3b 0a 20 20 6c 65 66 74 3a 20 31 32 25 3b 0a 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0a 20 20 7a 2d 69 6e 64 65 78 3a 20 31 30 30 30 30 32 3b 0a 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 35 73 20 6c 69 6e 65 61 72 3b 0a 20 20 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 35 73 20 6c 69 6e 65 61 72 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 30 2e 32 Data Ascii: ound: white; padding: 30px; width: 70%; position: fixed !important; top: 5%; left: 12%; opacity: 0; z-index: 100002; visibility: hidden; -webkit-transition: all 0.25s linear; -moz-transition: all 0.25s linear; -ms-transition: all 0.2
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 68 69 64 64 65 6e 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 7d 0a 0a 2f 2a 0a 20 2a 20 47 69 76 65 6e 20 74 68 61 74 20 74 68 69 73 20 69 73 20 73 69 74 74 69 6e 67 20 69 6e 20 61 20 76 61 72 69 61 62 6c 65 20 77 69 64 74 68 20 74 61 62 6c 65 20 63 65 6c 6c 2c 20 74 68 65 20 69 64 65 61 20 69 73 0a 20 2a 20 66 6f 72 20 69 74 20 74 6f 20 63 6f 6e 73 75 6d 65 20 74 68 65 20 65 6e 74 69 72 65 20 63 65 6c 6c 2e 20 54 68 65 20 61 64 6a 61 63 65 6e 74 20 63 65 6c 6c 20 63 6f 6e 74 61 69 6e 73 20 74 68 65 20 73 65 61 72 63 68 0a 20 2a 20 62 75 74 74 6f 6e 20 61 6e 64 20 74 68 61 74 20 69 73 20 61 20 66 69 78 65 64 20 77 69 64 74 68 20 63 65 6c 6c 2e 0a 20 2a 2f 0a 69 6e 70 75 74 2e 67 73 63 2d 69 6e 70 75 74 20 7b 0a 20 20 70 61 64 64 Data Ascii: hidden { overflow: hidden;}/* * Given that this is sitting in a variable width table cell, the idea is * for it to consume the entire cell. The adjacent cell contains the search * button and that is a fixed width cell. */input.gsc-input { padd
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 20 74 61 62 0a 20 2a 20 2e 67 73 63 2d 74 61 62 44 61 74 61 2e 67 73 63 2d 74 61 62 64 41 63 74 69 76 65 3a 20 74 68 65 20 64 61 74 61 20 61 72 65 61 20 66 6f 72 20 74 68 65 20 61 63 74 69 76 65 20 74 61 62 0a 20 2a 20 2e 67 73 63 2d 74 61 62 44 61 74 61 2e 67 73 63 2d 74 61 62 64 49 6e 61 63 74 69 76 65 3a 20 74 68 65 20 64 61 74 61 20 61 72 65 61 20 66 6f 72 20 69 6e 61 63 74 69 76 65 20 74 61 62 73 0a 20 2a 2f 0a 2e 67 73 63 2d 70 6f 73 69 74 69 6f 6e 69 6e 67 57 72 61 70 70 65 72 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 0a 2e 67 73 63 2d 74 61 62 73 41 72 65 61 20 7b 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 36 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f Data Ascii: tab * .gsc-tabData.gsc-tabdActive: the data area for the active tab * .gsc-tabData.gsc-tabdInactive: the data area for inactive tabs */.gsc-positioningWrapper { position: relative;}.gsc-tabsArea { clear: both; margin-top: 6px; border-botto
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 69 6f 6e 0a 20 2a 20 2d 20 6e 6f 20 74 77 69 64 64 6c 65 2c 20 74 61 62 62 65 64 20 6d 6f 64 65 20 72 75 6e 73 20 69 6e 20 66 75 6c 6c 20 65 78 70 61 6e 64 20 6d 6f 64 65 0a 20 2a 20 2d 20 6e 6f 20 74 69 74 6c 65 0a 20 2a 20 2d 20 6e 6f 20 73 74 61 74 73 0a 20 2a 2f 0a 2e 67 73 63 2d 74 61 62 44 61 74 61 20 2e 67 73 63 2d 72 65 73 75 6c 74 73 48 65 61 64 65 72 20 2e 67 73 63 2d 74 69 74 6c 65 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 67 73 63 2d 74 61 62 44 61 74 61 20 2e 67 73 63 2d 72 65 73 75 6c 74 73 48 65 61 64 65 72 20 2e 67 73 63 2d 73 74 61 74 73 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 67 73 63 2d 74 61 62 44 61 74 61 20 2e 67 73 63 2d 72 65 73 75 6c 74 73 48 65 61 64 65 72 20 2e 67 73 Data Ascii: ion * - no twiddle, tabbed mode runs in full expand mode * - no title * - no stats */.gsc-tabData .gsc-resultsHeader .gsc-title { display: none;}.gsc-tabData .gsc-resultsHeader .gsc-stats { display: none;}.gsc-tabData .gsc-resultsHeader .gs
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 30 70 78 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6d 70 6c 65 74 69 6f 6e 2d 69 63 6f 6e 20 7b 0a 20 20 2f 2a 20 70 6c 61 63 65 20 69 6d 61 67 65 20 69 6e 20 74 68 65 20 6d 69 64 64 6c 65 20 2a 2f 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6d 70 6c 65 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 67 73 63 2d 63 6f 6d 70 6c 65 74 69 6f 6e 2d 70 72 6f 6d 6f 74 69 6f 6e 2d 74 61 62 6c 65 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 69 6e 68 65 72 69 74 3b 0a 20 20 62 61 63 Data Ascii: ding-right: 10px;}.gsc-completion-icon { /* place image in the middle */ margin-left: auto; margin-right: auto; display: block; border: 1px solid #ddd;}.gsc-completion-container .gsc-completion-promotion-table { font-size: inherit; bac
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 73 69 7a 65 3a 20 2e 39 65 6d 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 36 37 36 37 36 37 3b 0a 7d 0a 0a 2e 67 73 63 2d 61 64 42 6c 6f 63 6b 20 2e 67 73 63 2d 61 64 20 7b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 38 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 35 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 33 70 78 3b 0a 7d 0a 0a 2e 67 73 63 2d 61 64 42 6c 6f 63 6b 20 2e 67 73 63 2d 61 64 20 61 20 7b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 65 72 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 63 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 65 6d 3b 0a 7d 0a 0a 2e 67 73 63 2d 61 64 42 6c 6f 63 6b 20 2e 67 73 63 2d 61 64 20 63 69 74 65 20 7b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 Data Ascii: size: .9em; color: #676767;}.gsc-adBlock .gsc-ad { padding-left: 8px; padding-top: 5px; padding-right: 3px;}.gsc-adBlock .gsc-ad a { font-weight: bolder; color: #00c; line-height: 1.4em;}.gsc-adBlock .gsc-ad cite { font-style: nor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49857	142.250.105.147	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	664	OUT	GET /cse/static/style/look/v4/default.css HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	791	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/css Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="prose-team" Report-To: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]} Content-Length: 4495 Date: Thu, 25 Apr 2024 13:30:40 GMT Expires: Thu, 25 Apr 2024 14:20:40 GMT Cache-Control: public, max-age=3000 Last-Modified: Wed, 17 Jun 2020 00:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:40 UTC	464	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 44 65 66 61 75 6c 74 20 54 68 65 6d 65 2c 20 76 34 2e 0a 20 2a 0a 20 2a 2f 0a 0a 2f 2a 20 53 65 6c 65 63 74 6f 72 20 66 6f 72 20 65 6e 74 69 72 65 20 65 6c 65 6d 65 6e 74 2e 20 2a 2f 0a 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 2d 63 73 65 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6e 74 72 6f 6c 2d 63 73 65 20 2e 67 73 63 2d 74 61 62 6c 65 2d 72 65 73 75 6c 74 20 7b 0a 20 20 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 7d 0a 0a 2e 67 73 63 2d 72 65 73 75 6c 74 73 48 65 61 64 65 72 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a 0a 2f 2a 20 53 65 61 72 63 68 20 69 6e 70 75 74 20 Data Ascii: /** * Default Theme, v4. * // Selector for entire element. /.gsc-control-cse { background-color: #fff; border: 1px solid #fff;}.gsc-control-cse .gsc-table-result { width: auto;}.gsc-resultsHeader { border: block;}/ Search input
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 66 66 3b 0a 7d 0a 0a 2e 67 73 63 2d 73 65 61 72 63 68 2d 62 6f 78 20 2e 67 73 63 2d 69 6e 70 75 74 3e 69 6e 70 75 74 3a 66 6f 63 75 73 2c 0a 2e 67 73 63 2d 69 6e 70 75 74 2d 62 6f 78 2d 66 6f 63 75 73 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 34 64 39 30 66 65 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2f 2a 20 53 65 61 72 63 68 20 62 75 74 74 6f 6e 20 2a 2f 0a 2e 67 73 63 2d 73 65 61 72 63 68 2d 62 75 74 74 6f 6e 2d 76 32 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 32 37 70 78 3b 0a 20 20 77 69 64 74 Data Ascii: ff;}.gsc-search-box .gsc-input>input:focus,.gsc-input-box-focus { border: 1px solid #4d90fe; box-shadow: inset 0 1px 2px rgba(0, 0, 0, .3); outline: none;}/* Search button */.gsc-search-button-v2 { font-size: 0; padding: 6px 27px; widt
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 2d 72 65 73 75 6c 74 20 2e 67 73 2d 74 69 74 6c 65 20 2a 2c 0a 2e 67 73 63 2d 63 75 72 73 6f 72 2d 70 61 67 65 2c 0a 2e 67 73 2d 73 70 65 6c 6c 69 6e 67 20 61 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 35 63 3b 0a 7d 0a 0a 2f 2a 20 53 6e 69 70 70 65 74 20 74 65 78 74 20 63 6f 6c 6f 72 20 2a 2f 0a 2e 67 73 2d 77 65 62 52 65 73 75 6c 74 20 2e 67 73 2d 73 6e 69 70 70 65 74 2c 0a 2e 67 73 2d 66 69 6c 65 46 6f 72 6d 61 74 54 79 70 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 7d 0a 0a 2f 2a 50 72 6f 6d 6f 74 69 6f 6e 20 53 65 74 74 69 6e 67 73 2a 2f 0a 2f 2a 20 54 68 65 20 65 6e 74 69 72 65 20 70 72 6f 6d 6f 20 2a 2f 0a 2e 67 73 63 2d 77 65 62 52 65 73 75 6c 74 2e 67 73 63 2d 72 65 73 75 6c 74 2e 67 73 63 2d 70 72 6f 6d 6f 74 69 6f 6e 20 7b 0a 20 20 Data Ascii: -result .gs-title ,.gsc-cursor-page,.gs-spelling a { color: #15c;}/ Snippet text color /.gs-webResult .gs-snippet,.gs-fileFormatType { color: #333;}/Promotion Settings// The entire promo */.gsc-webResult.gsc-result.gsc-promotion {
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 61 62 6c 65 20 77 68 69 63 68 20 63 6f 6e 74 61 69 6e 73 20 74 68 65 20 63 6f 6d 70 6c 65 74 69 6f 6e 73 0a 20 2a 2f 0a 2e 67 73 63 2d 63 6f 6d 70 6c 65 74 69 6f 6e 2d 73 65 6c 65 63 74 65 64 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 65 65 3b 0a 7d 0a 0a 2e 67 73 63 2d 63 6f 6d 70 6c 65 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 0a 20 20 2f 2a 20 54 68 65 20 74 6f 70 2c 20 6c 65 66 74 2c 20 61 6e 64 20 77 69 64 74 68 20 61 72 65 20 73 65 Data Ascii: able which contains the completions /.gsc-completion-selected { background: #eee;}.gsc-completion-container { font-family: Roboto, sans-serif; font-size: 16px; background: white; border: 1px solid #ccc; / The top, left, and width are se
2024-04-25 13:30:40 UTC	266	IN	Data Raw: 52 65 73 75 6c 74 20 2e 67 73 2d 74 69 74 6c 65 20 2e 67 73 2d 74 69 74 6c 65 2e 67 73 63 2d 75 73 72 2d 67 72 6f 75 70 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 35 63 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 7d 0a 0a 2e 67 73 2d 77 65 62 52 65 73 75 6c 74 20 2e 67 73 2d 74 69 74 6c 65 20 2e 67 73 2d 74 69 74 6c 65 2e 67 73 63 2d 75 73 72 2d 67 72 6f 75 70 2d 68 65 61 64 69 6e 67 20 62 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 35 63 3b 0a 7d 0a 0a 2e 67 63 73 63 2d 66 69 6e 64 2d 6d 6f 72 65 2d 6f 6e 2d 67 6f 6f 67 6c 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 35 63 3b 0a 7d 0a 0a 2e 67 63 73 63 2d 66 69 6e 64 2d 6d 6f 72 65 2d 6f 6e 2d 67 6f 6f 67 6c 65 2d 6d 61 67 6e 69 66 69 65 72 20 7b 0a 20 20 66 69 6c Data Ascii: Result .gs-title .gs-title.gsc-usr-group-heading { color: #15c; cursor: pointer;}.gs-webResult .gs-title .gs-title.gsc-usr-group-heading b { color: #15c;}.gcsc-find-more-on-google { color: #15c;}.gcsc-find-more-on-google-magnifier { fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49856	142.250.105.147	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	680	OUT	GET /cse/static/element/8435450f13508ca1/cse_element__en.js?usqp=CAI%3D HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	871	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="prose-team" Report-To: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]} Content-Length: 325815 Date: Thu, 25 Apr 2024 13:30:40 GMT Expires: Thu, 25 Apr 2024 13:30:40 GMT Cache-Control: private, max-age=31536000 Last-Modified: Wed, 10 Jan 2024 16:43:07 GMT X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:40 UTC	384	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 2c 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e Data Ascii: (function(){var g,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 0a 7d 2c 6b 61 3d 6a 61 28 74 68 69 73 29 2c 6d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 6b 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 Data Ascii: &&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ka=ja(this),ma=function(a,b){if(b)a:{var c=ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 72 61 77 3d 61 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 62 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 53 74 72 69 6e 67 28 61 29 2b 22 20 69 73 20 6e 6f 74 20 61 6e 20 69 74 65 72 61 62 6c 65 20 6f 72 20 41 72 72 61 79 4c 69 6b 65 22 29 3b 7d 2c 73 61 3d 66 75 6e 63 74 69 6f 6e Data Ascii: a=function(a){return a.raw=a},t=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:ba(a)};throw Error(String(a)+" is not an iterable or ArrayLike");},sa=function
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 69 6f 6e 28 68 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 66 63 29 7b 74 68 69 73 2e 66 63 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 64 6d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 44 75 28 29 7d 29 7d 74 68 69 73 2e 66 63 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 6b 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 64 6d 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 44 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 66 63 26 26 74 68 69 73 2e 66 63 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 66 63 3b 74 68 69 73 2e 66 63 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b Data Ascii: ion(h){if(null==this.fc){this.fc=[];var k=this;this.dm(function(){k.Du()})}this.fc.push(h)};var d=ka.setTimeout;b.prototype.dm=function(h){d(h,0)};b.prototype.Du=function(){for(;this.fc&&this.fc.length;){var h=this.fc;this.fc=[];for(var k=0;k<h.length;++k
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 68 69 73 2e 6d 61 3d 68 3b 74 68 69 73 2e 49 61 3d 6b 3b 32 3d 3d 3d 74 68 69 73 2e 6d 61 26 26 74 68 69 73 2e 43 7a 28 29 3b 74 68 69 73 2e 46 75 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 43 7a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 69 79 28 29 29 7b 76 61 72 20 6b 3d 6b 61 2e 63 6f 6e 73 6f 6c 65 3b 0a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 49 61 29 7d 7d 2c 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 69 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 6c 70 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 6b 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 6b 61 2e 45 76 65 6e 74 2c 6c Data Ascii: his.ma=h;this.Ia=k;2===this.ma&&this.Cz();this.Fu()};e.prototype.Cz=function(){var h=this;d(function(){if(h.iy()){var k=ka.console;"undefined"!==typeof k&&k.error(h.Ia)}},1)};e.prototype.iy=function(){if(this.lp)return!1;var h=ka.CustomEvent,k=ka.Event,l
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 20 22 2b 6d 2e 6d 61 29 3b 7d 7d 76 61 72 20 6d 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 6f 65 3f 66 2e 63 6d 28 6c 29 3a 74 68 69 73 2e 6f 65 2e 70 75 73 68 28 6c 29 3b 74 68 69 73 2e 6c 70 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 74 28 68 29 2c 70 3d 6d 2e 6e 65 78 74 28 29 3b 21 70 2e 64 6f 6e 65 3b 70 3d 6d 2e 6e 65 78 74 28 29 29 63 28 70 2e 76 61 6c 75 65 29 2e 6c 67 28 6b 2c 6c 29 7d 29 7d 3b 65 2e Data Ascii: "+m.ma);}}var m=this;null==this.oe?f.cm(l):this.oe.push(l);this.lp=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=t(h),p=m.next();!p.done;p=m.next())c(p.value).lg(k,l)})};e.
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 29 7b 69 66 28 70 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 72 65 74 75 72 6e 20 70 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 70 29 26 26 64 28 70 29 3b 72 65 74 75 72 6e 20 6d 28 70 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 70 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 70 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 70 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 70 2e 64 65 6c 65 74 65 28 6c 29 3b 70 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 70 2e 68 61 73 28 Data Ascii: ){if(p instanceof b)return p;Object.isExtensible(p)&&d(p);return m(p)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),p=new a([[l,2],[m,3]]);if(2!=p.get(l)\|\|3!=p.get(m))return!1;p.delete(l);p.set(m,4);return!p.has(
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 22 21 3d 70 2e 76 61 6c 75 65 5b 31 5d 29 72 65 74 75 72 6e 21 31 3b 70 3d 6d 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 70 2e 64 6f 6e 65 7c 7c 34 21 3d 70 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 22 74 22 21 3d 70 2e 76 61 6c 75 65 5b 31 5d 7c 7c 21 6d 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 3f 21 31 3a 21 30 7d 63 61 74 63 68 28 71 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 74 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 Data Ascii: "!=p.value[1])return!1;p=m.next();return p.done\|\|4!=p.value[0].x\|\|"t"!=p.value[1]\|\|!m.next().done?!1:!0}catch(q){return!1}}())return a;var b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=t(k);for(var l;!(l=k.next()).done;)l=l.value
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 70 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6c 26 26 74 79 70 65 6f 66 20 6c 3b 22 6f 62 6a 65 63 74 22 3d 3d 6d 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 6d 3f 62 2e 68 61 73 28 6c 29 3f 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 70 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 70 26 26 4a 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 70 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 71 3d 70 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 71 Data Ascii: p[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(k,l){var m=l&&typeof l;"object"==m\|\|"function"==m?b.has(l)?m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var p=k[0][m];if(p&&Ja(k[0],m))for(k=0;k<p.length;k++){var q=p[k];if(l!==l&&q
2024-04-25 13:30:40 UTC	1255	IN	Data Raw: 22 2c 22 65 73 33 22 29 3b 0a 76 61 72 20 4e 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 Data Ascii: ","es3");var Na=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular express

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49859	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	384	OUT	GET /static/img/common/icon_follow_youtube.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	698	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:44 GMT etag: W/"518-5e708938f417c-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 76895 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kD6n%2B%2FzCpTMgDk4izcVEwdMwd6LU4ro5lgE0GMrKNBNKo%2BIt7BpIo4X%2B6B1pOb2v%2BQKFRJZVWZ9nj4SKuvKMu%2F1mUikjmq8YIaiFazk%2BSko8CY%2BvvRiesCbbN0GicYwpQUa%2FPtA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb064b80eb09d-ATL
2024-04-25 13:30:40 UTC	671	IN	Data Raw: 35 31 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 33 2e 30 30 30 30 30 30 2c 20 37 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 518<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(3.000000, 7.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:40 UTC	640	IN	Data Raw: 39 30 36 30 38 38 2c 39 2e 35 39 32 36 36 30 37 20 43 2d 30 2e 30 30 36 31 33 34 39 38 35 32 32 2c 31 31 2e 38 30 39 33 33 30 36 20 30 2e 31 39 30 35 33 35 30 32 37 2c 31 34 2e 30 32 31 38 31 30 31 20 30 2e 35 38 37 39 33 35 34 33 34 2c 31 36 2e 32 30 31 34 34 39 31 20 43 30 2e 39 30 36 32 31 31 31 34 34 2c 31 37 2e 33 35 39 34 39 33 35 20 31 2e 37 39 37 33 36 33 34 31 2c 31 38 2e 32 36 34 34 31 33 38 20 32 2e 39 33 37 37 38 38 36 31 2c 31 38 2e 35 38 37 36 30 36 38 20 43 35 2e 30 34 30 30 35 31 38 38 2c 31 39 2e 31 36 31 32 39 30 33 20 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 43 31 33 2e 35 31 32 31 32 37 39 2c 31 39 2e 31 36 31 32 39 30 33 20 32 31 2e 39 35 39 34 Data Ascii: 906088,9.5926607 C-0.00613498522,11.8093306 0.190535027,14.0218101 0.587935434,16.2014491 C0.906211144,17.3594935 1.79736341,18.2644138 2.93778861,18.5876068 C5.04005188,19.1612903 13.5121279,19.1612903 13.5121279,19.1612903 C13.5121279,19.1612903 21.9594
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49862	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	386	OUT	GET /static/img/common/icon_follow_wordpress.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	700	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:43 GMT etag: W/"318-5e708938064cc-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 46950 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7auOIwQ3klNXDGj3gsyT%2Fgr%2Fsq64%2F%2FSE%2FQVcsYoLJuakTgP%2BeGlKcjKiM5739W9ih9PCJtHA%2F6x%2FpjI12InYjvSQH4aFtvFl%2BA66SIjbtSJBrcbaqlY420rUceFcCJOnTGqz%2Bw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb064ce7cada0-ATL
2024-04-25 13:30:40 UTC	669	IN	Data Raw: 33 31 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 33 32 70 78 22 20 68 65 69 67 68 74 3d 22 33 32 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 35 2e 30 30 30 30 30 30 2c 20 34 2e 30 30 30 30 30 30 29 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 66 69 6c 6c 2d 72 75 6c 65 Data Ascii: 318<svg xmlns="http://www.w3.org/2000/svg" width="32px" height="32px" viewBox="0 0 32 32" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g transform="translate(5.000000, 4.000000)" fill="#FFFFFF" fill-rule
2024-04-25 13:30:40 UTC	130	IN	Data Raw: 32 32 34 20 43 31 30 2e 36 38 36 34 36 30 39 2c 34 2e 36 30 32 32 34 20 31 39 2e 33 38 34 34 38 36 31 2c 31 33 2e 33 30 35 36 20 31 39 2e 33 38 34 34 38 36 31 2c 32 34 20 4c 32 34 2c 32 34 20 43 32 34 2c 31 30 2e 37 37 30 32 34 20 31 33 2e 32 33 31 39 30 38 31 2c 30 20 30 2c 30 20 5a 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 224 C10.6864609,4.60224 19.3844861,13.3056 19.3844861,24 L24,24 C24,10.77024 13.2319081,0 0,0 Z"/> </g> </g></svg>
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49861	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	380	OUT	GET /static/img/common/icon_newsletter.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	694	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 25 Aug 2022 03:41:48 GMT etag: W/"36a-5e70893cb19cb-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 18930 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Czz1TXO%2BIlRU0linqPQv8vlxKr8%2BRpYqdaVPiD8E%2BeOEcrmf8Tdmo31XkJhwKqxi%2BeSoy3IcreQjEJtlCRWJQPRHdbgL2MEVXLoxxC0%2BowJTDqctm%2FLj1H6t34FRCJ1GhsJy%2BY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb064c9c17bac-ATL
2024-04-25 13:30:40 UTC	675	IN	Data Raw: 33 36 61 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 70 78 22 20 68 65 69 67 68 74 3d 22 32 34 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 37 2e 37 31 33 33 30 30 38 34 2c 31 33 2e 39 35 31 37 33 33 36 20 4c 37 2e 36 37 37 34 32 34 39 38 2c 31 33 2e 39 31 39 34 34 35 33 20 4c 31 33 2e 39 34 35 36 35 37 33 2c 38 2e Data Ascii: 36a<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" version="1.1"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <path d="M7.71330084,13.9517336 L7.67742498,13.9194453 L13.9456573,8.
2024-04-25 13:30:40 UTC	206	IN	Data Raw: 30 36 39 2c 32 30 2e 39 37 32 33 30 30 36 20 43 31 35 2e 37 35 35 37 31 31 34 2c 32 31 2e 30 34 30 34 36 30 37 20 31 35 2e 34 39 39 32 30 35 2c 32 30 2e 39 38 30 39 31 33 39 20 31 35 2e 33 31 35 33 39 38 2c 32 30 2e 38 31 34 37 38 37 38 20 4c 31 30 2e 37 30 33 31 39 36 2c 31 36 2e 36 35 30 33 31 36 36 20 4c 37 2e 37 31 33 33 30 30 38 34 2c 31 39 2e 36 33 39 34 39 34 33 20 4c 37 2e 37 31 33 33 30 30 38 34 2c 31 33 2e 39 35 31 37 33 33 36 20 5a 22 20 66 69 6c 6c 3d 22 23 45 46 46 30 46 32 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 6e 6f 6e 7a 65 72 6f 22 2f 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: 069,20.9723006 C15.7557114,21.0404607 15.499205,20.9809139 15.315398,20.8147878 L10.703196,16.6503166 L7.71330084,19.6394943 L7.71330084,13.9517336 Z" fill="#EFF0F2" fill-rule="nonzero"/> </g></svg>
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49860	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	383	OUT	GET /static/img/icon/icon_arrow_eff0f2_12.svg HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	692	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Thu, 08 Sep 2022 06:07:13 GMT etag: W/"2e8-5e8243d9cc12f-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 56043 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ufHef9qhyZvMj7l57g1tsHJ5Xz0zNqHqXOHncJ8F9%2BEOosvziZ%2FaNQw7IHiQO8I%2BjMqFWoT559u2bXCoVEMgvm4eFpRh%2B7%2BVJmvO0KohPcHbi0PgvC186V%2BmDSdEqrgW7t39ElE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb064cc74674a-ATL
2024-04-25 13:30:40 UTC	677	IN	Data Raw: 32 65 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 38 20 31 38 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e Data Ascii: 2e8<?xml version="1.0" encoding="UTF-8"?><svg width="12" height="12" viewBox="0 0 18 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
2024-04-25 13:30:40 UTC	74	IN	Data Raw: 65 28 2d 34 35 2e 30 30 30 30 30 30 29 20 74 72 61 6e 73 6c 61 74 65 28 2d 39 2e 30 30 30 30 30 30 2c 20 2d 37 2e 30 30 30 30 30 30 29 20 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 76 67 3e 0a 0d 0a Data Ascii: e(-45.000000) translate(-9.000000, -7.000000) "></path> </g></svg>
2024-04-25 13:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49863	104.26.3.143	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	354	OUT	GET /favicon.ico HTTP/1.1 Host: www.wisecleaner.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:40 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:40 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close last-modified: Fri, 03 Aug 2012 23:30:12 GMT etag: W/"4486-4c664e8d2c900-gzip" vary: Accept-Encoding Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Age: 38602 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tRRNEfIIkuNnn4JCzkj9VTCKg0rfe58TQnj3oKwR0%2BDkPoAroCqb0XS0QpBbhilmZN%2By0fJsUBAGwLMUE3bamFt0ISNA0UY6Ct5MUEkCe2Edo4HqFDHaD0F7c5iOaUu%2Fo03swcY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb064ccb97cc4-ATL
2024-04-25 13:30:40 UTC	683	IN	Data Raw: 34 34 38 36 0d 0a 00 00 01 00 04 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 ee 25 00 00 18 18 00 00 01 00 20 00 88 09 00 00 96 36 00 00 10 10 00 00 01 00 20 00 68 04 00 00 1e 40 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 80 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 448600 %F % 6 h@(0` %
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a 4e 30 01 b7 5d 39 3f b6 5c 38 96 b7 5d 39 de b7 5d 39 fe b6 5c 38 fe b7 5d 39 ff b7 5d 39 ff b6 5c 38 fe b7 5d 39 ff b7 5d 39 ff b7 5d 39 fe b7 5d 39 ff b7 5d 39 e9 b6 5c 38 a5 b7 5d 39 51 a9 56 34 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a5 55 34 04 b7 5e 3a 61 b7 5d 39 d6 b7 5d Data Ascii: N0]9?\8]9]9\8]9]9\8]9]9]9]9]9\8]9QV4U4^:a]9]
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: c0 6d 45 9f c1 6e 45 fe c1 6f 46 ff c1 6f 46 ff c2 70 47 fe c2 70 47 ff c2 71 47 ff c2 71 47 ff c2 71 47 fe c2 70 47 ff c2 70 47 fe c1 70 47 ff c1 6f 46 ff c1 6e 45 fe c0 6d 45 ff bf 6c 44 ff bf 6b 43 fe be 6a 42 ff bd 69 42 ff bd 69 42 fe be 69 42 ff be 6a 43 ff c0 6c 44 fe c1 6f 46 ff c3 72 48 ff c5 76 4b fe c9 7b 4f ff cc 80 52 ff ce 84 56 ff d0 88 58 fe d2 8a 5a ff d2 8b 5b ff d1 89 5a fe d0 87 58 ff ce 83 55 ff cb 7e 52 fe c8 7a 4e ff c5 75 4a ff c2 70 47 fe bf 6c 44 ff bd 68 41 ff bb 64 3e fe b7 5d 39 f8 b6 5c 38 1c 00 00 00 00 00 00 00 00 00 00 00 00 c1 70 46 58 c2 70 47 fe c2 71 48 fe c3 72 48 ff c3 73 49 ff c3 73 49 fe c4 74 4a ff c4 74 4a ff c4 74 4a ff c4 74 4a fe c4 74 4a ff c4 73 49 fe c3 73 49 ff c3 72 49 ff c2 71 48 fe c2 70 47 ff c1 6f 46 Data Ascii: mEnEoFoFpGpGqGqGqGpGpGpGoFnEmElDkCjBiBiBiBjClDoFrHvK{ORVXZ[ZXU~RzNuJpGlDhAd>]9\8pFXpGqHrHsIsItJtJtJtJtJsIsIrIqHpGoF
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 87 58 fe d0 88 5a fe fa f4 f0 fe fe fe fe fe fe fd fd fe db af 9c fe fe fe fe fe fe fe fe fe d7 9b 76 fe cc 81 53 fe cb 7f 52 fe ca 7d 51 fe df b1 97 fe fe fe fe fe fe fe fe fe dc b1 a0 fe fd fb fb fe fe fe fe fe f1 df d7 fe c0 6c 44 fe bf 6b 43 fe be 69 42 fe bd 68 41 fe bc 66 40 fe bb 65 3f fe ba 63 3e fe ba 63 3d fe ba 63 3d fe ba 62 3d fe b9 61 3c fe b9 60 3b fe b8 5f 3b fe b8 5e 3a fe b7 5e 39 fe b7 5d 39 fe b6 5c 38 fe b6 5c 38 e1 b4 5b 38 07 cb 7e 51 58 cc 80 53 ff cd 82 54 fe ce 83 55 ff cf 85 57 ff cf 86 58 fe d0 88 58 ff d1 89 59 ff d1 89 5a fe d2 8a 5a ff d2 8a 5a ff dc a5 80 ff fe fe fe fe ff ff ff ff f1 e0 d9 fe ca 83 5e ff fe fe fe ff fe fe fe fe e5 bd a5 ff ce 83 55 ff cd 82 54 fe cc 80 53 ff ef d8 ca ff fe fe fe fe fe fe fe ff c9 82 61 ff Data Ascii: XZvSR}QlDkCiBhAf@e?c>c=c=b=a<`;_;^:^9]9\8\8[8~QXSTUWXXYZZZ^UTSa
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 65 ff e0 b6 a0 fe ff ff ff ff fe fd fc ff ea c7 ae fe ff ff ff ff ff ff ff ff da a8 8f fe cf 86 57 ff cd 83 55 ff cc 80 53 fe c6 78 50 ff fb f7 f5 ff fe fe fe fe fb f6 f3 ff c4 75 4c ff c1 6e 46 ff bf 6b 43 fe bd 68 41 ff bb 65 3f ff ba 62 3c fe b8 5f 3a ff b7 5d 39 ff b6 5c 38 fe b7 5d 39 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d3 8d 5c a6 d5 8f 5e ff d6 92 60 fe d8 94 62 ff d9 97 64 ff da 99 66 fe dc 9b 67 ff dd 9d 68 ff dd 9f 6a fe eb c5 a4 ff ff ff ff ff ff ff ff ff eb d2 c8 fe db 9b 67 ff de 9f 6a fe dd 9e 69 ff dc 9c 67 ff d7 9b 76 fe ff ff ff ff ff ff ff ff fc f8 f6 fe ff ff ff ff fe fd fd ff cd 87 60 fe d0 87 58 ff ce 84 56 ff cd 81 54 fe ca 7d 50 ff e9 cd c2 ff fe fe fe fe ff ff ff ff d3 98 7a ff c1 Data Ascii: eWUSxPuLnFkChAe?b<_:]9\8]9\^`bdfghjgjigv`XVT}Pz
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: ff d5 8f 5e fe d3 8c 5c ff d1 89 59 ff cf 86 57 fe cd 82 55 ff cb 7f 52 ff c9 7a 4f fe c3 71 48 ff c1 6f 46 ff c2 71 48 ff c1 6f 46 fe bf 6c 44 ff bd 69 42 ff bc 65 3f fe ba 62 3d ff b8 5f 3a fa b7 5d 39 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 99 65 6a dc 9c 67 ff dd 9f 6a ff df a2 6c fe e1 a5 6e ff e3 a8 71 ff e5 ac 73 fe e7 af 75 ff e8 b2 78 ff e9 b4 79 ff e8 b2 78 fe e7 af 76 ff e5 ac 73 fe e3 a9 71 ff e1 a6 6f ff e0 a2 6c fe de 9f 6a ff dc 9c 68 ff da 99 65 fe d8 96 63 ff d6 92 60 ff d5 8f 5e fe d3 8c 5c ff d1 89 59 ff cf 86 57 fe cd 82 54 ff cb 7f 52 ff c9 7c 50 fe c8 79 4d ff c5 75 4b ff c3 72 49 ff c1 6f 46 fe bf 6c 44 ff bd 69 42 ff bc 65 3f fe ba 62 3d ff b8 5f Data Ascii: ^\YWURzOqHoFqHoFlDiBe?b=_:]9!ejgjlnqsuxyxvsqoljhec`^\YWTR\|PyMuKrIoFlDiBe?b=_
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: c7 78 4d fe c5 75 4b ff c3 72 49 ff c1 6f 46 ff bf 6c 44 b0 bc 69 42 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 9c 68 53 dc 9c 68 eb dc 9d 68 fe dd 9d 68 fe dc 9d 68 fe dc 9c 68 fe dc 9b 67 fe db 9a 66 fe da 98 65 fe d9 97 64 fe d8 95 62 fe d6 92 60 fe d5 90 5f fe d4 8d 5d fe d2 8b 5b fe d0 88 59 fe cf 85 57 fe cd 83 55 fe cc 80 53 fe ca 7d 51 fe c8 7a 4e fe c7 77 4c fe c4 74 4a fe c2 71 48 f8 c1 6e 46 77 b8 68 41 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: xMuKrIoFlDiBhShhhhhgfedb`_][YWUS}QzNwLtJqHnFwhA
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 75 3f 27 05 bb 64 3e 92 bb 64 3e fe bb 65 3f ff bb 65 3e ff bb 64 3e ff bb 64 3e ff ba 63 3d ff b9 61 3c ff b8 60 3b ff b8 60 3b ff b9 62 3d ff bc 66 40 ff c0 6d 44 ff c4 74 4a ff cb 7e 51 ff c8 7a 4e ff ba 62 3d db a9 56 34 30 9d 50 31 25 b7 5e 3a b4 c1 6f 46 fc c4 74 4a ff c0 6c 44 fe b9 60 3b c9 ad 58 36 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 47 2c 08 bd 68 41 b5 bd 69 42 ff be 69 42 ff be 6a 42 ff be 69 42 ff be 69 42 ff bd 68 41 ff bd 67 41 ff bc 66 40 ff bb 64 3e ff bb 64 3e ff bb 64 3e ff bc 67 40 ff bf 6c 44 ff c3 73 49 ff c9 7b 4f ff cf 85 57 ff d2 8c 5c ff c0 6d 45 f3 c0 6c 44 f0 d6 92 60 ff d6 92 60 ff d0 87 58 ff ca 7d 51 ff c4 74 4a ff bb 64 3e fc b5 5c 38 5f 00 Data Ascii: u?'d>d>e?e>d>d>c=a<`;`;b=f@mDtJ~QzNb=V40P1%^:oFtJlD`;X6@G,hAiBiBjBiBiBhAgAf@d>d>d>g@lDsI{OW\mElD``X}QtJd>\8_
2024-04-25 13:30:40 UTC	1369	IN	Data Raw: ff bd 67 40 ff ba 63 3d ff b7 5e 3a ff b7 5d 39 ff b7 5d 39 ff b6 5c 38 98 9c 4f 30 26 00 00 00 00 00 00 00 00 00 00 00 00 d1 89 5a de d3 8d 5c ff d5 90 5f ff d7 93 61 ff d8 96 63 ff d9 98 64 ff df a7 7a ff fe fe fe ff f9 f1 ee ff d5 91 60 ff d9 97 64 ff e6 c3 af ff fe fe fe ff dd a6 7f ff fe fc fb ff f3 e5 df ff cc 80 53 ff cb 7f 52 ff e3 bf ae ff ff ff ff ff d9 a7 8e ff c0 6d 45 ff be 69 42 ff bb 64 3e ff b8 60 3b ff b7 5d 39 ff b7 5d 39 ff a5 54 33 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d3 8c 5c d1 d5 90 5f ff d7 93 61 ff d9 97 64 ff db 9a 66 ff dc 9c 68 ff ec c8 ab ff ff ff ff ff e9 cc bc ff dc 9d 68 ff db 9b 67 ff dd a8 85 ff ff ff ff ff f4 e2 d6 ff ff ff ff ff e4 bf ac ff cf 85 57 ff cc 81 54 ff d4 9a 7b ff ff ff ff ff ec d3 c7 ff c1 6f Data Ascii: g@c=^:]9]9\8O0&Z\_acdz`dSRmEiBd>`;]9]9T3V\_adfhhgWT{o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49865	142.250.105.101	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	766	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:41 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 137325 Date: Thu, 25 Apr 2024 13:30:41 GMT Expires: Fri, 25 Apr 2025 13:30:41 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 18:15:45 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:41 UTC	352	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 Data Ascii: on"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typ
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 Data Ascii: d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="undefined"!=type
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d Data Ascii: [];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 75 72 6e 21 30 3b 22 66 75 6e 63 74 69 Data Ascii: nction(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)return!0;"functi
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 28 5b 5d 29 3a 6e 65 77 20 65 28 66 75 Data Ascii: e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c([]):new e(fu
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 Data Ascii: n!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExt
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d 2e 6e 66 3d 7b 6e 65 78 74 3a 74 68 69 Data Ascii: p,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m.nf={next:thi
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 Data Ascii: =""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(function(){if(
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d 0a 5f 2e 75 61 28 63 29 3b 66 6f 72 28 Data Ascii: .entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=_.ua(c);for(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49866	142.250.105.101	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	775	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_1?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:41 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 124564 Date: Thu, 25 Apr 2024 13:30:41 GMT Expires: Fri, 25 Apr 2025 13:30:41 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 18:15:45 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:41 UTC	352	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 31 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 59 66 3d 5f 2e 59 66 7c 7c 7b 7d 3b 5f 2e 59 66 2e 4d 76 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 6f 72 28 76 61 72 20 64 3d 5b 5d 2c 65 3d 32 2c 66 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 3c 66 3b 2b 2b 65 29 64 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 65 5d 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 68 3d 64 2e 73 6c 69 63 65 28 29 2c 6b 3d 30 2c 6c 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6b 3c 6c 3b 2b 2b 6b 29 68 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 6b 5d 29 3b 72 65 74 75 72 6e 20 62 2e 61 70 70 6c 79 28 61 2c 68 29 Data Ascii: gapi.loaded_1(function(_){var window=this;_.Yf=_.Yf\|\|{};_.Yf.Mv=function(a,b,c){for(var d=[],e=2,f=arguments.length;e<f;++e)d.push(arguments[e]);return function(){for(var h=d.slice(),k=0,l=arguments.length;k<l;++k)h.push(arguments[k]);return b.apply(a,h)
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 6d 6f 76 65 22 2c 61 2c 21 31 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6d 6f 75 73 65 6d 6f 76 65 22 2c 61 29 3a 5f 2e 5a 66 28 22 63 61 6e 6e 6f 74 20 61 74 74 61 63 68 42 72 6f 77 73 65 72 45 76 65 6e 74 3a 20 6d 6f 75 73 65 6d 6f 76 65 22 29 7d 3b 5f 2e 59 66 2e 45 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 62 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: nction(a){var b=window;"undefined"!=typeof b.addEventListener?b.addEventListener("mousemove",a,!1):"undefined"!=typeof b.attachEvent?b.attachEvent("onmousemove",a):_.Zf("cannot attachBrowserEvent: mousemove")};_.Yf.Eda=function(a){var b=window;b.removeEve
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6d 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 3b 62 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6d 29 3b 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 28 22 30 2e 22 2b 6d 5b 30 5d 29 7d 3b 76 61 72 20 63 3d 5f 2e 47 66 28 22 72 61 6e 64 6f 6d 2f 6d 61 78 4f 62 73 65 72 76 65 4d 6f 75 73 65 6d 6f 76 65 22 29 3b 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 2d 31 29 3b 76 61 72 20 64 3d 30 2c 65 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2c 66 3d 31 2c 68 3d 31 45 36 2a 28 73 63 72 65 65 6e 2e 77 69 64 74 68 2a 73 63 72 65 65 6e 2e 77 69 64 74 68 2b 73 63 72 65 65 6e 2e 68 65 69 67 68 74 29 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 3d 6d 7c 7c 77 69 6e 64 6f 77 2e 65 76 65 6e 74 3b 76 61 72 20 6e 3d 6d 2e 73 63 72 65 65 6e 58 Data Ascii: m=new window.Uint32Array(1);b.getRandomValues(m);return Number("0."+m[0])};var c=_.Gf("random/maxObserveMousemove");null==c&&(c=-1);var d=0,e=Math.random(),f=1,h=1E6(screen.widthscreen.width+screen.height),k=function(m){m=m\|\|window.event;var n=m.screenX
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 3b 24 71 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 55 67 2e 63 61 6c 6c 28 22 2e 2e 22 2c 22 5f 6e 6f 6f 70 5f 65 63 68 6f 22 2c 5f 2e 4c 61 2e 57 63 61 29 7d 2c 30 29 7d 3b 61 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 66 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 30 29 2c 68 3d 66 5b 66 2e 6c 65 6e 67 74 68 2d 31 5d 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 68 29 7b 76 61 72 20 6b 3d 68 3b 66 2e 70 6f 70 28 29 7d 66 2e 75 6e 73 68 69 66 74 28 62 2c 61 2c 6b 2c 63 29 3b 5f 2e 55 67 2e 63 61 6c Data Ascii: ;$q=function(){window.setTimeout(function(){_.Ug.call("..","_noop_echo",_.La.Wca)},0)};ar=function(a,b,c){var d=function(e){var f=Array.prototype.slice.call(arguments,0),h=f[f.length-1];if("function"===typeof h){var k=h;f.pop()}f.unshift(b,a,k,c);_.Ug.cal
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 67 66 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 7c 7c 5f 2e 67 66 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 5f 2e 67 66 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 7d 3b 0a 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 79 66 2e 68 3d 61 7d 3b 66 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 79 66 2e 62 73 68 3d 61 7d 3b 67 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 2e 5f 5f 5f 6a 73 6c 3d 77 69 6e 64 6f 77 2e 5f 5f 5f 6a 73 6c 7c 7c 7b 7d 3b 62 5b 61 5d 3d 62 5b 61 5d 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 62 5b 61 5d 7d 3b 68 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 Data Ascii: tion(){return _.gf.location.origin\|\|_.gf.location.protocol+"//"+_.gf.location.host};er=function(a){_.yf.h=a};fr=function(a){_.yf.bsh=a};gr=function(a){var b=window.___jsl=window.___jsl\|\|{};b[a]=b[a]\|\|[];return b[a]};hr=function(a){return"object"===typeof
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 31 3b 2b 2b 65 29 7b 76 61 72 20 68 3d 7b 7d 3b 64 3d 64 5b 61 5b 65 5d 5d 3d 68 7d 64 5b 61 5b 65 5d 5d 3d 62 7d 65 6c 73 65 20 63 3d 61 3b 5f 2e 51 69 28 21 30 29 3b 64 3d 77 69 6e 64 6f 77 2e 5f 5f 5f 67 63 66 67 3b 62 3d 67 72 28 22 63 75 22 29 3b 61 3d 77 69 6e 64 6f 77 2e 5f 5f 5f 67 75 3b 64 26 26 64 21 3d 3d 61 26 26 28 6b 72 28 62 2c 64 29 2c 77 69 6e 64 6f 77 2e 5f 5f 5f 67 75 3d 64 29 3b 64 3d 67 72 28 22 63 75 22 29 3b 65 3d 64 6f 63 75 6d 65 6e 74 2e 73 63 72 69 70 74 73 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 7c 7c 5b 5d 3b 61 3d 5b 5d 3b 66 3d 5b 5d 3b 66 2e 70 75 73 68 2e 61 70 70 6c 79 28 66 2c 67 72 28 22 75 73 22 29 29 3b 66 6f 72 28 68 3d 30 3b 68 3c 65 Data Ascii: 1;++e){var h={};d=d[a[e]]=h}d[a[e]]=b}else c=a;_.Qi(!0);d=window.___gcfg;b=gr("cu");a=window.___gu;d&&d!==a&&(kr(b,d),window.___gu=d);d=gr("cu");e=document.scripts\|\|document.getElementsByTagName("script")\|\|[];a=[];f=[];f.push.apply(f,gr("us"));for(h=0;h<e
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 54 6f 6f 6c 62 61 72 41 70 69 2e 70 72 6f 74 6f 74 79 70 65 2c 5f 2e 67 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2c 5f 2e 67 2e 6f 70 65 6e 57 69 6e 64 6f 77 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 70 65 6e 57 69 6e 64 6f 77 2c 5f 2e 67 2e 63 51 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 6f 73 65 57 69 6e 64 6f 77 2c 5f 2e 67 2e 4c 5a 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 4f 6e 43 6c 6f 73 65 48 61 6e 64 6c 65 72 2c 5f 2e 67 2e 4e 50 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 6e 43 6c 6f 73 65 50 6f 70 75 70 2c 5f 2e 67 2e 4c 59 3d 76 72 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 73 69 7a 65 57 69 6e 64 6f 77 3b 65 6c 73 65 7b 76 61 72 20 76 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 76 72 2e 50 61 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: ToolbarApi.prototype,_.g=vr.prototype,_.g.openWindow=vr.prototype.openWindow,_.g.cQ=vr.prototype.closeWindow,_.g.LZ=vr.prototype.setOnCloseHandler,_.g.NP=vr.prototype.canClosePopup,_.g.LY=vr.prototype.resizeWindow;else{var vr=function(){};vr.Pa=function()
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 2c 42 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 4c 61 2e 46 55 2b 2b 3b 72 65 74 75 72 6e 5b 22 49 22 2c 5f 2e 4c 61 2e 46 55 2c 22 5f 22 2c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 5d 2e 6a 6f 69 6e 28 22 22 29 7d 2c 43 72 2c 44 72 2c 45 72 2c 48 72 2c 49 72 2c 4a 72 2c 4b 72 2c 4d 72 2c 4c 72 3b 5f 2e 4c 61 2e 49 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 5f 2e 6d 66 28 29 3b 5f 2e 6f 66 28 5f 2e 48 6d 2c 62 29 3b 5f 2e 6f 66 28 61 2c 62 29 3b 72 65 74 75 72 6e 20 62 7d 3b 0a 43 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 61 2e 6a 6f 69 6e 28 22 2c 22 29 3a 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 3f 5f 2e 4c 67 28 61 29 3a Data Ascii: ,Br=function(){_.La.FU++;return["I",_.La.FU,"_",(new Date).getTime()].join("")},Cr,Dr,Er,Hr,Ir,Jr,Kr,Mr,Lr;_.La.Io=function(a){var b=_.mf();_.of(_.Hm,b);_.of(a,b);return b};Cr=function(a){return a instanceof Array?a.join(","):a instanceof Object?_.Lg(a):
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 5d 3d 61 5b 64 5d 29 2c 30 3d 3d 64 2e 69 6e 64 65 78 4f 66 28 22 66 72 2d 22 29 26 26 28 63 5b 64 2e 73 75 62 73 74 72 69 6e 67 28 33 29 5d 3d 61 5b 64 5d 29 2c 22 23 22 3d 3d 62 5b 64 5d 26 26 28 63 5b 64 5d 3d 61 5b 64 5d 29 3b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 63 29 64 65 6c 65 74 65 20 61 5b 22 66 72 2d 22 2b 65 5d 2c 64 65 6c 65 74 65 20 61 5b 22 23 22 2b 65 5d 2c 64 65 6c 65 74 65 20 61 5b 65 5d 3b 72 65 74 75 72 6e 20 63 7d 3b 0a 4b 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 22 3a 22 3d 3d 61 2e 63 68 61 72 41 74 28 30 29 29 7b 76 61 72 20 62 3d 5f 2e 52 69 28 22 69 66 72 61 6d 65 73 2f 22 2b 61 2e 73 75 62 73 74 72 69 6e 67 28 31 29 29 3b 61 3d 7b 7d 3b 5f 2e 6f 66 28 62 2c 61 29 3b 28 62 3d 61 2e 75 72 6c 29 26 26 28 61 2e 75 72 6c Data Ascii: ]=a[d]),0==d.indexOf("fr-")&&(c[d.substring(3)]=a[d]),"#"==b[d]&&(c[d]=a[d]);for(var e in c)delete a["fr-"+e],delete a["#"+e],delete a[e];return c};Kr=function(a){if(":"==a.charAt(0)){var b=_.Ri("iframes/"+a.substring(1));a={};_.of(b,a);(b=a.url)&&(a.url
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 26 21 5f 2e 4c 61 2e 57 77 5b 62 5d 26 26 5f 2e 4c 61 2e 4c 46 5b 62 5d 29 3f 28 61 2e 4b 46 3d 5b 5d 2c 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 46 44 3d 21 30 3b 66 6f 72 28 76 61 72 20 63 3d 61 2e 4b 46 2e 6c 65 6e 67 74 68 2c 64 3d 30 3b 64 3c 63 3b 2b 2b 64 29 61 2e 4b 46 5b 64 5d 2e 63 61 6c 6c 28 61 29 7d 29 29 3a 61 2e 46 44 3d 21 30 29 7d 2c 4f 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 46 44 3f 62 2e 63 61 6c 6c 28 61 29 3a 61 2e 4b 46 2e 70 75 73 68 28 62 29 7d 3b 4c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4f 72 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 50 72 28 74 68 69 73 2c 61 2c 62 29 7d 29 7d 3b 76 61 72 20 50 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 61 2e Data Ascii: &!_.La.Ww[b]&&_.La.LF[b])?(a.KF=[],b(function(){a.FD=!0;for(var c=a.KF.length,d=0;d<c;++d)a.KF[d].call(a)})):a.FD=!0)},Or=function(a,b){a.FD?b.call(a):a.KF.push(b)};Lr.prototype.mb=function(a,b){Or(this,function(){Pr(this,a,b)})};var Pr=function(a,b,c){a.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49870	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:40 UTC	1064	OUT	GET /subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:41 UTC	2043	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Apr 2024 13:30:41 GMT Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=YnkeQfygHdM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=2rbnv3xY9ig; Domain=.youtube.com; Expires=Tue, 22-Oct-2024 13:30:41 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D; Domain=.youtube.com; Expires=Tue, 22-Oct-2024 13:30:41 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 13:30:41 UTC	2043	IN	Data Raw: 38 63 65 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 59 6f 75 54 75 62 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 2f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 2f 73 75 62 73 63 72 69 62 65 5f 65 6d 62 65 64 2f 63 73 73 2f 77 77 77 2d 73 75 62 73 63 72 69 62 65 2d 65 6d 62 65 64 5f 73 70 6c 69 74 5f 76 30 2e 63 73 73 22 20 6e 61 6d 65 3d 22 77 77 77 2d 73 75 62 73 63 72 69 62 65 2d 65 6d 62 65 64 22 20 6e 6f 6e 63 65 3d 22 75 4d 64 6f 75 47 6d 64 2d 6f 64 4d 73 61 66 78 6d 67 31 48 53 41 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4a 41 4f 6e 4e 5a 47 65 57 37 51 74 6c 4f 58 50 38 50 46 45 54 77 22 3e 69 66 20 28 27 75 6e 64 65 66 69 6e 65 64 27 20 3d 3d 20 Data Ascii: 8ce<html><head><title>YouTube</title><link rel="stylesheet" href="/s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.css" name="www-subscribe-embed" nonce="uMdouGmd-odMsafxmg1HSA"><script nonce="JAOnNZGeW7QtlOXP8PFETw">if ('undefined' ==
2024-04-25 13:30:41 UTC	218	IN	Data Raw: 74 2e 73 65 74 43 6f 6e 66 69 67 28 7b 27 53 55 42 53 43 52 49 42 45 5f 45 4d 42 45 44 5f 48 4f 56 45 52 43 41 52 44 5f 55 52 4c 27 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 5c 2f 73 75 62 73 63 72 69 62 65 5f 65 6d 62 65 64 3f 61 63 74 69 6f 6e 5f 63 61 72 64 5c 78 33 64 31 5c 78 32 36 63 68 61 6e 6e 65 6c 69 64 5c 78 33 64 55 43 58 4c 62 69 75 6d 72 44 7a 50 53 4a 69 6b 49 39 42 49 5a 6a 72 77 5c 78 32 36 75 73 65 67 61 70 69 5c 78 33 64 31 22 7d 29 3b 20 79 74 62 69 6e 2e 77 77 77 2e 73 75 62 73 63 72 69 62 65 65 6d 62 65 64 2e 69 6e 69 74 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 0d 0a Data Ascii: t.setConfig({'SUBSCRIBE_EMBED_HOVERCARD_URL': "https:\/\/www.youtube.com\/subscribe_embed?action_card\x3d1\x26channelid\x3dUCXLbiumrDzPSJikI9BIZjrw\x26usegapi\x3d1"}); ytbin.www.subscribeembed.init();</script></body>
2024-04-25 13:30:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49869	192.229.163.25	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:41 UTC	786	OUT	GET /widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.wisecleaner.com HTTP/1.1 Host: platform.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:41 UTC	627	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * Age: 2701478 Cache-Control: public, max-age=315360000 Content-Type: text/html; charset=utf-8 Date: Thu, 25 Apr 2024 13:30:41 GMT Etag: "81267302efdfb3e4524a22631a8fc99e" Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server: ECS (agb/A435) Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ Vary: Accept-Encoding x-amz-server-side-encryption: AES256 X-Cache: HIT x-tw-cdn: VZ Content-Length: 327164 Connection: close
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 6d 65 74 61 20 63 68 61 72 74 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 54 77 69 74 74 65 72 20 57 69 64 67 65 74 20 49 66 72 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 3c 62 6f 64 79 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 29 7b 46 75 6e 63 74 69 6f 6e 26 26 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 26 26 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 26 26 28 2f 28 4d 53 49 45 20 28 5b 36 37 38 39 5d 7c 31 30 7c 31 31 29 29 7c 54 72 69 64 65 6e 74 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 Data Ascii: <!DOCTYPE HTML><meta chartset="utf-8"><title>Twitter Widget Iframe</title><body><script type="text/javascript">!function(){Function&&Function.prototype&&Function.prototype.bind&&(/(MSIE ([6789]\|10\|11))\|Trident/.test(navigator.userAgent)\|\|function(e){v
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 28 70 2c 47 29 7c 30 2c 69 3d 28 69 3d 69 2b 4d 61 74 68 2e 69 6d 75 6c 28 70 2c 5a 29 7c 30 29 2b 4d 61 74 68 2e 69 6d 75 6c 28 62 2c 47 29 7c 30 2c 6f 3d 6f 2b 4d 61 74 68 2e 69 6d 75 6c 28 62 2c 5a 29 7c 30 3b 76 61 72 20 5f 65 3d 28 63 2b 28 6e 3d 6e 2b 4d 61 74 68 2e 69 6d 75 6c 28 75 2c 51 29 7c 30 29 7c 30 29 2b 28 28 38 31 39 31 26 28 69 3d 28 69 3d 69 2b 4d 61 74 68 2e 69 6d 75 6c 28 75 2c 65 65 29 7c 30 29 2b 4d 61 74 68 2e 69 6d 75 6c 28 64 2c 51 29 7c 30 29 29 3c 3c 31 33 29 7c 30 3b 63 3d 28 28 6f 3d 6f 2b 4d 61 74 68 2e 69 6d 75 6c 28 64 2c 65 65 29 7c 30 29 2b 28 69 3e 3e 3e 31 33 29 7c 30 29 2b 28 5f 65 3e 3e 3e 32 36 29 7c 30 2c 5f 65 26 3d 36 37 31 30 38 38 36 33 2c 6e 3d 4d 61 74 68 2e 69 6d 75 6c 28 6b 2c 7a 29 2c 69 3d 28 69 3d 4d 61 Data Ascii: (p,G)\|0,i=(i=i+Math.imul(p,Z)\|0)+Math.imul(b,G)\|0,o=o+Math.imul(b,Z)\|0;var _e=(c+(n=n+Math.imul(u,Q)\|0)\|0)+((8191&(i=(i=i+Math.imul(u,ee)\|0)+Math.imul(d,Q)\|0))<<13)\|0;c=((o=o+Math.imul(d,ee)\|0)+(i>>>13)\|0)+(_e>>>26)\|0,_e&=67108863,n=Math.imul(k,z),i=(i=Ma
2024-04-25 13:30:41 UTC	2	IN	Data Raw: 3b 30 Data Ascii: ;0
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 21 3d 3d 6e 2e 6e 65 67 61 74 69 76 65 3b 29 64 2d 2d 2c 6e 2e 6e 65 67 61 74 69 76 65 3d 30 2c 6e 2e 5f 69 73 68 6c 6e 73 75 62 6d 75 6c 28 69 2c 31 2c 75 29 2c 6e 2e 69 73 5a 65 72 6f 28 29 7c 7c 28 6e 2e 6e 65 67 61 74 69 76 65 5e 3d 31 29 3b 66 26 26 28 66 2e 77 6f 72 64 73 5b 75 5d 3d 64 29 7d 72 65 74 75 72 6e 20 66 26 26 66 2e 73 74 72 69 70 28 29 2c 6e 2e 73 74 72 69 70 28 29 2c 22 64 69 76 22 21 3d 3d 74 26 26 30 21 3d 3d 72 26 26 6e 2e 69 75 73 68 72 6e 28 72 29 2c 7b 64 69 76 3a 66 7c 7c 6e 75 6c 6c 2c 6d 6f 64 3a 6e 7d 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 64 69 76 6d 6f 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 28 21 65 2e 69 73 5a 65 72 6f 28 29 29 2c 74 68 69 73 2e 69 73 5a 65 72 6f 28 29 3f 7b 64 69 Data Ascii: !==n.negative;)d--,n.negative=0,n._ishlnsubmul(i,1,u),n.isZero()\|\|(n.negative^=1);f&&(f.words[u]=d)}return f&&f.strip(),n.strip(),"div"!==t&&0!==r&&n.iushrn(r),{div:f\|\|null,mod:n}},o.prototype.divmod=function(e,t,r){return n(!e.isZero()),this.isZero()?{di
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 65 6f 66 20 65 29 69 66 28 74 29 7b 69 66 28 22 68 65 78 22 3d 3d 3d 74 29 66 6f 72 28 28 65 3d 65 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 61 2d 7a 30 2d 39 5d 2b 2f 67 69 2c 22 22 29 29 2e 6c 65 6e 67 74 68 25 32 21 3d 30 26 26 28 65 3d 22 30 22 2b 65 29 2c 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 3d 32 29 72 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 65 5b 6e 5d 2b 65 5b 6e 2b 31 5d 2c 31 36 29 29 7d 65 6c 73 65 20 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 6e 29 2c 6f 3d 69 3e 3e 38 2c 61 3d 32 35 35 26 69 3b 6f 3f 72 2e 70 75 73 68 28 6f 2c 61 29 3a 72 2e 70 75 73 68 28 61 29 7d 65 6c 73 65 20 66 6f 72 28 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 Data Ascii: eof e)if(t){if("hex"===t)for((e=e.replace(/[^a-z0-9]+/gi,"")).length%2!=0&&(e="0"+e),n=0;n<e.length;n+=2)r.push(parseInt(e[n]+e[n+1],16))}else for(var n=0;n<e.length;n++){var i=e.charCodeAt(n),o=i>>8,a=255&i;o?r.push(o,a):r.push(a)}else for(n=0;n<e.length
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 74 66 2d 31 36 6c 65 22 3a 72 65 74 75 72 6e 20 32 2a 72 3b 63 61 73 65 22 68 65 78 22 3a 72 65 74 75 72 6e 20 72 3e 3e 3e 31 3b 63 61 73 65 22 62 61 73 65 36 34 22 3a 72 65 74 75 72 6e 20 7a 28 65 29 2e 6c 65 6e 67 74 68 3b 64 65 66 61 75 6c 74 3a 69 66 28 6e 29 72 65 74 75 72 6e 20 71 28 65 29 2e 6c 65 6e 67 74 68 3b 74 3d 28 22 22 2b 74 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 3d 21 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 2c 72 29 7b 76 61 72 20 6e 3d 65 5b 74 5d 3b 65 5b 74 5d 3d 65 5b 72 5d 2c 65 5b 72 5d 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 79 28 65 2c 74 2c 72 2c 6e 2c 69 29 7b 69 66 28 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 2d 31 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 72 3f 28 6e 3d 72 Data Ascii: tf-16le":return 2*r;case"hex":return r>>>1;case"base64":return z(e).length;default:if(n)return q(e).length;t=(""+t).toLowerCase(),n=!0}}function b(e,t,r){var n=e[t];e[t]=e[r],e[r]=n}function y(e,t,r,n,i){if(0===e.length)return-1;if("string"==typeof r?(n=r
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 69 66 28 69 3d 6e 75 6c 6c 2c 72 3c 31 32 38 29 7b 69 66 28 28 74 2d 3d 31 29 3c 30 29 62 72 65 61 6b 3b 6f 2e 70 75 73 68 28 72 29 7d 65 6c 73 65 20 69 66 28 72 3c 32 30 34 38 29 7b 69 66 28 28 74 2d 3d 32 29 3c 30 29 62 72 65 61 6b 3b 6f 2e 70 75 73 68 28 72 3e 3e 36 7c 31 39 32 2c 36 33 26 72 7c 31 32 38 29 7d 65 6c 73 65 20 69 66 28 72 3c 36 35 35 33 36 29 7b 69 66 28 28 74 2d 3d 33 29 3c 30 29 62 72 65 61 6b 3b 6f 2e 70 75 73 68 28 72 3e 3e 31 32 7c 32 32 34 2c 72 3e 3e 36 26 36 33 7c 31 32 38 2c 36 33 26 72 7c 31 32 38 29 7d 65 6c 73 65 7b 69 66 28 21 28 72 3c 31 31 31 34 31 31 32 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 63 6f 64 65 20 70 6f 69 6e 74 22 29 3b 69 66 28 Data Ascii: (239,191,189);if(i=null,r<128){if((t-=1)<0)break;o.push(r)}else if(r<2048){if((t-=2)<0)break;o.push(r>>6\|192,63&r\|128)}else if(r<65536){if((t-=3)<0)break;o.push(r>>12\|224,r>>6&63\|128,63&r\|128)}else{if(!(r<1114112))throw new Error("Invalid code point");if(
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 28 22 6c 69 73 74 65 6e 65 72 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 21 74 68 69 73 2e 5f 65 76 65 6e 74 73 7c 7c 21 74 68 69 73 2e 5f 65 76 65 6e 74 73 5b 65 5d 29 72 65 74 75 72 6e 20 74 68 69 73 3b 69 66 28 61 3d 28 72 3d 74 68 69 73 2e 5f 65 76 65 6e 74 73 5b 65 5d 29 2e 6c 65 6e 67 74 68 2c 6f 3d 2d 31 2c 72 3d 3d 3d 74 7c 7c 6e 28 72 2e 6c 69 73 74 65 6e 65 72 29 26 26 72 2e 6c 69 73 74 65 6e 65 72 3d 3d 3d 74 29 64 65 6c 65 74 65 20 74 68 69 73 2e 5f 65 76 65 6e 74 73 5b 65 5d 2c 74 68 69 73 2e 5f 65 76 65 6e 74 73 2e 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 26 26 74 68 69 73 2e 65 6d 69 74 28 22 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 22 2c 65 2c 74 29 3b 65 6c 73 65 20 69 66 28 69 28 72 29 29 7b 66 6f 72 28 Data Ascii: ("listener must be a function");if(!this._events\|\|!this._events[e])return this;if(a=(r=this._events[e]).length,o=-1,r===t\|\|n(r.listener)&&r.listener===t)delete this._events[e],this._events.removeListener&&this.emit("removeListener",e,t);else if(i(r)){for(
2024-04-25 13:30:41 UTC	16383	IN	Data Raw: 28 31 37 35 29 2c 6e 2e 68 6d 61 63 3d 72 28 31 37 36 29 2c 6e 2e 73 68 61 31 3d 6e 2e 73 68 61 2e 73 68 61 31 2c 6e 2e 73 68 61 32 35 36 3d 6e 2e 73 68 61 2e 73 68 61 32 35 36 2c 6e 2e 73 68 61 32 32 34 3d 6e 2e 73 68 61 2e 73 68 61 32 32 34 2c 6e 2e 73 68 61 33 38 34 3d 6e 2e 73 68 61 2e 73 68 61 33 38 34 2c 6e 2e 73 68 61 35 31 32 3d 6e 2e 73 68 61 2e 73 68 61 35 31 32 2c 6e 2e 72 69 70 65 6d 64 31 36 30 3d 6e 2e 72 69 70 65 6d 64 2e 72 69 70 65 6d 64 31 36 30 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 7b 7d 2e 74 6f 53 74 72 69 6e 67 3b 65 2e 65 78 70 6f 72 74 73 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 72 2e 63 61 Data Ascii: (175),n.hmac=r(176),n.sha1=n.sha.sha1,n.sha256=n.sha.sha256,n.sha224=n.sha.sha224,n.sha384=n.sha.sha384,n.sha512=n.sha.sha512,n.ripemd160=n.ripemd.ripemd160},function(e,t){var r={}.toString;e.exports=Array.isArray\|\|function(e){return"[object Array]"==r.ca
2024-04-25 13:30:41 UTC	6	IN	Data Raw: 74 2c 72 3d 74 68 Data Ascii: t,r=th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49874	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:41 UTC	1084	OUT	GET /s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:41 UTC	660	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/css Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 39210 Date: Thu, 25 Apr 2024 13:30:41 GMT Expires: Fri, 25 Apr 2025 13:30:41 GMT Cache-Control: public, max-age=31536000 Last-Modified: Sun, 25 Jun 2023 02:58:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:41 UTC	595	IN	Data Raw: 62 6f 64 79 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 73 74 61 72 74 7d 6d 65 6e 75 2c 6f 6c 2c 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 62 6c 6f 63 6b 71 75 6f 74 65 2c 71 7b 71 75 6f 74 65 73 3a 6e 6f 6e 65 7d 62 6c 6f 63 6b 71 75 6f 74 65 3a 62 65 66 6f 72 65 2c 62 6c 6f 63 6b 71 75 6f 74 65 3a 61 66 74 65 72 2c 71 3a 62 65 66 6f 72 65 2c 71 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 27 27 3b 63 6f 6e 74 65 6e 74 3a 6e 6f 6e 65 7d 69 6e 73 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 64 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6c 69 6e 65 2d 74 68 72 6f 75 67 68 7d 74 61 62 6c 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6c Data Ascii: body{line-height:1;text-align:left;text-align:start}menu,ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:before,blockquote:after,q:before,q:after{content:'';content:none}ins{text-decoration:none}del{text-decoration:line-through}table{border-coll
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 3b 62 6f 72 64 65 72 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 68 72 2c 68 74 6d 6c 2c 69 2c 69 66 72 61 6d 65 2c 69 6d 67 2c 69 6e 73 2c 6b 62 64 2c 6c 61 62 65 6c 2c 6c 65 67 65 6e 64 2c 6c 69 2c 6d 65 6e 75 2c 6f 62 6a 65 63 74 2c 6f 6c 2c 70 2c 70 72 65 2c 71 2c 73 2c 73 61 6d 70 2c 73 6d 61 6c 6c 2c 73 70 61 6e 2c 73 74 72 69 6b 65 2c 73 74 72 6f 6e 67 2c 73 75 62 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 66 6f 6e 74 2d 73 Data Ascii: ;border:0;font-size:100%;background:transparent}h1,h2,h3,h4,h5,h6{margin:0;padding:0;border:0;background:transparent}hr,html,i,iframe,img,ins,kbd,label,legend,li,menu,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub{margin:0;padding:0;border:0;font-s
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 69 67 68 74 3a 35 30 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 70 78 7d 2e 66 75 6c 6c 20 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 73 75 62 73 63 72 69 70 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 70 78 7d 2e 64 61 72 6b 20 2e 79 74 2d 75 73 65 72 6e 61 6d 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 79 74 2d 65 72 72 6f 72 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 79 74 2d 65 72 72 6f 72 2d 69 63 6f 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 62 6f 72 64 65 72 3a 31 Data Ascii: ight:500;white-space:nowrap;margin-left:58px}.full .yt-uix-button-subscription-container{margin-left:58px}.dark .yt-username{color:#fff}.yt-error{line-height:21px;overflow:hidden;white-space:nowrap}.yt-error-icon{float:left;width:20px;height:20px;border:1
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6d 62 2d 72 65 6c 61 74 65 64 2d 70 6c 61 79 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 36 33 2e 33 33 33 33 33 33 25 7d 2e 79 74 2d 74 68 75 6d 62 2d 64 65 66 61 75 6c 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 36 2e 32 35 25 7d 2e 79 74 2d 70 6c 2d 74 68 75 6d 62 20 2e 79 74 2d 74 68 75 6d 62 2d 34 33 20 2e 79 74 2d 74 68 75 6d 62 2d 64 65 66 61 75 6c 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 36 2e 35 31 31 36 32 38 25 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 30 7b 77 69 64 74 68 3a 31 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 38 7b 77 69 64 74 68 3a 31 38 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 32 30 7b 77 69 64 74 68 3a 32 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 32 33 7b 77 69 64 74 68 3a 32 33 70 78 7d 2e 79 74 Data Ascii: mb-related-playlist{padding-bottom:63.333333%}.yt-thumb-default{padding-bottom:56.25%}.yt-pl-thumb .yt-thumb-43 .yt-thumb-default{padding-bottom:46.511628%}.yt-thumb-10{width:10px}.yt-thumb-18{width:18px}.yt-thumb-20{width:20px}.yt-thumb-23{width:23px}.yt
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 34 31 7b 77 69 64 74 68 3a 31 34 31 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 34 35 7b 77 69 64 74 68 3a 31 34 35 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 35 30 7b 77 69 64 74 68 3a 31 35 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 35 32 7b 77 69 64 74 68 3a 31 35 32 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 35 34 7b 77 69 64 74 68 3a 31 35 34 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 30 7b 77 69 64 74 68 3a 31 36 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 32 7b 77 69 64 74 68 3a 31 36 32 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 35 7b 77 69 64 74 68 3a 31 36 35 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 37 7b 77 69 64 74 68 3a 31 36 37 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 39 7b 77 69 64 74 68 3a 31 36 39 70 78 7d 2e 79 74 2d 74 68 Data Ascii: 41{width:141px}.yt-thumb-145{width:145px}.yt-thumb-150{width:150px}.yt-thumb-152{width:152px}.yt-thumb-154{width:154px}.yt-thumb-160{width:160px}.yt-thumb-162{width:162px}.yt-thumb-165{width:165px}.yt-thumb-167{width:167px}.yt-thumb-169{width:169px}.yt-th
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2d 77 72 61 70 20 2e 6d 6f 75 73 65 6f 76 65 72 2d 70 6c 61 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2d 77 72 61 70 3a 68 6f 76 65 72 20 2e 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2c 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2d 77 72 61 70 20 2e 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 3a 66 6f 63 75 73 2c 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 Data Ascii: p-mouseover-img .yt-uix-mouseover-img-wrap .mouseover-play{display:none;opacity:0;position:absolute}.exp-mouseover-img .yt-uix-mouseover-img-wrap:hover .mouseover-img,.exp-mouseover-img .yt-uix-mouseover-img-wrap .mouseover-img:focus,.exp-mouseover-img .y
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 65 72 20 2e 76 69 64 65 6f 2d 74 69 6d 65 2d 6f 76 65 72 6c 61 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 63 6f 6e 74 61 69 6e 73 2d 61 64 64 74 6f 3a 68 6f 76 65 72 20 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 2c 2e 75 78 2d 74 68 75 6d 62 2d 77 72 61 70 3a 68 6f 76 65 72 20 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 2c 61 3a 68 6f 76 65 72 20 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 2c 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 3a 66 6f 63 75 73 2c 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 61 63 74 69 76 65 7b 72 69 67 68 74 3a 32 70 78 7d 2e 76 69 64 65 6f 2d 6c 69 73 74 2d 69 74 65 6d 20 2e 75 78 2d 74 68 75 6d 62 2d 77 72 61 70 2c 2e 76 69 64 65 6f 2d 6c 69 73 74 2d 69 74 65 6d 20 2e 79 74 2d 70 6c 2d Data Ascii: er .video-time-overlay{display:none}.contains-addto:hover .video-actions,.ux-thumb-wrap:hover .video-actions,a:hover .video-actions,.video-actions:focus,.video-actions.yt-uix-button-active{right:2px}.video-list-item .ux-thumb-wrap,.video-list-item .yt-pl-
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 72 65 73 75 6d 65 2d 70 6c 61 79 62 61 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 65 65 3b 6f 70 61 63 69 74 79 3a 2e 36 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 72 65 73 75 6d 65 2d 70 6c 61 79 62 61 63 6b 2d 70 72 6f 67 72 65 73 73 2d 62 61 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 36 32 31 31 37 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 76 69 64 65 6f 2d 74 69 6d 65 2d 6f 76 65 72 6c 61 79 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 68 65 69 67 68 74 3a 31 34 Data Ascii: osition:absolute}.resume-playback-background{background:#eee;opacity:.6;width:100%}.resume-playback-progress-bar{background:#e62117;opacity:1}.video-time-overlay{margin-top:0;margin-right:0;padding:0 4px;font-weight:500;font-size:11px;color:#fff;height:14
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 64 65 72 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 3a 68 6f 76 65 72 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 3a 61 63 74 69 76 65 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 3a 66 6f 63 75 73 7b 6f 70 61 63 69 74 79 3a 2e 35 3b 66 69 6c 74 65 72 3a 61 6c 70 68 61 28 6f 70 61 63 69 74 79 3d 35 30 29 3b 63 75 72 73 6f 72 3a 61 75 74 6f 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 7d 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 20 69 6d 67 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 68 61 73 2d 69 63 6f 6e 2e 6e 6f 2d 69 63 6f 6e 2d 6d 61 72 6b 75 Data Ascii: der:0;padding:0}.yt-uix-button[disabled],.yt-uix-button[disabled]:hover,.yt-uix-button[disabled]:active,.yt-uix-button[disabled]:focus{opacity:.5;filter:alpha(opacity=50);cursor:auto;box-shadow:none}.yt-uix-button img,.yt-uix-button-has-icon.no-icon-marku
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 7a 65 3a 31 35 70 78 7d 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 3a 68 6f 76 65 72 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 74 65 78 74 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 63 36 63 36 63 36 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 30 66 30 66 30 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 30 29 7d 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 3a 61 63 74 69 76 65 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 74 6f 67 67 6c 65 64 2c 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 2e 79 74 2d 75 69 78 2d 62 75 74 74 6f 6e 2d 61 63 74 69 Data Ascii: ze:15px}.yt-uix-button-default:hover,.yt-uix-button-text:hover{border-color:#c6c6c6;background:#f0f0f0;box-shadow:0 1px 0 rgba(0,0,0,0.10)}.yt-uix-button-default:active,.yt-uix-button-default.yt-uix-button-toggled,.yt-uix-button-default.yt-uix-button-acti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49875	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:41 UTC	1062	OUT	GET /s/subscriptions/subscribe_embed/js/www-subscribe-embed_v0.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/subscribe_embed?usegapi=1&channel=wisecleanervideo&layout=default&count=default&origin=https%3A%2F%2Fwww.wisecleaner.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:41 UTC	668	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 258173 Date: Thu, 25 Apr 2024 13:30:41 GMT Expires: Fri, 25 Apr 2025 13:30:41 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 15 Sep 2020 21:45:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:41 UTC	587	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 2f 2a 0a 0a 20 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 20 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 20 20 2a 2f 0a 76 61 72 20 6d 3b 0a 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 20 7b 0a 20 20 76 61 72 20 62 20 3d 20 30 3b 0a 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 62 20 3c 20 61 2e 6c 65 6e 67 74 68 20 3f 20 7b 64 6f 6e 65 3a 20 21 31 2c 20 76 61 6c 75 65 3a 20 61 5b 62 2b 2b 5d 7d 20 3a 20 7b 64 6f 6e 65 3a 20 21 30 7d 0a 20 20 7d 0a 7d 0a 76 61 72 20 62 61 20 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 3d Data Ascii: (function() { /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */var m;function aa(a) { var b = 0; return function() { return b < a.length ? {done: !1, value: a[b++]} : {done: !0} }}var ba = 'function' =
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 6f 66 20 73 65 6c 66 20 26 26 20 73 65 6c 66 2c 0a 20 20 20 20 27 6f 62 6a 65 63 74 27 20 3d 3d 20 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 20 26 26 20 67 6c 6f 62 61 6c 0a 20 20 5d 3b 0a 20 20 66 6f 72 20 28 76 61 72 20 62 20 3d 20 30 3b 20 62 20 3c 20 61 2e 6c 65 6e 67 74 68 3b 20 2b 2b 62 29 20 7b 0a 20 20 20 20 76 61 72 20 63 20 3d 20 61 5b 62 5d 3b 0a 20 20 20 20 69 66 20 28 63 20 26 26 20 63 2e 4d 61 74 68 20 3d 3d 20 4d 61 74 68 29 20 72 65 74 75 72 6e 20 63 0a 20 20 7d 0a 20 20 74 68 72 6f 77 20 45 72 72 6f 72 28 27 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 27 29 3b 0a 7d 0a 76 61 72 20 64 61 20 3d 20 63 61 28 74 68 69 73 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 72 28 61 2c 20 62 29 20 7b 0a 20 20 69 66 20 28 62 29 0a 20 Data Ascii: of self && self, 'object' == typeof global && global ]; for (var b = 0; b < a.length; ++b) { var c = a[b]; if (c && c.Math == Math) return c } throw Error('Cannot find global object');}var da = ca(this);function r(a, b) { if (b)
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 20 63 20 3c 20 62 2e 6c 65 6e 67 74 68 3b 20 63 2b 2b 29 20 7b 0a 20 20 20 20 76 61 72 20 64 20 3d 20 64 61 5b 62 5b 63 5d 5d 3b 0a 20 20 20 20 27 66 75 6e 63 74 69 6f 6e 27 20 3d 3d 3d 20 74 79 70 65 6f 66 20 64 20 26 26 20 27 66 75 6e 63 74 69 6f 6e 27 20 21 3d 20 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 20 26 26 0a 20 20 20 20 20 20 20 20 62 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 20 61 2c 20 7b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 20 21 30 2c 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 61 62 6c 65 3a 20 21 30 2c 0a 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 61 28 61 61 28 74 68 69 73 29 Data Ascii: c < b.length; c++) { var d = da[b[c]]; 'function' === typeof d && 'function' != typeof d.prototype[a] && ba(d.prototype, a, { configurable: !0, writable: !0, value: function() { return ea(aa(this)
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 29 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 61 70 70 6c 79 2e 63 61 6c 6c 28 63 2c 20 65 2c 20 64 29 20 7c 7c 20 65 0a 20 20 7d 0a 7d 28 29 2c 20 6a 61 3b 0a 69 66 20 28 27 66 75 6e 63 74 69 6f 6e 27 20 3d 3d 20 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 29 0a 20 20 6a 61 20 3d 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 0a 65 6c 73 65 20 7b 0a 20 20 76 61 72 20 6b 61 3b 0a 20 20 61 3a 20 7b 0a 20 20 20 20 76 61 72 20 6c 61 20 3d 20 7b 61 3a 20 21 30 7d 2c 20 6d 61 20 3d 20 7b 7d 3b 20 74 72 79 20 7b 0a 20 20 20 20 20 20 6d 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 20 3d 20 6c 61 3b 0a 20 20 20 20 20 20 6b 61 20 3d Data Ascii: .prototype); return Function.prototype.apply.call(c, e, d) \|\| e }}(), ja;if ('function' == typeof Object.setPrototypeOf) ja = Object.setPrototypeOf;else { var ka; a: { var la = {a: !0}, ma = {}; try { ma.__proto__ = la; ka =
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 61 28 61 2c 20 62 2c 20 63 29 20 7b 0a 20 20 61 2e 66 20 3d 20 63 3b 0a 20 20 72 65 74 75 72 6e 20 7b 0a 20 20 20 20 76 61 6c 75 65 3a 20 62 0a 20 20 7d 0a 7d 0a 71 61 2e 70 72 6f 74 6f 74 79 70 65 2e 4f 20 3d 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0a 20 20 74 68 69 73 2e 66 20 3d 20 61 0a 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 20 7b 0a 20 20 74 68 69 73 2e 66 20 3d 20 6e 65 77 20 71 61 3b 0a 20 20 74 68 69 73 2e 67 20 3d 20 61 0a 7d 0a 66 75 6e 63 74 69 6f 6e 20 76 61 28 61 2c 20 62 29 20 7b 0a 20 20 72 61 28 61 2e 66 29 3b 0a 20 20 76 61 72 20 63 20 3d 20 61 2e 66 2e 6c 3b 0a 20 20 69 66 20 28 63 29 0a 20 20 20 20 72 65 74 75 72 6e 20 77 61 28 61 2c 20 27 72 65 74 75 72 6e 27 20 69 6e 20 63 20 3f 20 Data Ascii: };function ta(a, b, c) { a.f = c; return { value: b }}qa.prototype.O = function(a) { this.f = a};function ua(a) { this.f = new qa; this.g = a}function va(a, b) { ra(a.f); var c = a.f.l; if (c) return wa(a, 'return' in c ?
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 0a 20 20 20 20 72 65 74 75 72 6e 20 62 0a 20 20 7d 3b 0a 20 20 74 68 69 73 5b 27 74 68 72 6f 77 27 5d 20 3d 20 66 75 6e 63 74 69 6f 6e 28 62 29 20 7b 0a 20 20 20 20 72 61 28 61 2e 66 29 3b 0a 20 20 20 20 61 2e 66 2e 6c 20 3f 20 62 20 3d 20 77 61 28 61 2c 20 61 2e 66 2e 6c 5b 27 74 68 72 6f 77 27 5d 2c 20 62 2c 20 61 2e 66 2e 46 29 20 3a 20 28 73 61 28 61 2e 66 2c 20 62 29 2c 20 62 20 3d 20 78 61 28 61 29 29 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 62 0a 20 20 7d 3b 0a 20 20 74 68 69 73 5b 27 72 65 74 75 72 6e 27 5d 20 3d 20 66 75 6e 63 74 69 6f 6e 28 62 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 76 61 28 61 2c 20 62 29 0a 20 20 7d 3b 0a 20 20 74 68 69 73 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 Data Ascii: return b }; this['throw'] = function(b) { ra(a.f); a.f.l ? b = wa(a, a.f.l['throw'], b, a.f.F) : (sa(a.f, b), b = xa(a)); return b }; this['return'] = function(b) { return va(a, b) }; this[Symbol.iterator] = function() {
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 20 66 6f 72 20 28 76 61 72 20 65 20 3d 20 4d 61 74 68 2e 6d 61 78 28 30 2c 20 4d 61 74 68 2e 6d 69 6e 28 63 20 7c 20 30 2c 20 64 2e 6c 65 6e 67 74 68 29 29 2c 20 66 20 3d 20 62 2e 6c 65 6e 67 74 68 3b 0a 20 20 20 20 20 20 20 20 20 30 20 3c 20 66 20 26 26 20 30 20 3c 20 65 3b 29 0a 20 20 20 20 20 20 69 66 20 28 64 5b 2d 2d 65 5d 20 21 3d 20 62 5b 2d 2d 66 5d 29 20 72 65 74 75 72 6e 20 21 31 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 30 20 3e 3d 20 66 0a 20 20 7d 0a 7d 29 3b 0a 72 28 27 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 27 2c 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0a 20 20 72 65 74 75 72 6e 20 61 20 3f 20 61 20 3a 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 29 20 7b 0a 20 20 20 20 76 61 72 20 64 20 3d 20 41 61 28 Data Ascii: for (var e = Math.max(0, Math.min(c \| 0, d.length)), f = b.length; 0 < f && 0 < e;) if (d[--e] != b[--f]) return !1; return 0 >= f }});r('String.prototype.startsWith', function(a) { return a ? a : function(b, c) { var d = Aa(
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 65 74 75 72 6e 20 61 3b 0a 20 20 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 69 66 20 28 6e 75 6c 6c 20 3d 3d 20 74 68 69 73 2e 66 29 20 7b 0a 20 20 20 20 20 20 74 68 69 73 2e 66 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 76 61 72 20 68 20 3d 20 74 68 69 73 3b 0a 20 20 20 20 20 20 74 68 69 73 2e 69 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 68 2e 6f 28 29 0a 20 20 20 20 20 20 7d 29 0a 20 20 20 20 7d 0a 20 20 20 20 74 68 69 73 2e 66 2e 70 75 73 68 28 67 29 0a 20 20 7d 3b 0a 20 20 76 61 72 20 65 20 3d 20 64 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 0a 20 20 63 2e 70 72 6f 74 6f 74 79 70 65 2e 69 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 65 28 67 2c 20 30 29 0a 20 Data Ascii: eturn a; c.prototype.g = function(g) { if (null == this.f) { this.f = []; var h = this; this.i(function() { h.o() }) } this.f.push(g) }; var e = da.setTimeout; c.prototype.i = function(g) { e(g, 0)
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 68 20 3f 20 74 68 69 73 2e 4a 28 67 29 20 3a 20 74 68 69 73 2e 41 28 67 29 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4a 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 76 61 72 20 68 20 3d 20 76 6f 69 64 20 30 3b 0a 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 68 20 3d 20 67 2e 74 68 65 6e 0a 20 20 20 20 7d 20 63 61 74 63 68 20 28 6b 29 20 7b 0a 20 20 20 20 20 20 74 68 69 73 2e 6f 28 6b 29 3b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 0a 20 20 20 20 7d 0a 20 20 20 20 27 66 75 6e 63 74 69 6f 6e 27 20 3d 3d 20 74 79 70 65 6f 66 20 68 20 3f 20 74 68 69 73 2e 6a 61 28 68 2c 20 67 29 20 3a 20 74 68 69 73 2e 41 28 67 29 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6f Data Ascii: } h ? this.J(g) : this.A(g) } }; b.prototype.J = function(g) { var h = void 0; try { h = g.then } catch (k) { this.o(k); return } 'function' == typeof h ? this.ja(h, g) : this.A(g) }; b.prototype.o
2024-04-25 13:30:41 UTC	1255	IN	Data Raw: 20 71 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 20 3d 20 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 74 68 69 73 2e 64 61 28 6b 28 67 2c 20 6c 29 2c 20 6b 28 68 2c 20 6e 29 29 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 70 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 5b 27 63 61 74 63 68 27 5d 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 20 67 29 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 64 61 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 2c 20 68 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 73 77 69 74 63 68 20 28 6c 2e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 63 61 Data Ascii: q; n = t }); this.da(k(g, l), k(h, n)); return p }; b.prototype['catch'] = function(g) { return this.then(void 0, g) }; b.prototype.da = function(g, h) { function k() { switch (l.g) { ca

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49878	104.244.42.136	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	620	OUT	GET /settings?session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1 Host: syndication.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://platform.twitter.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://platform.twitter.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:42 UTC	567	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 13:30:41 GMT perf: 7402827104 vary: Origin server: tsa_b content-type: application/json; charset=utf-8 cache-control: must-revalidate, max-age=600 last-modified: Thu, 25 Apr 2024 13:30:42 GMT content-length: 930 x-transaction-id: 18456d129e10b83d strict-transport-security: max-age=631138519 access-control-allow-origin: https://platform.twitter.com access-control-allow-credentials: true x-response-time: 7 x-connection-hash: 85705d966c9c17708dcd5cc38afed7e2b0eebe2f3c6f3ccd9c1e093f7771b01d connection: close
2024-04-25 13:30:42 UTC	930	IN	Data Raw: 7b 22 73 68 6f 75 6c 64 5f 6f 62 74 61 69 6e 5f 63 6f 6f 6b 69 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 73 22 3a 7b 22 74 66 77 5f 74 69 6d 65 6c 69 6e 65 5f 6c 69 73 74 22 3a 7b 22 62 75 63 6b 65 74 22 3a 5b 5d 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 66 6f 6c 6c 6f 77 65 72 5f 63 6f 75 6e 74 5f 73 75 6e 73 65 74 22 3a 7b 22 62 75 63 6b 65 74 22 3a 74 72 75 65 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 74 77 65 65 74 5f 65 64 69 74 5f 62 61 63 6b 65 6e 64 22 3a 7b 22 62 75 63 6b 65 74 22 3a 22 6f 6e 22 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 72 65 66 73 72 63 5f 73 65 73 73 69 6f 6e 22 3a 7b 22 62 75 63 6b 65 74 22 3a 22 6f 6e 22 2c 22 76 65 72 73 Data Ascii: {"should_obtain_cookie_consent":false,"features":{"tfw_timeline_list":{"bucket":[],"version":null},"tfw_follower_count_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_backend":{"bucket":"on","version":null},"tfw_refsrc_session":{"bucket":"on","vers

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49879	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	916	OUT	GET /s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube.com/s/subscriptions/subscribe_embed/css/www-subscribe-embed_split_v0.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:42 UTC	648	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 156 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 25 Apr 2024 05:58:36 GMT Expires: Fri, 25 Apr 2025 05:58:36 GMT Cache-Control: public, max-age=31536000 Last-Modified: Fri, 18 Sep 2020 20:15:00 GMT Content-Type: image/png Age: 27126 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:42 UTC	156	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 0c 08 06 00 00 00 6b e7 3d 81 00 00 00 63 49 44 41 54 78 01 63 f8 ff ff bf 27 10 3f fb 4f 22 80 ea f1 64 20 4f 33 c2 10 86 ff 14 02 9c 06 3c 95 14 ff ff f3 e0 1e f2 0d 78 c2 c1 f1 ff a9 84 e0 ff ef 1b 57 90 67 c0 33 90 01 cc 0c ff 9f 71 32 fc ff 90 9f 4c a9 01 49 14 78 61 c3 72 5a 07 22 85 80 d2 84 f4 1c 64 80 17 88 41 86 e6 27 20 bd 00 d4 5b dc 8c 6f 9e e4 5a 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRk=cIDATxc'?O"d O3<xWg3q2LIxarZ"dA' [oZIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49882	173.194.219.113	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	650	OUT	GET /js/rpc:shindig_random.js?onload=init HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:42 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 15119 Date: Thu, 25 Apr 2024 13:30:42 GMT Expires: Thu, 25 Apr 2024 13:30:42 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "9b77125b6924cb07" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:42 UTC	418	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e Data Ascii: (function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof win
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 7d 2c 63 61 3d 62 61 28 74 68 69 73 29 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 63 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 0a 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 61 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: d global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 6d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 6e 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2c 64 61 3d 30 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 79 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 78 21 3d 3d 78 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 53 61 66 65 55 72 6c 20 69 73 20 6e 6f 74 20 6d 65 61 6e 74 20 74 6f 20 62 65 20 62 75 69 6c 74 20 64 69 72 65 63 74 6c 79 22 29 3b 74 68 69 73 2e 76 3d 61 7d 3b 79 Data Ascii: ght The Closure Library Authors. SPDX-License-Identifier: Apache-2.0/var m=this\|\|self,n="closure_uid_"+(1E9Math.random()>>>0),da=0,r=function(a){return a};var y=function(a){if(x!==x)throw Error("SafeUrl is not meant to be built directly");this.v=a};y
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 2c 6d 61 3d 2f 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 2f 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 5b 62 5d 3d 61 5b 62 5d 7c 7c 63 7d 2c 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 6f 72 74 28 29 3b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2c 63 3d 76 6f 69 64 20 30 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 65 21 3d 63 26 26 62 2e 70 75 73 68 28 65 29 3b 63 3d 65 7d 72 65 74 75 72 6e 20 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3b 69 66 28 28 61 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 29 26 26 6d 61 2e 74 65 73 74 28 61 29 29 61 3d 61 28 6e 75 6c 6c 29 3b 65 6c 73 65 7b 61 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 Data Ascii: ,ma=/\[native code\]/,H=function(a,b,c){return a[b]=a[b]\|\|c},na=function(a){a=a.sort();for(var b=[],c=void 0,d=0;d<a.length;d++){var e=a[d];e!=c&&b.push(e);c=e}return b},I=function(){var a;if((a=Object.create)&&ma.test(a))a=a(null);else{a={};for(var b in
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 3b 7d 3b 55 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 63 3f 4b 5b 62 5d 3d 48 28 4b 2c 62 2c 5b 5d 29 2e 63 6f 6e 63 61 74 28 63 29 3a 48 28 4b 2c 62 2c 63 29 7d 69 66 28 62 3d 61 2e 75 29 61 3d 48 28 4b 2c 22 75 73 22 2c 5b 5d 29 2c 61 2e 70 75 73 68 28 62 29 2c 28 62 3d 2f 5e 68 74 74 70 73 3a 28 2e 2a 29 24 2f 2e 65 78 65 63 28 62 29 29 26 26 61 2e 70 75 73 68 28 22 68 74 74 70 3a 22 2b 62 5b 31 5d 29 7d 5d 29 3b 76 61 72 20 76 61 3d 2f 5e 28 5c 2f 5b 61 2d Data Ascii: ;};U.push(["jsl",function(a){for(var b in a)if(Object.prototype.hasOwnProperty.call(a,b)){var c=a[b];"object"==typeof c?K[b]=H(K,b,[]).concat(c):H(K,b,c)}if(b=a.u)a=H(K,"us",[]),a.push(b),(b=/^https:(.*)$/.exec(b))&&a.push("http:"+b[1])}]);var va=/^(\/[a-
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 29 7d 2c 45 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 2f 22 21 3d 3d 61 2e 63 68 61 72 41 74 28 30 29 26 26 56 28 22 72 65 6c 61 74 69 76 65 20 70 61 74 68 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 61 2e 73 75 62 73 74 72 69 6e Data Ascii: ,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join("")},Ea=function(a){"/"!==a.charAt(0)&&V("relative path");for(var b=a.substrin
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 5f 30 2d 39 5c 2f 41 2d 5a 61 2d 7a 5d 2b 3d 7b 30 2c 32 7d 24 2f 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 5b 5d 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 30 3e 66 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 4a 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4b 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 61 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 48 61 29 3f 61 3a 4b 2e 6e Data Ascii: _0-9\/A-Za-z]+={0,2}$/,Ia=function(a,b){for(var c=[],d=0;d<a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=0>f}f&&c.push(e)}return c},Ja=function(){var a=K.nonce;return void 0!==a?a&&a===String(a)&&a.match(Ha)?a:K.n
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 3a 20 21 68 69 6e 74 22 29 3b 4f 61 28 62 7c 7c 5b 5d 2c 63 2c 61 29 7d 2c 4f 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 21 21 4b 2e 67 6c 72 70 3b 61 3d 6e 61 28 61 29 7c 7c 5b 5d 3b 76 61 72 20 65 3d 62 2e 63 61 6c 6c 62 61 63 6b 2c 66 3d 62 2e 63 6f 6e 66 69 67 2c 6b 3d 62 2e 74 69 6d 65 6f 75 74 2c 74 3d 62 2e 6f 6e 74 69 6d 65 6f 75 74 2c 6c 3d 62 2e 6f 6e 65 72 72 6f 72 2c 70 3d 76 6f 69 64 20 30 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6c 26 26 28 70 3d 6c 29 3b 76 61 72 20 7a 3d 6e 75 6c 6c 2c 52 3d 21 31 3b 69 66 28 6b 26 26 21 74 7c 7c 21 6b 26 26 74 29 74 68 72 6f 77 22 54 69 6d 65 6f 75 74 20 72 65 71 75 69 72 65 73 20 62 6f 74 68 20 74 68 65 20 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 Data Ascii: : !hint");Oa(b\|\|[],c,a)},Oa=function(a,b,c){var d=!!K.glrp;a=na(a)\|\|[];var e=b.callback,f=b.config,k=b.timeout,t=b.ontimeout,l=b.onerror,p=void 0;"function"==typeof l&&(p=l);var z=null,R=!1;if(k&&!t\|\|!k&&t)throw"Timeout requires both the timeout parameter
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 61 2e 6d 65 73 73 61 67 65 29 7d 51 61 3d 52 61 3b 76 61 72 20 59 3d 51 61 3b 76 61 72 20 4d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 4b 2e 68 65 65 26 26 30 3c 4b 2e 68 65 6c 29 74 72 79 7b 72 65 74 75 72 6e 20 61 28 29 7d 63 61 74 63 68 28 63 29 7b 62 26 26 62 28 63 29 2c 4b 2e 68 65 6c 2d 2d 2c 50 61 28 22 64 65 62 75 67 5f 65 72 72 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 77 69 6e 64 6f 77 2e 5f 5f 5f 6a 73 6c 2e 68 65 66 6e 28 63 29 7d 63 61 74 63 68 28 64 29 7b 74 68 72 6f 77 20 63 3b 7d 7d 29 7d 65 6c 73 65 20 74 72 79 7b 72 65 74 75 72 6e 20 61 28 29 7d 63 61 74 63 68 28 63 29 7b 74 68 72 6f 77 20 62 26 26 62 28 63 29 2c 63 3b 7d 7d 3b 76 61 72 20 53 61 3d 4a 2e 6c 6f 61 64 3b 53 61 26 26 48 28 4b 2c 22 6f 6c 22 2c Data Ascii: a.message)}Qa=Ra;var Y=Qa;var Ma=function(a,b){if(K.hee&&0<K.hel)try{return a()}catch(c){b&&b(c),K.hel--,Pa("debug_error",function(){try{window.___jsl.hefn(c)}catch(d){throw c;}})}else try{return a()}catch(c){throw b&&b(c),c;}};var Sa=J.load;Sa&&H(K,"ol",
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 3a 7b 63 73 73 3a 31 7d 2c 0a 64 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 43 61 6c 6c 62 61 63 6b 3a 21 31 2c 64 72 69 76 65 5f 73 68 61 72 65 3a 7b 73 6b 69 70 49 6e 69 74 43 6f 6d 6d 61 6e 64 3a 21 30 7d 2c 63 73 69 3a 7b 72 61 74 65 3a 2e 30 31 7d 2c 63 6c 69 65 6e 74 3a 7b 63 6f 72 73 3a 21 31 7d 2c 73 69 67 6e 49 6e 44 65 70 72 65 63 61 74 69 6f 6e 3a 7b 72 61 74 65 3a 30 7d 2c 69 6e 63 6c 75 64 65 5f 67 72 61 6e 74 65 64 5f 73 63 6f 70 65 73 3a 21 30 2c 6c 6c 61 6e 67 3a 22 65 6e 22 2c 69 66 72 61 6d 65 73 3a 7b 79 6f 75 74 75 62 65 3a 7b 70 61 72 61 6d 73 3a 7b 6c 6f 63 61 74 69 6f 6e 3a 5b 22 73 65 61 72 63 68 22 2c 22 68 61 73 68 22 5d 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f Data Ascii: :{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49881	173.194.219.113	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	782	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:42 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 136969 Date: Thu, 25 Apr 2024 13:30:42 GMT Expires: Fri, 25 Apr 2025 13:30:42 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 18:15:45 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:42 UTC	352	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 Data Ascii: on"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typ
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 Data Ascii: d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="undefined"!=type
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d Data Ascii: [];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 75 72 6e 21 30 3b 22 66 75 6e 63 74 69 Data Ascii: nction(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)return!0;"functi
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 28 5b 5d 29 3a 6e 65 77 20 65 28 66 75 Data Ascii: e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c([]):new e(fu
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 Data Ascii: n!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExt
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d 2e 6e 66 3d 7b 6e 65 78 74 3a 74 68 69 Data Ascii: p,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m.nf={next:thi
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 Data Ascii: =""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(function(){if(
2024-04-25 13:30:42 UTC	1255	IN	Data Raw: 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d 0a 5f 2e 75 61 28 63 29 3b 66 6f 72 28 Data Ascii: .entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=_.ua(c);for(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49884	151.101.12.157	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	568	OUT	GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1 Host: platform.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:42 UTC	619	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7884 Last-Modified: Mon, 11 Dec 2023 17:19:47 GMT ETag: "fdf02dd038ed38dbf3c240d56262af0c" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=315360000 Content-Type: application/javascript; charset=utf-8 Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Accept-Ranges: bytes Date: Thu, 25 Apr 2024 13:30:42 GMT X-Served-By: cache-iad-kjyo7100074-IAD, cache-pdk-katl1840035-PDK X-Cache: HIT, HIT Vary: Accept-Encoding TW-CDN: FT
2024-04-25 13:30:42 UTC	1379	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 72 6c 6c 3d 77 69 6e 64 6f 77 2e 5f 5f 74 77 74 74 72 6c 6c 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 7b 31 36 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 33 39 29 2c 61 3d 6e 28 31 36 32 29 2c 73 3d 6e 28 37 29 3b 28 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 72 29 29 2e 62 75 69 6c 64 3d 73 28 72 2e 62 75 69 6c 64 2c 6e 75 6c 6c 2c 61 29 2c 74 2e 65 78 70 6f 72 74 73 3d 72 7d 2c 31 36 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 37 31 29 2c 61 3d 6e 28 33 37 29 2c 73 3d 6e 28 33 34 29 2c 69 3d 6e 28 33 38 29 2c 6f 3d 6e 28 30 29 2c 75 3d 6e 28 37 29 2c 63 3d 6e 28 33 33 29 2c 6c 3d 6e 28 35 29 2c 68 3d 6e 28 31 36 35 29 3b 74 2e 65 78 Data Ascii: (window.__twttrll=window.__twttrll\|\|[]).push([[2],{160:function(t,e,n){var r=n(39),a=n(162),s=n(7);(r=Object.create(r)).build=s(r.build,null,a),t.exports=r},161:function(t,e,n){var r=n(71),a=n(37),s=n(34),i=n(38),o=n(0),u=n(7),c=n(33),l=n(5),h=n(165);t.ex
2024-04-25 13:30:42 UTC	1379	IN	Data Raw: 79 3a 73 2c 62 75 69 6c 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 70 72 6f 74 6f 74 79 70 65 2e 62 75 69 6c 64 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 73 65 6c 65 63 74 6f 72 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 57 69 64 67 65 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 6c 65 63 74 6f 72 73 3b 74 3d 74 7c 7c 7b 7d 2c 74 68 69 73 2e 57 69 64 67 65 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 6c 65 63 74 6f 72 73 3d 61 2e 61 75 67 28 7b 7d 2c 74 2c 65 29 7d 7d 29 2c 74 2e 65 78 70 6f 72 74 73 3d 69 7d 2c 31 36 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 36 29 2c 61 3d 6e 28 33 35 29 2c 73 3d 6e 28 34 31 29 2c 69 3d 6e 28 30 29 2c 6f 3d Data Ascii: y:s,build:function(){return r.prototype.build.apply(this,arguments)},selectors:function(t){var e=this.Widget.prototype.selectors;t=t\|\|{},this.Widget.prototype.selectors=a.aug({},t,e)}}),t.exports=i},163:function(t,e,n){var r=n(6),a=n(35),s=n(41),i=n(0),o=
2024-04-25 13:30:42 UTC	1379	IN	Data Raw: 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 7d 7d 29 2c 74 2e 64 65 66 69 6e 65 28 22 73 65 74 44 61 74 61 41 74 74 72 69 62 75 74 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 73 61 6e 64 62 6f 78 2e 73 61 6e 64 62 6f 78 45 6c 3b 61 2e 66 6f 72 49 6e 28 74 68 69 73 2e 77 69 64 67 65 74 44 61 74 61 41 74 74 72 69 62 75 74 65 73 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 2e 68 61 73 56 61 6c 75 65 28 6e 29 26 26 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 22 2b 65 2c 6e 29 7d 29 7d 29 2c 74 2e 61 66 74 65 72 28 22 72 65 6e 64 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 61 74 61 41 74 74 72 69 62 75 74 65 73 28 29 7d 29 7d 7d 2c 31 37 32 3a 66 75 6e 63 Data Ascii: ",function(){return{}}),t.define("setDataAttributes",function(){var t=this.sandbox.sandboxEl;a.forIn(this.widgetDataAttributes(),function(e,n){r.hasValue(n)&&t.setAttribute("data-"+e,n)})}),t.after("render",function(){this.setDataAttributes()})}},172:func
2024-04-25 13:30:42 UTC	1379	IN	Data Raw: 65 65 6e 5f 6e 61 6d 65 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 73 63 72 65 65 6e 4e 61 6d 65 2c 73 68 6f 77 5f 63 6f 75 6e 74 3a 21 74 26 26 22 6e 6f 6e 65 22 21 3d 3d 74 68 69 73 2e 70 61 72 61 6d 73 2e 63 6f 75 6e 74 26 26 74 68 69 73 2e 70 61 72 61 6d 73 2e 73 68 6f 77 43 6f 75 6e 74 2c 73 68 6f 77 5f 73 63 72 65 65 6e 5f 6e 61 6d 65 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 73 68 6f 77 53 63 72 65 65 6e 4e 61 6d 65 2c 70 72 65 76 69 65 77 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 70 72 65 76 69 65 77 2c 70 61 72 74 6e 65 72 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 70 61 72 74 6e 65 72 2c 64 6e 74 3a 69 2e 65 6e 61 62 6c 65 64 28 29 2c 74 69 6d 65 3a 2b 6e 65 77 20 44 61 74 65 7d 29 7d 29 2c 74 2e 61 72 6f 75 6e 64 28 22 77 69 64 67 65 74 44 61 74 61 41 74 74 Data Ascii: een_name:this.params.screenName,show_count:!t&&"none"!==this.params.count&&this.params.showCount,show_screen_name:this.params.showScreenName,preview:this.params.preview,partner:this.params.partner,dnt:i.enabled(),time:+new Date})}),t.around("widgetDataAtt
2024-04-25 13:30:42 UTC	1379	IN	Data Raw: 72 20 72 3d 6e 28 36 29 2c 61 3d 6e 28 34 29 2c 73 3d 6e 28 38 29 2c 69 3d 6e 28 33 33 29 2c 6f 3d 6e 28 31 39 29 2c 75 3d 6e 28 31 37 37 29 2c 63 3d 6e 28 37 33 29 2c 6c 3d 6e 28 30 29 2c 68 3d 6e 28 31 36 29 2c 70 3d 6e 28 32 29 2c 66 3d 6e 28 31 36 30 29 2c 6d 3d 6e 28 37 29 2c 64 3d 6e 28 37 32 29 2c 67 3d 6e 28 37 30 29 2c 62 3d 64 2e 74 77 65 65 74 42 75 74 74 6f 6e 48 74 6d 6c 50 61 74 68 2c 77 3d 22 58 20 50 6f 73 74 20 42 75 74 74 6f 6e 22 2c 76 3d 22 74 77 69 74 74 65 72 2d 74 77 65 65 74 2d 62 75 74 74 6f 6e 22 2c 5f 3d 22 74 77 69 74 74 65 72 2d 73 68 61 72 65 2d 62 75 74 74 6f 6e 22 2c 78 3d 22 74 77 69 74 74 65 72 2d 68 61 73 68 74 61 67 2d 62 75 74 74 6f 6e 22 2c 79 3d 22 74 77 69 74 74 65 72 2d 6d 65 6e 74 69 6f 6e 2d 62 75 74 74 6f 6e 22 Data Ascii: r r=n(6),a=n(4),s=n(8),i=n(33),o=n(19),u=n(177),c=n(73),l=n(0),h=n(16),p=n(2),f=n(160),m=n(7),d=n(72),g=n(70),b=d.tweetButtonHtmlPath,w="X Post Button",v="twitter-tweet-button",_="twitter-share-button",x="twitter-hashtag-button",y="twitter-mention-button"
2024-04-25 13:30:42 UTC	989	IN	Data Raw: 29 2c 74 2e 61 72 6f 75 6e 64 28 22 77 69 64 67 65 74 44 61 74 61 41 74 74 72 69 62 75 74 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 6d 65 6e 74 69 6f 6e 22 3d 3d 74 68 69 73 2e 70 61 72 61 6d 73 2e 74 79 70 65 3f 6c 2e 61 75 67 28 7b 22 73 63 72 65 65 6e 2d 6e 61 6d 65 22 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 73 63 72 65 65 6e 4e 61 6d 65 7d 2c 74 28 29 29 3a 22 68 61 73 68 74 61 67 22 3d 3d 74 68 69 73 2e 70 61 72 61 6d 73 2e 74 79 70 65 3f 6c 2e 61 75 67 28 7b 68 61 73 68 74 61 67 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 62 75 74 74 6f 6e 48 61 73 68 74 61 67 7d 2c 74 28 29 29 3a 6c 2e 61 75 67 28 7b 75 72 6c 3a 74 68 69 73 2e 70 61 72 61 6d 73 2e 75 72 6c 7d 2c 74 28 29 29 7d 29 2c 74 2e 61 72 6f 75 6e 64 28 22 73 63 72 69 62 Data Ascii: ),t.around("widgetDataAttributes",function(t){return"mention"==this.params.type?l.aug({"screen-name":this.params.screenName},t()):"hashtag"==this.params.type?l.aug({hashtag:this.params.buttonHashtag},t()):l.aug({url:this.params.url},t())}),t.around("scrib

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49885	104.244.42.8	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	407	OUT	GET /settings?session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1 Host: syndication.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:42 UTC	468	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 13:30:42 GMT perf: 7402827104 vary: Origin server: tsa_b content-type: application/json; charset=utf-8 cache-control: must-revalidate, max-age=600 last-modified: Thu, 25 Apr 2024 13:30:42 GMT content-length: 930 x-transaction-id: 3d4bccb73a46a4b8 strict-transport-security: max-age=631138519 x-response-time: 6 x-connection-hash: bef5fbfe652181874f62f8073a551570bd853c941a09acc5195616aa916729f2 connection: close
2024-04-25 13:30:42 UTC	930	IN	Data Raw: 7b 22 73 68 6f 75 6c 64 5f 6f 62 74 61 69 6e 5f 63 6f 6f 6b 69 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 73 22 3a 7b 22 74 66 77 5f 74 69 6d 65 6c 69 6e 65 5f 6c 69 73 74 22 3a 7b 22 62 75 63 6b 65 74 22 3a 5b 5d 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 66 6f 6c 6c 6f 77 65 72 5f 63 6f 75 6e 74 5f 73 75 6e 73 65 74 22 3a 7b 22 62 75 63 6b 65 74 22 3a 74 72 75 65 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 74 77 65 65 74 5f 65 64 69 74 5f 62 61 63 6b 65 6e 64 22 3a 7b 22 62 75 63 6b 65 74 22 3a 22 6f 6e 22 2c 22 76 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 74 66 77 5f 72 65 66 73 72 63 5f 73 65 73 73 69 6f 6e 22 3a 7b 22 62 75 63 6b 65 74 22 3a 22 6f 6e 22 2c 22 76 65 72 73 Data Ascii: {"should_obtain_cookie_consent":false,"features":{"tfw_timeline_list":{"bucket":[],"version":null},"tfw_follower_count_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_backend":{"bucket":"on","version":null},"tfw_refsrc_session":{"bucket":"on","vers

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49886	142.250.9.91	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:42 UTC	612	OUT	GET /s/subscriptions/subscribe_embed/img/subscribe_button_branded_lozenge.png HTTP/1.1 Host: www.youtube.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:43 UTC	649	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 156 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 20 Apr 2024 13:21:56 GMT Expires: Sun, 20 Apr 2025 13:21:56 GMT Cache-Control: public, max-age=31536000 Last-Modified: Fri, 18 Sep 2020 20:15:00 GMT Content-Type: image/png Age: 432526 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:43 UTC	156	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 0c 08 06 00 00 00 6b e7 3d 81 00 00 00 63 49 44 41 54 78 01 63 f8 ff ff bf 27 10 3f fb 4f 22 80 ea f1 64 20 4f 33 c2 10 86 ff 14 02 9c 06 3c 95 14 ff ff f3 e0 1e f2 0d 78 c2 c1 f1 ff a9 84 e0 ff ef 1b 57 90 67 c0 33 90 01 cc 0c ff 9f 71 32 fc ff 90 9f 4c a9 01 49 14 78 61 c3 72 5a 07 22 85 80 d2 84 f4 1c 64 80 17 88 41 86 e6 27 20 bd 00 d4 5b dc 8c 6f 9e e4 5a 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRk=cIDATxc'?O"d O3<xWg3q2LIxarZ"dA' [oZIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49887	173.194.219.113	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	772	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	902	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 66035 Date: Thu, 25 Apr 2024 13:30:43 GMT Expires: Fri, 25 Apr 2025 13:30:43 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 18:15:45 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:43 UTC	353	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 Data Ascii: n"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==type
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f Data Ascii: &&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="undefined"!=typeo
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 Data Ascii: ];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}c
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 75 72 6e 21 30 3b 22 66 75 6e 63 74 69 6f Data Ascii: ction(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)return!0;"functio
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 28 5b 5d 29 3a 6e 65 77 20 65 28 66 75 6e Data Ascii: .resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c([]):new e(fun
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 Data Ascii: !1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExte
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d 2e 6e 66 3d 7b 6e 65 78 74 3a 74 68 69 73 Data Ascii: ,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m.nf={next:this
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6d Data Ascii: ""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(function(){if(m
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d 0a 5f 2e 75 61 28 63 29 3b 66 6f 72 28 76 Data Ascii: entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=_.ua(c);for(v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49889	108.177.122.154	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	874	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-17835040-1&cid=1842655186.1714051839&jid=1016391291&gjid=194722105&_gid=672239341.1714051841&_u=YADAAUAAAAAAACAAI~&z=1130479592 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.wisecleaner.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	597	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.wisecleaner.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 13:30:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 1 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:43 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49891	104.244.42.72	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	1196	OUT	GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1 Host: syndication.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	445	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 13:30:43 GMT perf: 7402827104 vary: Origin server: tsa_b content-type: image/gif cache-control: must-revalidate, max-age=600 last-modified: Thu, 25 Apr 2024 13:30:43 GMT content-length: 43 x-transaction-id: 0de9e128ba47e8bf strict-transport-security: max-age=631138519 x-response-time: 7 x-connection-hash: 1061161a6a6ec0282018f6847221edd55e5709883b589c34055b78f47f2da8af connection: close
2024-04-25 13:30:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49888	192.229.163.25	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	748	OUT	GET /widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html HTTP/1.1 Host: platform.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	626	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * Age: 2701457 Cache-Control: public, max-age=315360000 Content-Type: text/html; charset=utf-8 Date: Thu, 25 Apr 2024 13:30:43 GMT Etag: "bf4801052efb5f8f12057c849e9b590f" Last-Modified: Mon, 11 Dec 2023 17:19:47 GMT P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server: ECS (agb/5385) Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ Vary: Accept-Encoding x-amz-server-side-encryption: AES256 X-Cache: HIT x-tw-cdn: VZ Content-Length: 37658 Connection: close
2024-04-25 13:30:43 UTC	16383	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 73 63 72 69 62 65 3d 22 70 61 67 65 3a 62 75 74 74 6f 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 58 20 46 6f 6c 6c 6f 77 20 42 75 74 74 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 62 61 73 65 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 74 77 69 74 74 65 72 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 69 63 72 6f 66 6f 72 6d 61 74 73 2e 6f 72 67 2f 70 72 6f 66 69 6c 65 2f 68 63 61 72 64 22 3e Data Ascii: <!DOCTYPE html><html data-scribe="page:button"><head> <meta charset="utf-8"> <title>X Follow Button</title> <base target="_blank"> <link rel="dns-prefetch" href="//twitter.com"> <link rel="profile" href="http://microformats.org/profile/hcard">
2024-04-25 13:30:43 UTC	1	IN	Data Raw: 20 Data Ascii:
2024-04-25 13:30:43 UTC	16383	IN	Data Raw: 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 6e 75 6d 65 72 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 3b 74 68 69 73 2e 5f 73 74 61 74 65 3d 3d 3d 78 26 26 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 68 69 73 2e 5f 65 61 63 68 45 6e 74 72 79 28 74 5b 65 5d 2c 65 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 61 63 68 45 6e 74 72 79 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 69 6e 73 74 61 6e 63 65 43 6f 6e 73 74 72 75 63 74 6f 72 2c 72 3d 6e 2e 72 65 73 6f 6c 76 65 3b 69 66 28 72 3d 3d 3d 5f 29 7b 76 61 72 20 6f 3d 4f 28 74 29 3b 69 66 28 6f 3d 3d 3d 79 26 26 74 2e 5f 73 74 61 74 65 21 3d 3d 78 29 74 68 69 73 2e 5f 73 65 74 74 6c 65 64 41 74 28 74 2e 5f 73 74 61 74 65 2c 65 Data Ascii: t.prototype._enumerate=function(t){for(var e=0;this._state===x&&e<t.length;e++)this._eachEntry(t[e],e)},t.prototype._eachEntry=function(t,e){var n=this._instanceConstructor,r=n.resolve;if(r===_){var o=O(t);if(o===y&&t._state!==x)this._settledAt(t._state,e
2024-04-25 13:30:43 UTC	4891	IN	Data Raw: 6e 67 22 29 2c 76 6f 69 64 28 52 2e 74 69 74 6c 65 3d 5f 28 22 59 6f 75 20 61 72 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 25 7b 6e 61 6d 65 7d 20 6f 6e 20 58 22 2c 7b 6e 61 6d 65 3a 65 7d 29 29 3b 78 2e 63 6c 61 73 73 4e 61 6d 65 3d 78 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 2f 20 3f 66 6f 6c 6c 6f 77 69 6e 67 2f 2c 22 22 29 2c 52 2e 74 69 74 6c 65 3d 5f 28 22 46 6f 6c 6c 6f 77 20 25 7b 6e 61 6d 65 7d 20 6f 6e 20 58 22 2c 7b 6e 61 6d 65 3a 65 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 29 7b 72 65 74 75 72 6e 2f 66 6f 6c 6c 6f 77 69 6e 67 2f 2e 74 65 73 74 28 78 2e 63 6c 61 73 73 4e 61 6d 65 29 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 74 29 7b 72 65 74 75 72 6e 20 4d 2e 6f 70 65 6e 28 74 2c 6e 75 6c 6c 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 Data Ascii: ng"),void(R.title=_("You are following %{name} on X",{name:e}));x.className=x.className.replace(/ ?following/,""),R.title=_("Follow %{name} on X",{name:e})}}function nt(){return/following/.test(x.className)}function rt(t){return M.open(t,null)}function ot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49892	142.250.105.101	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	801	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_2?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	902	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 27382 Date: Thu, 25 Apr 2024 13:30:43 GMT Expires: Fri, 25 Apr 2025 13:30:43 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 18:15:45 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:43 UTC	353	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 32 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 49 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 54 3d 61 7d 3b 5f 2e 67 3d 5f 2e 49 6f 2e 70 72 6f 74 6f 74 79 70 65 3b 5f 2e 67 2e 4e 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 54 2e 61 6e 63 68 6f 72 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 5f 2e 67 2e 71 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 54 2e 61 6e 63 68 6f 72 7d 3b 5f 2e 67 2e 50 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 54 2e 61 6e 63 68 6f 72 50 6f 73 69 74 69 6f 6e 3d 61 7d 3b 5f 2e 67 2e 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 54 2e 68 65 69 67 68 74 3d 61 Data Ascii: gapi.loaded_2(function(_){var window=this;_.Io=function(a){this.T=a};_.g=_.Io.prototype;_.g.NK=function(a){this.T.anchor=a;return this};_.g.qj=function(){return this.T.anchor};_.g.PK=function(a){this.T.anchorPosition=a};_.g.ke=function(a){this.T.height=a
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 73 7d 3b 5f 2e 67 2e 59 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 54 2e 77 69 64 74 68 7d 3b 5f 2e 67 2e 73 65 74 5a 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 54 2e 7a 49 6e 64 65 78 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 5f 2e 67 2e 67 65 74 5a 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 54 2e 7a 49 6e 64 65 78 7d 3b 0a 5f 2e 4a 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 54 2e 63 6f 6e 6e 65 63 74 57 69 74 68 51 75 65 72 79 50 61 72 61 6d 73 3d 21 30 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 63 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 22 72 74 6c 22 3d 3d 5f 2e 4d 73 28 61 2c 22 64 69 72 65 63 74 69 6f 6e 22 29 7d 3b 5f Data Ascii: s};_.g.Yb=function(){return this.T.width};_.g.setZIndex=function(a){this.T.zIndex=a;return this};_.g.getZIndex=function(){return this.T.zIndex};_.Jo=function(a){a.T.connectWithQueryParams=!0;return a};_.ct=function(a){return"rtl"==_.Ms(a,"direction")};_
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 73 2e 74 6f 70 29 3b 74 68 69 73 2e 77 69 64 74 68 3d 4d 61 74 68 2e 63 65 69 6c 28 74 68 69 73 2e 77 69 64 74 68 29 3b 74 68 69 73 2e 68 65 69 67 68 74 3d 4d 61 74 68 2e 63 65 69 6c 28 74 68 69 73 2e 68 65 69 67 68 74 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 5f 2e 67 2e 66 6c 6f 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6c 65 66 74 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 6c 65 66 74 29 3b 74 68 69 73 2e 74 6f 70 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 74 6f 70 29 3b 74 68 69 73 2e 77 69 64 74 68 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 77 69 64 74 68 29 3b 74 68 69 73 2e 68 65 69 67 68 74 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 68 65 69 67 68 74 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a Data Ascii: s.top);this.width=Math.ceil(this.width);this.height=Math.ceil(this.height);return this};_.g.floor=function(){this.left=Math.floor(this.left);this.top=Math.floor(this.top);this.width=Math.floor(this.width);this.height=Math.floor(this.height);return this};
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 61 3d 2f 28 3f 3a 69 50 68 6f 6e 65 7c 43 50 55 29 5c 73 2b 4f 53 5c 73 2b 28 5c 53 2b 29 2f 2c 28 61 3d 61 2e 65 78 65 63 28 5f 2e 41 62 28 29 29 29 3f 61 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5f 2f 67 2c 22 2e 22 29 3a 22 22 29 3a 22 22 7d 28 29 3b 76 61 72 20 69 74 3b 69 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 65 78 65 63 28 5f 2e 41 62 28 29 29 29 3f 61 5b 31 5d 3a 22 22 7d 3b 5f 2e 6a 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 5f 2e 6b 69 29 72 65 74 75 72 6e 20 69 74 28 2f 46 69 72 65 66 6f 78 5c 2f 28 5b 30 2d 39 2e 5d 2b 29 2f 29 3b 69 66 28 5f 2e 5a 64 7c 7c 5f 2e 24 64 7c 7c 5f 2e 59 64 29 72 65 74 75 72 6e 20 5f 2e 74 65 3b 69 66 28 5f 2e 6f 69 29 7b 69 66 28 5f 2e 6a 63 28 29 7c 7c 5f 2e 6b 63 28 29 29 Data Ascii: a=/(?:iPhone\|CPU)\s+OS\s+(\S+)/,(a=a.exec(_.Ab()))?a[1].replace(/_/g,"."):""):""}();var it;it=function(a){return(a=a.exec(_.Ab()))?a[1]:""};_.jt=function(){if(_.ki)return it(/Firefox\/([0-9.]+)/);if(_.Zd\|\|_.$d\|\|_.Yd)return _.te;if(_.oi){if(_.jc()\|\|_.kc())
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 69 64 74 68 7c 7c 61 2e 73 63 72 6f 6c 6c 48 65 69 67 68 74 3e 61 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 7c 7c 22 66 69 78 65 64 22 3d 3d 63 7c 7c 22 61 62 73 6f 6c 75 74 65 22 3d 3d 63 7c 7c 22 72 65 6c 61 74 69 76 65 22 3d 3d 63 29 29 72 65 74 75 72 6e 20 61 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 0a 5f 2e 6d 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 6e 65 77 20 5f 2e 46 73 28 30 2c 49 6e 66 69 6e 69 74 79 2c 49 6e 66 69 6e 69 74 79 2c 30 29 2c 63 3d 5f 2e 49 65 28 61 29 2c 64 3d 63 2e 77 62 28 29 2e 62 6f 64 79 2c 65 3d 63 2e 77 62 28 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 66 3d 5f 2e 77 73 28 63 2e 48 62 29 3b 61 3d 6c 74 28 61 29 3b 29 69 66 28 21 28 5f 2e 5a 64 26 26 30 3d 3d 61 2e 63 6c 69 65 6e 74 57 Data Ascii: idth\|\|a.scrollHeight>a.clientHeight\|\|"fixed"==c\|\|"absolute"==c\|\|"relative"==c))return a;return null};_.mt=function(a){for(var b=new _.Fs(0,Infinity,Infinity,0),c=_.Ie(a),d=c.wb().body,e=c.wb().documentElement,f=_.ws(c.Hb);a=lt(a);)if(!(_.Zd&&0==a.clientW
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 2d 6d 2e 63 6c 69 65 6e 74 57 69 64 74 68 2d 6d 2e 73 63 72 6f 6c 6c 4c 65 66 74 3a 6d 2e 73 63 72 6f 6c 6c 4c 65 66 74 3b 70 3d 6b 74 28 70 2c 6e 65 77 20 5f 2e 76 73 28 6e 2c 6d 2e 73 63 72 6f 6c 6c 54 6f 70 29 29 7d 7d 7d 6d 3d 70 7c 7c 6e 65 77 20 5f 2e 76 73 3b 70 3d 5f 2e 6e 74 28 61 29 3b 28 6e 3d 5f 2e 6d 74 28 61 29 29 26 26 70 2e 64 49 28 6e 65 77 20 5f 2e 64 74 28 6e 2e 6c 65 66 74 2c 6e 2e 74 6f 70 2c 6e 2e 72 69 67 68 74 2d 6e 2e 6c 65 66 74 2c 6e 2e 62 6f 74 74 6f 6d 2d 0a 6e 2e 74 6f 70 29 29 3b 6e 3d 5f 2e 49 65 28 61 29 3b 74 3d 5f 2e 49 65 28 63 29 3b 6e 2e 77 62 28 29 21 3d 74 2e 77 62 28 29 26 26 28 71 3d 6e 2e 77 62 28 29 2e 62 6f 64 79 2c 74 3d 5f 2e 54 73 28 71 2c 74 2e 67 65 74 57 69 6e 64 6f 77 28 29 29 2c 74 3d 6b 74 28 74 2c 5f Data Ascii: -m.clientWidth-m.scrollLeft:m.scrollLeft;p=kt(p,new _.vs(n,m.scrollTop))}}}m=p\|\|new _.vs;p=_.nt(a);(n=_.mt(a))&&p.dI(new _.dt(n.left,n.top,n.right-n.left,n.bottom-n.top));n=_.Ie(a);t=_.Ie(c);n.wb()!=t.wb()&&(q=n.wb().body,t=_.Ts(q,t.getWindow()),t=kt(t,_
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 26 28 62 3d 66 2e 79 2c 66 2e 79 3c 65 2e 74 6f 70 26 26 28 66 2e 79 3d 65 2e 74 6f 70 2c 61 7c 3d 38 29 2c 66 2e 79 2b 75 2e 68 65 69 67 68 74 3e 65 2e 62 6f 74 74 6f 6d 26 26 28 75 2e 68 65 69 67 68 74 3d 4d 61 74 68 2e 6d 69 6e 28 65 2e 62 6f 74 74 6f 6d 2d 66 2e 79 2c 62 2b 75 2e 68 65 69 67 68 74 2d 65 2e 74 6f 70 29 2c 75 2e 68 65 69 67 68 74 3d 4d 61 74 68 2e 6d 61 78 28 75 2e 68 65 69 67 68 74 2c 30 29 2c 61 7c 3d 38 29 29 2c 66 2e 79 2b 75 2e 68 65 69 67 68 74 3e 65 2e 62 6f 74 74 6f 6d 26 26 68 26 34 26 26 28 66 2e 79 3d 4d 61 74 68 2e 6d 61 78 28 65 2e 62 6f 74 74 6f 6d 2d 75 2e 68 65 69 67 68 74 2c 65 2e 74 6f 70 29 2c 61 7c 3d 32 29 2c 68 26 38 26 26 28 61 7c 3d 28 66 2e 79 3c 65 2e 74 6f 70 3f 36 34 3a 30 29 7c 28 66 2e 79 2b 75 2e 68 65 69 Data Ascii: &(b=f.y,f.y<e.top&&(f.y=e.top,a\|=8),f.y+u.height>e.bottom&&(u.height=Math.min(e.bottom-f.y,b+u.height-e.top),u.height=Math.max(u.height,0),a\|=8)),f.y+u.height>e.bottom&&h&4&&(f.y=Math.max(e.bottom-u.height,e.top),a\|=2),h&8&&(a\|=(f.y<e.top?64:0)\|(f.y+u.hei
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 62 2e 68 65 69 67 68 74 29 29 7d 61 2e 41 61 2e 61 6e 63 68 6f 72 3d 22 22 7d 3b 5f 2e 43 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 42 65 66 6f 72 65 50 61 72 65 6e 74 4f 70 65 6e 3d 5f 2e 43 74 2e 70 72 6f 74 6f 74 79 70 65 2e 52 76 3b 5f 2e 45 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 43 74 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 7d 3b 5f 2e 43 28 5f 2e 45 74 2c 5f 2e 43 74 29 3b 5f 2e 67 3d 5f 2e 45 74 2e 70 72 6f 74 6f 74 79 70 65 3b 5f 2e 67 2e 6f 70 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 41 61 2c 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 73 22 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 2e 63 6f 6e 74 61 69 6e 65 72 29 2e 61 70 70 Data Ascii: b.height))}a.Aa.anchor=""};_.Ct.prototype.onBeforeParentOpen=_.Ct.prototype.Rv;_.Et=function(a){_.Ct.call(this,a)};_.C(_.Et,_.Ct);_.g=_.Et.prototype;_.g.open=function(){var a=this.Aa,b=document.createElement("ins");document.getElementById(a.container).app
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 3a 20 22 2b 63 2e 61 6e 63 68 6f 72 42 6f 78 2e 77 69 64 74 68 2b 22 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 20 22 2b 63 2e 61 6e 63 68 6f 72 42 6f 78 2e 68 65 69 67 68 74 2b 22 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 20 2d 31 30 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 20 22 2b 28 62 3f 22 62 6c 6f 63 6b 22 3a 22 6e 6f 6e 65 22 29 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 22 7d 3b 0a 5f 2e 48 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 30 2c 64 3d 30 3b 69 66 28 62 2e 70 61 67 65 58 7c 7c 62 2e 70 61 67 65 59 29 63 3d 62 2e 70 61 67 65 58 2c 64 3d 62 2e 70 61 67 65 59 3b 65 6c 73 65 20 69 66 28 62 2e 63 6c 69 65 6e 74 58 7c 7c 62 2e 63 6c 69 65 6e 74 59 29 Data Ascii: : "+c.anchorBox.width+"px !important;height: "+c.anchorBox.height+"px !important;z-index: -10000 !important;display: "+(b?"block":"none")+" !important;"};_.Ht=function(a,b){var c=0,d=0;if(b.pageX\|\|b.pageY)c=b.pageX,d=b.pageY;else if(b.clientX\|\|b.clientY)
2024-04-25 13:30:43 UTC	1255	IN	Data Raw: 66 74 2d 63 65 6e 74 65 72 22 3a 21 30 2c 22 72 69 67 68 74 2d 63 65 6e 74 65 72 22 3a 21 30 7d 3b 0a 5f 2e 4d 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 65 3d 65 7c 7c 7b 78 3a 30 2c 79 3a 30 7d 3b 69 66 28 4b 74 5b 62 5d 29 7b 76 61 72 20 66 3d 5f 2e 57 73 28 61 29 2e 77 69 64 74 68 2f 32 3b 65 2e 78 3d 22 74 6f 70 2d 72 69 67 68 74 22 3d 3d 64 7c 7c 22 62 6f 74 74 6f 6d 2d 72 69 67 68 74 22 3d 3d 64 3f 65 2e 78 2b 66 3a 65 2e 78 2d 66 7d 4b 74 5b 64 5d 26 26 28 66 3d 5f 2e 57 73 28 63 29 2e 77 69 64 74 68 2f 32 2c 65 2e 78 2b 3d 66 29 3b 4c 74 5b 62 5d 26 26 28 66 3d 5f 2e 57 73 28 61 29 2e 68 65 69 67 68 74 2f 32 2c 65 2e 79 3d 22 72 69 67 68 74 2d 62 6f 74 74 6f 6d 22 3d 3d 64 7c 7c 22 6c 65 66 74 2d 62 6f 74 74 6f 6d 22 3d 3d Data Ascii: ft-center":!0,"right-center":!0};_.Mt=function(a,b,c,d,e){e=e\|\|{x:0,y:0};if(Kt[b]){var f=_.Ws(a).width/2;e.x="top-right"==d\|\|"bottom-right"==d?e.x+f:e.x-f}Kt[d]&&(f=_.Ws(c).width/2,e.x+=f);Lt[b]&&(f=_.Ws(a).height/2,e.y="right-bottom"==d\|\|"left-bottom"==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49893	142.250.105.157	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	616	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-17835040-1&cid=1842655186.1714051839&jid=1016391291&gjid=194722105&_gid=672239341.1714051841&_u=YADAAUAAAAAAACAAI~&z=1130479592 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 13:30:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 1 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:43 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49894	104.244.42.8	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:43 UTC	957	OUT	GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.wisecleaner.com%2Fthanks-for-choosing-WiseCare365.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1714051841572%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=23573a4b92be966386dd3bcaa06c1e011847d690 HTTP/1.1 Host: syndication.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:30:43 UTC	445	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 13:30:42 GMT perf: 7402827104 vary: Origin server: tsa_b content-type: image/gif cache-control: must-revalidate, max-age=600 last-modified: Thu, 25 Apr 2024 13:30:43 GMT content-length: 43 x-transaction-id: ac6c2b539776d955 strict-transport-security: max-age=631138519 x-response-time: 8 x-connection-hash: bcfec959a7e6b106d385dbab0262b8ee8182b96e29082d6cfa1ea0e113687422 connection: close
2024-04-25 13:30:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49895	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:44 UTC	1119	OUT	GET /subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wisecleaner.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:44 UTC	1536	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Apr 2024 13:30:44 GMT Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 13:30:44 UTC	764	IN	Data Raw: 32 66 35 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 59 6f 75 54 75 62 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 2f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 2f 73 75 62 73 63 72 69 62 65 5f 65 6d 62 65 64 2f 63 73 73 2f 77 77 77 2d 73 75 62 73 63 72 69 62 65 2d 65 6d 62 65 64 2d 63 61 72 64 5f 76 30 2e 63 73 73 22 20 6e 61 6d 65 3d 22 77 77 77 2d 73 75 62 73 63 72 69 62 65 2d 65 6d 62 65 64 2d 63 61 72 64 22 20 6e 6f 6e 63 65 3d 22 7a 57 7a 4b 39 62 56 45 59 58 45 51 54 47 6d 61 4b 30 35 57 37 51 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 31 45 45 72 67 64 51 39 75 31 66 37 47 4d 7a 48 57 71 6a 56 75 51 22 3e 69 66 20 28 27 Data Ascii: 2f5<html dir="ltr"><head><title>YouTube</title><link rel="stylesheet" href="/s/subscriptions/subscribe_embed/css/www-subscribe-embed-card_v0.css" name="www-subscribe-embed-card" nonce="zWzK9bVEYXEQTGmaK05W7Q"><script nonce="1EErgdQ9u1f7GMzHWqjVuQ">if ('
2024-04-25 13:30:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49902	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:44 UTC	1034	OUT	GET /s/subscriptions/subscribe_embed/css/www-subscribe-embed-card_v0.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:44 UTC	659	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/css Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 9041 Date: Thu, 25 Apr 2024 13:30:44 GMT Expires: Fri, 25 Apr 2025 13:30:44 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 25 Nov 2020 01:15:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:44 UTC	596	IN	Data Raw: 2e 79 74 2d 76 61 6c 69 67 6e 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 79 74 2d 76 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 79 74 2d 76 61 6c 69 67 6e 3a 62 65 66 6f 72 65 2c 2e 79 74 2d 76 61 6c 69 67 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 79 74 2d 76 61 6c 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 27 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 79 74 2d 74 68 75 6d 62 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 31 66 31 66 31 3b 66 6f Data Ascii: .yt-valign{white-space:nowrap}.yt-valign-center{white-space:nowrap;text-align:center}.yt-valign:before,.yt-valign-container{vertical-align:middle;display:inline-block}.yt-valign:before{content:'';height:100%}.yt-thumb{overflow:hidden;background:#f1f1f1;fo
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 79 74 2d 74 68 75 6d 62 2d 70 6f 73 74 65 72 2c 2e 79 74 2d 74 68 75 6d 62 2d 73 71 75 61 72 65 2c 2e 79 74 2d 74 68 75 6d 62 2d 66 65 65 64 2c 2e 79 74 2d 74 68 75 6d 62 2d 72 65 6c 61 74 65 64 2d 70 6c 61 79 6c 69 73 74 2c 2e 79 74 2d 74 68 75 6d 62 2d 64 65 66 61 75 6c 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 61 75 74 6f 7d 2e 79 74 2d 74 68 75 6d 62 2d 70 6f 73 74 65 72 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 34 32 2e 38 35 37 31 34 33 25 7d 2e 79 74 2d 74 68 75 6d 62 2d 73 71 75 61 72 65 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 30 25 7d 2e 79 74 2d 74 68 75 6d 62 2d 66 65 65 64 Data Ascii: play:inline-block;vertical-align:middle}.yt-thumb-poster,.yt-thumb-square,.yt-thumb-feed,.yt-thumb-related-playlist,.yt-thumb-default{display:block;height:auto}.yt-thumb-poster{padding-bottom:142.857143%}.yt-thumb-square{padding-bottom:100%}.yt-thumb-feed
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 3a 39 36 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 30 30 7b 77 69 64 74 68 3a 31 30 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 30 34 7b 77 69 64 74 68 3a 31 30 34 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 30 36 7b 77 69 64 74 68 3a 31 30 36 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 31 30 7b 77 69 64 74 68 3a 31 31 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 32 30 7b 77 69 64 74 68 3a 31 32 30 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 36 38 7b 68 65 69 67 68 74 3a 39 34 70 78 3b 77 69 64 74 68 3a 31 36 38 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 32 34 7b 77 69 64 74 68 3a 31 32 34 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 32 36 7b 77 69 64 74 68 3a 31 32 36 70 78 7d 2e 79 74 2d 74 68 75 6d 62 2d 31 32 38 7b 77 69 64 74 68 3a 31 32 38 70 78 7d 2e 79 74 Data Ascii: :96px}.yt-thumb-100{width:100px}.yt-thumb-104{width:104px}.yt-thumb-106{width:106px}.yt-thumb-110{width:110px}.yt-thumb-120{width:120px}.yt-thumb-168{height:94px;width:168px}.yt-thumb-124{width:124px}.yt-thumb-126{width:126px}.yt-thumb-128{width:128px}.yt
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 65 72 2d 69 6d 67 20 2e 74 68 75 6d 62 2d 77 72 61 70 70 65 72 20 2e 76 69 64 65 6f 2d 61 63 74 69 6f 6e 73 7b 7a 2d 69 6e 64 65 78 3a 33 7d 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2d 77 72 61 70 20 2e 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 7b 7a 2d 69 6e 64 65 78 3a 32 7d 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 2d 77 72 61 70 20 2e 6d 6f 75 73 65 6f 76 65 72 2d 70 6c 61 79 7b 68 65 69 67 68 74 3a 34 38 70 78 3b 77 69 64 74 68 3a 34 38 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 65 78 70 2d 6d 6f 75 73 65 6f 76 65 72 2d 69 6d 67 20 2e 79 74 2d 75 69 78 2d 6d 6f 75 Data Ascii: er-img .thumb-wrapper .video-actions{z-index:3}.exp-mouseover-img .yt-uix-mouseover-img-wrap .mouseover-img{z-index:2}.exp-mouseover-img .yt-uix-mouseover-img-wrap .mouseover-play{height:48px;width:48px;margin:auto;z-index:1}.exp-mouseover-img .yt-uix-mou
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 62 75 74 74 6f 6e 2c 2e 63 6f 6e 74 61 69 6e 73 2d 70 65 72 63 65 6e 74 2d 64 75 72 61 74 69 6f 6e 2d 77 61 74 63 68 65 64 20 2e 61 64 64 74 6f 2d 71 75 65 75 65 2d 62 75 74 74 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 34 70 78 7d 2e 63 6f 6e 74 61 69 6e 73 2d 61 64 64 74 6f 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 61 3a 68 6f 76 65 72 20 2e 63 6f 6e 74 61 69 6e 73 2d 61 64 64 74 6f 20 2e 76 69 64 65 6f 2d 74 69 6d 65 2c 2e 63 6f 6e 74 61 69 6e 73 2d 61 64 64 74 6f 3a 68 6f 76 65 72 20 2e 76 69 64 65 6f 2d 74 69 6d 65 2c 61 3a 68 6f 76 65 72 20 2e 63 6f 6e 74 61 69 6e 73 2d 61 64 64 74 6f 20 2e 76 69 64 65 Data Ascii: button,.contains-percent-duration-watched .addto-queue-button{margin-bottom:4px}.contains-addto{display:block;position:relative;height:100%;overflow:hidden}a:hover .contains-addto .video-time,.contains-addto:hover .video-time,a:hover .contains-addto .vide
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 6f 72 3a 23 30 30 30 3b 6f 70 61 63 69 74 79 3a 2e 35 3b 66 69 6c 74 65 72 3a 61 6c 70 68 61 28 6f 70 61 63 69 74 79 3d 35 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 77 6f 72 64 2d 77 72 61 70 3a 6e 6f 72 6d 61 6c 3b 2d 6f 2d 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 7d 2e 77 61 74 63 68 65 64 20 2e 76 69 64 65 6f 2d 74 68 75 6d 62 7b 6f 70 61 63 69 74 79 3a 2e 37 3b 66 69 6c 74 65 72 3a 61 6c 70 68 61 28 6f 70 61 63 69 74 79 3d 37 30 29 7d 2e 72 65 73 75 6d 65 2d 70 6c 61 79 62 61 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2c 2e 72 65 73 75 6d 65 2d 70 6c 61 79 62 61 63 6b 2d 70 72 6f 67 72 65 73 Data Ascii: or:#000;opacity:.5;filter:alpha(opacity=50);overflow:hidden;white-space:nowrap;word-wrap:normal;-o-text-overflow:ellipsis;text-overflow:ellipsis}.watched .video-thumb{opacity:.7;filter:alpha(opacity=70)}.resume-playback-background,.resume-playback-progres
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 7d 62 75 74 74 6f 6e 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 63 61 6e 76 61 73 2c 63 61 70 74 69 6f 6e 2c 63 65 6e 74 65 72 2c 63 69 74 65 2c 63 6f 64 65 2c 64 64 2c 64 65 6c 2c 64 66 6e 2c 64 69 76 2c 64 6c 2c 64 74 2c 65 6d 2c 65 6d 62 65 64 2c 66 69 65 6c 64 73 65 74 2c 66 6f 6e 74 2c 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 62 61 63 Data Ascii: }button{margin:0;padding:0;border:0;background:transparent}canvas,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,embed,fieldset,font,form{margin:0;padding:0;border:0;font-size:100%;background:transparent}h1,h2,h3,h4,h5,h6{margin:0;padding:0;border:0;bac
2024-04-25 13:30:44 UTC	915	IN	Data Raw: 65 2d 63 61 72 64 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 35 70 78 20 35 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 79 74 2d 75 73 65 72 2d 69 63 6f 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 34 30 70 78 7d 2e 79 74 2d 73 75 62 73 63 72 69 70 74 69 6f 6e 2d 70 72 6f 6d 70 74 2c 2e 79 74 2d 75 73 65 72 2d 6e 61 6d 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 70 78 3b 68 65 69 67 68 74 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 34 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 79 74 2d 73 75 62 73 63 72 69 70 74 69 6f 6e 2d 70 72 6f 6d 70 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 36 Data Ascii: e-card{padding:2px 5px 5px;overflow:hidden;white-space:nowrap}.yt-user-icon{float:left;width:40px}.yt-subscription-prompt,.yt-user-name{margin-left:50px;height:14px;line-height:14px;text-align:center;white-space:nowrap}.yt-subscription-prompt{margin-top:6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49901	64.233.176.93	443	6828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:44 UTC	1018	OUT	GET /s/subscriptions/subscribe_embed/js/www-subscribe-embed-card_v0.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCXLbiumrDzPSJikI9BIZjrw&usegapi=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=YnkeQfygHdM; VISITOR_INFO1_LIVE=2rbnv3xY9ig; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-04-25 13:30:44 UTC	668	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 153068 Date: Thu, 25 Apr 2024 13:30:44 GMT Expires: Fri, 25 Apr 2025 13:30:44 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 15 Sep 2020 21:45:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 13:30:44 UTC	587	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 2f 2a 0a 0a 20 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 20 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 20 20 2a 2f 0a 76 61 72 20 72 3b 0a 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 20 7b 0a 20 20 76 61 72 20 62 20 3d 20 30 3b 0a 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 62 20 3c 20 61 2e 6c 65 6e 67 74 68 20 3f 20 7b 64 6f 6e 65 3a 20 21 31 2c 20 76 61 6c 75 65 3a 20 61 5b 62 2b 2b 5d 7d 20 3a 20 7b 64 6f 6e 65 3a 20 21 30 7d 0a 20 20 7d 0a 7d 0a 76 61 72 20 62 61 20 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 3d Data Ascii: (function() { /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */var r;function aa(a) { var b = 0; return function() { return b < a.length ? {done: !1, value: a[b++]} : {done: !0} }}var ba = 'function' =
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 6f 66 20 73 65 6c 66 20 26 26 20 73 65 6c 66 2c 0a 20 20 20 20 27 6f 62 6a 65 63 74 27 20 3d 3d 20 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 20 26 26 20 67 6c 6f 62 61 6c 0a 20 20 5d 3b 0a 20 20 66 6f 72 20 28 76 61 72 20 62 20 3d 20 30 3b 20 62 20 3c 20 61 2e 6c 65 6e 67 74 68 3b 20 2b 2b 62 29 20 7b 0a 20 20 20 20 76 61 72 20 63 20 3d 20 61 5b 62 5d 3b 0a 20 20 20 20 69 66 20 28 63 20 26 26 20 63 2e 4d 61 74 68 20 3d 3d 20 4d 61 74 68 29 20 72 65 74 75 72 6e 20 63 0a 20 20 7d 0a 20 20 74 68 72 6f 77 20 45 72 72 6f 72 28 27 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 27 29 3b 0a 7d 0a 76 61 72 20 64 61 20 3d 20 63 61 28 74 68 69 73 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 28 61 2c 20 62 29 20 7b 0a 20 20 69 66 20 28 62 29 0a 20 Data Ascii: of self && self, 'object' == typeof global && global ]; for (var b = 0; b < a.length; ++b) { var c = a[b]; if (c && c.Math == Math) return c } throw Error('Cannot find global object');}var da = ca(this);function t(a, b) { if (b)
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 20 63 20 3c 20 62 2e 6c 65 6e 67 74 68 3b 20 63 2b 2b 29 20 7b 0a 20 20 20 20 76 61 72 20 64 20 3d 20 64 61 5b 62 5b 63 5d 5d 3b 0a 20 20 20 20 27 66 75 6e 63 74 69 6f 6e 27 20 3d 3d 3d 20 74 79 70 65 6f 66 20 64 20 26 26 20 27 66 75 6e 63 74 69 6f 6e 27 20 21 3d 20 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 20 26 26 0a 20 20 20 20 20 20 20 20 62 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 20 61 2c 20 7b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 20 21 30 2c 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 61 62 6c 65 3a 20 21 30 2c 0a 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 61 28 61 61 28 74 68 69 73 29 Data Ascii: c < b.length; c++) { var d = da[b[c]]; 'function' === typeof d && 'function' != typeof d.prototype[a] && ba(d.prototype, a, { configurable: !0, writable: !0, value: function() { return ea(aa(this)
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 61 2c 20 62 29 3b 0a 20 20 65 6c 73 65 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 63 20 69 6e 20 62 29 0a 20 20 20 20 20 20 69 66 20 28 27 70 72 6f 74 6f 74 79 70 65 27 20 21 3d 20 63 29 0a 20 20 20 20 20 20 20 20 69 66 20 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 20 3d 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 64 20 26 26 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 20 63 2c 20 64 29 0a 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 0a 20 20 20 20 20 20 20 20 20 20 61 5b 63 5d 20 3d 20 62 5b 63 5d 3b 0a 20 20 61 2e 48 20 3d 20 62 2e 70 72 Data Ascii: a, b); else for (var c in b) if ('prototype' != c) if (Object.defineProperties) { var d = Object.getOwnPropertyDescriptor(b, c); d && Object.defineProperty(a, c, d) } else a[c] = b[c]; a.H = b.pr
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 66 20 28 21 65 2e 64 6f 6e 65 29 20 72 65 74 75 72 6e 20 61 2e 66 2e 41 20 3d 20 21 31 2c 20 65 3b 0a 20 20 20 20 76 61 72 20 66 20 3d 20 65 2e 76 61 6c 75 65 0a 20 20 7d 20 63 61 74 63 68 20 28 67 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 61 2e 66 2e 6a 20 3d 20 6e 75 6c 6c 2c 20 70 61 28 61 2e 66 2c 20 67 29 2c 20 75 61 28 61 29 0a 20 20 7d 0a 20 20 61 2e 66 2e 6a 20 3d 20 6e 75 6c 6c 3b 0a 20 20 64 2e 63 61 6c 6c 28 61 2e 66 2c 20 66 29 3b 0a 20 20 72 65 74 75 72 6e 20 75 61 28 61 29 0a 7d 0a 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 20 7b 0a 20 20 66 6f 72 20 28 3b 20 61 2e 66 2e 66 3b 29 20 74 72 79 20 7b 0a 20 20 20 20 20 20 76 61 72 20 62 20 3d 20 61 2e 67 28 61 2e 66 29 3b 0a 20 20 20 20 20 20 69 66 20 28 62 29 20 72 65 74 75 72 6e 20 61 2e 66 Data Ascii: f (!e.done) return a.f.A = !1, e; var f = e.value } catch (g) { return a.f.j = null, pa(a.f, g), ua(a) } a.f.j = null; d.call(a.f, f); return ua(a)}function ua(a) { for (; a.f.f;) try { var b = a.g(a.f); if (b) return a.f
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 21 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 75 6c 6c 0a 7d 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 77 61 28 61 2c 20 62 2c 20 63 29 20 7b 0a 20 20 69 66 20 28 6e 75 6c 6c 20 3d 3d 20 61 29 0a 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 0a 20 20 20 20 20 20 20 20 27 54 68 65 20 5c 27 74 68 69 73 5c 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 27 20 2b 20 63 20 2b 0a 20 20 20 20 20 20 20 20 27 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 27 29 3b 0a 20 20 69 66 20 28 62 20 69 6e Data Ascii: return !1 } } : null});function wa(a, b, c) { if (null == a) throw new TypeError( 'The \'this\' value for String.prototype.' + c + ' must not be null or undefined'); if (b in
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 74 2e 61 73 73 69 67 6e 20 3a 20 66 75 6e 63 74 69 6f 6e 28 61 2c 20 62 29 20 7b 0a 20 20 66 6f 72 20 28 76 61 72 20 63 20 3d 20 31 3b 20 63 20 3c 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 20 63 2b 2b 29 20 7b 0a 20 20 20 20 76 61 72 20 64 20 3d 20 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 0a 20 20 20 20 69 66 20 28 64 29 0a 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 65 20 69 6e 20 64 29 20 41 28 64 2c 20 65 29 20 26 26 20 28 61 5b 65 5d 20 3d 20 64 5b 65 5d 29 0a 20 20 7d 0a 20 20 72 65 74 75 72 6e 20 61 0a 7d 3b 0a 74 28 27 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0a 20 20 72 65 74 75 72 6e 20 61 20 7c 7c 20 78 61 0a 7d 29 3b 0a 74 28 27 50 72 6f 6d 69 73 65 27 2c 20 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: t.assign : function(a, b) { for (var c = 1; c < arguments.length; c++) { var d = arguments[c]; if (d) for (var e in d) A(d, e) && (a[e] = d[e]) } return a};t('Object.assign', function(a) { return a \|\| xa});t('Promise', function(a
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 28 6c 29 20 7b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6d 29 20 7b 0a 20 20 20 20 20 20 20 20 6b 20 7c 7c 20 28 6b 20 3d 20 21 30 2c 20 6c 2e 63 61 6c 6c 28 68 2c 20 6d 29 29 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 68 20 3d 20 74 68 69 73 2c 20 6b 20 3d 20 21 31 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 7b 0a 20 20 20 20 20 20 72 65 73 6f 6c 76 65 3a 20 67 28 74 68 69 73 2e 54 29 2c 20 72 65 6a 65 63 74 3a 20 67 28 74 68 69 73 2e 6c 29 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 54 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 69 66 20 28 67 20 3d 3d 3d 20 74 68 69 73 29 0a 20 Data Ascii: nction() { function g(l) { return function(m) { k \|\| (k = !0, l.call(h, m)) } } var h = this, k = !1; return { resolve: g(this.T), reject: g(this.l) } }; b.prototype.T = function(g) { if (g === this)
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 67 29 20 66 2e 67 28 74 68 69 73 2e 66 5b 67 5d 29 3b 0a 20 20 20 20 20 20 74 68 69 73 2e 66 20 3d 20 6e 75 6c 6c 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 76 61 72 20 66 20 3d 20 6e 65 77 20 63 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 61 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 76 61 72 20 68 20 3d 20 74 68 69 73 2e 6a 28 29 3b 0a 20 20 20 20 67 2e 4e 28 68 2e 72 65 73 6f 6c 76 65 2c 20 68 2e 72 65 6a 65 63 74 29 0a 20 20 7d 3b 0a 20 20 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 61 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 2c 20 68 29 20 7b 0a 20 20 20 20 76 61 72 20 6b 20 3d 20 74 68 69 73 2e 6a 28 29 3b 0a 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 67 2e 63 61 6c 6c 28 68 2c 20 6b 2e 72 65 73 6f 6c 76 65 2c 20 6b 2e 72 65 Data Ascii: g) f.g(this.f[g]); this.f = null } }; var f = new c; b.prototype.ka = function(g) { var h = this.j(); g.N(h.resolve, h.reject) }; b.prototype.la = function(g, h) { var k = this.j(); try { g.call(h, k.resolve, k.re
2024-04-25 13:30:44 UTC	1255	IN	Data Raw: 29 2c 20 6d 20 3d 20 6c 2e 6e 65 78 74 28 29 3b 20 21 6d 2e 64 6f 6e 65 3b 20 6d 20 3d 20 6c 2e 6e 65 78 74 28 29 29 20 64 28 6d 2e 76 61 6c 75 65 29 2e 4e 28 68 2c 20 6b 29 0a 20 20 20 20 7d 29 0a 20 20 7d 3b 0a 20 20 62 2e 61 6c 6c 20 3d 20 66 75 6e 63 74 69 6f 6e 28 67 29 20 7b 0a 20 20 20 20 76 61 72 20 68 20 3d 20 75 28 67 29 2c 20 6b 20 3d 20 68 2e 6e 65 78 74 28 29 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 6b 2e 64 6f 6e 65 20 3f 20 64 28 5b 5d 29 20 3a 20 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 6c 2c 20 6d 29 20 7b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 77 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 78 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 71 5b 77 5d 20 3d 20 78 3b 0a 20 20 20 20 20 20 Data Ascii: ), m = l.next(); !m.done; m = l.next()) d(m.value).N(h, k) }) }; b.all = function(g) { var h = u(g), k = h.next(); return k.done ? d([]) : new b(function(l, m) { function n(w) { return function(x) { q[w] = x;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49910	104.26.2.143	443	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:50 UTC	170	OUT	GET /messages/index.php?to=checknews&pid=3 HTTP/1.1 Connection: Keep-Alive Accept-Charset: utf-8 User-Agent: Embarcadero URI Client/1.0 Host: info.wisecleaner.com
2024-04-25 13:30:51 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache set-cookie: PHPSESSID=002dikgif01pkknqq1msu0o4i0; expires=Thu, 25-Apr-2024 15:30:50 GMT; Max-Age=7200; path=/ vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=95HF1NMbGVNKOyKCD0c7%2Fp8WRjh%2BRP%2FQwzUq45ZJgJNB%2F%2FcQkV8oKhZob%2BUa0OCfcb76BL2BxMH5WN0A58PNYn3JkIJGPigDjRFR6djaiT8nclUpnP%2B0GMEvzts69Kr1jY3AeBwJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0a33f2b672e-ATL
2024-04-25 13:30:51 UTC	45	IN	Data Raw: 32 37 0d 0a 7b 22 73 65 72 76 65 72 74 69 6d 65 22 3a 20 22 32 30 32 34 2d 30 34 2d 32 35 22 2c 20 22 6e 65 77 73 22 3a 5b 5d 7d 0d 0a Data Ascii: 27{"servertime": "2024-04-25", "news":[]}
2024-04-25 13:30:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49909	104.26.2.143	443	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:50 UTC	128	OUT	GET /toolbox/toolsv6.ini HTTP/1.1 Connection: Keep-Alive User-Agent: Embarcadero URI Client/1.0 Host: www.wisecleaner.com
2024-04-25 13:30:50 UTC	615	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:50 GMT Transfer-Encoding: chunked Connection: close last-modified: Fri, 01 Dec 2023 15:54:53 GMT etag: W/"e97-60b74ca03b1c2-gzip" vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nZpyJ6YJ9TJ2ZjC%2FFyiay7bFBLgWUXBBMOmfhocqeFUtbFGt5lhCl74yGpnHsKJ8ICysBFJ1w2%2BtwoB%2Fxn9nhtT6rigcZrjlpXhhlnyrND%2B5XIfv3i%2BIeqnMOfuMbfLZ1Eemfmo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0a33c567bab-ATL
2024-04-25 13:30:50 UTC	754	IN	Data Raw: 65 39 37 0d 0a 5b 57 69 73 65 20 44 75 70 6c 69 63 61 74 65 20 46 69 6e 64 65 72 5d 0d 0a 54 72 61 6e 53 65 63 74 69 6f 6e 3d 44 75 70 6c 69 63 61 74 65 46 69 6e 64 65 72 0d 0a 44 65 66 61 75 6c 74 4e 61 6d 65 3d 44 75 70 6c 69 63 61 74 65 20 46 69 6e 64 65 72 0d 0a 45 78 65 3d 57 69 73 65 44 75 70 6c 69 63 61 74 65 46 69 6e 64 65 72 2e 65 78 65 0d 0a 54 72 61 6e 44 65 73 63 3d 44 75 70 6c 69 63 61 74 65 46 69 6e 64 65 72 44 65 73 63 0d 0a 44 65 73 63 3d 41 20 64 75 70 6c 69 63 61 74 65 20 66 69 6c 65 20 6d 61 6e 61 67 65 6d 65 6e 74 20 74 6f 6f 6c 0d 0a 42 75 69 6c 64 3d 36 30 0d 0a 50 6e 67 55 72 6c 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 74 6f 6f 6c 62 6f 78 2f 69 6d 61 67 65 73 76 36 2f 44 75 70 6c 69 63 Data Ascii: e97[Wise Duplicate Finder]TranSection=DuplicateFinderDefaultName=Duplicate FinderExe=WiseDuplicateFinder.exeTranDesc=DuplicateFinderDescDesc=A duplicate file management toolBuild=60PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/Duplic
2024-04-25 13:30:50 UTC	1369	IN	Data Raw: 2f 56 45 52 59 53 49 4c 45 4e 54 0d 0a 0d 0a 5b 57 69 73 65 20 46 6f 72 63 65 20 44 65 6c 65 74 65 72 5d 0d 0a 54 72 61 6e 53 65 63 74 69 6f 6e 3d 46 6f 72 63 65 44 65 6c 65 74 65 72 0d 0a 44 65 66 61 75 6c 74 4e 61 6d 65 3d 46 6f 72 63 65 20 44 65 6c 65 74 65 72 0d 0a 45 78 65 3d 57 69 73 65 44 65 6c 65 74 65 72 2e 65 78 65 0d 0a 54 72 61 6e 44 65 73 63 3d 46 6f 72 63 65 44 65 6c 65 74 65 72 44 65 73 63 0d 0a 44 65 73 63 3d 41 20 73 61 66 65 6c 79 20 61 6e 64 20 65 61 73 69 6c 79 20 66 69 6c 65 20 75 6e 6c 6f 63 6b 65 72 20 26 20 64 65 6c 65 74 65 72 0d 0a 42 75 69 6c 64 3d 35 35 0d 0a 50 6e 67 55 72 6c 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 74 6f 6f 6c 62 6f 78 2f 69 6d 61 67 65 73 76 36 2f 46 6f 72 63 65 Data Ascii: /VERYSILENT[Wise Force Deleter]TranSection=ForceDeleterDefaultName=Force DeleterExe=WiseDeleter.exeTranDesc=ForceDeleterDescDesc=A safely and easily file unlocker & deleterBuild=55PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/Force
2024-04-25 13:30:50 UTC	1369	IN	Data Raw: 6f 77 6e 6c 6f 61 64 55 72 6c 3d 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 73 6f 66 74 2f 57 4a 53 53 65 74 75 70 2e 65 78 65 0d 0a 49 6e 73 74 61 6c 6c 50 61 72 3d 2f 56 45 52 59 53 49 4c 45 4e 54 0d 0a 0d 0a 5b 57 69 73 65 20 4d 65 6d 6f 72 79 20 4f 70 74 69 6d 69 7a 65 72 5d 0d 0a 54 72 61 6e 53 65 63 74 69 6f 6e 3d 4d 65 6d 6f 72 79 4f 70 74 69 6d 69 7a 65 72 0d 0a 44 65 66 61 75 6c 74 4e 61 6d 65 3d 4d 65 6d 6f 72 79 20 4f 70 74 69 6d 69 7a 65 72 0d 0a 45 78 65 3d 57 69 73 65 4d 65 6d 6f 72 79 4f 70 74 69 6d 7a 65 72 2e 65 78 65 0d 0a 54 72 61 6e 44 65 73 63 3d 4d 65 6d 6f 72 79 4f 70 74 69 6d 69 7a 65 72 44 65 73 63 0d 0a 44 65 73 63 3d 46 72 65 65 20 4d 65 6d 6f 72 79 20 46 72 65 65 75 70 Data Ascii: ownloadUrl=https://downloads.wisecleaner.com/soft/WJSSetup.exeInstallPar=/VERYSILENT[Wise Memory Optimizer]TranSection=MemoryOptimizerDefaultName=Memory OptimizerExe=WiseMemoryOptimzer.exeTranDesc=MemoryOptimizerDescDesc=Free Memory Freeup
2024-04-25 13:30:50 UTC	250	IN	Data Raw: 65 72 44 65 73 63 0d 0a 44 65 73 63 3d 41 20 53 69 6d 70 6c 65 20 42 75 74 20 45 66 66 65 63 74 69 76 65 20 47 61 6d 65 20 42 6f 6f 73 74 65 72 0d 0a 42 75 69 6c 64 3d 38 31 0d 0a 50 6e 67 55 72 6c 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 74 6f 6f 6c 62 6f 78 2f 69 6d 61 67 65 73 76 36 2f 47 61 6d 65 42 6f 6f 73 74 65 72 2e 73 76 67 0d 0a 50 6e 67 4c 6f 63 61 6c 3d 69 6d 67 5c 47 61 6d 65 42 6f 6f 73 74 65 72 2e 73 76 67 0d 0a 44 6f 77 6e 6c 6f 61 64 55 72 6c 3d 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 2f 73 6f 66 74 2f 57 47 42 53 65 74 75 70 2e 65 78 65 0d 0a 49 6e 73 74 61 6c 6c 50 61 72 3d 2f 56 45 52 59 53 49 4c 45 4e 54 0d 0a 0d 0a Data Ascii: erDescDesc=A Simple But Effective Game BoosterBuild=81PngUrl=https://www.wisecleaner.com/toolbox/imagesv6/GameBooster.svgPngLocal=img\GameBooster.svgDownloadUrl=https://downloads.wisecleaner.com/soft/WGBSetup.exeInstallPar=/VERYSILENT
2024-04-25 13:30:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49911	104.26.2.143	443	5640	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:50 UTC	182	OUT	GET /software_update/getinfo_v6.php?p_id=31&s_build=636 HTTP/1.1 Connection: Keep-Alive Accept-Charset: utf-8 User-Agent: Embarcadero URI Client/1.0 Host: www.wisecleaner.com
2024-04-25 13:30:51 UTC	573	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g6%2FO5fdOFCw3ni3bBIJ2CIkh%2B11D1hVfingiZhq1pNlndiMpivmdDgacY1aLUq0KIYZrkpyZ6D9m%2FKF80u2lOim34INwrcM1ec7c8Qy4j3t0k7Dmxw2uWgAHCZwGQGkm%2BLkYccc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879eb0a3399cad65-ATL
2024-04-25 13:30:51 UTC	796	IN	Data Raw: 32 62 32 38 0d 0a 7b 22 69 64 22 3a 22 33 31 22 2c 22 6e 61 6d 65 22 3a 22 57 69 73 65 20 43 61 72 65 20 33 36 35 20 76 36 22 2c 22 62 75 69 6c 64 22 3a 22 36 33 35 22 2c 22 73 65 74 75 70 22 3a 22 30 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 2d 77 69 73 65 63 61 72 65 33 36 35 2e 68 74 6d 6c 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 65 78 65 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 73 6f 66 74 5c 2f 57 69 73 65 43 61 72 65 33 36 35 5f 36 2e 36 2e 35 2e 36 33 35 2e 65 78 65 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 66 69 6c 65 73 22 3a 5b 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 41 75 74 6f 55 Data Ascii: 2b28{"id":"31","name":"Wise Care 365 v6","build":"635","setup":"0","url":"https:\/\/www.wisecleaner.com\/update-wisecare365.html","download_exe":"https:\/\/downloads.wisecleaner.com\/soft\/WiseCare365_6.6.5.635.exe","download_files":[{"file_name":"AutoU
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 6d 65 5f 36 2e 30 2e 33 2e 35 39 33 2e 7a 69 70 22 2c 22 70 61 74 68 22 3a 22 22 2c 22 62 75 69 6c 64 22 3a 22 35 34 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 44 65 66 72 61 67 4f 70 74 69 6f 6e 73 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 44 65 66 72 61 67 4f 70 74 69 6f 6e 73 5f 36 2e 30 2e 33 2e 35 39 33 2e 7a 69 70 22 2c 22 70 61 74 68 22 3a 22 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 44 4d 61 6e 61 67 65 72 2e 64 6c 6c 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e Data Ascii: me_6.0.3.593.zip","path":"","build":"54"},{"file_name":"DefragOptions.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/DefragOptions_6.0.3.593.zip","path":"","build":""},{"file_name":"DManager.dll","download_url":"http:\/\/down
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 69 70 22 2c 22 70 61 74 68 22 3a 22 22 2c 22 62 75 69 6c 64 22 3a 22 36 33 36 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 57 69 73 65 44 65 66 72 61 67 2e 64 6c 6c 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 57 69 73 65 44 65 66 72 61 67 5f 36 2e 30 2e 33 2e 35 39 33 2e 7a 69 70 22 2c 22 70 61 74 68 22 3a 22 22 2c 22 62 75 69 6c 64 22 3a 22 34 31 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 57 69 73 65 45 72 61 73 65 72 2e 64 6c 6c 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e Data Ascii: ip","path":"","build":"636"},{"file_name":"WiseDefrag.dll","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/WiseDefrag_6.0.3.593.zip","path":"","build":"41"},{"file_name":"WiseEraser.dll","download_url":"http:\/\/downloads.wiseclean
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 75 61 67 65 73 5c 2f 42 65 6c 61 72 75 73 69 61 6e 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 42 75 6c 67 61 72 69 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 42 75 6c 67 61 72 69 61 6e 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 43 61 74 61 6c 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 Data Ascii: uages\/Belarusian.lan","path":"Languages","build":""},{"file_name":"Bulgarian.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/Languages\/Bulgarian.lan","path":"Languages","build":""},{"file_name":"Catalan.ini","download_url":"
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 28 4e 65 64 65 72 6c 61 6e 64 73 29 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 44 75 74 63 68 28 4e 65 64 65 72 6c 61 6e 64 73 29 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 45 6e 67 6c 69 73 68 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c Data Ascii: (Nederlands).ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/Languages\/Dutch(Nederlands).lan","path":"Languages","build":""},{"file_name":"English.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/L
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 49 6e 64 6f 6e 65 73 69 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 49 6e 64 6f 6e 65 73 69 61 6e 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 49 74 61 6c 69 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 Data Ascii: ","build":""},{"file_name":"Indonesian.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/Languages\/Indonesian.lan","path":"Languages","build":""},{"file_name":"Italian.ini","download_url":"http:\/\/downloads.wisecleaner.com\/up
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 4e 6f 72 77 65 67 69 61 6e 28 4e 79 6e 6f 72 73 6b 29 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 50 65 72 73 69 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 50 65 72 73 69 61 6e 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 50 6f 6c 69 73 68 2e 69 Data Ascii: /care365_v6\/Languages\/Norwegian(Nynorsk).lan","path":"Languages","build":""},{"file_name":"Persian.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/Languages\/Persian.lan","path":"Languages","build":""},{"file_name":"Polish.i
2024-04-25 13:30:51 UTC	1369	IN	Data Raw: 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 53 6c 6f 76 65 6e 69 61 6e 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 4c 61 6e 67 75 61 67 65 73 5c 2f 53 6c 6f 76 65 6e 69 61 6e 2e 6c 61 6e 22 2c 22 70 61 74 68 22 3a 22 4c 61 6e 67 75 61 67 65 73 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 53 70 61 6e 69 73 68 28 53 70 61 69 6e 29 2e 69 6e 69 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 Data Ascii: ld":""},{"file_name":"Slovenian.ini","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/Languages\/Slovenian.lan","path":"Languages","build":""},{"file_name":"Spanish(Spain).ini","download_url":"http:\/\/downloads.wisecleaner.com\/upd
2024-04-25 13:30:51 UTC	677	IN	Data Raw: 5c 2f 54 68 65 6d 65 73 5f 76 36 5f 36 2e 31 2e 34 2e 36 30 31 2e 7a 69 70 22 2c 22 70 61 74 68 22 3a 22 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 2c 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 41 75 74 6f 53 68 75 74 64 6f 77 6e 2e 73 76 67 22 2c 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 64 6f 77 6e 6c 6f 61 64 73 2e 77 69 73 65 63 6c 65 61 6e 65 72 2e 63 6f 6d 5c 2f 75 70 64 61 74 65 5c 2f 63 61 72 65 33 36 35 5f 76 36 5c 2f 74 6f 6f 6c 73 5c 2f 69 6d 67 2e 7a 69 70 22 2c 22 70 61 74 68 22 3a 22 74 6f 6f 6c 73 5c 2f 69 6d 67 22 2c 22 62 75 69 6c 64 22 3a 22 22 7d 5d 2c 22 6d 61 69 6e 5f 65 78 65 22 3a 22 57 69 73 65 43 61 72 65 33 36 35 2e 65 78 65 22 2c 22 62 6c 6f 67 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 Data Ascii: \/Themes_v6_6.1.4.601.zip","path":"","build":""},{"file_name":"AutoShutdown.svg","download_url":"http:\/\/downloads.wisecleaner.com\/update\/care365_v6\/tools\/img.zip","path":"tools\/img","build":""}],"main_exe":"WiseCare365.exe","blog_url":"https:\/\/ww
2024-04-25 13:30:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49914	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:30:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PwDlxXseu3VEHbh&MD=lcm7x2Bz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 13:30:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 46ce702e-3a16-4f59-881a-2ccf52b5af36 MS-RequestId: 5c25ac02-9ad0-4bf2-87a1-4cb53cb96b88 MS-CV: IMVVUYxkb06ZrHSe.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 13:30:58 GMT Connection: close Content-Length: 25457
2024-04-25 13:30:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-25 13:30:59 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	15:30:00
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe"
Imagebase:	0x400000
File size:	20'168'536 bytes
MD5 hash:	C27C3107BB20803C3F5D8EAB7258BB48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:30:00
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-0JG3C.tmp\SecuriteInfo.com.FileRepPup.14974.19067.tmp" /SL5="$1045C,19204712,857088,C:\Users\user\Desktop\SecuriteInfo.com.FileRepPup.14974.19067.exe"
Imagebase:	0x400000
File size:	2'680'240 bytes
MD5 hash:	A7F5051B66AD0D9965C6DC9DF8955ED4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:30:01
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f
Imagebase:	0xff0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:30:01
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:30:29
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:30:29
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"
Imagebase:	0x400000
File size:	18'762'136 bytes
MD5 hash:	A020B60C4DD43183E92322EBBD984622
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000000.1959149673.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:30:29
Start date:	25/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:30:30
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1076,i,16708299124163291726,5417237086903671621,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:30:37
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe"
Imagebase:	0x400000
File size:	651'216 bytes
MD5 hash:	29887FFC5D12948658902E66BDAA09AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000C.00000000.2045282560.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:30:46
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"
Imagebase:	0x400000
File size:	8'538'008 bytes
MD5 hash:	4E793E5FBA64A9EDCDDB922E1AA9DAC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000E.00000000.2133553791.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.9%
Total number of Nodes:	115
Total number of Limit Nodes:	11

Executed Functions

Function 6C182B3F Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,6C1821E7,6C182098,?,?,6C17A5B9,?,?,6C171043,00000040,2ADA91DB,?,?,6C18BE4F), ref: 6C182B44
_free.LIBCMT ref: 6C182B79
_free.LIBCMT ref: 6C182BA0
SetLastError.KERNEL32(00000000), ref: 6C182BAD
SetLastError.KERNEL32(00000000), ref: 6C182BB6

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: fe41fcd617e27e3dcafbf49dc94b10a5e6375d46a64f63195dfd5cef5e0dc0a4
Instruction ID: f4fbd6678f1ae0dfba30bdb54404ae4fa77e628470eeb125f379ece100b4047b
Opcode Fuzzy Hash: fe41fcd617e27e3dcafbf49dc94b10a5e6375d46a64f63195dfd5cef5e0dc0a4
Instruction Fuzzy Hash: 5701D67664FA026AD6139B354C8CE4B31399BC3BB97290225FC05A2A40FB24C80559A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C2458F3 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,6C246D18,00000000,00000001,00000000,00000000,00000000,?,6C246F8D,00000001,00000214,?,6C246CCE), ref: 6C245936

Part of subcall function 6C2447DE: __getptd_noexit.LIBCMT ref: 6C2447DE

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a1d51e551be94c691a006970e251dd12c429a54a5edb1e0446a87bffe967bf5b
Instruction ID: 4dd12e005e43579be434d1cf58c3821b7cd6a24aa277a3ed360065b5ace99836
Opcode Fuzzy Hash: a1d51e551be94c691a006970e251dd12c429a54a5edb1e0446a87bffe967bf5b
Instruction Fuzzy Hash: 2701B93131522A9BEB1ECE25C814B5A33A4AB82775F15C639FCD5CA9D0DB70D400C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1820A3 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6C182B70,00000001,00000364,?,?,?,6C1821E7,6C182098,?,?,6C17A5B9,?), ref: 6C1820E4

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2025048b7ef34cc6dad58ed5aa208700aa6629a35f79ffe5c9242b0dfa267450
Instruction ID: 9204d3f5bb112689ceb89e9dc7775a8750b3de2503938fffd79316079378d65b
Opcode Fuzzy Hash: 2025048b7ef34cc6dad58ed5aa208700aa6629a35f79ffe5c9242b0dfa267450
Instruction Fuzzy Hash: 50F0543168F625A6EB235B669C08F4B3799AB52764B254211AC14E79D4CF30E804DEE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C21DF70 Relevance: 81.6, APIs: 32, Strings: 14, Instructions: 1134COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C21E02E
_memset.LIBCMT ref: 6C21E063
sqlite3_initialize.SQLITE3 ref: 6C21E06B
_memset.LIBCMT ref: 6C21E09C
sqlite3_strnicmp.SQLITE3(?,tokenize,00000008), ref: 6C21E0EA
sqlite3_mprintf.SQLITE3(6C25D55C,?), ref: 6C21E112
sqlite3_strnicmp.SQLITE3(?,?,0000000A), ref: 6C21E255
sqlite3_free.SQLITE3 ref: 6C21E28E
sqlite3_free.SQLITE3(?), ref: 6C21E53A
sqlite3_free.SQLITE3(?), ref: 6C21E547
sqlite3_free.SQLITE3(?), ref: 6C21E566
sqlite3_mprintf.SQLITE3(6C25D55C,simple), ref: 6C21E62C

Part of subcall function 6C21D7A0: sqlite3_mprintf.SQLITE3(6C25D55C), ref: 6C21D7CD

sqlite3_initialize.SQLITE3 ref: 6C21E6CC
_memset.LIBCMT ref: 6C21E72D
sqlite3_strnicmp.SQLITE3(?,?,?), ref: 6C21E928

Strings

tokenize, xrefs: 6C21E0E4
desc, xrefs: 6C21E3AF
unrecognized matchinfo: %s, xrefs: 6C21E2D6
unrecognized parameter: %s, xrefs: 6C21E278
missing %s parameter in fts4 constructor, xrefs: 6C21EA24
error parsing prefix parameter: %s, xrefs: 6C21E68D
fts3, xrefs: 6C21E2BF
asc, xrefs: 6C21E387
compress, xrefs: 6C21E1B1, 6C21EA15, 6C21EA23
simple, xrefs: 6C21E622, 6C21E64E
uncompress, xrefs: 6C21E1C7, 6C21EA1E
matchinfo, xrefs: 6C21E185
unrecognized order: %s, xrefs: 6C21E3C6
no such column: %s, xrefs: 6C21E9DC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$_memsetsqlite3_initializesqlite3_mprintfsqlite3_strnicmp
String ID: asc$compress$desc$error parsing prefix parameter: %s$fts3$matchinfo$missing %s parameter in fts4 constructor$no such column: %s$simple$tokenize$uncompress$unrecognized matchinfo: %s$unrecognized order: %s$unrecognized parameter: %s
API String ID: 2956600794-94978937
Opcode ID: 17e4d25be731f7d24ef38ca2ee090b27758583569628b04490058315034311c2
Instruction ID: 124c5947878b1f71690d446be469cdfd7e5394d8dbf7a9ade8cdb5f4d1e9f12f
Opcode Fuzzy Hash: 17e4d25be731f7d24ef38ca2ee090b27758583569628b04490058315034311c2
Instruction Fuzzy Hash: 88928BB1A083158BD701CF29C888A5BB7E4BF86309F044929FD8997F41DB75D949CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C21B830 Relevance: 35.6, APIs: 10, Strings: 10, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_initialize.SQLITE3 ref: 6C21B865
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00021319,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C21B89C
_memset.LIBCMT ref: 6C21B951
sqlite3_free.SQLITE3(00000000), ref: 6C21B99A
sqlite3_errcode.SQLITE3(?), ref: 6C21BD06
sqlite3_uri_parameter.SQLITE3(?,hexkey), ref: 6C21BD56

Strings

%s at line %d of [%.10s], xrefs: 6C21B895
`, xrefs: 6C21BA06
RTRIM, xrefs: 6C21BAB7
BINARY, xrefs: 6C21BA3D, 6C21BA6F, 6C21BA87, 6C21BAD3
temp, xrefs: 6C21BC02
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C21B886
main, xrefs: 6C21BBF2
hexkey, xrefs: 6C21BD50
misuse, xrefs: 6C21B890
NOCASE, xrefs: 6C21BA9F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_errcodesqlite3_freesqlite3_initializesqlite3_logsqlite3_uri_parameter
String ID: %s at line %d of [%.10s]$BINARY$NOCASE$RTRIM$`$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$hexkey$main$misuse$temp
API String ID: 1260756807-2503352190
Opcode ID: ac53dad6647bcc957b68fbc9fdee217bc777ac31c929abfb21f39e384b072634
Instruction ID: 525891c341867c1add9f25b9b715e2140b1190291c1a373fd148229135c4aabf
Opcode Fuzzy Hash: ac53dad6647bcc957b68fbc9fdee217bc777ac31c929abfb21f39e384b072634
Instruction Fuzzy Hash: 3512E1F1A0834A9BD701CF29C881B9677F4BB45308F184969EE548BF82E775D409CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B8A30 Relevance: 26.8, APIs: 13, Strings: 2, Instructions: 596COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B8B4B

Strings

:memory:, xrefs: 6C1B8A86
@, xrefs: 6C1B8B75

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: :memory:$@
API String ID: 2102423945-2169683656
Opcode ID: 8042c32d3513c2b71b2f76b3925d62b3d9bcde99a70e806c13a5ffc42e3f6d43
Instruction ID: 31a202eaf2911fb6fc33155c02e137369554fa52f2df88af5010bf16a7dfe4d2
Opcode Fuzzy Hash: 8042c32d3513c2b71b2f76b3925d62b3d9bcde99a70e806c13a5ffc42e3f6d43
Instruction Fuzzy Hash: BD2214B0A012168FEB11CF65C8D4B9A77B4BF25708F2441AED819BB782DB31D945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C221840 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 290COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3(?), ref: 6C2218BB
sqlite3_free.SQLITE3(?), ref: 6C2218C7
sqlite3_free.SQLITE3(?), ref: 6C2218E6
_memset.LIBCMT ref: 6C2218FE
sqlite3_value_numeric_type.SQLITE3(?), ref: 6C22190F
sqlite3_value_numeric_type.SQLITE3(?), ref: 6C22193D
sqlite3_blob_close.SQLITE3(?), ref: 6C221A55
sqlite3_mprintf.SQLITE3(SELECT %s ORDER BY rowid %s,?,DESC), ref: 6C221AB5
sqlite3_mprintf.SQLITE3(SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s,?,?,?,?,?,DESC), ref: 6C221AEC

Part of subcall function 6C21F1C0: sqlite3_mprintf.SQLITE3(SELECT %s WHERE rowid = ?,?), ref: 6C21F1DE

sqlite3_free.SQLITE3(00000000), ref: 6C221B14
sqlite3_bind_value.SQLITE3(00000000,00000001,?), ref: 6C221B4F

Strings

DESC, xrefs: 6C221A9C, 6C221AAE, 6C221AC3, 6C221AD5
SELECT %s ORDER BY rowid %s, xrefs: 6C221AB0
ASC, xrefs: 6C221AA3, 6C221ACA
SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 6C221AE7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf$sqlite3_value_numeric_type$_memsetsqlite3_bind_valuesqlite3_blob_closesqlite3_finalize
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 3144557152-3496276579
Opcode ID: 60dd51060c780b8d6c4fd2d4272a3bc58265d84bde597c56f25b4217ce9f081c
Instruction ID: 3c8a04a7762062b6888aa2d61e792ffe4857688b616ed637ff7bda03e99e46eb
Opcode Fuzzy Hash: 60dd51060c780b8d6c4fd2d4272a3bc58265d84bde597c56f25b4217ce9f081c
Instruction Fuzzy Hash: EEA1F27160474A9FD310CF69C880F97B3E4AB84319F148629FC69C7B41E77AE889C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BDEC0 Relevance: 24.3, APIs: 10, Strings: 3, Instructions: 1583COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E1C0,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BDFDF

Strings

%s at line %d of [%.10s], xrefs: 6C1BDFD8, 6C1BE57D, 6C1BE5AC, 6C1BE807, 6C1BE832, 6C1BE8CF, 6C1BEB40, 6C1BF1B4
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BDFC9, 6C1BE56E, 6C1BE59D, 6C1BE7F8, 6C1BE823, 6C1BE8C0, 6C1BEB31, 6C1BF1A5
database corruption, xrefs: 6C1BDFD3, 6C1BE578, 6C1BE5A7, 6C1BE802, 6C1BE82D, 6C1BE8CA, 6C1BEB3B, 6C1BF1AF

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 97b20acf18143bbf0737ad15d9f1f1be0da8090c9fae1829c64d2004be2fd5bc
Instruction ID: 0b1ce1b5c2c265c1670e69c20357f965fbf32afd7eadbcd2373d96b32bfa4892
Opcode Fuzzy Hash: 97b20acf18143bbf0737ad15d9f1f1be0da8090c9fae1829c64d2004be2fd5bc
Instruction Fuzzy Hash: B4E27C746083418FC314CF29C480B5AB7F1BF99308F1489ADE899ABB51D735E946CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6C231B60 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 620COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,?,?,00000000,00000001,00000000), ref: 6C231BC4
sqlite3_bind_int64.SQLITE3(?,00000002,00000000,?,?,00000001,?,?,00000000,00000001,00000000), ref: 6C231BD5
sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,00000000,00000001,00000000), ref: 6C231BE1
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,00000000,00000001,00000000), ref: 6C231D3A
sqlite3_mprintf.SQLITE3(SELECT %s,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,00000000), ref: 6C231D68
sqlite3_finalize.SQLITE3(?), ref: 6C231D7F
sqlite3_free.SQLITE3(00000000), ref: 6C231DE5
sqlite3_step.SQLITE3(?), ref: 6C231DF8
sqlite3_column_text.SQLITE3(?,?), ref: 6C232142
sqlite3_column_bytes.SQLITE3(?,?,?,?), ref: 6C23214F

Strings

<$#l, xrefs: 6C231DB3, 6C232313
SELECT %s, xrefs: 6C231D5B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mprintfsqlite3_step$sqlite3_bind_valuesqlite3_column_bytessqlite3_column_textsqlite3_finalizesqlite3_freesqlite3_reset
String ID: <$#l$SELECT %s
API String ID: 1003252418-3835304549
Opcode ID: aa242cc2d93aa15c31b663b8840437bca83b9f384345de2a0826d292c9dee83b
Instruction ID: 5805232cb39de2bb9be85cfa4e0b003fa7ae783760529cbff8a025c12accb739
Opcode Fuzzy Hash: aa242cc2d93aa15c31b663b8840437bca83b9f384345de2a0826d292c9dee83b
Instruction Fuzzy Hash: B7327AB06087558FD724CF68C884B5BB7F5BF85308F20492DE9A98B751D731E886CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C22DDE0 Relevance: 21.2, APIs: 14, Instructions: 250COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3(?,?,00000000), ref: 6C22DE10
sqlite3_free.SQLITE3(00000000,?,?,?,?,00000000), ref: 6C22DE67
sqlite3_bind_int64.SQLITE3(?,00000001,00000000,00000000,?,?,?,?,00000000), ref: 6C22DE8A
sqlite3_step.SQLITE3(?,?,00000001,00000000,00000000,?,?,?,?,00000000), ref: 6C22DE94
sqlite3_column_bytes.SQLITE3(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22DEA8
sqlite3_column_blob.SQLITE3(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22DEB4
_memset.LIBCMT ref: 6C22DED1
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22DEDE
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22DEEF
sqlite3_free.SQLITE3(00000000), ref: 6C22DFAA
sqlite3_bind_int64.SQLITE3(?,00000001,00000000,00000000), ref: 6C22DFC9
sqlite3_step.SQLITE3(?), ref: 6C22E046
sqlite3_reset.SQLITE3(?), ref: 6C22E04F
sqlite3_free.SQLITE3(00000000), ref: 6C22E05D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_bind_int64sqlite3_resetsqlite3_step$_memsetsqlite3_column_blobsqlite3_column_bytessqlite3_initialize
String ID:
API String ID: 3220301254-0
Opcode ID: 7223cce5428e65cb1f94871a8a15aba396e8e20196d34a80edb9112cec818d36
Instruction ID: 3fcc67e2b0aeaad77ed9d8ef795849c5e36f89171fecb284a2addc92fa4e71f8
Opcode Fuzzy Hash: 7223cce5428e65cb1f94871a8a15aba396e8e20196d34a80edb9112cec818d36
Instruction Fuzzy Hash: 2A81C1757043069BD710CF28D881B9BB3E4AF84719F140568FD489B740EB39E909CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C22FE70 Relevance: 16.7, APIs: 11, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,?,?,?,00000000,?), ref: 6C22FEAD
sqlite3_bind_int64.SQLITE3(?,00000002,?,?,?,00000001,?,?,?,00000000,?), ref: 6C22FEBE
sqlite3_step.SQLITE3(?,?,00000002,?,?,?,00000001,?,?,?,00000000,?), ref: 6C22FEC4
sqlite3_column_int.SQLITE3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C22FED4
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C22FEE0
sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22FF0D
sqlite3_column_int64.SQLITE3(?,00000000), ref: 6C22FF1D
sqlite3_reset.SQLITE3(?), ref: 6C22FF4A
sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C22FF82
sqlite3_step.SQLITE3(?), ref: 6C22FFAC
sqlite3_reset.SQLITE3(?), ref: 6C22FFB5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$sqlite3_bind_valuesqlite3_column_intsqlite3_column_int64sqlite3_mprintf
String ID:
API String ID: 28351138-0
Opcode ID: b0face03c4268720049a922cafb035d34b69f146bdf4dd214da6dbb04063a604
Instruction ID: 4587b11116a6616819394f3d4d89a84b536d076f6b95c6d50fcfb09d6540e4e2
Opcode Fuzzy Hash: b0face03c4268720049a922cafb035d34b69f146bdf4dd214da6dbb04063a604
Instruction Fuzzy Hash: 4D5160B1A00616AFD701CF69D841A8AB7B8FF5930CF048265F90897B41E735EA65CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C22B500 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,?,?,?,?,?,?,?,6C22D9E3,?,?,?), ref: 6C22B537
sqlite3_bind_int64.SQLITE3(?,00000002,?,?,?,00000001,?,?,?,?,?,?,?,6C22D9E3,?,?), ref: 6C22B545
sqlite3_bind_int64.SQLITE3(?,00000003,00000001,?,?,00000002,?,?,?,00000001,?,?,?,?,?), ref: 6C22B555
sqlite3_bind_int64.SQLITE3(?,00000004,?,?,?,00000003,00000001,?,?,00000002,?,?,?,00000001,?,?), ref: 6C22B565
sqlite3_bind_int64.SQLITE3(?,00000005,?,?), ref: 6C22B584

Part of subcall function 6C1CAB00: sqlite3_log.SQLITE3(00000015,API called with finalized prepared statement,?,?,?,6C1CAC80,?,?,?,?,6C1CAD7E,?,?,?,?,00000000), ref: 6C1CAB22
Part of subcall function 6C1CAB00: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00012013,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1CAC55

sqlite3_mprintf.SQLITE3(%lld %lld,?,?,?,00000001), ref: 6C22B59D
sqlite3_step.SQLITE3(?), ref: 6C22B638
sqlite3_reset.SQLITE3(?), ref: 6C22B641

Strings

%lld %lld, xrefs: 6C22B598

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_logsqlite3_mprintf$sqlite3_bind_valuesqlite3_resetsqlite3_step
String ID: %lld %lld
API String ID: 1792184958-3794783949
Opcode ID: ffc7c421226c79368e456f62db2f7d8dfe42e0865faa9abcaaf4c9953140d18c
Instruction ID: dd260a0cccddcc6a05fb75cb2a60cde9858de225ba86ef101abc967c35503a01
Opcode Fuzzy Hash: ffc7c421226c79368e456f62db2f7d8dfe42e0865faa9abcaaf4c9953140d18c
Instruction Fuzzy Hash: 6B419FB57001096BE710DA59DC45FFB33A9AB94329F040214FD1997B80EB79E81587F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A4930 Relevance: 15.2, APIs: 5, Strings: 3, Instructions: 1197COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1A53F6
Inf, xrefs: 6C1A5152
+, xrefs: 6C1A4FB2

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: +$Inf$gfff
API String ID: 0-4047550567
Opcode ID: 48eb05ffcf26e40239042f995db3da5d76f31cb999f8db2b8e2a4c42bc6b1660
Instruction ID: 9a10070f62c011a4bb8f6eb48903d91e0f26540ec43c1de7397428f4aebfbc81
Opcode Fuzzy Hash: 48eb05ffcf26e40239042f995db3da5d76f31cb999f8db2b8e2a4c42bc6b1660
Instruction Fuzzy Hash: FA924979A0D7429FD306CFA8C48035ABBF0AF96308F14599DE8C597741EB75C84ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C2364B0 Relevance: 13.7, APIs: 9, Instructions: 197COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2364CF
sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C236527
sqlite3_step.SQLITE3(?,?,00000001,?,?), ref: 6C236530
sqlite3_column_blob.SQLITE3(?,00000000,?,00000061,00000000), ref: 6C236547
sqlite3_column_bytes.SQLITE3(?,00000000,?,00000000,?,00000061,00000000), ref: 6C23655D
sqlite3_initialize.SQLITE3(?,?,?,?,?,00000061,00000000), ref: 6C236574
sqlite3_reset.SQLITE3(?,?,00000061,00000000), ref: 6C2365F9
sqlite3_free.SQLITE3(?,?,?,00000061,00000000), ref: 6C236665
__allrem.LIBCMT ref: 6C2366A7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_initializesqlite3_resetsqlite3_step
String ID:
API String ID: 2262414560-0
Opcode ID: 40fd34a511339b952d9030935cf46ceeafe73187f18d4d6a3da66988659f6a28
Instruction ID: 25173165b14c09b5f5d072eb4208e318b787306b5d0911ec53f7413906e6327e
Opcode Fuzzy Hash: 40fd34a511339b952d9030935cf46ceeafe73187f18d4d6a3da66988659f6a28
Instruction Fuzzy Hash: D5616DB1A047269FD724CF29C480A5AB7E8FB44719F14862DFC598BB40D335E8548FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D1C00 Relevance: 13.0, APIs: 2, Strings: 5, Instructions: 729COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1D1C9C

Strings

cannot open %s column for writing, xrefs: 6C1D21ED
no such column: "%s", xrefs: 6C1D2197
cannot open view: %s, xrefs: 6C1D2101
cannot open virtual table: %s, xrefs: 6C1D20D3
cannot open table without rowid: %s, xrefs: 6C1D20EA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$no such column: "%s"
API String ID: 2102423945-1501083125
Opcode ID: e07a353a558ae8b3d2e61bcfe54ead3904bce3a4f24500553087839788fd4035
Instruction ID: 13cab3372f30a0ed7e6fe3bc4a85ec1b04a561958261df02965fce5cee857b51
Opcode Fuzzy Hash: e07a353a558ae8b3d2e61bcfe54ead3904bce3a4f24500553087839788fd4035
Instruction Fuzzy Hash: A452B2B06043018FD715CF29C488B5AB7F1BF99318F26856DE8A99BB41D734F845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1FD5F0 Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 697COMMON

Download Yara Rule

Strings

ORDER BY clause should come after %s not before, xrefs: 6C1FD675
UNION, xrefs: 6C1FD65A, 6C1FD6A4, 6C1FD6A9
UNION ALL, xrefs: 6C1FD66F, 6C1FD6CB, 6C1FD6D0
EXCEPT, xrefs: 6C1FD668, 6C1FD674, 6C1FD6BE, 6C1FD6C3
INTERSECT, xrefs: 6C1FD661, 6C1FD6B1, 6C1FD6B6
LIMIT clause should come after %s not before, xrefs: 6C1FD6AA, 6C1FD6B7, 6C1FD6C4, 6C1FD6D1

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: EXCEPT$INTERSECT$LIMIT clause should come after %s not before$ORDER BY clause should come after %s not before$UNION$UNION ALL
API String ID: 0-1603949139
Opcode ID: 8274106a03ca00f69d2ba9c263b0da58e5c62acc870d6f5fd0319703feba1f43
Instruction ID: 06ed9aef4f306de900e518d25bbd74fb76d098bcaae42502e320a56f1798604c
Opcode Fuzzy Hash: 8274106a03ca00f69d2ba9c263b0da58e5c62acc870d6f5fd0319703feba1f43
Instruction Fuzzy Hash: D7427BB46087009FC314DF28C480A6BB7F5BF99708F54892DF8A98BB51D734E946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C225C50 Relevance: 12.3, APIs: 8, Instructions: 348COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C225D3D
sqlite3_free.SQLITE3(?), ref: 6C225D6D
sqlite3_initialize.SQLITE3 ref: 6C225D8B
sqlite3_free.SQLITE3(?), ref: 6C225DBB
sqlite3_initialize.SQLITE3(?,?,?,?,?,?,?,?,?,6C226259,?,?,00000000,?,00000000,00000001), ref: 6C225E92
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C226259,?,?), ref: 6C225EC2
_memset.LIBCMT ref: 6C225FC5
sqlite3_free.SQLITE3(?), ref: 6C22600A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$_memset
String ID:
API String ID: 129612031-0
Opcode ID: c3f0d49778c4d1bafeb7132d5ad0930f73d60711b79fc318e6e5574d9b3a8bc0
Instruction ID: 9a99edf4bc77c8e527765c889481c148fbb9405a1407af43e4b999c8ef7e95c5
Opcode Fuzzy Hash: c3f0d49778c4d1bafeb7132d5ad0930f73d60711b79fc318e6e5574d9b3a8bc0
Instruction Fuzzy Hash: 06D16BB16093069FD711CF29C884A5BB7E4BF88318F048A2DFC4997755E778E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C22BBE0 Relevance: 12.3, APIs: 8, Instructions: 335COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3(?,00000000,?,?,?,?,?,?,6C22D985,?,?,?,?,?), ref: 6C22BBF8
_memset.LIBCMT ref: 6C22BC23
sqlite3_initialize.SQLITE3(?,?,?,00000000,?,?,?,?,?,?,6C22D985,?,?,?,?,?), ref: 6C22BC36
sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C22BC88
sqlite3_column_int64.SQLITE3(?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C22BC98
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C22BCB2
sqlite3_initialize.SQLITE3 ref: 6C22BE24
sqlite3_realloc.SQLITE3(?,6C22D985,?,?,?,?,00000000,?,?,?,?,?,?,6C22D985,?,?), ref: 6C22BF46

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize$_memsetsqlite3_column_int64sqlite3_reallocsqlite3_resetsqlite3_step
String ID:
API String ID: 1480127802-0
Opcode ID: 093ce8026e7decc37474dec619d13a67a9efcabf47118283cde908fe3ca72e75
Instruction ID: 91e4ed8f421bdfad7259c29bd43fe5838a48ea34f3d58d15ba08344137b85a5c
Opcode Fuzzy Hash: 093ce8026e7decc37474dec619d13a67a9efcabf47118283cde908fe3ca72e75
Instruction Fuzzy Hash: 60C16FB1A087059FD314CF29C880A5BB7E5FF98318F184A2DF98A97B51E734E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C20F540 Relevance: 11.6, APIs: 2, Strings: 4, Instructions: 1116COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000011C,automatic index on %s(%s),?), ref: 6C20F756
_memset.LIBCMT ref: 6C20F97A

Strings

B, xrefs: 6C20FAB5
BINARY, xrefs: 6C20FB56, 6C20FBA7, 6C20FBEA, 6C20FC12
automatic index on %s(%s), xrefs: 6C20F74C
A, xrefs: 6C20FA95

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_log
String ID: A$B$BINARY$automatic index on %s(%s)
API String ID: 1972405431-2328087975
Opcode ID: c32723a2d81e723e1fa7319a87aa3a400983941f9740d1814cdbb39f7d8a1113
Instruction ID: 8d783daba32b9d850f73ff8e33791221dea244fbfb5bcc838b193c385dcd16da
Opcode Fuzzy Hash: c32723a2d81e723e1fa7319a87aa3a400983941f9740d1814cdbb39f7d8a1113
Instruction Fuzzy Hash: 80A29C746087468FD714CF28C480A57B7F1FF89308F148A5EE8998BB92E731E855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C239A00 Relevance: 10.6, APIs: 7, Instructions: 137COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(00000000), ref: 6C239AA6
sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C239AE4
sqlite3_step.SQLITE3(?,?,00000001,?,?), ref: 6C239AED
sqlite3_reset.SQLITE3(?), ref: 6C239AF9
sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C239B13
sqlite3_step.SQLITE3(?,?,00000001,?,?), ref: 6C239B1C
sqlite3_reset.SQLITE3(?), ref: 6C239B28

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$sqlite3_free
String ID:
API String ID: 1869056413-0
Opcode ID: 5ebfaef8bc1b30bf6b9daa14a0b4c070c0b15a190be678d96b8588ee4c7b1939
Instruction ID: e4e70640c13fae039e770943d1ef96da7cbf7dff6e6a44a4cf28b6cbfa3e780c
Opcode Fuzzy Hash: 5ebfaef8bc1b30bf6b9daa14a0b4c070c0b15a190be678d96b8588ee4c7b1939
Instruction Fuzzy Hash: B94191F1A04215ABD700EF29D88096773B8EF85329F049669FC1D8B741EB35E814CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C185D2B Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C185E71

Strings

1#IND, xrefs: 6C187069
1#QNAN, xrefs: 6C187077
1#SNAN, xrefs: 6C187070
1#INF, xrefs: 6C18707E

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d3d80419045e72d5c3de4cdbf37287acbff5a70c54db80445aa31c4871bdec16
Instruction ID: bb63e3ab9d76eb14a7d04351394d1170cc10b3e1eeb1c2cc9b8172630f945dec
Opcode Fuzzy Hash: d3d80419045e72d5c3de4cdbf37287acbff5a70c54db80445aa31c4871bdec16
Instruction Fuzzy Hash: 5BC26C71E1E6288FDB25CE28DD407DAB3B5EB55308F1542EAD84DE7640E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 6C234B00 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

Strings

unknown error, xrefs: 6C234DD9
<b>, xrefs: 6C234B16
string or blob too big, xrefs: 6C234B7F, 6C234F16, 6C234F41, 6C234F67
abort due to ROLLBACK, xrefs: 6C234E00, 6C234E07

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: <b>$abort due to ROLLBACK$string or blob too big$unknown error
API String ID: 0-3830260191
Opcode ID: 32a70b2fa1831d7ed0296d8d1696cac3d14391b435fd04f9a9e4f43d81d7f579
Instruction ID: 6a24f647658339de9b897c52ee5b67b38078858a64fbd2adb59015fb36a4104b
Opcode Fuzzy Hash: 32a70b2fa1831d7ed0296d8d1696cac3d14391b435fd04f9a9e4f43d81d7f579
Instruction Fuzzy Hash: 92D183B0A002298FDB24CF69C884B9ABBF1BF48315F1485ADE85DD7B41D731A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C229F70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?,00000000,?,?,?,00000000,6C232C3A,?), ref: 6C22A00E

Strings

:,#l, xrefs: 6C22A088, 6C229FBD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64
String ID: :,#l
API String ID: 3007292478-1965564495
Opcode ID: 36d3dbe41637bdd2a6be9e2b2db1d3fa174d158bb6c0a6176d528388d2881258
Instruction ID: 63822df93afa02f7eac0cd2df59764eb3dfa436aa971a7b8819cfabec54fc75b
Opcode Fuzzy Hash: 36d3dbe41637bdd2a6be9e2b2db1d3fa174d158bb6c0a6176d528388d2881258
Instruction Fuzzy Hash: 183158B26012099FD320DF15D841BA2F3A5FB80319F04C699FC594BB42E736E8A1C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6C231810 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,00000002,00000000), ref: 6C2318B5
sqlite3_bind_int64.SQLITE3(?,00000002,00000008,?,?,00000001,00000002,00000000), ref: 6C2318C3
sqlite3_step.SQLITE3(?,?,00000002,00000008,?,?,00000001,00000002,00000000), ref: 6C2318C9
sqlite3_reset.SQLITE3(?), ref: 6C2318D2

Strings

CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);, xrefs: 6C231872

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_resetsqlite3_step
String ID: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
API String ID: 3032042052-3682956527
Opcode ID: c38a9bb69bb9bb9e7917e48eeb5bb007faa89aff0284839f6f6c1d0e3f6da21d
Instruction ID: a7ee1fce53f5c4d668a3cfbf59cd116fafa79ee3b504f6db78d00e0d9e22b5bc
Opcode Fuzzy Hash: c38a9bb69bb9bb9e7917e48eeb5bb007faa89aff0284839f6f6c1d0e3f6da21d
Instruction Fuzzy Hash: 952104B0604A1A6FF3018A24C851FE773E9AF41308F049905FC488AA81E774E9A987DA

Uniqueness

Uniqueness Score: -1.00%

Function 6C1786E0 Relevance: 7.7, APIs: 5, Instructions: 220fileCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00070000,00000000,00000000,?,00000018,?,00000000), ref: 6C178760
ReadFile.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 6C1787C2
__aulldiv.LIBCMT ref: 6C1787EF

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ControlDeviceFileRead__aulldiv
String ID:
API String ID: 3690653572-0
Opcode ID: a49c2f7d0efa6b34b9044e12e427174396001c6b95fa4e8f36f714930a05d985
Instruction ID: 9e635cfc702939df210175ae97e63ecd47ea0958dfaa1e686020f1c0fb44604d
Opcode Fuzzy Hash: a49c2f7d0efa6b34b9044e12e427174396001c6b95fa4e8f36f714930a05d985
Instruction Fuzzy Hash: D181E9B16043409FE720CF25C880BA7B7E9FF88708F04566EF8899A691D774E954CB72

Uniqueness

Uniqueness Score: -1.00%

Function 6C22DCF0 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3(00000000,?,00000000), ref: 6C22DD12
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C22DD6C
sqlite3_bind_int64.SQLITE3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C22DD95
sqlite3_step.SQLITE3(?), ref: 6C22DDB6
sqlite3_reset.SQLITE3(?), ref: 6C22DDBF

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_freesqlite3_initializesqlite3_resetsqlite3_step
String ID:
API String ID: 2882628063-0
Opcode ID: 0ce3940c610d430d2937714f8dc19fe80616e3392fd2c36858059e926195ad5a
Instruction ID: 0868e19735c0987e91275b44ed6d84e76cba0bcb2b6b04d7ce0de27df52e2c41
Opcode Fuzzy Hash: 0ce3940c610d430d2937714f8dc19fe80616e3392fd2c36858059e926195ad5a
Instruction Fuzzy Hash: E821F17660020967D3119A559C81BEBB3ADDFC5228F040629FD488B740EB79F90A87E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C22DA70 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,00000002,00000000,?,?,?,?), ref: 6C22DAFA
sqlite3_step.SQLITE3(?,?,00000001,00000002,00000000,?,?,?,?), ref: 6C22DB00
sqlite3_column_int.SQLITE3(?,00000000,?,?,?,?,?,?,?,?,?), ref: 6C22DB0F
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C22DB27

Part of subcall function 6C22D7D0: _memset.LIBCMT ref: 6C22D7F6

sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?), ref: 6C22DB3E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_reset$_memsetsqlite3_bind_int64sqlite3_column_intsqlite3_step
String ID:
API String ID: 4127197742-0
Opcode ID: ec1a28bece3a1fb254a6797637c3fe37a15bffa3c58adaaaa74016e92c42c42a
Instruction ID: bdf5f10325f3fb8a1db1b56050f928eb3dd6e8c430234f2275b2581996268fc9
Opcode Fuzzy Hash: ec1a28bece3a1fb254a6797637c3fe37a15bffa3c58adaaaa74016e92c42c42a
Instruction Fuzzy Hash: FF210A72E0451A27D310A9646CD1AEAF358BF5172EF480739FD1896E40E72E6C68C2E3

Uniqueness

Uniqueness Score: -1.00%

Function 6C230E10 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,00000001,00000000,00000000,00000001,?,6C2310B3,00000000,?,00000001,?), ref: 6C230E4F
sqlite3_step.SQLITE3(?,?,00000001,00000001,00000000,00000000,00000001,?,6C2310B3,00000000,?,00000001,?), ref: 6C230E55
sqlite3_column_blob.SQLITE3(?,00000000,?,?,?,?,?,00000000,00000001,?,6C2310B3,00000000,?,00000001,?), ref: 6C230E64
sqlite3_column_bytes.SQLITE3(?,00000000,?,00000000,?,?,?,?,?,00000000,00000001,?,6C2310B3,00000000,?,00000001), ref: 6C230E6F

Part of subcall function 6C22EA40: sqlite3_initialize.SQLITE3(?,?,?,6C230E8D,?), ref: 6C22EA5D

sqlite3_reset.SQLITE3(?,?,?,?,?,?,00000000,00000001,?,6C2310B3,00000000,?,00000001,?), ref: 6C230EB3

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_bind_valuesqlite3_column_blobsqlite3_column_bytessqlite3_initializesqlite3_mprintfsqlite3_resetsqlite3_step
String ID:
API String ID: 3907657176-0
Opcode ID: 1ad7c27837e565ae9305db9dc5a64bde24f8290f323e70b2e1a8a22f0dee8ef8
Instruction ID: f486b53c82d5c58a0a7006b4a47cb89221ccd25fea3afae8e8ee8375c553fae8
Opcode Fuzzy Hash: 1ad7c27837e565ae9305db9dc5a64bde24f8290f323e70b2e1a8a22f0dee8ef8
Instruction Fuzzy Hash: 6511ACB1A043456BD700DE699885E9B77A8AFC2718F04892CFD188B741E779DA08C7E7

Uniqueness

Uniqueness Score: -1.00%

Function 6C243AA6 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C2453AF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C2453C4
UnhandledExceptionFilter.KERNEL32(6C2552EC), ref: 6C2453CF
GetCurrentProcess.KERNEL32(C0000409), ref: 6C2453EB
TerminateProcess.KERNEL32(00000000), ref: 6C2453F2

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 60c86d17b5db4d1a8e31fb6f5014d015d1487e93e27a050a65346a4ce34d844b
Instruction ID: fb311adc8893d42cb63587b20d7db40b649df42c6516b89200b381d01b13ec7e
Opcode Fuzzy Hash: 60c86d17b5db4d1a8e31fb6f5014d015d1487e93e27a050a65346a4ce34d844b
Instruction Fuzzy Hash: 8D21CDB8A11228DFDF07DF29D48C6453BB4FB0AB05F90A16AED08867C0E7B05581CB65

Uniqueness

Uniqueness Score: -1.00%

Function 6C23AB50 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,00000000,00000000), ref: 6C23ADCB
sqlite3_step.SQLITE3(?,?,00000001,00000000,00000000), ref: 6C23ADD8
sqlite3_reset.SQLITE3(?), ref: 6C23ADE8

Strings

d, xrefs: 6C23ADF0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step
String ID: d
API String ID: 3048644476-2564639436
Opcode ID: d017446e23829504319cfa6e36fcbf75825b02e88a9149e62412532aa5323b7e
Instruction ID: d4db4f87052538fc49039a0cffe550ef9433954a0ff9873b9c241ee46d152a83
Opcode Fuzzy Hash: d017446e23829504319cfa6e36fcbf75825b02e88a9149e62412532aa5323b7e
Instruction Fuzzy Hash: 91D189B1508319CFCB01CF59C880A5ABBF5BFC9709F148A6DF8985B611D736D906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C237A80 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C237AA4
sqlite3_step.SQLITE3(?,?,00000001,?,?), ref: 6C237AAD
sqlite3_reset.SQLITE3(?,00000000,?,00000000,?), ref: 6C237B7A
sqlite3_reset.SQLITE3(?), ref: 6C237B8F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_bind_int64sqlite3_step
String ID:
API String ID: 4282268999-0
Opcode ID: 44015fe06697f29cae73e96f6f947d594a2cf1032ebac68752ba4b590128a684
Instruction ID: 01f0b65ad18671e903371fc9bd3d3d929c4a1425e9b61321e08dd19e4f94ba0b
Opcode Fuzzy Hash: 44015fe06697f29cae73e96f6f947d594a2cf1032ebac68752ba4b590128a684
Instruction Fuzzy Hash: 8F31BCB1B00219DBDB20CF68D985A57B3F9AB44B19F040528FD59CBB40DB35E810CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C229630 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C229666
sqlite3_step.SQLITE3(?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C22966C
sqlite3_column_type.SQLITE3(?,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00000000), ref: 6C22967B
sqlite3_reset.SQLITE3(?,?,?,?,?,?,00000000,00000000,00000000,?,00000000), ref: 6C229689

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_bind_valuesqlite3_column_typesqlite3_mprintfsqlite3_resetsqlite3_step
String ID:
API String ID: 3328426425-0
Opcode ID: 9cc8121d005f579c6d6eb6e71dba0d2d3cb158db8cc97af7a199d172076e36cb
Instruction ID: faf8a49ad9695212c6ae4bb5972c8999a0d741a8ade4b2832fc6f8e92d0c12ef
Opcode Fuzzy Hash: 9cc8121d005f579c6d6eb6e71dba0d2d3cb158db8cc97af7a199d172076e36cb
Instruction Fuzzy Hash: 4801F9727082145BD711AA19AC42BEB33DCCBD2229F040176FC0CC7740E76A952982E7

Uniqueness

Uniqueness Score: -1.00%

Function 6C2295A0 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(00000000,00000001,00000000,?,?,?,00000000,?), ref: 6C2295D3
sqlite3_step.SQLITE3(00000000,00000000,00000001,00000000,?,?,?,00000000,?), ref: 6C2295D9
sqlite3_column_type.SQLITE3(00000000,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C2295E9
sqlite3_reset.SQLITE3(00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C229600

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_bind_valuesqlite3_column_typesqlite3_mprintfsqlite3_resetsqlite3_step
String ID:
API String ID: 3328426425-0
Opcode ID: ae55932cc8cd18b753e5e45cc793c4f519e7722f89227b7189c9cea0e4422f85
Instruction ID: 1c21e153fedb961d8a54256129a3d439b464de7a70a6428f37770ce211453cd1
Opcode Fuzzy Hash: ae55932cc8cd18b753e5e45cc793c4f519e7722f89227b7189c9cea0e4422f85
Instruction Fuzzy Hash: 5101B575B04219ABE700AE58AC42BDE73A8DB15319F140165FC08D7740FB76AA3487E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C238820 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C238839
sqlite3_bind_int64.SQLITE3(?,00000002,?,?,?,00000001,?,?), ref: 6C23884C
sqlite3_step.SQLITE3(?,?,00000002,?,?,?,00000001,?,?), ref: 6C238855
sqlite3_reset.SQLITE3(?), ref: 6C238861

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_resetsqlite3_step
String ID:
API String ID: 3032042052-0
Opcode ID: 7c567f7761661aa79c38d083c0c84c599c1c5cfecab248d054cab34fc0ae461f
Instruction ID: ce1120665efa229404a1bcac268c01f6f75fe3b067aef18ddd280fca1830b915
Opcode Fuzzy Hash: 7c567f7761661aa79c38d083c0c84c599c1c5cfecab248d054cab34fc0ae461f
Instruction Fuzzy Hash: C3F05EB5610214AFD614CF58DC86DEB33AD9B58228F004608BE5557B80DA76FC5087F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C238870 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C238889
sqlite3_bind_int64.SQLITE3(?,00000002,?,?,?,00000001,?,?), ref: 6C23889C
sqlite3_step.SQLITE3(?,?,00000002,?,?,?,00000001,?,?), ref: 6C2388A5
sqlite3_reset.SQLITE3(?), ref: 6C2388B1

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_resetsqlite3_step
String ID:
API String ID: 3032042052-0
Opcode ID: abd3a8a07745929cc35b0ed92bc0a6f51bf3734ca76ccca1084edd3c6cf5612b
Instruction ID: 05112206d2cccbdd6ee863b9835bee2d5e12b972c5a4224d8d1b3471ec863d97
Opcode Fuzzy Hash: abd3a8a07745929cc35b0ed92bc0a6f51bf3734ca76ccca1084edd3c6cf5612b
Instruction Fuzzy Hash: BEF05EB5610304ABD614CF54DC86DA733AD9B58628F004608BD5557B80EBB9FC1487F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F3EA0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 566COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3(00000001,00000000,?,?,?), ref: 6C1F4033
sqlite3_stricmp.SQLITE3(BINARY,?), ref: 6C1F4427

Strings

BINARY, xrefs: 6C1F4422

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: BINARY
API String ID: 912767213-907554435
Opcode ID: 9ca5bf462fa8318d1ce02cb75feb784e799acb99f7e714a085bd3fa178bc4ed7
Instruction ID: d21836bf38c2e7dc28bd42bef1a6e37298be0e3742aa8db7de477c6d2c1e5412
Opcode Fuzzy Hash: 9ca5bf462fa8318d1ce02cb75feb784e799acb99f7e714a085bd3fa178bc4ed7
Instruction Fuzzy Hash: 6322BD75B042199BDB00CF69D980BEEB3F1EF58318F184265E824ABB41D735E947CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C22EC40 Relevance: 4.8, APIs: 3, Instructions: 299COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C22EDB9
sqlite3_initialize.SQLITE3 ref: 6C22EE44
sqlite3_initialize.SQLITE3 ref: 6C22EE9F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize
String ID:
API String ID: 1587646821-0
Opcode ID: 91b1a805399fb837bb9d7cad142c361b40c3da1f3c3086c6612cb09dcc22b848
Instruction ID: b6aeb07869cf641c10f1127d9b38d322ed4946c7c9f384b384f8c9738615ea35
Opcode Fuzzy Hash: 91b1a805399fb837bb9d7cad142c361b40c3da1f3c3086c6612cb09dcc22b848
Instruction Fuzzy Hash: 25B19EB1A083458FD315CF29C480B6AF7E6EFC8319F184A2DE8D983741D778A909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C22FD70 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,?,?,?,?,?), ref: 6C22FDB2
sqlite3_step.SQLITE3(?,?,00000001,?,?,?,?,?), ref: 6C22FDB8
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?), ref: 6C22FE5B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_bind_valuesqlite3_mprintfsqlite3_resetsqlite3_step
String ID:
API String ID: 4265959322-0
Opcode ID: bba62ba7a1d6395de0eae9a7c2d0e7ed27598ae9b06e32a8e210b965f383fb3b
Instruction ID: 2caa2221a1b19c0ca8bd8dd0bd3764350a6becb83866fb17d8cbaeed44a9d885
Opcode Fuzzy Hash: bba62ba7a1d6395de0eae9a7c2d0e7ed27598ae9b06e32a8e210b965f383fb3b
Instruction Fuzzy Hash: D731E07060121A9BE716CF28D898B6773A8BF40719F040528FC55CBB82EB39E815C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C180285 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6C18037D
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C180387
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6C180394

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a9aa102cd4e744d6274f83d99da64e0fa2b5abaaa4b2f8eccb0fbf68027bef73
Instruction ID: ed490ec48f63801ccf2468cae1e79f019b1e9a0e08f579b67d4cc28548cb43cf
Opcode Fuzzy Hash: a9aa102cd4e744d6274f83d99da64e0fa2b5abaaa4b2f8eccb0fbf68027bef73
Instruction Fuzzy Hash: B131D67490221C9BCB21DF65D8887CDBBB8BF08314F5082DAE91CA7250EB749B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6C230D40 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 6C229310: sqlite3_mprintf.SQLITE3(INSERT INTO %Q.'%q_content' VALUES(%s),?,?,?), ref: 6C2294B6
Part of subcall function 6C229310: sqlite3_bind_value.SQLITE3(?,?,?), ref: 6C229560

sqlite3_bind_int64.SQLITE3(?,00000001,00000001,00000000,?,?,?,?,?,00000001,?), ref: 6C230D7A

Part of subcall function 6C1CAB00: sqlite3_log.SQLITE3(00000015,API called with finalized prepared statement,?,?,?,6C1CAC80,?,?,?,?,6C1CAD7E,?,?,?,?,00000000), ref: 6C1CAB22
Part of subcall function 6C1CAB00: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00012013,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1CAC55

sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 6C230DEC
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 6C230DF5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$sqlite3_bind_int64sqlite3_bind_valuesqlite3_mprintfsqlite3_resetsqlite3_step
String ID:
API String ID: 425786140-0
Opcode ID: fb883e1757497447b6c524e49f592f5abaf61385bd7bc37bbd2aecf32d6835d5
Instruction ID: 553b730a0cec8287af9d3d2674f48485d173c55f9fb85b1d4ade513699d8b332
Opcode Fuzzy Hash: fb883e1757497447b6c524e49f592f5abaf61385bd7bc37bbd2aecf32d6835d5
Instruction Fuzzy Hash: 7A11E4B960025A6BE3018A58DC81F9B73E9DF9522DF180128FD1897B81EB75F915C3F2

Uniqueness

Uniqueness Score: -1.00%

Function 6C181191 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6C181167,?,6C193590,0000000C,6C18129A,00000000,00000000,00000001,6C17AACC,6C193320,0000000C,6C17A975,?), ref: 6C1811B2
TerminateProcess.KERNEL32(00000000,?,6C181167,?,6C193590,0000000C,6C18129A,00000000,00000000,00000001,6C17AACC,6C193320,0000000C,6C17A975,?), ref: 6C1811B9
ExitProcess.KERNEL32 ref: 6C1811CB

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9e9e2d978cc4b64c686ac4ce892e473e0a0633308a40f829b5381981519288b1
Instruction ID: d4a6deb3db5814a0af8008b33f062a6b2137dc95acbb0ab145d691872421ee57
Opcode Fuzzy Hash: 9e9e2d978cc4b64c686ac4ce892e473e0a0633308a40f829b5381981519288b1
Instruction Fuzzy Hash: 52E04F3610A544ABCF016F60C908A883B3AFB03285B100214F9548BA21CB36D842DF40

Uniqueness

Uniqueness Score: -1.00%

Function 6C17FA50 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1e3c2d5c58663c819ff35cae56b32564b047a89b1a28a5b5f47e3d90beea19
Instruction ID: 2f348f48c670d92745cb3f98873f5b447c4761ee3dba0659f6d1f29d532203af
Opcode Fuzzy Hash: 0f1e3c2d5c58663c819ff35cae56b32564b047a89b1a28a5b5f47e3d90beea19
Instruction Fuzzy Hash: D0025E71E012199FDF24CFA9C89069EB7F1FF88314F25826AD925E7784D730AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C252409 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94dd75ba93cdb1d4db8bddbfb10460540b17b882b9e332546df72fa8c1ebfa7
Instruction ID: 3fff032db4f819bcb5eea704ed1c87bade913f61f93e9746b00cc0ae8a84f288
Opcode Fuzzy Hash: f94dd75ba93cdb1d4db8bddbfb10460540b17b882b9e332546df72fa8c1ebfa7
Instruction Fuzzy Hash: 50320162E29F064EDB239635C836336A258AFB73C5F55D727FC25B6DD6EB2880934100

Uniqueness

Uniqueness Score: -1.00%

Function 6C214490 Relevance: 1.9, Strings: 1, Instructions: 688COMMON

Download Yara Rule

Strings

P, xrefs: 6C2149CE

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 7394b737460d56f88ccfc7c87e2ae1b2e1ef0750457ea97ffe7cf94ada7d3d48
Instruction ID: 492717a6efcbe19d41d25e90f5e7895b4e3a3d6077c95997354e6139a49606ed
Opcode Fuzzy Hash: 7394b737460d56f88ccfc7c87e2ae1b2e1ef0750457ea97ffe7cf94ada7d3d48
Instruction Fuzzy Hash: 6D624A7460878A8FD314CF19C484E16BBF1FF89308F15869DE9998BB62E331E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BCD00 Relevance: 1.8, APIs: 1, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1BD011

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: aaaa8fdfc4a8cbefcedee64f677ea0b5e78270e8693799cdbe2303dc12cdf2cb
Instruction ID: 17b241eea49efa853d1b068a996661c238fe938281d7920a0cb39f0b2ae06bc5
Opcode Fuzzy Hash: aaaa8fdfc4a8cbefcedee64f677ea0b5e78270e8693799cdbe2303dc12cdf2cb
Instruction Fuzzy Hash: 65C19BB1A042119FC704DF29C490A5ABBE5BF88318F15866DF899A7B41D334E945CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C18A778 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6C18A773,?,?,00000008,?,?,6C18A413,00000000), ref: 6C18A9A5

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0fef2339fc3d36f78d0b9dcd37e5af906b45f91d41b1b1e0683ea814900bc400
Instruction ID: 9e91c3b26018d7ec4788da5ad75982edc1a53ac36558f8f235acf502cff979e0
Opcode Fuzzy Hash: 0fef2339fc3d36f78d0b9dcd37e5af906b45f91d41b1b1e0683ea814900bc400
Instruction Fuzzy Hash: 43B158316166089FD705CF28C486B547BA0FF55368F268658E8A9CF6E1C339E992CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6C23C510 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C23C547

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6c7341b223553be25a438056bfed2c0597d63f1cf2d117dc92ae4b88b7db8b66
Instruction ID: da3fbbda67b3a983a8cb1e6d82e80f2373fd12460c6581ed3d740b22e27e3262
Opcode Fuzzy Hash: 6c7341b223553be25a438056bfed2c0597d63f1cf2d117dc92ae4b88b7db8b66
Instruction Fuzzy Hash: 54511C1410DBD19EC3268A7944906E2FFE16F67005F48CA8DD4EA47783C654B698DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAE90 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?,?), ref: 6C1CAEA4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_bind_int64
String ID:
API String ID: 3007292478-0
Opcode ID: c1f1daf6b4b04424e48a67e25c879642ab23ced374421459458b6fbd06bd0bad
Instruction ID: e71881d5c732bfa4074c901fcd0724c9c5a83dff1a40190194608f7622b68617
Opcode Fuzzy Hash: c1f1daf6b4b04424e48a67e25c879642ab23ced374421459458b6fbd06bd0bad
Instruction Fuzzy Hash: D9D0C9E66106086B9710DE5C9C45CBA336DD745124B404648BD2887781EA31EA2087EA

Uniqueness

Uniqueness Score: -1.00%

Function 6C18511F Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6C18511F

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 10ead864c79ebd9721ff243b1e9762dd8b4e54089c291f75bb1550001a1fb4b0
Instruction ID: ad7eb46bcb9f5bc7efe7718bc23a4da654f43701af78f258fe52d828e58f34f4
Opcode Fuzzy Hash: 10ead864c79ebd9721ff243b1e9762dd8b4e54089c291f75bb1550001a1fb4b0
Instruction Fuzzy Hash: A2A02230302300CFCF808F3283A830C3AFCFA032C0F808228A008C8000EB308000BF00

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BE604 Relevance: .8, Instructions: 766COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6584666830099cc4cbdb0d4521bb67675ba9db22e1ea03a0142ba82d1b8d6f9
Instruction ID: a799263a48594abf9b165e6cdf6a02c6738fe200c72a34a6d5b461c70c12ef28
Opcode Fuzzy Hash: b6584666830099cc4cbdb0d4521bb67675ba9db22e1ea03a0142ba82d1b8d6f9
Instruction Fuzzy Hash: 63625A746083118FC714CF19C580A5AB7F2BFC9308F158AADE899ABB51D734E946CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6C23DFE0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c779cf8acf82849ba145022c19bdb26888e57b64fa3b74fd06a41222152221
Instruction ID: 22b3c1b9371a5de2b9027f7b5250a2f9742c928449d3e19cb1168f42d5a881bd
Opcode Fuzzy Hash: 37c779cf8acf82849ba145022c19bdb26888e57b64fa3b74fd06a41222152221
Instruction Fuzzy Hash: B62231B7F503298FDB18CED5DCC05D9B3A3BBD831471F91698905EB316D6B4AA068B80

Uniqueness

Uniqueness Score: -1.00%

Function 6C212970 Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eac697a7d000e7812ea1d93e8aca9fa6b4390ecbc2e45b9c271d302ce84bf72
Instruction ID: 04ac1d8b25a018a0c0fa883b1a14443496d2919117341f005a4c7c2d712f7dcd
Opcode Fuzzy Hash: 9eac697a7d000e7812ea1d93e8aca9fa6b4390ecbc2e45b9c271d302ce84bf72
Instruction Fuzzy Hash: 98228FB4E0821A8FDB04CF59C484BAEBBF1BF4A319F148259FD55A7B81D7349941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A65A0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23ece3b53da8b323ca3a4fb91d30711d5b7904e4b4a536b27af6b7353a484a6
Instruction ID: f6f529fbfbd4771d225f002b2db9b12b12a1b17869617cbf4c2192a2e9b53c1c
Opcode Fuzzy Hash: a23ece3b53da8b323ca3a4fb91d30711d5b7904e4b4a536b27af6b7353a484a6
Instruction Fuzzy Hash: E5E1DF3A51D2848FD71A8A7CC4E53A57BA2DF62314F0DC6ACC9A58FBC7C129850EC751

Uniqueness

Uniqueness Score: -1.00%

Function 6C23BE90 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91833092b5a09d994e6f1bdba40cc14d2845e604f1ae06ef342b4a572232a0
Instruction ID: f95bc205a7d1ad8c5eef5403b0ad352a3e6a7a73b88320a6b9df9eea48ad5773
Opcode Fuzzy Hash: 7d91833092b5a09d994e6f1bdba40cc14d2845e604f1ae06ef342b4a572232a0
Instruction Fuzzy Hash: 9D02ED76E006288FCB50CF9AC8846DDF7F2BF8C314F1A81AAD95CA7311D67569428F94

Uniqueness

Uniqueness Score: -1.00%

Function 6C23CDB0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055db46fe2002ae75e92462b6c81993c084e8edbe0b3b06e6d86f86ec2dede9d
Instruction ID: a782e13c5b8c05760d23ac3db2eb01c72af64643c6b6dadc6abdc9ade52de2d8
Opcode Fuzzy Hash: 055db46fe2002ae75e92462b6c81993c084e8edbe0b3b06e6d86f86ec2dede9d
Instruction Fuzzy Hash: 72B1C8B1D4569D9BDF01CBAAD4A05EEFFF0EF1A221F18429ED89863341D2345749CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C23D660 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e15469e0a19f09eb649739005fa27a60fcd98fa987006eef9f12d6849c40945
Instruction ID: 98c48d49be6f3c85f5ffddba29f56c01274f0899ac07dc24619e2f326b274ded
Opcode Fuzzy Hash: 0e15469e0a19f09eb649739005fa27a60fcd98fa987006eef9f12d6849c40945
Instruction Fuzzy Hash: 1FC18175A042E58FDB05CF6AC8D8469BBF2EB8B21175A825ECA4527392C330B515CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 6C23DA20 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b0e28e397cf05315410fd6ca44063a803f609421c394dc0fc6dc7c10bca05b
Instruction ID: c516e18d245e1d229f797ff30c02b04904b352d47ae8fb58df184dd1736b23ef
Opcode Fuzzy Hash: 65b0e28e397cf05315410fd6ca44063a803f609421c394dc0fc6dc7c10bca05b
Instruction Fuzzy Hash: 3FC195769053A68FDB05CF6AC8D4469FBF2FF9A21175E814BC9846B392C230B515CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6C17F0AB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ba329e11baace00773774d907c8455ff89fc03b99409d7b91907ac82efd5de
Instruction ID: 8c3473280a38708369bd85a92217c7a55bd002ea0de23abb717f7c2d645cb81b
Opcode Fuzzy Hash: 88ba329e11baace00773774d907c8455ff89fc03b99409d7b91907ac82efd5de
Instruction Fuzzy Hash: 5F61677538070AA6DA308968D890BEF33E4EF6774CF200519E872DBE80DB59D9478775

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A7C60 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac94f7eac41c7ba299ea80b4b50479f0a51c57bbc69ec6c4242dca7a4822289
Instruction ID: c7efae468a9c5ff76b346f7705c545192ba47a9d17ef32d2b6278e687edc0e7c
Opcode Fuzzy Hash: 1ac94f7eac41c7ba299ea80b4b50479f0a51c57bbc69ec6c4242dca7a4822289
Instruction Fuzzy Hash: A84149B6E055225AE34CCF2AA529261FFD3ABD134170DC17EE5AA87A49C7708416E7C0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A7B00 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5685902d4e89956fc0d0d471af60a5e1c49392893c2ad2c7dc98dc71d3595fb3
Instruction ID: 6549c15a82f97c9ca9b4a60384a724baaa22254aa1badfb8fc7a31bff11896f7
Opcode Fuzzy Hash: 5685902d4e89956fc0d0d471af60a5e1c49392893c2ad2c7dc98dc71d3595fb3
Instruction Fuzzy Hash: 9931D392A8A6489AD700D93DCC053D5BB92C7A7118F6CC7B9D4588BFCBD277940AC790

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CADE0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID:
API String ID: 632333372-0
Opcode ID: 51fb0b52b9d10110231e6b3304fcfdaeb3002035cdc33852dfa1e33a943f87f8
Instruction ID: cd42c60a220718170cd84141862cf258253de16e6ccf9b4e61c3f0020bc9485e
Opcode Fuzzy Hash: 51fb0b52b9d10110231e6b3304fcfdaeb3002035cdc33852dfa1e33a943f87f8
Instruction Fuzzy Hash: 0911D03530470687D700DF19E48865BB7A8FF95324F508AA9F9A983644DB39E428C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6C23D570 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea725ef14c8abddfc50ff8410476a9532b505b8e2e60593363e0b43e5f88e75
Instruction ID: 74258b71417a9796812b9ac0e0db00277733b66468cd72a972be6d8db31cacbe
Opcode Fuzzy Hash: 3ea725ef14c8abddfc50ff8410476a9532b505b8e2e60593363e0b43e5f88e75
Instruction Fuzzy Hash: D321783291A4F18ACF468F66909C415FBF6EE4B602B4F40969E806B292C320F851D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAEB0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID:
API String ID: 632333372-0
Opcode ID: 7cfe9281ce3b28e657e7266786f58d02f036bcaafee00aaf5b538b52ac9b1e7d
Instruction ID: 9470d04e217d2fa983d9504bced98b538ff237659f01c1bb69fae492971fe737
Opcode Fuzzy Hash: 7cfe9281ce3b28e657e7266786f58d02f036bcaafee00aaf5b538b52ac9b1e7d
Instruction Fuzzy Hash: EE01D8B03002098FDB01CF18D8849AAB3A9FFA5318B148269FD1487750EB34FC11CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAF90 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35dd76b313c828f4353326d8cbc03ca3314e0a5af69dd5d2f6c0803f7185aace
Instruction ID: 1c4b85a4b5ffac1201f6c5f6d8a527cc870a092bcb39c6f7eac0d02caa557003
Opcode Fuzzy Hash: 35dd76b313c828f4353326d8cbc03ca3314e0a5af69dd5d2f6c0803f7185aace
Instruction Fuzzy Hash: 21F062F060014D9BDB01CE58E844BDF33A8ABA8328F144354F92887AC0D378DC6087A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAD90 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93603c9553d0e3bf22508623e1488eff55b9fd023316f966f29373eccbb806a
Instruction ID: d2f5800440e3fac87383ca258851c2d232f8fd311d2bfc813bdd1eccfa6675e8
Opcode Fuzzy Hash: c93603c9553d0e3bf22508623e1488eff55b9fd023316f966f29373eccbb806a
Instruction Fuzzy Hash: 80F012B17001099BDB00CE68E851BAF339DAB64729F544614F938C7BC0D639E9A18792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CB470 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5af7d1fc23b27e611e3244a7d9ba71841e7d195958ee86b3955fb315e52749
Instruction ID: 02705a49e805420561b7fb947486f20c5f35b52ed68256d555777b6a6e2c5783
Opcode Fuzzy Hash: 7f5af7d1fc23b27e611e3244a7d9ba71841e7d195958ee86b3955fb315e52749
Instruction Fuzzy Hash: 19F0303024A28C9BD7049B10D545BB43B99BB2020DF2541D8F9198FFA2D37FD48AC752

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAF30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID:
API String ID: 632333372-0
Opcode ID: e8d14b05fa5f03a94c895edd18b0855db48f3788e1ad0ba2855904e7958a2988
Instruction ID: 787ac6729bb0c7d32e8c851285d25ad83f936978cef6b7fff7c35989360b7da5
Opcode Fuzzy Hash: e8d14b05fa5f03a94c895edd18b0855db48f3788e1ad0ba2855904e7958a2988
Instruction Fuzzy Hash: 36E0C2BA30010457CB02CA9DD884A8A33ECAFA41647044060FA4CC7300DA34E80487F2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAD60 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792c17c7ecbac26e9caaa05e65fcce6555ba42a0f9e218243dcc0f5125fa8fb5
Instruction ID: d7e22a250d765dfbfbc919d656fe629a8b1199f88f23da6ec7fdf6dd8bf36079
Opcode Fuzzy Hash: 792c17c7ecbac26e9caaa05e65fcce6555ba42a0f9e218243dcc0f5125fa8fb5
Instruction Fuzzy Hash: BED067B56042097FDB44DE48EC42EAB37ACAB58654F144118B90887341D671FD5087B5

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAF60 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489b63264ba4d26e5f9f52a3f0b892316546618f182fe09105f9bc8fbd54099f
Instruction ID: 0c33f5fd90dd1ed68b970fd92099ad2e0e4e38e422c087dc4ea83a3502203576
Opcode Fuzzy Hash: 489b63264ba4d26e5f9f52a3f0b892316546618f182fe09105f9bc8fbd54099f
Instruction Fuzzy Hash: 3AD067B56142097FDB44DE48EC82EAB37ADAB58654F144118B90887341D671ED5087B5

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAFF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0d13a454925c918d2cd04b87f81a1167c5251cede2fd453e543adae3ec2c87
Instruction ID: 36d0f7d9ccab618805f7486252a390054a7259df95d082db5e13d8f74cfd177f
Opcode Fuzzy Hash: ef0d13a454925c918d2cd04b87f81a1167c5251cede2fd453e543adae3ec2c87
Instruction Fuzzy Hash: 7FD092B5600209AFDB40DE48EC86EAB37ACAB98A14F448114BD0887341D670FD608BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1ABD10 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_snprintf.SQLITE3(?,?,%s%c%s,00000000,0000005C,?), ref: 6C1ABD7C
sqlite3_win32_is_nt.SQLITE3 ref: 6C1ABD97
sqlite3_free.SQLITE3(00000000), ref: 6C1ABDBF
sqlite3_win32_is_nt.SQLITE3 ref: 6C1ABDE6
sqlite3_free.SQLITE3(00000000), ref: 6C1ABE04
sqlite3_free.SQLITE3(00000000), ref: 6C1ABE49
sqlite3_free.SQLITE3(00000000), ref: 6C1ABE6D
sqlite3_free.SQLITE3(00000000), ref: 6C1ABE76

Part of subcall function 6C1A8F00: sqlite3_log.SQLITE3(?,os_win.c:%d: (%lu) %s(%s) - %s,?,?,?,?,00000000), ref: 6C1A8F8B

sqlite3_free.SQLITE3(00000000), ref: 6C1ABEA7
sqlite3_win32_mbcs_to_utf8.SQLITE3(00000000), ref: 6C1ABEB0
sqlite3_free.SQLITE3(00000000), ref: 6C1ABF87
sqlite3_snprintf.SQLITE3(?,?,6C25D55C,00000000), ref: 6C1ABFB1
sqlite3_free.SQLITE3(00000000,?,?,6C25D55C,00000000), ref: 6C1ABFB7

Strings

winFullPathname1, xrefs: 6C1ABEE8
winFullPathname4, xrefs: 6C1ABE91
winFullPathname3, xrefs: 6C1ABE1E
winFullPathname2, xrefs: 6C1ABF5D
%s%c%s, xrefs: 6C1ABD75

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintfsqlite3_win32_is_nt$sqlite3_logsqlite3_win32_mbcs_to_utf8
String ID: %s%c%s$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 1044633130-2604382604
Opcode ID: 653f346aea92e1fe18e02caa60a332c7de3e2300d6f4c03a5fe750dbd5a2e75e
Instruction ID: d27a14a829fe4166cb51e76b31a4fb0c7591088c7ca8e761bbef5f5daf664412
Opcode Fuzzy Hash: 653f346aea92e1fe18e02caa60a332c7de3e2300d6f4c03a5fe750dbd5a2e75e
Instruction Fuzzy Hash: ED614ABEB0129927E70156E56C86BEF736C9F9122CF140165FD09CBB81FB25D81782E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F4AA3 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 459COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(%s.%s,?,00000000), ref: 6C1F4ADF
sqlite3_free.SQLITE3(00000000), ref: 6C1F4B01
sqlite3_initialize.SQLITE3 ref: 6C1F4B21
sqlite3_snprintf.SQLITE3(?,00000000,unable to open shared library [%s],?), ref: 6C1F4B55
sqlite3_initialize.SQLITE3 ref: 6C1F4BC0
sqlite3_strnicmp.SQLITE3(?,lib,00000003), ref: 6C1F4C26
sqlite3_initialize.SQLITE3 ref: 6C1F4CD5
sqlite3_snprintf.SQLITE3(?,00000000,no entry point [%s] in shared library [%s],?,?), ref: 6C1F4D6B
sqlite3_mprintf.SQLITE3(error during initialization: %s,?), ref: 6C1F4EA8

Strings

lib, xrefs: 6C1F4C20
:'l, xrefs: 6C1F4AC4
unable to open shared library [%s], xrefs: 6C1F4B4E
:'l, xrefs: 6C1F4B0C
error during initialization: %s, xrefs: 6C1F4EA3
_init, xrefs: 6C1F4C6A
no entry point [%s] in shared library [%s], xrefs: 6C1F4D64
sqlite3_, xrefs: 6C1F4BFC
%s.%s, xrefs: 6C1F4ADA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize$sqlite3_mprintfsqlite3_snprintf$sqlite3_freesqlite3_strnicmp
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$sqlite3_$unable to open shared library [%s]$:'l$:'l
API String ID: 1536048489-2255373788
Opcode ID: b1f260a918f7a861a212c190ab0215b1694a1951e71d8ddcfbc4c4b96ae83017
Instruction ID: 23abc6df5ed34363448f13636535cab672c8deb2e29309f881c318f9e6ac5adb
Opcode Fuzzy Hash: b1f260a918f7a861a212c190ab0215b1694a1951e71d8ddcfbc4c4b96ae83017
Instruction Fuzzy Hash: 12F1CEB16012119BD701CF29D988B9B73E8FF85318F044629FC69D7B41E735E916CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AB510 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1AB568
sqlite3_win32_is_nt.SQLITE3(?,?,?,?,?,?,?,?,?,?,00000000,00000008), ref: 6C1AB5A9
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000008), ref: 6C1AB5D7
sqlite3_win32_is_nt.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000008), ref: 6C1AB65D

Part of subcall function 6C1AB0D0: _memset.LIBCMT ref: 6C1AB0FD
Part of subcall function 6C1AB0D0: sqlite3_free.SQLITE3(00000000), ref: 6C1AB149

Part of subcall function 6C1A8AB0: _memset.LIBCMT ref: 6C1A8AF0

sqlite3_log.SQLITE3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,00009CC0,?,?,00000000,00000008,?,?,?,?,?,6C1AA566,?,?), ref: 6C1AB74A
sqlite3_free.SQLITE3(?,0000000E,00009CC7), ref: 6C1AB77D
sqlite3_free.SQLITE3(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,6C1AA566,?,?), ref: 6C1AB78A
sqlite3_free.SQLITE3(?,?,?,00000000,00000008,?,?,?,?,?,6C1AA566,?,?,00000008,00080006,00000000), ref: 6C1AB7B6
sqlite3_free.SQLITE3(00000000,?,?,00000000,00000008,?,?,?,?,?,6C1AA566,?,?,00000008,00080006,00000000), ref: 6C1AB7CB
sqlite3_free.SQLITE3(?,?,?,?,00000000,00000008,?,?,?,?,?,6C1AA566,?,?,00000008,00080006), ref: 6C1AB7D8

Strings

%s at line %d of [%.10s], xrefs: 6C1AB7FB
psow, xrefs: 6C1AB866
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C1AB743
cannot open file, xrefs: 6C1AB7F6
winOpen, xrefs: 6C1AB76B
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1AB7EC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$_memset$sqlite3_win32_is_nt$sqlite3_log
String ID: %s at line %d of [%.10s]$cannot open file$delayed %dms for lock/sharing conflict at line %d$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$psow$winOpen
API String ID: 1408502458-3629694183
Opcode ID: 754aedd4f91244fd72d58014a8bd906fe0e45656816167098f994108d2ee6b4d
Instruction ID: c6783966044fa16e6c1c84bee19ae115ad893904df46e8f6efa9c8ac3bd0b751
Opcode Fuzzy Hash: 754aedd4f91244fd72d58014a8bd906fe0e45656816167098f994108d2ee6b4d
Instruction Fuzzy Hash: 02B1F3B9A043459BD700CFA9D981B5BB7F4BB88318F144A2DF95997B80D730E806CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C222470 Relevance: 31.6, APIs: 7, Strings: 11, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C208A40: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,0001CFBF,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C208ABC

sqlite3_initialize.SQLITE3(00000000,00000000,?,6C21BC7A), ref: 6C222498
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,00000000,00000000,?,6C21BC7A), ref: 6C222530
sqlite3_overload_function.SQLITE3(00000000,snippet,000000FF,?,?,?,?,?,?,?,?,00000000,00000000,?,6C21BC7A), ref: 6C222555
sqlite3_overload_function.SQLITE3(00000000,offsets,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C22256B
sqlite3_overload_function.SQLITE3(00000000,matchinfo,00000001), ref: 6C222581
sqlite3_overload_function.SQLITE3(00000000,matchinfo,00000002), ref: 6C222597
sqlite3_overload_function.SQLITE3(00000000,optimize,00000001), ref: 6C2225AD

Strings

optimize, xrefs: 6C2225A7
fts4aux, xrefs: 6C222481
fts3, xrefs: 6C2225CA
snippet, xrefs: 6C22254F
porter, xrefs: 6C2224F0
unicode61, xrefs: 6C22250B
fts3tokenize, xrefs: 6C222606
simple, xrefs: 6C2224C4
offsets, xrefs: 6C222565
matchinfo, xrefs: 6C22257B, 6C222591
fts4, xrefs: 6C2225E8

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_overload_function$sqlite3_freesqlite3_initializesqlite3_log
String ID: fts3$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 225236520-719320448
Opcode ID: d7c70d18a265e0123b3ce06998706a1a7f7b7da2e30d5ef0062107a65e2dbd64
Instruction ID: ab447cda291acb987ae7e67bd2b902f8eac476643fe72f7975ca39dc67836937
Opcode Fuzzy Hash: d7c70d18a265e0123b3ce06998706a1a7f7b7da2e30d5ef0062107a65e2dbd64
Instruction Fuzzy Hash: 8231FAA2E5412D23D72629665C41BAB21C89B046BEF0C4B61FD08FBF41F75EDDA442E3

Uniqueness

Uniqueness Score: -1.00%

Function 6C204850 Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 354COMMON

Download Yara Rule

Strings

cannot create INSTEAD OF trigger on table: %S, xrefs: 6C204B2A
cannot create triggers on virtual tables, xrefs: 6C204A0E
cannot create trigger on system table, xrefs: 6C204AB3
corrupt database, xrefs: 6C2048B0
sqlite_master, xrefs: 6C204B9B
unknown database %T, xrefs: 6C2048D9
temporary trigger may not have qualified name, xrefs: 6C20487C
trigger, xrefs: 6C2049BF
trigger %T already exists, xrefs: 6C204A74
#, xrefs: 6C204BFD
AFTER, xrefs: 6C204AF9
BEFORE, xrefs: 6C204AEF, 6C204B07
cannot create %s trigger on view: %S, xrefs: 6C204B08
sqlite_temp_master, xrefs: 6C204B91, 6C204BA7
sqlite_, xrefs: 6C204A9A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: #$AFTER$BEFORE$cannot create %s trigger on view: %S$cannot create INSTEAD OF trigger on table: %S$cannot create trigger on system table$cannot create triggers on virtual tables$corrupt database$sqlite_$sqlite_master$sqlite_temp_master$temporary trigger may not have qualified name$trigger$trigger %T already exists$unknown database %T
API String ID: 0-2710458316
Opcode ID: 5e75bfee4c1829180165cf5da622313ee6660425ec6dfc21dc17b2da113a8b46
Instruction ID: 0f4660eaa590bfde893063043b828c3c2e9f6d9d05c19d1f24c4e27a64891dca
Opcode Fuzzy Hash: 5e75bfee4c1829180165cf5da622313ee6660425ec6dfc21dc17b2da113a8b46
Instruction Fuzzy Hash: FED1D475B0434A9BD700CF19C880B9A77E5BF99308F18896EFC589BB42D731E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B1CC0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 459COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B1DC3
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 6C1B1EAE
sqlite3_uri_parameter.SQLITE3(00001000,nolock), ref: 6C1B1F55
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,6C1B8DF2), ref: 6C1B2074
sqlite3_uri_parameter.SQLITE3(00001000,immutable), ref: 6C1B20B9

Strings

immutable, xrefs: 6C1B20B3
-journal, xrefs: 6C1B1E51
-wal, xrefs: 6C1B1E97
nolock, xrefs: 6C1B1F4F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_uri_parameter$_memset
String ID: -journal$-wal$immutable$nolock
API String ID: 172269523-3408036318
Opcode ID: 2528c3762102a78ff683f19155035e04e21f1dec0f0af371c3d5adf4bed474b8
Instruction ID: bb97728efc51f021a1caf639efd0f4aa9164d1a051ca019303837828a57da430
Opcode Fuzzy Hash: 2528c3762102a78ff683f19155035e04e21f1dec0f0af371c3d5adf4bed474b8
Instruction Fuzzy Hash: 01F1E971A04606AFDB04CF68C884BDABBF5FF55308F188269D828AB741D735E919CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F4550 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 380COMMON

Download Yara Rule

APIs

Part of subcall function 6C1A7F30: sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,NULL,?,6C1F9538,?,?,00000000,?,?,6C1C9EFE), ref: 6C1A7F41

sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00019D0C,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000000,?,?,Function_00058620,?,00000000,?,SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid,?,6C25DEE8), ref: 6C1F458A
sqlite3_step.SQLITE3(?,?,?,00000000,?,?,Function_00058620,?,00000000,?,SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid,?,6C25DEE8,?,00000000,?), ref: 6C1F4627
_memset.LIBCMT ref: 6C1F468D

Strings

%s at line %d of [%.10s], xrefs: 6C1F4583
d, xrefs: 6C1F477C
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1F4574
misuse, xrefs: 6C1F457E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$_memsetsqlite3_step
String ID: %s at line %d of [%.10s]$d$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 133566924-425260766
Opcode ID: fe0ca38bdd5fad9f3e8732b1b49846afcbd3f3b7f5df8ec0db9293f500a366c8
Instruction ID: cd367165a241a2c59acaa09d3ff153f492fb0f340fc3fc41e0cb2c458cea342d
Opcode Fuzzy Hash: fe0ca38bdd5fad9f3e8732b1b49846afcbd3f3b7f5df8ec0db9293f500a366c8
Instruction Fuzzy Hash: AAD123B0A043508BD701CF29CA84B9A77E4BF5571CF144A29FCB99BB01D734D956CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C185931 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6C185975

Part of subcall function 6C18719E: _free.LIBCMT ref: 6C1871BB
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C1871CD
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C1871DF
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C1871F1
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187203
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187215
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187227
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187239
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C18724B
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C18725D
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C18726F
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187281
Part of subcall function 6C18719E: _free.LIBCMT ref: 6C187293

_free.LIBCMT ref: 6C18596A

Part of subcall function 6C18201B: HeapFree.KERNEL32(00000000,00000000,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?), ref: 6C182031
Part of subcall function 6C18201B: GetLastError.KERNEL32(?,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?,?), ref: 6C182043

_free.LIBCMT ref: 6C18598C
_free.LIBCMT ref: 6C1859A1
_free.LIBCMT ref: 6C1859AC
_free.LIBCMT ref: 6C1859CE
_free.LIBCMT ref: 6C1859E1
_free.LIBCMT ref: 6C1859EF
_free.LIBCMT ref: 6C1859FA
_free.LIBCMT ref: 6C185A32
_free.LIBCMT ref: 6C185A39
_free.LIBCMT ref: 6C185A56
_free.LIBCMT ref: 6C185A6E

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2e3d6aa3476cdc80c58128be3dd5d6d3b4aae5c89896614e2da655b43eeaed5f
Instruction ID: 794b277d39ec075e5ee53366564c3d4ae85683e4a984e49d030276cc0e0544e8
Opcode Fuzzy Hash: 2e3d6aa3476cdc80c58128be3dd5d6d3b4aae5c89896614e2da655b43eeaed5f
Instruction Fuzzy Hash: C6315A71A0E7009FFB219B79D884B8A77E9EF04328F20452AE45AD7A50DB35E884DF10

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A1E00 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 298COMMON

Download Yara Rule

Strings

localtime, xrefs: 6C1A1E6C
month, xrefs: 6C1A2137
PRVJ, xrefs: 6C1A2093
}, xrefs: 6C1A202E
weekday , xrefs: 6C1A1FE2
start of , xrefs: 6C1A2103
unixepoch, xrefs: 6C1A1EDC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: PRVJ$localtime$month$start of $unixepoch$weekday $}
API String ID: 0-2186168836
Opcode ID: aa6686994f280fdd5fa3faec65bcc5419d70f865153595bd6104a01979226013
Instruction ID: 15ac5b20794048cc85f9135b04bfdb62e0257ad7902face9716092c56b07bb67
Opcode Fuzzy Hash: aa6686994f280fdd5fa3faec65bcc5419d70f865153595bd6104a01979226013
Instruction Fuzzy Hash: 31A17DBAE042589BDB008FE5D8507EE7BF5AF9A318F684195DC49EB742E731C40AC790

Uniqueness

Uniqueness Score: -1.00%

Function 6C1EC460 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_value_double.SQLITE3 ref: 6C1EC49F
sqlite3_snprintf.SQLITE3(00000032,?,%!.15g), ref: 6C1EC4B8
sqlite3_snprintf.SQLITE3(00000032,?,%!.20e), ref: 6C1EC4FB
sqlite3_value_blob.SQLITE3(-00000001,00000001), ref: 6C1EC543
sqlite3_value_bytes.SQLITE3(00000000,?,00000001), ref: 6C1EC552
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,00000001), ref: 6C1EC603
sqlite3_value_text.SQLITE3(?,?,00000001), ref: 6C1EC61E

Strings

%!.15g, xrefs: 6C1EC4AC
%!.20e, xrefs: 6C1EC4EF
NULL, xrefs: 6C1EC6AF
string or blob too big, xrefs: 6C1EC5EC, 6C1EC6CD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_freesqlite3_value_blobsqlite3_value_bytessqlite3_value_doublesqlite3_value_text
String ID: %!.15g$%!.20e$NULL$string or blob too big
API String ID: 485450803-1779043326
Opcode ID: e876136cf8662c2b9b0a9b04a4232c3b70b501461af173b00a3e08e55ff595e6
Instruction ID: ec20649163c66f8584a5437707f87df62f9f0c4d95eadfb65d15d0b68d7ac7a0
Opcode Fuzzy Hash: e876136cf8662c2b9b0a9b04a4232c3b70b501461af173b00a3e08e55ff595e6
Instruction Fuzzy Hash: E9717B716086409BD3009B38CC51BAB7BE0AF9A328F58465CF9E5CB7C1E775C5168793

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F8620 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 212COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0001AC70,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000000,?,00000001,6C25DEE8,?,6C1F88CE,?,00000003,?,00000000,00000000), ref: 6C1F86C8
sqlite3_strnicmp.SQLITE3(?,create ,00000007,00000000,?,00000001,6C25DEE8,?,6C1F88CE,?,00000003,?,00000000,00000000,?,?), ref: 6C1F871A
sqlite3_finalize.SQLITE3(?), ref: 6C1F87AA
sqlite3_errmsg.SQLITE3(?), ref: 6C1F87C5

Part of subcall function 6C1F8580: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0001AC70,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,?,6C1F8850,00000000,00000000,?,?), ref: 6C1F8607

sqlite3_finalize.SQLITE3(?), ref: 6C1F87DF

Strings

%s at line %d of [%.10s], xrefs: 6C1F86C1
create , xrefs: 6C1F8714
malformed database schema (%s), xrefs: 6C1F8672
invalid rootpage, xrefs: 6C1F8830
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1F86B2
database corruption, xrefs: 6C1F86BC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_finalizesqlite3_log$sqlite3_errmsgsqlite3_strnicmp
String ID: %s at line %d of [%.10s]$create $database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$invalid rootpage$malformed database schema (%s)
API String ID: 422761961-261009547
Opcode ID: 72de124729d959620b9e5e5f261187a3afdb12a1518ffb5bfdd2b78f606869e9
Instruction ID: b988cf85f8fd2635993fbef63142f6a994a971640203545961e73ae5343620c8
Opcode Fuzzy Hash: 72de124729d959620b9e5e5f261187a3afdb12a1518ffb5bfdd2b78f606869e9
Instruction Fuzzy Hash: 9161E7767042049BE700CF6AD881B9BB7E4EF5622CF18456AED1CCBB41E731E816C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C2185F0 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 201COMMON

Download Yara Rule

Strings

trigger, xrefs: 6C21878A
explain, xrefs: 6C218800
temp, xrefs: 6C2187AD
create, xrefs: 6C218763
temporary, xrefs: 6C2187D0
end, xrefs: 6C2187DD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: create$end$explain$temp$temporary$trigger
API String ID: 0-841675879
Opcode ID: 1bd7e7d773775552d28834109b0981ddcf5c5ae4871f7eb2342e6b4df74c3fee
Instruction ID: dca331be6fc1da15f900a0628f3305de6f21e7b3714a093b8cddc005c54cfdb0
Opcode Fuzzy Hash: 1bd7e7d773775552d28834109b0981ddcf5c5ae4871f7eb2342e6b4df74c3fee
Instruction Fuzzy Hash: E3517C2554E2DF89D7214E1A58D0BEF7BE24B4334EF1B095BEEE947D02E312A047C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C21D560 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(docid INTEGER PRIMARY KEY), ref: 6C21D587

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_mprintf.SQLITE3(%z, 'c%d%q',00000000,?,00000000), ref: 6C21D5A8

Part of subcall function 6C1A6040: sqlite3_vmprintf.SQLITE3(?,?), ref: 6C1A6058

sqlite3_mprintf.SQLITE3(%z, langid,00000000,?), ref: 6C21D5C9

Strings

%z, 'c%d%q', xrefs: 6C21D5A3
CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);, xrefs: 6C21D6C6
CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);, xrefs: 6C21D6A0
CREATE TABLE %Q.'%q_content'(%s), xrefs: 6C21D5EA
CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));, xrefs: 6C21D67D
docid INTEGER PRIMARY KEY, xrefs: 6C21D57F
CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);, xrefs: 6C21D663
%z, langid, xrefs: 6C21D5C4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_initializesqlite3_vmprintf
String ID: %z, 'c%d%q'$%z, langid$CREATE TABLE %Q.'%q_content'(%s)$CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);$CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));$CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);$CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);$docid INTEGER PRIMARY KEY
API String ID: 294794726-1647661071
Opcode ID: 476454554b47c9ec478005d8b2ebf74c11fd13be0872ead35876d85e69f19c80
Instruction ID: 3c5ecec668a8afe65bb5eeb8459174a3887b6d2870d556bb11ca1c204906815e
Opcode Fuzzy Hash: 476454554b47c9ec478005d8b2ebf74c11fd13be0872ead35876d85e69f19c80
Instruction Fuzzy Hash: AA41B1B1A0551AFBDB12DFA5D888A9BB7B8BB05208F104655ED0593F01D734F990C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6C172840 Relevance: 18.1, APIs: 12, Instructions: 92fileCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,2ADA91DB,?,00000000,?,?,6C18BE70,000000FF,?,6C171947,?,?,?,?,?,6C1718FB), ref: 6C17287D
CloseHandle.KERNEL32(?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947,?,?,?,?,?,6C1718FB), ref: 6C172889
EnterCriticalSection.KERNEL32(?,2ADA91DB,?,00000000,?,?,6C18BE70,000000FF,?,6C171947,?,?,?,?,?,6C1718FB), ref: 6C172899
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947,?,?,?,?,?,6C1718FB), ref: 6C17289F
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947,?,?,?,?,?,6C1718FB), ref: 6C1728A5
FlushViewOfFile.KERNEL32(?,?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728C3
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728D3
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728D9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728DF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728EB
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728F1
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,?,6C18BE70,000000FF,?,6C171947), ref: 6C1728F7

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeave$CloseEventFileFlushHandleView
String ID:
API String ID: 85601692-0
Opcode ID: 7a13fe1d0d68282574acd04309d4588dd7822bfbd8594742760a0d60e6ea64e3
Instruction ID: 7f0b42561433fc66b92675b3f639e9b1f7973fd8cfab99451690f8b5065ffa9b
Opcode Fuzzy Hash: 7a13fe1d0d68282574acd04309d4588dd7822bfbd8594742760a0d60e6ea64e3
Instruction Fuzzy Hash: FC3150B6A0560ABBDB14DBB5DC48F96B7ACFF09254F100626E529C3A40D735F528CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CDD77 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 404COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
cannot open savepoint - SQL statements in progress, xrefs: 6C1D1129
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
gfff, xrefs: 6C1D13E2
cannot release savepoint - SQL statements in progress, xrefs: 6C1D1133
abort due to ROLLBACK, xrefs: 6C1D16E5
no such savepoint: %s, xrefs: 6C1CDEB7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$gfff$gfff$no such savepoint: %s$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-105844914
Opcode ID: 3a23b2184b812cdcae76c8be9548cbfcb090563cf6836e4a7aff93813cbf4d38
Instruction ID: 7ddb8c693b93ddadab14ac7d11e8c978077c9abb0a2a4280ca43f3623d66f21e
Opcode Fuzzy Hash: 3a23b2184b812cdcae76c8be9548cbfcb090563cf6836e4a7aff93813cbf4d38
Instruction Fuzzy Hash: 01028170A40715CFDB24CF24C881BAAB7B0BF25308F1445AEE85997B41D739EA85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1DEA30 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 365COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 6C1DEDEB

Strings

sqlite_sequence, xrefs: 6C1DED05
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q, xrefs: 6C1DED1F
sqlite_master, xrefs: 6C1DECAE, 6C1DECB9, 6C1DECDF, 6C1DECF1
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;, xrefs: 6C1DED42
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q, xrefs: 6C1DECF3
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;, xrefs: 6C1DECBB
view %s may not be altered, xrefs: 6C1DEB5E
there is already another table or index with this name: %s, xrefs: 6C1DEDA6
sqlite_temp_master, xrefs: 6C1DECA7, 6C1DECD8

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;$UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q$UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q$UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;$sqlite_master$sqlite_sequence$sqlite_temp_master$there is already another table or index with this name: %s$view %s may not be altered
API String ID: 2313487548-73246999
Opcode ID: 1502be0f5cd384b1f6ffba01d2ec8c12c41dca9ce05a81c70a7a9e76b0e0ad18
Instruction ID: 20d0f595db5fd071dc8922513ac326fc988b7993805895af2b436930fcb955f6
Opcode Fuzzy Hash: 1502be0f5cd384b1f6ffba01d2ec8c12c41dca9ce05a81c70a7a9e76b0e0ad18
Instruction Fuzzy Hash: C4C1AE75A006099BDB00DF99C880BAFB3B9EF94309F214568E9159BB41DB31FE05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BD5F0 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 355COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1BD711
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E03E,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD7B6
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E03B,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD7DF

Part of subcall function 6C1B7F00: _memset.LIBCMT ref: 6C1B7F4E
Part of subcall function 6C1B7F00: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E064,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B819B

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E049,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD82E
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E057,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD8E0
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E05D,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD937
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E064,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BD9A2

Strings

%s at line %d of [%.10s], xrefs: 6C1BD7AF, 6C1BD7D8, 6C1BD827, 6C1BD8D9, 6C1BD930, 6C1BD99B
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BD7A0, 6C1BD7C9, 6C1BD818, 6C1BD8CA, 6C1BD921, 6C1BD98C
database corruption, xrefs: 6C1BD7AA, 6C1BD7D3, 6C1BD822, 6C1BD8D4, 6C1BD92B, 6C1BD996

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$_memset
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 2320441212-2708572664
Opcode ID: b3546c3eeddbdd658e3b5a5228733c15901a90041c722b7027f69b753b2d148b
Instruction ID: 747bf5f73bbfd0b8fa8a29fc047a8f8aeba6d5d6ae5e49ab72c6254ea8035c15
Opcode Fuzzy Hash: b3546c3eeddbdd658e3b5a5228733c15901a90041c722b7027f69b753b2d148b
Instruction Fuzzy Hash: F0C137352083918BC304DF2DC49056ABBE1EFD820DF448AAEF8D9A7B45D335D545CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F5B00 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 251COMMON

Download Yara Rule

APIs

sqlite3_file_control.SQLITE3(?,?,0000000E,?), ref: 6C1F5CDC
sqlite3_free.SQLITE3(?), ref: 6C1F5D05

Strings

timeout, xrefs: 6C1F8494
-%T, xrefs: 6C1F5C41
result, xrefs: 6C1F5CEE
corrupt database, xrefs: 6C1F5B6A
unknown database %T, xrefs: 6C1F5BAB
?, xrefs: 6C1F5D4F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_file_controlsqlite3_free
String ID: -%T$?$corrupt database$result$timeout$unknown database %T
API String ID: 1356203071-1875218240
Opcode ID: 93649a5cbd220c438708176e3ea96157453b041253985ee9929ac7e8dfbd62b7
Instruction ID: d44a3c3d8ebb06a7c2f2bca2ed27148a0c3213da2a227aa1766fb8fa005939e2
Opcode Fuzzy Hash: 93649a5cbd220c438708176e3ea96157453b041253985ee9929ac7e8dfbd62b7
Instruction Fuzzy Hash: 599181B46087019FD304CF29D880B5BB7E5BFC5318F54892EE9A987741EB35D90ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C23B600 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C23B658
sqlite3_snprintf.SQLITE3(00000200,?,%lld,?,?), ref: 6C23B748
sqlite3_snprintf.SQLITE3(00000200,?, %g), ref: 6C23B792
sqlite3_mprintf.SQLITE3(%s {%s},?,?), ref: 6C23B7CC

Strings

%lld, xrefs: 6C23B736
%s {%s}, xrefs: 6C23B7C7
{%s}, xrefs: 6C23B843
string or blob too big, xrefs: 6C23B89F
%g, xrefs: 6C23B77D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf$_memsetsqlite3_mprintf
String ID: %g$%lld$%s {%s}$string or blob too big${%s}
API String ID: 1051938722-1180788773
Opcode ID: 70806be50085b881b6844ef78c1da756f4a9c82cb876386a1edfb3cb93003da1
Instruction ID: d7560076abdb3a996f5193ac422aad40530b69c80bb73d7cfe8152c90c00b227
Opcode Fuzzy Hash: 70806be50085b881b6844ef78c1da756f4a9c82cb876386a1edfb3cb93003da1
Instruction Fuzzy Hash: F481CDB06097658FD710CF28888869BBBF0AF85308F14992DFC9987751E730D509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E5990 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 209COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3(00000000,sqlite_,00000007), ref: 6C1E5B09
sqlite3_strnicmp.SQLITE3(00000000,sqlite_stat,0000000B), ref: 6C1E5B1F

Strings

sqlite_master, xrefs: 6C1E5A43, 6C1E5A58
table %s may not be dropped, xrefs: 6C1E5B2E
use DROP TABLE to delete table %s, xrefs: 6C1E5B4D
use DROP VIEW to delete view %s, xrefs: 6C1E5B66
tbl, xrefs: 6C1E5B91
sqlite_temp_master, xrefs: 6C1E5A39
sqlite_stat, xrefs: 6C1E5B19
sqlite_, xrefs: 6C1E5B03

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: sqlite_$sqlite_master$sqlite_stat$sqlite_temp_master$table %s may not be dropped$tbl$use DROP TABLE to delete table %s$use DROP VIEW to delete view %s
API String ID: 1961171630-981731797
Opcode ID: 15040e54e63a3effe4ae75016388726de58604fb66f2b5f719c6a88b60fc1afe
Instruction ID: be62a5e8e2dffba586018e5ccf5841c1f052a1ba80f77cf2c8ba73e61ac3adaf
Opcode Fuzzy Hash: 15040e54e63a3effe4ae75016388726de58604fb66f2b5f719c6a88b60fc1afe
Instruction Fuzzy Hash: 5661D174A00A14ABEB10DF59CC80FAB73A9AF99308F1881A9EC15DBB46F774DD05C791

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D1410 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Part of subcall function 6C1C6D20: _memset.LIBCMT ref: 6C1C6D4D

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
cannot start a transaction within a transaction, xrefs: 6C1D1514
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
cannot commit - no transaction is active, xrefs: 6C1D1524
cannot commit transaction - SQL statements in progress, xrefs: 6C1D1454
gfff, xrefs: 6C1D14B2
abort due to ROLLBACK, xrefs: 6C1D16E5
cannot rollback - no transaction is active, xrefs: 6C1D151B, 6C1D1529

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_log
String ID: abort due to ROLLBACK$cannot commit - no transaction is active$cannot commit transaction - SQL statements in progress$cannot rollback - no transaction is active$cannot start a transaction within a transaction$gfff$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 1972405431-336795239
Opcode ID: 12fca4d9282d5f389384b6ed757d9ac54b75041574274f2e851dd6faccf806a3
Instruction ID: e6163f795e102b162ada78768adff886717be8ed531d60b2aee30ac199d0aa80
Opcode Fuzzy Hash: 12fca4d9282d5f389384b6ed757d9ac54b75041574274f2e851dd6faccf806a3
Instruction Fuzzy Hash: 91710774A043158BDB24CF24DC807A9B7B0AB15328F1542A9E849D7F41E779FD85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C21AC90 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 93COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,invalid,?,?,?,6C1F87CA,?), ref: 6C21ACDE
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,000210DA,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,6C1F87CA,?), ref: 6C21ACFC

Strings

%s at line %d of [%.10s], xrefs: 6C21ACF5
invalid, xrefs: 6C21ACD2
unknown error, xrefs: 6C21ACA5, 6C21AD0A, 6C21AD3B, 6C21AD60
API call with %s database connection pointer, xrefs: 6C21ACD7
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C21ACE6
misuse, xrefs: 6C21ACF0
abort due to ROLLBACK, xrefs: 6C21AD85

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$abort due to ROLLBACK$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$invalid$misuse$unknown error
API String ID: 632333372-3672103609
Opcode ID: de5e47ae1b8d0d2101a0e7c2f007bf7c6262c5370d060fcfb8dc4e1e209a00f2
Instruction ID: c4b088e775efa3dae56eed48fbf9822c4f63598491639281ff4273af005eb464
Opcode Fuzzy Hash: de5e47ae1b8d0d2101a0e7c2f007bf7c6262c5370d060fcfb8dc4e1e209a00f2
Instruction Fuzzy Hash: DB218A3972990EA7DB015619D80072A73D4EB4166BF140175FE14E7F81E610F818C3E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E2E60 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 397COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 6C1E30E2

Strings

sqlite_sequence, xrefs: 6C1E3125
corrupt database, xrefs: 6C1E2EC5
sqlite_master, xrefs: 6C1E2E9B, 6C1E2FB4, 6C1E2FBF
unknown database %T, xrefs: 6C1E2EEC
temporary table name must be unqualified, xrefs: 6C1E2F2C
table %T already exists, xrefs: 6C1E303E
sqlite_temp_master, xrefs: 6C1E2E91, 6C1E2FAD
there is already an index named %s, xrefs: 6C1E308E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID: corrupt database$sqlite_master$sqlite_sequence$sqlite_temp_master$table %T already exists$temporary table name must be unqualified$there is already an index named %s$unknown database %T
API String ID: 2313487548-2307159186
Opcode ID: 91e29a998ad33e8fd3bae433d2a2590fc16a414d1a6158fdb141b0c9036bcdce
Instruction ID: e82b07256efa9b34504c40ae74879b9e94b42f6da5d5a0b69d1f76b6f157f134
Opcode Fuzzy Hash: 91e29a998ad33e8fd3bae433d2a2590fc16a414d1a6158fdb141b0c9036bcdce
Instruction Fuzzy Hash: 41D15571B00A05ABDB04CF68D880BEEB7B4AF58308F5441A9ED18DB742D735EA56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F8860 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 321COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6C1F8B22
sqlite3_free.SQLITE3(?), ref: 6C1F8B7C

Strings

unknown error, xrefs: 6C1F8949
SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid, xrefs: 6C1F8AF8
sqlite_master, xrefs: 6C1F8894
unsupported file format, xrefs: 6C1F8AD1
sqlite_temp_master, xrefs: 6C1F8888
abort due to ROLLBACK, xrefs: 6C1F897F
attached databases must use the same text encoding as main database, xrefs: 6C1F8A40

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_execsqlite3_free
String ID: SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid$abort due to ROLLBACK$attached databases must use the same text encoding as main database$sqlite_master$sqlite_temp_master$unknown error$unsupported file format
API String ID: 3183936835-444642373
Opcode ID: c11a475bf4a37dbff8fd3687c1614495fcd089e68b354684d72a0b4fef52a7e5
Instruction ID: 5f6b36355418ad5b4830195d2749c18ada2a2c3c20d8e9a7cc9c48f8566a8974
Opcode Fuzzy Hash: c11a475bf4a37dbff8fd3687c1614495fcd089e68b354684d72a0b4fef52a7e5
Instruction Fuzzy Hash: CED1BBB0A047498FEB10CFAAC480BDEB7F1FF5A318F14455AD825ABB41D735A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CC959 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 271COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3(?), ref: 6C1CCA7F

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
gfff, xrefs: 6C1CC999
string or blob too big, xrefs: 6C1CCB0C
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_value_text
String ID: abort due to ROLLBACK$gfff$gfff$out of memory$statement aborts at %d: [%s] %s$string or blob too big$unknown error
API String ID: 348685305-610606413
Opcode ID: e0343e0790c08fe8081ba43b664770a8d7dc220cdadd973340cc644d836fc856
Instruction ID: 9e2ff5c56f1304a19c4bdf76182e55cd75af181427aba12c080937dd4d734134
Opcode Fuzzy Hash: e0343e0790c08fe8081ba43b664770a8d7dc220cdadd973340cc644d836fc856
Instruction Fuzzy Hash: 68B1C274A002148FDB24CF14D880BAAB7F0EF55318F1485ADE889A7B41D779FA89CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D1AA0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?,00000000,00000000,?,?,6C1D209E,?,?), ref: 6C1D1AC2
sqlite3_finalize.SQLITE3(?), ref: 6C1D1B1D
sqlite3_finalize.SQLITE3(?), ref: 6C1D1B7E
sqlite3_errmsg.SQLITE3(?), ref: 6C1D1BC2

Strings

integer, xrefs: 6C1D1AFB, 6C1D1B03
cannot open value of type %s, xrefs: 6C1D1B04
no such rowid: %lld, xrefs: 6C1D1B9E
real, xrefs: 6C1D1AF1
null, xrefs: 6C1D1AEA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_errmsgsqlite3_step
String ID: cannot open value of type %s$integer$no such rowid: %lld$null$real
API String ID: 1289365376-2278770044
Opcode ID: 6788f70cd4e348c38f03da3ca2dd0b828e02e1383f9a3344c69b4fd1fd71de74
Instruction ID: 7e70ef374153ee8704f29a483eb15c4132f240c46dd1fdcfb59600027dee4c74
Opcode Fuzzy Hash: 6788f70cd4e348c38f03da3ca2dd0b828e02e1383f9a3344c69b4fd1fd71de74
Instruction Fuzzy Hash: 194191B53047048FC724CF59D880A67B7F5EB88328F1546A9ED09CBB11E635F855C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CAB00 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API called with finalized prepared statement,?,?,?,6C1CAC80,?,?,?,?,6C1CAD7E,?,?,?,?,00000000), ref: 6C1CAB22
sqlite3_log.SQLITE3(00000015,bind on a busy prepared statement: [%s],?,?,?,?,6C1CAC80,?,?,?,?,6C1CAD7E,?,?,?,?), ref: 6C1CAC37
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00012013,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1CAC55

Strings

%s at line %d of [%.10s], xrefs: 6C1CAC4E
bind on a busy prepared statement: [%s], xrefs: 6C1CAC30
API called with finalized prepared statement, xrefs: 6C1CAB1B
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1CAB2A, 6C1CAC3F
misuse, xrefs: 6C1CAC49
API called with NULL prepared statement, xrefs: 6C1CAB0E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-842070507
Opcode ID: 57ee5d25f30aeb0c35efca80c27d1a7aa320fb5350d8df6efc548c9b044b62f2
Instruction ID: c4a3461c06e47c93754b8d393260630ad1e05bca2b5e29280bed318e424d5b07
Opcode Fuzzy Hash: 57ee5d25f30aeb0c35efca80c27d1a7aa320fb5350d8df6efc548c9b044b62f2
Instruction Fuzzy Hash: 13312230700A089BD721CF69D884B56B3A5FBB431DF040669FD658BB82D77AE855C293

Uniqueness

Uniqueness Score: -1.00%

Function 6C171D50 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 88COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32(?,00000104,?,?,00000000), ref: 6C171D89
new.LIBCMT ref: 6C171DF4
FindNextVolumeW.KERNEL32(00000000,0000005C,00000104,?,00000000,0000005C,?,?,?,00000000), ref: 6C171E3C
FindVolumeClose.KERNEL32(00000000,?,?,?,?,?,?,00000000,0000005C,?,?,?,00000000), ref: 6C171E71

Strings

\, xrefs: 6C171DC9
?, xrefs: 6C171DD3
\, xrefs: 6C171DBF
\, xrefs: 6C171DE7
\, xrefs: 6C171DDD

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: FindVolume$CloseFirstNext
String ID: ?$\$\$\$\
API String ID: 1686509636-919962348
Opcode ID: 75571e6ff31a9386ec5e73102f1cad9a2a6fdedfdcaebec7396ed4cf3efb6736
Instruction ID: cc8cf4fe4da07cefc740daa0e086a9e703ceb9f1f51d55bd601651747bd0922c
Opcode Fuzzy Hash: 75571e6ff31a9386ec5e73102f1cad9a2a6fdedfdcaebec7396ed4cf3efb6736
Instruction Fuzzy Hash: 0131C7B5D013089ACF30DB60DC9DFDA73B4AF15318F10469DD51966581E7709B898A61

Uniqueness

Uniqueness Score: -1.00%

Function 6C21ADB0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,invalid), ref: 6C21ADE7

Strings

invalid, xrefs: 6C21ADDB
unknown error, xrefs: 6C21AE33
out of memory, xrefs: 6C21ADBB, 6C21AE0F
API call with %s database connection pointer, xrefs: 6C21ADE0
library routine called out of sequence, xrefs: 6C21ADEF
abort due to ROLLBACK, xrefs: 6C21AE5A, 6C21AE5F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$invalid$library routine called out of sequence$out of memory$unknown error
API String ID: 632333372-162952193
Opcode ID: f26547aa24f4acb2eceaabd04a9b0bd1c80bdb442189d348e98d07ee36f881cf
Instruction ID: 4b3c19d01d639fc83eeb71fc21fe251788fe08b77328d84e0b85d3454de6faba
Opcode Fuzzy Hash: f26547aa24f4acb2eceaabd04a9b0bd1c80bdb442189d348e98d07ee36f881cf
Instruction Fuzzy Hash: F8216B35B09B0D87CB214B14D400B6B73E5AB4161EF54043DFE5ADBF41E665E8588381

Uniqueness

Uniqueness Score: -1.00%

Function 6C18299B Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C1829AF

Part of subcall function 6C18201B: HeapFree.KERNEL32(00000000,00000000,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?), ref: 6C182031
Part of subcall function 6C18201B: GetLastError.KERNEL32(?,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?,?), ref: 6C182043

_free.LIBCMT ref: 6C1829BB
_free.LIBCMT ref: 6C1829C6
_free.LIBCMT ref: 6C1829D1
_free.LIBCMT ref: 6C1829DC
_free.LIBCMT ref: 6C1829E7
_free.LIBCMT ref: 6C1829F2
_free.LIBCMT ref: 6C1829FD
_free.LIBCMT ref: 6C182A08
_free.LIBCMT ref: 6C182A16

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 19f92e53282a8ad882a34e2e02cd18bcb6e5d247f3449c6108970314bcf035b3
Instruction ID: f8acdcf39422678ee05fc97549923c61ee94977a185900b01403b24ffe886a62
Opcode Fuzzy Hash: 19f92e53282a8ad882a34e2e02cd18bcb6e5d247f3449c6108970314bcf035b3
Instruction Fuzzy Hash: D61189B5506908BFCB02DF54C885EDA3BB9EF04354B6141A5F9098FA21D732DA55EF40

Uniqueness

Uniqueness Score: -1.00%

Function 6C2369D0 Relevance: 15.0, APIs: 10, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3(?,?,6C23B5F3), ref: 6C2369DA
sqlite3_finalize.SQLITE3(?,6C23B5F3), ref: 6C2369E6

Part of subcall function 6C1C90B0: sqlite3_log.SQLITE3(00000015,API called with finalized prepared statement), ref: 6C1C90D7
Part of subcall function 6C1C90B0: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00011BA8,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000015,API called with finalized prepared statement), ref: 6C1C90F2

sqlite3_finalize.SQLITE3(?,?,6C23B5F3), ref: 6C2369F2
sqlite3_finalize.SQLITE3(?,?,?,6C23B5F3), ref: 6C2369FE
sqlite3_finalize.SQLITE3(?,?,?,?,6C23B5F3), ref: 6C236A0A
sqlite3_finalize.SQLITE3(?,?,?,?,?,6C23B5F3), ref: 6C236A16
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,6C23B5F3), ref: 6C236A22
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A2E
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A3A
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A43

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_log$sqlite3_free
String ID:
API String ID: 637232822-0
Opcode ID: 898cbab567eeb118a941e34afcf7f925a61d3749f5b95290a29ecf4cb7966e37
Instruction ID: 52085689cc9f097fd8ddd9a07074ba5726ad2d9a75daa85bb87261ac0259f70a
Opcode Fuzzy Hash: 898cbab567eeb118a941e34afcf7f925a61d3749f5b95290a29ecf4cb7966e37
Instruction Fuzzy Hash: 7AF0B6E0A006009BD2249B25A9A1A9773BC6F6011CB044928FA4756F05EF3BF53CC6DB

Uniqueness

Uniqueness Score: -1.00%

Function 6C218C60 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 287COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,000209D5,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000000,00000000,?,?,?,6C218AF6,00000012,6C25924C), ref: 6C218C8C

Strings

%s at line %d of [%.10s], xrefs: 6C218C85
<4'l, xrefs: 6C218DE0
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C218C76
misuse, xrefs: 6C218C80
<4'l, xrefs: 6C218E0F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$<4'l$<4'l$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-1400871453
Opcode ID: 5dc0bca46545851f47139265dc63a61aa85ad8ef0c46ad0f885e159aa34d4e46
Instruction ID: 77b7fe88af282dbd6c0d3426ad2b527ca42216d15b5c20c11622868eaa71e836
Opcode Fuzzy Hash: 5dc0bca46545851f47139265dc63a61aa85ad8ef0c46ad0f885e159aa34d4e46
Instruction Fuzzy Hash: 96816C36B091284BDB15CE5EB8C1199F3E5F78A236F5442BBFE0CD7B40D672982486E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1ECC30 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3(?), ref: 6C1ECD33
sqlite3_value_text.SQLITE3(?), ref: 6C1ECD45
sqlite3_value_bytes.SQLITE3(?), ref: 6C1ECD5D
sqlite3_initialize.SQLITE3 ref: 6C1ECE5D
sqlite3_free.SQLITE3(00000000,string or blob too big,00000001), ref: 6C1ECF57
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C1ECF6A
sqlite3_free.SQLITE3(00000000), ref: 6C1ECF73

Strings

string or blob too big, xrefs: 6C1ECF18, 6C1ECF47

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_value_bytes$sqlite3_initializesqlite3_result_error_nomemsqlite3_value_text
String ID: string or blob too big
API String ID: 2398831921-2803948771
Opcode ID: 5465c6349086be44e37405c2b099b49876075ecc1410fa3f2aac240bfe7ad783
Instruction ID: 2977ebdce1a44f9ff4a1d1befc8cdd33c07c9bb1a81b3ae79eb34c09bf0f9d04
Opcode Fuzzy Hash: 5465c6349086be44e37405c2b099b49876075ecc1410fa3f2aac240bfe7ad783
Instruction Fuzzy Hash: 05A11571608B418BD310DF28C8A07AABFE2AF99318F28465DF895C7B41D735E859C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7F00 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 278COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B7F4E
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E03E,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7FEF
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E03B,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B8019
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E05D,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B8132

Part of subcall function 6C21C2F0: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000D560,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,6C1B6ACA), ref: 6C21C308

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E064,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B819B

Strings

%s at line %d of [%.10s], xrefs: 6C1B7FE8, 6C1B8012, 6C1B812B, 6C1B8194
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B7FD9, 6C1B8003, 6C1B811C, 6C1B8185
database corruption, xrefs: 6C1B7FE3, 6C1B800D, 6C1B8126, 6C1B818F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$_memset
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 2320441212-2708572664
Opcode ID: 87530f6a4993b93d108d5ee8932cf8fb4f67d8f888f865fbb224c4b32cdb2335
Instruction ID: 117a3e19315b0ab64071cf55a6bb877580b338da0805c017d0a641994b644935
Opcode Fuzzy Hash: 87530f6a4993b93d108d5ee8932cf8fb4f67d8f888f865fbb224c4b32cdb2335
Instruction Fuzzy Hash: C491593520C3964BC300CF2DD4905AA7BE1EBD5219F5486AEF8D997F42D23AD50ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0480 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 255COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3(?), ref: 6C1D05BE

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
gfff, xrefs: 6C1D04C9
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_value_text
String ID: abort due to ROLLBACK$gfff$gfff$out of memory$statement aborts at %d: [%s] %s$unknown error
API String ID: 348685305-1475756570
Opcode ID: 323316bcba0d907a5e5b550f2e9037d4da66ad2ee79b9b7191fdd921a2c9448a
Instruction ID: 8d0e0259c161ffe22f6336c84c45578b9077aa15a56486e173e709b35c670cb3
Opcode Fuzzy Hash: 323316bcba0d907a5e5b550f2e9037d4da66ad2ee79b9b7191fdd921a2c9448a
Instruction Fuzzy Hash: 61B1C370A002548FDB24CF18D880BA9B7B0FF15318F1485EED8499BB52E779EA85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C21DC70 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 246COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 6C21DC8D

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_errmsg.SQLITE3 ref: 6C21DCC5
sqlite3_free.SQLITE3(00000000), ref: 6C21DCDF
sqlite3_initialize.SQLITE3 ref: 6C21DDF0

Strings

(, xrefs: 6C21DDCB
SELECT * FROM %Q.%Q, xrefs: 6C21DC7E
(, xrefs: 6C21DF1C

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize$sqlite3_errmsgsqlite3_freesqlite3_mprintf
String ID: ($($SELECT * FROM %Q.%Q
API String ID: 2281841910-4264555708
Opcode ID: 1dc25a58b1ddd278518c9d5f7db3535f3ee423bee3fbc309a57903e23691189a
Instruction ID: 21f48d54805eecb6a47319bdeecd3ff2e5d71f58f2c3dfe5b8d1eaffdbc5e7ef
Opcode Fuzzy Hash: 1dc25a58b1ddd278518c9d5f7db3535f3ee423bee3fbc309a57903e23691189a
Instruction Fuzzy Hash: C1919AB560C316CFD312CF28C884A5BB7E0AF85309F044969FEA49BB01D734E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AB8D0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3(00000000,00000000,6C278CE0,?,?,6C1AA28A,?,?,00000000), ref: 6C1AB8EA
sqlite3_free.SQLITE3(00000000), ref: 6C1AB911
sqlite3_win32_is_nt.SQLITE3 ref: 6C1AB946
sqlite3_log.SQLITE3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,00009D78), ref: 6C1ABA0F
sqlite3_free.SQLITE3(00000000), ref: 6C1ABA18

Part of subcall function 6C1A8AB0: _memset.LIBCMT ref: 6C1A8AF0

sqlite3_free.SQLITE3(00000000), ref: 6C1ABAC9

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C1ABA08
winDelete, xrefs: 6C1ABAB9

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt$_memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 3588406750-1405699761
Opcode ID: 3a5ec0064c9074c2105fdea4af6e824cfe9b2d0019bb213dd42a9f75fc1803ba
Instruction ID: 90773be05db5c07e45a1530e99ddc1eb3c3b4c0f4b1390218e20bab57c518b55
Opcode Fuzzy Hash: 3a5ec0064c9074c2105fdea4af6e824cfe9b2d0019bb213dd42a9f75fc1803ba
Instruction Fuzzy Hash: AE516BBDB0229857DB114AE558C87AE7375EB63328F384626E925C3BC0E734C447C766

Uniqueness

Uniqueness Score: -1.00%

Function 6C1ABB01 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 6C1ABB16

Part of subcall function 6C1A8AB0: _memset.LIBCMT ref: 6C1A8AF0

sqlite3_free.SQLITE3 ref: 6C1ABB37
sqlite3_win32_is_nt.SQLITE3 ref: 6C1ABB7C
sqlite3_log.SQLITE3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,00009DAA), ref: 6C1ABC61
sqlite3_free.SQLITE3(00000000), ref: 6C1ABC74
sqlite3_free.SQLITE3(00000000), ref: 6C1ABCAA

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C1ABC5A
winAccess, xrefs: 6C1ABC87

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt$_memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 3588406750-1873940834
Opcode ID: f48a3e21092555e4a7a9fca23ffa9ed87a6752540d4747fdf2b8ebcdbfc53a9d
Instruction ID: 619483b009cc94dfe5525598e819662a352d122267a0be84ac471e352b1a9201
Opcode Fuzzy Hash: f48a3e21092555e4a7a9fca23ffa9ed87a6752540d4747fdf2b8ebcdbfc53a9d
Instruction Fuzzy Hash: 2B51F7796093899FD710CFB8C481B9EB3E1BF96318F150A2EE85583A84EB358546C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6C221FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

Strings

<b>, xrefs: 6C221FB3
snippet, xrefs: 6C22200A
wrong number of arguments to function snippet(), xrefs: 6C221FE7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: <b>$snippet$wrong number of arguments to function snippet()
API String ID: 0-203703274
Opcode ID: 9ac300ec05fa8a5eaaea8fea9eab70fc3fde477b64652cfab3962fea2089bd58
Instruction ID: 51bebca6765b24eb904d77efb48896c4ef87381b2d8cf27057890f75cd56d718
Opcode Fuzzy Hash: 9ac300ec05fa8a5eaaea8fea9eab70fc3fde477b64652cfab3962fea2089bd58
Instruction Fuzzy Hash: 1631C8B2A043099BC710CE59E841B5BF3E4AB9422DF00462DFC6987B41E736E559C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 6C179A10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?), ref: 6C179A32
CloseHandle.KERNEL32(?), ref: 6C179A47
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 6C179A61
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 6C179A77

Strings

MapViewOfFile error =%dd, xrefs: 6C179A96

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: File$View$CloseCreateHandleMappingUnmap
String ID: MapViewOfFile error =%dd
API String ID: 289744089-947979745
Opcode ID: 6200eae902cb76c58bccce3cfc49478381b5672c3224a3197473e87ba18116b1
Instruction ID: fdfdb165a5c576519e8af978f9d312387f7c2c9047bc860352b19aeee1404523
Opcode Fuzzy Hash: 6200eae902cb76c58bccce3cfc49478381b5672c3224a3197473e87ba18116b1
Instruction Fuzzy Hash: 9D219F786477009FFB30AF24DC28B42B7E4BB0A759F200B09E98696BC0D770E008DB20

Uniqueness

Uniqueness Score: -1.00%

Function 6C18BD56 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

FindCompleteObject.LIBCMT ref: 6C18BD77
FindSITargetTypeInstance.LIBVCRUNTIME ref: 6C18BD9B
FindMITargetTypeInstance.LIBVCRUNTIME ref: 6C18BDB0

Part of subcall function 6C18B933: PMDtoOffset.LIBCMT ref: 6C18B9FD

FindVITargetTypeInstance.LIBVCRUNTIME ref: 6C18BDB7
PMDtoOffset.LIBCMT ref: 6C18BDC8
std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 6C18BDF2
__CxxThrowException@8.LIBVCRUNTIME ref: 6C18BE02

Strings

Bad dynamic_cast!, xrefs: 6C18BDE9

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: Find$InstanceTargetType$Offset$CompleteException@8ObjectThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Bad dynamic_cast!
API String ID: 528452320-2956939130
Opcode ID: aa12bc8907a4e19955f0f2ba80179ab6cd58c5071a1b6b9f034b26e9470efdc8
Instruction ID: 810472faa85b3f69f4ae08e33dbb09f21fd0483969c304c3398c8ce38707982e
Opcode Fuzzy Hash: aa12bc8907a4e19955f0f2ba80179ab6cd58c5071a1b6b9f034b26e9470efdc8
Instruction Fuzzy Hash: 3221D272A0A608AFCB00CEA8CC44BEE7778EB4831CF140549F81597B50DB34D944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C232D40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3(?,SAVEPOINT fts3,00000000,00000000,00000000,?,?,?,6C22218D), ref: 6C232D57

Part of subcall function 6C1F4550: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00019D0C,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000000,?,?,Function_00058620,?,00000000,?,SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid,?,6C25DEE8), ref: 6C1F458A

sqlite3_blob_close.SQLITE3(?,?,?,?,6C22218D), ref: 6C232DCF

Part of subcall function 6C22E070: sqlite3_bind_int64.SQLITE3(?,00000001,?,?,00000000,00000001,00000000,?,?,?,?,?,?,?,?,6C2323DF), ref: 6C22E0B5
Part of subcall function 6C22E070: sqlite3_bind_int64.SQLITE3(?,00000002,?,?,?,00000001,?,?,00000000,00000001,00000000), ref: 6C22E0C6
Part of subcall function 6C22E070: sqlite3_step.SQLITE3(?,?,00000002,?,?,?,00000001,?,?,00000000,00000001,00000000), ref: 6C22E0CC

sqlite3_exec.SQLITE3(?,ROLLBACK TO fts3,00000000,00000000,00000000,?,?,?,?,?,6C22218D), ref: 6C232D8A

Part of subcall function 6C1F4550: sqlite3_step.SQLITE3(?,?,?,00000000,?,?,Function_00058620,?,00000000,?,SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid,?,6C25DEE8,?,00000000,?), ref: 6C1F4627
Part of subcall function 6C1F4550: _memset.LIBCMT ref: 6C1F468D

sqlite3_exec.SQLITE3(?,RELEASE fts3,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C22218D), ref: 6C232DA1

Part of subcall function 6C1F4550: sqlite3_column_text.SQLITE3(?,00000000,?,?,?,?,00000000,?,?,Function_00058620,?,00000000), ref: 6C1F46EE

sqlite3_exec.SQLITE3(?,RELEASE fts3,00000000,00000000,00000000,?,?,?,?,?,6C22218D), ref: 6C232DBA

Strings

ROLLBACK TO fts3, xrefs: 6C232D84
SAVEPOINT fts3, xrefs: 6C232D51
RELEASE fts3, xrefs: 6C232D9B, 6C232DB4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_exec$sqlite3_bind_int64sqlite3_step$_memsetsqlite3_blob_closesqlite3_column_textsqlite3_log
String ID: RELEASE fts3$ROLLBACK TO fts3$SAVEPOINT fts3
API String ID: 2006434357-3733817512
Opcode ID: fc912f213dd64b331e92a984e9f96d85ae30d36d25f6403c6e119a80d95e283b
Instruction ID: b522dcec5df49f0169b41cc973ed09e780be703b49f47a9625e7febbd26b92a3
Opcode Fuzzy Hash: fc912f213dd64b331e92a984e9f96d85ae30d36d25f6403c6e119a80d95e283b
Instruction Fuzzy Hash: BC11C4F56C070963E23152286C06F5772D40B90B19F250918FE3DABFC2FAA5F41642F9

Uniqueness

Uniqueness Score: -1.00%

Function 6C222800 Relevance: 13.7, APIs: 9, Instructions: 226COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3(?,?,?,?,6C224293,?,?,?,?,?,?,?), ref: 6C22284B
sqlite3_free.SQLITE3(00000000,?,?,00000000,00000001,?,?,?,?,?,?,?,?,?,6C224293,?), ref: 6C2228D9
sqlite3_free.SQLITE3(00000000,?,?,?,?,6C224293,?,?,?,?,?,?,?), ref: 6C222944
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C224293), ref: 6C22295C
sqlite3_initialize.SQLITE3 ref: 6C2229A0
sqlite3_free.SQLITE3(00000000,?,?,?,6C224293,?,?,?,?,?,?,?), ref: 6C2229CD
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,6C224293,?,?,?,?,?), ref: 6C222A16
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,6C224293,?,?,?,?,?), ref: 6C222A2C
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,?,6C224293,?,?,?,?), ref: 6C222A3D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize
String ID:
API String ID: 3567857118-0
Opcode ID: 40b8dc69937b1b768fabce745c8f9d943f428fc3fe2c4a05604803a1e29ddf23
Instruction ID: ca8b48944f3cc32b4c26f0e26c8f5b88f868ace5b56213c431f5b807a0b87b77
Opcode Fuzzy Hash: 40b8dc69937b1b768fabce745c8f9d943f428fc3fe2c4a05604803a1e29ddf23
Instruction Fuzzy Hash: BE71A5B1A147059FD314DF69D940A9BB7E4FF88628F144A2EFC49C7B00E735E5098B92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CD9FA Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 338COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
string or blob too big, xrefs: 6C1CCB0C
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$out of memory$statement aborts at %d: [%s] %s$string or blob too big$unknown error
API String ID: 0-95868776
Opcode ID: 73ea2de4df290065f4f00322e457105cd5dafe366583e27f483affe4c40c3c12
Instruction ID: d58abaa9912ef7406e0738dd177a49676fce21dfa85d58342490bf7d7d0c5be1
Opcode Fuzzy Hash: 73ea2de4df290065f4f00322e457105cd5dafe366583e27f483affe4c40c3c12
Instruction Fuzzy Hash: 1CE1B574E442198FDB24CF14C880BE9B3B1BB15318F1585EED849A7B41E778AE85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CC445 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 260COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
string or blob too big, xrefs: 6C1CCB0C
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$out of memory$statement aborts at %d: [%s] %s$string or blob too big$unknown error
API String ID: 0-95868776
Opcode ID: 051c282c9e143f2b4199583436b8e2e18eb69722fda3d742c944f1f8d776492f
Instruction ID: 75456b737121e7693d952cb30067a756ff1334070b7b93f11a333677dd3b8e0c
Opcode Fuzzy Hash: 051c282c9e143f2b4199583436b8e2e18eb69722fda3d742c944f1f8d776492f
Instruction Fuzzy Hash: 3DA1D470A003558FDB24CF14C880BAAB7B4AF6431CF1985ADE84997B41D779FD89CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C241810 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 6C241A35
domain error, xrefs: 6C2418CE

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: domain error$string or blob too big
API String ID: 0-3775860708
Opcode ID: 82b743a6200da2f92763fb5efec27a2b24d8c7b3bf0facf84e6809e92418eede
Instruction ID: baab43cd94c75f7d0379e928db81398cbafef532353168fb7653ff5db636f320
Opcode Fuzzy Hash: 82b743a6200da2f92763fb5efec27a2b24d8c7b3bf0facf84e6809e92418eede
Instruction Fuzzy Hash: 7F713B32A046494BD305CE68D84079A77A2EB82339F188799FCA8877C1E731D499C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C2415C0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 6C2417E4
domain error, xrefs: 6C241680

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: domain error$string or blob too big
API String ID: 0-3775860708
Opcode ID: 414f982aa86ca1c6bea38a390604f6053e40d96fea1e1a090245eb812c80aa07
Instruction ID: 7776b83bd679b7144d502da084862455712b760e55bdc5a5c0e1d54fcf9bbeb9
Opcode Fuzzy Hash: 414f982aa86ca1c6bea38a390604f6053e40d96fea1e1a090245eb812c80aa07
Instruction Fuzzy Hash: 5971493570434A4BD304CE28D88069A7795EF8532DF18876DFDA88BBD1E732D4A98792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E3CC0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 225COMMON

Download Yara Rule

Strings

CREATE TABLE , xrefs: 6C1E3E14
,%l, xrefs: 6C1E3E39, 6C1E3E4A, 6C1E3EF1
8%l, xrefs: 6C1E3F13, 6C1E3F16
0%l,%l, xrefs: 6C1E3E9F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: ,%l$0%l,%l$8%l$CREATE TABLE
API String ID: 0-3763110634
Opcode ID: 6969112664c3904acdf59602dfb9d01d0a5f7fe2746032693ddcbab24c5ff500
Instruction ID: 72c70dd04593c9e34fa0afbf669a3f376750d59d2318de77aa39c565d25ba79a
Opcode Fuzzy Hash: 6969112664c3904acdf59602dfb9d01d0a5f7fe2746032693ddcbab24c5ff500
Instruction Fuzzy Hash: CB811275A046099FCB10CF59C4846AEBBB1FF89318FA88299EC15DB721D735DA07CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C23C9C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

sqlite3_value_blob.SQLITE3(?), ref: 6C23CADD
sqlite3_randomness.SQLITE3(00000010,?), ref: 6C23CB11
sqlite3_initialize.SQLITE3 ref: 6C23CB2B
sqlite3_initialize.SQLITE3 ref: 6C23CB5F
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C23CB7E
sqlite3_free.SQLITE3(?), ref: 6C23CC49

Strings

string or blob too big, xrefs: 6C23CC2A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize$sqlite3_freesqlite3_randomnesssqlite3_result_error_nomemsqlite3_value_blob
String ID: string or blob too big
API String ID: 4060092727-2803948771
Opcode ID: 7e0bc30bfd2014787b36753b1afc924d9fb6ccd63b9c07a6152d9ec7b2788d54
Instruction ID: 47975ef6fde89ed9740cacda1729b8898b820642b9d7dc96152aa783c5256a10
Opcode Fuzzy Hash: 7e0bc30bfd2014787b36753b1afc924d9fb6ccd63b9c07a6152d9ec7b2788d54
Instruction Fuzzy Hash: 87818DB1A093768BD720EF18C440B9BB7E0AF85B58F049A1DEC9D97B41D734E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C235890 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C23589E
sqlite3_free.SQLITE3(?), ref: 6C235A70
sqlite3_free.SQLITE3(00000000,?), ref: 6C235A76

Strings

tokenchars=, xrefs: 6C2359BC
remove_diacritics=1, xrefs: 6C23590E
separators=, xrefs: 6C235A0C
remove_diacritics=0, xrefs: 6C235951

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize
String ID: remove_diacritics=0$remove_diacritics=1$separators=$tokenchars=
API String ID: 3567857118-4153190982
Opcode ID: c8b8146cd6932dc31e0b7b55e238353c1fae58398176e3a30e900016c1b0a17e
Instruction ID: 81afab679e1093cf13aecb3f05448493be17490d1f37221b20b4746cfcd5c25c
Opcode Fuzzy Hash: c8b8146cd6932dc31e0b7b55e238353c1fae58398176e3a30e900016c1b0a17e
Instruction Fuzzy Hash: D751A4E1A0829A4BD311CE258490756FFB2AB42338F5D96B8ECDD5FB41D732E84287D1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7A70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B7BE3
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF6E,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C09
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF56,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C32
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF50,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C5B

Strings

%s at line %d of [%.10s], xrefs: 6C1B7C02, 6C1B7C2B, 6C1B7C54
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B7BF3, 6C1B7C1C, 6C1B7C45
database corruption, xrefs: 6C1B7BFD, 6C1B7C26, 6C1B7C4F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$_memset
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 2320441212-2708572664
Opcode ID: b6625416f02986cf6ea76295e7cc8ac513d7235c8320d22e941cbedb849c18e7
Instruction ID: fcf7238073d72555ea4940930f116952df0ea3875dd75434200205b8faae8a3b
Opcode Fuzzy Hash: b6625416f02986cf6ea76295e7cc8ac513d7235c8320d22e941cbedb849c18e7
Instruction Fuzzy Hash: 1E51C5705083469FC304CF59D880A6ABBE0FB84309F148AAEF89997B81D735E554CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0637 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 152COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6C1D15B3
sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
string or blob too big, xrefs: 6C1CCB0C
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$string or blob too big$unknown error
API String ID: 2320820228-3833822409
Opcode ID: cc054ab1c62bdc21b9eec84e132f4191390819c1355a03b8990b1627cd28df55
Instruction ID: fe13590db88134474a2897a66e15d86f5a6237604ad51538127e835965be7037
Opcode Fuzzy Hash: cc054ab1c62bdc21b9eec84e132f4191390819c1355a03b8990b1627cd28df55
Instruction Fuzzy Hash: 3851E2B4B003049BEB248F28D890BFA77B4AB2531CF1545A9E84997F41E739F949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C224DF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3(temp,?,?), ref: 6C224E34
sqlite3_declare_vtab.SQLITE3(?,CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)), ref: 6C224EA9
sqlite3_initialize.SQLITE3 ref: 6C224EC0
_memset.LIBCMT ref: 6C224EF0

Strings

invalid arguments to fts4aux constructor, xrefs: 6C224E67
temp, xrefs: 6C224E2F
CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 6C224E9F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_declare_vtabsqlite3_initializesqlite3_strnicmp
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 3450478998-537686372
Opcode ID: 8aca73bfb396d2c2c0406fe611f487f7334ca1bc414edd7bb6bf9d9af2fb378f
Instruction ID: 0fac163a38531decac654609b4ec02a996722dbb79c0fc54429686f3225884b4
Opcode Fuzzy Hash: 8aca73bfb396d2c2c0406fe611f487f7334ca1bc414edd7bb6bf9d9af2fb378f
Instruction Fuzzy Hash: 51416A75A0430A9FD714CF19D880997B7E5EF88329F18C669EC598BB01E735E809CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C22A420 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3(?,?,00000001,?,?,?,00000001,?,6C21F6C4,00000000,?,00000001,?,00000000), ref: 6C22A449

Part of subcall function 6C1D27B0: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00013F92,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1D27D7

sqlite3_mprintf.SQLITE3(%s_segments,00000001), ref: 6C22A465
sqlite3_initialize.SQLITE3(00000001,?,6C21F6C4,00000000), ref: 6C22A4D8
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,00000001,?,6C21F6C4,00000000), ref: 6C22A56A

Strings

block, xrefs: 6C22A49A
%s_segments, xrefs: 6C22A460

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_blob_reopensqlite3_freesqlite3_initializesqlite3_logsqlite3_mprintf
String ID: %s_segments$block
API String ID: 3571655905-4076095781
Opcode ID: 42f20b9433d6371c6faf37d8666365c859372b8d24ccb200570de47154a5ccb5
Instruction ID: 5b55959c8c8dc23e3869c42582e745ba430af067b51b498306056fab29864649
Opcode Fuzzy Hash: 42f20b9433d6371c6faf37d8666365c859372b8d24ccb200570de47154a5ccb5
Instruction Fuzzy Hash: 234174B2A0060ADBD7208E69E844BA7B3E9EB84319F104629FD18D7F40E775E855C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C246EAE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6C26EE90,00000008,6C246FB6,00000000,00000000,?,6C246CCE,00000000,00000001,00000000,?,6C249894,00000018,6C26EF60,0000000C), ref: 6C246EBF
__lock.LIBCMT ref: 6C246EF3

Part of subcall function 6C249909: __mtinitlocknum.LIBCMT ref: 6C24991F
Part of subcall function 6C249909: __amsg_exit.LIBCMT ref: 6C24992B
Part of subcall function 6C249909: EnterCriticalSection.KERNEL32(00000000,00000000,?,6C247086,0000000D,6C26EEB8,00000008,6C24717D,00000000,?,6C2451CF,00000000,6C26EDD0,00000008,6C245234,?), ref: 6C249933

InterlockedIncrement.KERNEL32(?), ref: 6C246F00
__lock.LIBCMT ref: 6C246F14
___addlocaleref.LIBCMT ref: 6C246F32

Strings

KERNEL32.DLL, xrefs: 6C246EBA
Xa%l, xrefs: 6C246EC8

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL$Xa%l
API String ID: 637971194-1387481482
Opcode ID: b37a7ccec0c054c1c15ed68402fcaa0292c9311ea06cce3e2694f2b4df81abed
Instruction ID: 6eff7ddd08e8e83b5e0de0d8d52c7612fe1711462c054e141b1465726c8c5b07
Opcode Fuzzy Hash: b37a7ccec0c054c1c15ed68402fcaa0292c9311ea06cce3e2694f2b4df81abed
Instruction Fuzzy Hash: 23016D71410B08DFD7249F69D84978AFBF0AF11324F10C90EDCAA96BA0CB70AA48CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C21AEC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,invalid), ref: 6C21AEF1
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,0002111F,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C21AF0F

Strings

%s at line %d of [%.10s], xrefs: 6C21AF08
invalid, xrefs: 6C21AEE5
API call with %s database connection pointer, xrefs: 6C21AEEA
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C21AEF9
misuse, xrefs: 6C21AF03

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$invalid$misuse
API String ID: 632333372-2000704368
Opcode ID: b16c2fb0ce2248d3a844ff95719e32f61bcfa64c807c7820fc315a93f97f9f9f
Instruction ID: 615f1bffa1f504977604f55ce1dce4775a598da6db33eecddce9bd7c42caa1d1
Opcode Fuzzy Hash: b16c2fb0ce2248d3a844ff95719e32f61bcfa64c807c7820fc315a93f97f9f9f
Instruction Fuzzy Hash: 7FF0817161E14C57C7008614DC01F3A3784874031EF5006D9FE2CDEF87E603E86992D5

Uniqueness

Uniqueness Score: -1.00%

Function 6C21AF40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 38COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,invalid), ref: 6C21AF71
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00021128,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000015,API call with %s database connection pointer,invalid), ref: 6C21AF8C

Strings

%s at line %d of [%.10s], xrefs: 6C21AF85
invalid, xrefs: 6C21AF65
API call with %s database connection pointer, xrefs: 6C21AF6A
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C21AF76
misuse, xrefs: 6C21AF80

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$invalid$misuse
API String ID: 632333372-2000704368
Opcode ID: 23f46d381adb8ab7c7562840c1f69e50a48162904af4dfdc60c919965cb9106f
Instruction ID: fa5f43d3048dbdca64a10af49ada8e2e87b63a5f93b7bbfc75f7bf6585155527
Opcode Fuzzy Hash: 23f46d381adb8ab7c7562840c1f69e50a48162904af4dfdc60c919965cb9106f
Instruction Fuzzy Hash: 31F0597460E14DA7DB1159449C01F7D3784D78030EF200A98FE29EEEC2E603A46D52E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A7F30 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,NULL,?,6C1F9538,?,?,00000000,?,?,6C1C9EFE), ref: 6C1A7F41
sqlite3_log.SQLITE3(00000015,API call with %s database connection pointer,invalid,?,6C1F9538,?,?,00000000,?,?,6C1C9EFE), ref: 6C1A7F71

Strings

unopened, xrefs: 6C1A7F7D
invalid, xrefs: 6C1A7F65
API call with %s database connection pointer, xrefs: 6C1A7F3A, 6C1A7F6A, 6C1A7F82
NULL, xrefs: 6C1A7F35

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: API call with %s database connection pointer$NULL$invalid$unopened
API String ID: 632333372-406007132
Opcode ID: 616b3d162c7668fb047e4b4442d053bdee350047876a7434c16ac6ac0a9c1cde
Instruction ID: af75b5edbaa028429a8a766830685e409f975c9587bad1b75d0c623acc8f1d1f
Opcode Fuzzy Hash: 616b3d162c7668fb047e4b4442d053bdee350047876a7434c16ac6ac0a9c1cde
Instruction Fuzzy Hash: 17F0656962650C16DA1653F46D01F6F334447D431EFB408A6F932E8DCDE74193756042

Uniqueness

Uniqueness Score: -1.00%

Function 6C18560D Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6C17F4F5,6C17F4F5,?,?,?,6C18585E,00000001,00000001,57E85006), ref: 6C185667
__alloca_probe_16.LIBCMT ref: 6C18569F
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6C18585E,00000001,00000001,57E85006,?,?,?), ref: 6C1856ED
__alloca_probe_16.LIBCMT ref: 6C185784
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,57E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6C1857E7
__freea.LIBCMT ref: 6C1857F4

Part of subcall function 6C182055: HeapAlloc.KERNEL32(00000000,?,?,?,6C17A5B9,?,?,6C171043,00000040,2ADA91DB,?,?,6C18BE4F,000000FF), ref: 6C182087

__freea.LIBCMT ref: 6C1857FD
__freea.LIBCMT ref: 6C185822

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 263d95bce824445d1d08b5c4a0220f0bb53f2a55fc98c47fd96a057a4f174fc8
Instruction ID: 4e4b0e74017c419f64f8b4b46346554f81f0ea9b41e13783b4e88acd9c5c688d
Opcode Fuzzy Hash: 263d95bce824445d1d08b5c4a0220f0bb53f2a55fc98c47fd96a057a4f174fc8
Instruction Fuzzy Hash: 5451047260A206EBFF15CE64CC80FAF3BA9EB51754F618229FC16D6640EB34DC458E60

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BB9A0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 416COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000EE15,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BBE04

Strings

%s at line %d of [%.10s], xrefs: 6C1BBDFD, 6C1BBE34
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BBDEE, 6C1BBE25
database corruption, xrefs: 6C1BBDF8, 6C1BBE2F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: fec13042151b10e15429cb6031379e1df73cbab19034fc0966648a0c9f1bb430
Instruction ID: ad729be0d893d0733c3c8cf0b7665ded207eef102a45e810a0470feebae8706e
Opcode Fuzzy Hash: fec13042151b10e15429cb6031379e1df73cbab19034fc0966648a0c9f1bb430
Instruction Fuzzy Hash: 56F10F706082418FD704CF24C4C4B6A7BA0BF85318F054699ED95ABFA2E739E845CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F8F63 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 411COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1F8FDF

Strings

database schema is locked: %s, xrefs: 6C1F9091
statement too long, xrefs: 6C1F9051
(, xrefs: 6C1F91F8

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: ($database schema is locked: %s$statement too long
API String ID: 2102423945-3861767200
Opcode ID: 6cb49e61740ae82e823976d0832048b02f4dc016d4dd7f3b306948bd247e6a7b
Instruction ID: 8e702c7db4b6bcf20e52281376f11a93b9e38445b591da964576fbd4abb641a0
Opcode Fuzzy Hash: 6cb49e61740ae82e823976d0832048b02f4dc016d4dd7f3b306948bd247e6a7b
Instruction Fuzzy Hash: 59F1E1B0A00605DFDB11EF64C8A4BDEB7F0BF51308F148129D86997B81DB74E956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C241A60 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 289COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 6C241CDA
domain error, xrefs: 6C241B20

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: domain error$string or blob too big
API String ID: 0-3775860708
Opcode ID: 76dfa8d558d4c764fb717463ac7bcf390614bdff63336b72cac78b15f835f797
Instruction ID: 735197dfac2bf110fa28ee855b8eebaf2645bc7cd324cac6db1a5cde3658aecf
Opcode Fuzzy Hash: 76dfa8d558d4c764fb717463ac7bcf390614bdff63336b72cac78b15f835f797
Instruction Fuzzy Hash: D09145727083198BC3048F28D88475A77A1EB8632DF18875AFCA8D7B91E731D4A5C793

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CEA1E Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 282COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$out of memory$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-387920682
Opcode ID: 3201edb677d2b89b1e1781aa5048245e335fce8a3f32613b40ceb1cb21eb8b21
Instruction ID: b1858d31abcf661db9c2de8bf784e5622f29279e08b75d8cc7560fd70abff09d
Opcode Fuzzy Hash: 3201edb677d2b89b1e1781aa5048245e335fce8a3f32613b40ceb1cb21eb8b21
Instruction Fuzzy Hash: 7FC1E274E002548BDB24CF14C880BE9B7B1AF65318F1885DDE94967B41D739EE86CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B44A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 274COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B44F6
sqlite3_malloc64.SQLITE3(?,?), ref: 6C1B460D

Part of subcall function 6C1A3E30: sqlite3_initialize.SQLITE3 ref: 6C1A3E36

sqlite3_free.SQLITE3(00000000), ref: 6C1B4733
sqlite3_log.SQLITE3(0000011B,recovered %d frames from WAL file %s,?,?), ref: 6C1B47B4

Strings

, xrefs: 6C1B4526
recovered %d frames from WAL file %s, xrefs: 6C1B47AA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_freesqlite3_initializesqlite3_logsqlite3_malloc64
String ID: $recovered %d frames from WAL file %s
API String ID: 344883112-3175670447
Opcode ID: 888ea19aa300e9452e04e3d8017fd604a7e1ac7e75acab9cc6a901f7177ff933
Instruction ID: 9461d0186876d2217c32142361a2e79fbb29f18fb0287c2f7e44cdb7d8ebaf0b
Opcode Fuzzy Hash: 888ea19aa300e9452e04e3d8017fd604a7e1ac7e75acab9cc6a901f7177ff933
Instruction Fuzzy Hash: 24A15CB4E006099FDB14CF99C880AAEB7F9FF99308F148529D506ABB40E734E946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C237CD0 Relevance: 10.8, APIs: 7, Instructions: 267COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 6C237CFD
_memset.LIBCMT ref: 6C237D0D
sqlite3_initialize.SQLITE3 ref: 6C237E16
sqlite3_free.SQLITE3(?), ref: 6C237F9F

Part of subcall function 6C237A80: sqlite3_bind_int64.SQLITE3(?,00000001,?,?), ref: 6C237AA4
Part of subcall function 6C237A80: sqlite3_step.SQLITE3(?,?,00000001,?,?), ref: 6C237AAD
Part of subcall function 6C237A80: sqlite3_reset.SQLITE3(?,00000000,?,00000000,?), ref: 6C237B7A

_memset.LIBCMT ref: 6C237E59
_memset.LIBCMT ref: 6C237E72

Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,6C23B5F3), ref: 6C2369DA
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,6C23B5F3), ref: 6C2369E6
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,6C23B5F3), ref: 6C2369F2
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,6C23B5F3), ref: 6C2369FE
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,?,6C23B5F3), ref: 6C236A0A
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,?,?,6C23B5F3), ref: 6C236A16
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,?,?,?,6C23B5F3), ref: 6C236A22
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A2E
Part of subcall function 6C2369D0: sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A3A
Part of subcall function 6C2369D0: sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,6C23B5F3), ref: 6C236A43

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_finalize$_memsetsqlite3_free$sqlite3_bind_int64sqlite3_initializesqlite3_resetsqlite3_step
String ID:
API String ID: 1684937644-0
Opcode ID: ce0e8177f2937ea8d71fccf6f4d3ddfe370cabf42e3a4bda394c98381a9c7e45
Instruction ID: 38974a5a7e070a6337c50849dadd29c02164d11afc5d0570deed6b3a30e2fa4d
Opcode Fuzzy Hash: ce0e8177f2937ea8d71fccf6f4d3ddfe370cabf42e3a4bda394c98381a9c7e45
Instruction Fuzzy Hash: FB918DB1A043199BC710CF29C980A9BB7E4BF88718F145A6EEC8DD7741E731E915CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CED16 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 258COMMON

Download Yara Rule

APIs

sqlite3_randomness.SQLITE3(00000008,?), ref: 6C1CEE99

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_randomness
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 2799796375-3899832264
Opcode ID: 3402df198501eb77959354f6a7a0986c383043bd60279d6c9f9dcfa004e8690c
Instruction ID: 66e50f8b9ecfc120291c2d73410e7fcdac5df608062abae84c34122477c1a184
Opcode Fuzzy Hash: 3402df198501eb77959354f6a7a0986c383043bd60279d6c9f9dcfa004e8690c
Instruction Fuzzy Hash: F1B1A071A003148BDB20CF18C881BE9B7B1BF64318F2546D9E409A7B91D779EE85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CE51F Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 6C1CBA30: _memset.LIBCMT ref: 6C1CBAB2
Part of subcall function 6C1CBA30: _memset.LIBCMT ref: 6C1CBAE9

Part of subcall function 6C1B8A30: _memset.LIBCMT ref: 6C1B8B4B

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Part of subcall function 6C1BADD0: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000EA35,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BADF9

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset$sqlite3_log
String ID: abort due to ROLLBACK$gfff$out of memory$statement aborts at %d: [%s] %s$unknown error
API String ID: 1424968112-387920682
Opcode ID: e93d6b83fe829e5a450962a4d1070d7be953abbca7f74de4c5d4289747c0ee68
Instruction ID: c792105b0dd6fcbc6859d9eade9729959e8d13fd6eaaab724ef840271d428c10
Opcode Fuzzy Hash: e93d6b83fe829e5a450962a4d1070d7be953abbca7f74de4c5d4289747c0ee68
Instruction Fuzzy Hash: 8C91F674A003149BE720CF64CC81BAAB7F0AB15318F1846ADE54AA7B81D779F989CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E0F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3(00000080,?,cannot DETACH database within transaction), ref: 6C1E10B6

Part of subcall function 6C1B9220: sqlite3_free.SQLITE3(?,6C2197C3,?,?,?,6C1C28BA), ref: 6C1B92A9
Part of subcall function 6C1B9220: sqlite3_free.SQLITE3(?,6C2197C3,?,?,?,6C1C28BA), ref: 6C1B92CB
Part of subcall function 6C1B9220: sqlite3_free.SQLITE3(5DE58B5B,?,6C2197C3,?,?,?,6C1C28BA), ref: 6C1B92EE

sqlite3_snprintf.SQLITE3(00000080,?,database %s is locked,?), ref: 6C1E110A

Strings

cannot detach database %s, xrefs: 6C1E1092
database %s is locked, xrefs: 6C1E10F9
cannot DETACH database within transaction, xrefs: 6C1E10A5
no such database: %s, xrefs: 6C1E107E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf
String ID: cannot DETACH database within transaction$cannot detach database %s$database %s is locked$no such database: %s
API String ID: 2418834857-3374617522
Opcode ID: a2af3cb1a78c8f0c1fc11000b892c7b82888d6fb8cf27f923da55925c02a7eb9
Instruction ID: 5b9e6b2b071d1e9a5b1115760d4fd3054a7d909480cd573078511eddb623c774
Opcode Fuzzy Hash: a2af3cb1a78c8f0c1fc11000b892c7b82888d6fb8cf27f923da55925c02a7eb9
Instruction Fuzzy Hash: FD71E331A047588FD720CF28C884B9AB7F1AF5A308F2585D9D899CBB42D775D989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0CA8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
string or blob too big, xrefs: 6C1CCB0C
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$string or blob too big$unknown error
API String ID: 0-3833822409
Opcode ID: 9fd24c020a978a991e34338a67c369d47e1889d1e2b60af11d787843bb70701e
Instruction ID: df61ba4cc4f83ec5032ca69ce67aedd9d3972102b36391719ad525a52c16eebf
Opcode Fuzzy Hash: 9fd24c020a978a991e34338a67c369d47e1889d1e2b60af11d787843bb70701e
Instruction Fuzzy Hash: B271B3B0A002598FDB24CF28C880BEAB7B1BF55318F1445A9D44DA7B41E779ED85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0B38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 6C1C8F10: sqlite3_free.SQLITE3(00000000,?,?,00000001,?,?,?,?,?,?,?,6C1C6ED4), ref: 6C1C8FCE

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Part of subcall function 6C1CBA30: _memset.LIBCMT ref: 6C1CBAB2
Part of subcall function 6C1CBA30: _memset.LIBCMT ref: 6C1CBAE9

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
out of memory, xrefs: 6C1D1648
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset$sqlite3_freesqlite3_log
String ID: abort due to ROLLBACK$gfff$out of memory$statement aborts at %d: [%s] %s$unknown error
API String ID: 1672770757-387920682
Opcode ID: 1981b4cb4bd04b9b535d58756c85f0ab39bbac1e5ef1c058a2726b673ea19c76
Instruction ID: 1cea6a3171eb06cb9011f0dafb5e32a3ad872a58dd23a358f02efcab48bd2142
Opcode Fuzzy Hash: 1981b4cb4bd04b9b535d58756c85f0ab39bbac1e5ef1c058a2726b673ea19c76
Instruction Fuzzy Hash: 6171F370A003148BEB20CF24C980BEAB7B5BF15328F2546ADE84997B41D779F985CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C174890 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 182COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(?,?,00000104,?,?,?,?,00000104), ref: 6C17490B

Strings

UDF, xrefs: 6C174A5E
FAT, xrefs: 6C1749CF
exFAT, xrefs: 6C174A1B
NTFS, xrefs: 6C174949
FAT32, xrefs: 6C17498F

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: InformationVolume
String ID: FAT$FAT32$NTFS$UDF$exFAT
API String ID: 2039140958-2685762470
Opcode ID: 97fad8178fa94fc865ad24ca64626279430dce212f08b81d172485e245412015
Instruction ID: a92eaad88beae815d28b58f7e8f2331abf69783330ce24438559c084811d1281
Opcode Fuzzy Hash: 97fad8178fa94fc865ad24ca64626279430dce212f08b81d172485e245412015
Instruction Fuzzy Hash: C951C3726002059AEB30EF20C801BE673BAEF35348F5546A5C546EBA55F732D684CF78

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0A32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3(?), ref: 6C1D0AA3

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_value_text
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 348685305-3899832264
Opcode ID: 3826b089ac11b32efd22866da18fe42373239d46cf5e6c8b3d7872de8d846846
Instruction ID: 92aff86a7bbdc99a09828bf80ef15ab182bef7905b05f09fbe5e296f7628927a
Opcode Fuzzy Hash: 3826b089ac11b32efd22866da18fe42373239d46cf5e6c8b3d7872de8d846846
Instruction Fuzzy Hash: 2F6191B4E002188FDB24CF24C880BE9B7B5FB15318F1545AAD44DA7B41E739EA85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BCB60 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000F173,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BCBC7
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000F197,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BCC80

Strings

%s at line %d of [%.10s], xrefs: 6C1BCBC0, 6C1BCC79, 6C1BCCE5
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BCBB1, 6C1BCC6A, 6C1BCCD6
database corruption, xrefs: 6C1BCBBB, 6C1BCC74, 6C1BCCE0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 14949062a066d1875b55ce433e43d67a4092210e6a5039f38a8cc601da781589
Instruction ID: 1cb4bb64908e7a351319f003c20b537a81ffb68dcd45aef7dba15afbb0ad030e
Opcode Fuzzy Hash: 14949062a066d1875b55ce433e43d67a4092210e6a5039f38a8cc601da781589
Instruction Fuzzy Hash: 0541077270430557C300EE6DD89066BB3E4EBA8628F150A3AED58E7F41E771F8458AD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0984 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
database table is locked: %s, xrefs: 6C1D09D6
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$database table is locked: %s$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-604735505
Opcode ID: b25ac42bb160b468a393fce67c3d9a975072fd4fb85d6d2eb80294c56579447e
Instruction ID: 750b62e74b45413382535a11e3138ec3ba27a798507797062897926de3278ff6
Opcode Fuzzy Hash: b25ac42bb160b468a393fce67c3d9a975072fd4fb85d6d2eb80294c56579447e
Instruction Fuzzy Hash: 7351C6B4A003049BEB24CF24D891BBAB7B0EB65328F2445ADE84997F41D739F945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C187F65 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,6C1886DA,?,00000000,?,00000000,00000000), ref: 6C187FA7
__fassign.LIBCMT ref: 6C188022
__fassign.LIBCMT ref: 6C18803D
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 6C188063
WriteFile.KERNEL32(?,?,00000000,6C1886DA,00000000,?,?,?,?,?,?,?,?,?,6C1886DA,?), ref: 6C188082
WriteFile.KERNEL32(?,?,00000001,6C1886DA,00000000,?,?,?,?,?,?,?,?,?,6C1886DA,?), ref: 6C1880BB

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4966b7f18054a84f34a027cf5cd7d3a06d494dc2ea9b428f8e8422f1eb67bc62
Instruction ID: 862dcca884bc59473ddb900d39e89215355b06d77ea696e654cb3ee46966b15a
Opcode Fuzzy Hash: 4966b7f18054a84f34a027cf5cd7d3a06d494dc2ea9b428f8e8422f1eb67bc62
Instruction Fuzzy Hash: 4651B371A062499FEB10CFA8C895ADEBBF4EF0A300F15421AE955F7681D730D941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFBA3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
z, xrefs: 6C1CFBBF
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error$z
API String ID: 632333372-1455945824
Opcode ID: d9c316433c4bda0d5ba7c131f5aeef9fb27fe522725d8cd2ed8bf3021a241f04
Instruction ID: 3ed4528a177c7752142c53cabfc8f703185d8fcb5026e43e701f1c73a4921a55
Opcode Fuzzy Hash: d9c316433c4bda0d5ba7c131f5aeef9fb27fe522725d8cd2ed8bf3021a241f04
Instruction Fuzzy Hash: 4651D4B4A003049BEB24CF28C880BE9B7B0FB55328F2585ADD84997B41D779F985CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C23C820 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

SELECT pw=sqlite_crypt(?1,pw), isAdmin FROM "%w".sqlite_user WHERE uname=?2, xrefs: 6C23C860

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: SELECT pw=sqlite_crypt(?1,pw), isAdmin FROM "%w".sqlite_user WHERE uname=?2
API String ID: 0-3985876714
Opcode ID: 4cb60178c01e459c2c5a1c726fd074b8e03c7007d17778358573a2f4acf83a10
Instruction ID: 09d652fa2dbd3de6be590cb6644ddcbdfa79db97693fe175c768f4f8b70c299b
Opcode Fuzzy Hash: 4cb60178c01e459c2c5a1c726fd074b8e03c7007d17778358573a2f4acf83a10
Instruction Fuzzy Hash: CC415BB2B0122557D711DE69EC40BDA73A8AF45729F14027AFC0CCBB41E736D91583E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A8DD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 6C1A8DEA
sqlite3_free.SQLITE3(00000000), ref: 6C1A8E47
sqlite3_snprintf.SQLITE3(?,?,OsError 0x%lx (%lu),?,?), ref: 6C1A8EC9
sqlite3_snprintf.SQLITE3(?,?,6C25D55C,00000000), ref: 6C1A8EE8
sqlite3_free.SQLITE3(00000000,?,?,6C25D55C,00000000), ref: 6C1A8EEE

Strings

OsError 0x%lx (%lu), xrefs: 6C1A8EC2

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_snprintf$sqlite3_win32_is_nt
String ID: OsError 0x%lx (%lu)
API String ID: 4082161338-3720535092
Opcode ID: 92133a454c121b98a05e34048d889efca2685e3888e26c6cae9525b42a2d674a
Instruction ID: a40b036028ec49dac5930b842161278f4640d558248601c82f511183f0da0ff8
Opcode Fuzzy Hash: 92133a454c121b98a05e34048d889efca2685e3888e26c6cae9525b42a2d674a
Instruction Fuzzy Hash: 8831C1BA700250AFA711DEE99C84EAB77E8EBC5758B144A19FC19C7640E730D906C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 6C23AFD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid',?,?,00000000,00000000,?,00000000,00000000,?), ref: 6C23AFF0

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_step.SQLITE3(?,?,?,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 6C23B02D
sqlite3_column_int64.SQLITE3(?,00000000,?,?,?,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 6C23B03D
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 6C23B04A
sqlite3_free.SQLITE3(?,?,?,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 6C23B0A0

Strings

SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid', xrefs: 6C23AFE7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_column_int64sqlite3_finalizesqlite3_freesqlite3_initializesqlite3_mprintfsqlite3_step
String ID: SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid'
API String ID: 3768494849-3406912602
Opcode ID: 8b69c6fd61f40fb80409424a3d68735cdc4af53f204d9beadab9b1e7e2ae0f87
Instruction ID: f2bd97dc3ed2dac587df84bd6064e72a7afd470193458ddeb04b7e9188e281e5
Opcode Fuzzy Hash: 8b69c6fd61f40fb80409424a3d68735cdc4af53f204d9beadab9b1e7e2ae0f87
Instruction Fuzzy Hash: 9F2127F67046195BD3008E19AC81B5A73A4EBC8728F144239FD2CDBB40EE76DD09878A

Uniqueness

Uniqueness Score: -1.00%

Function 6C187341 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C187305: _free.LIBCMT ref: 6C18732E

_free.LIBCMT ref: 6C18738F

Part of subcall function 6C18201B: HeapFree.KERNEL32(00000000,00000000,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?), ref: 6C182031
Part of subcall function 6C18201B: GetLastError.KERNEL32(?,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?,?), ref: 6C182043

_free.LIBCMT ref: 6C18739A
_free.LIBCMT ref: 6C1873A5
_free.LIBCMT ref: 6C1873F9
_free.LIBCMT ref: 6C187404
_free.LIBCMT ref: 6C18740F
_free.LIBCMT ref: 6C18741A

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc6c8774f4af8a7f10302056479eb82fa765c01fccbbf477bafe56496657bec4
Instruction ID: a5e9b3ee5ca7090658cd8536821833a340bdc0554fa24ed7dfe9250a07e5dbb6
Opcode Fuzzy Hash: dc6c8774f4af8a7f10302056479eb82fa765c01fccbbf477bafe56496657bec4
Instruction Fuzzy Hash: 60117F7164AB08ABD633E7B0CC09FCB779C9F04704F418816BB99E6A91DB24F548DE91

Uniqueness

Uniqueness Score: -1.00%

Function 6C2448EC Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6C244911
__calloc_crt.LIBCMT ref: 6C24491D
__getptd.LIBCMT ref: 6C24492A
CreateThread.KERNEL32(00000000,00000000,6C244887,00000000,00000000,6C1A648A), ref: 6C244961
GetLastError.KERNEL32(?,?,?,6C1A648A,00000000,00000000,Function_000063B0,00000000,00000000,00000004), ref: 6C24496B
_free.LIBCMT ref: 6C244974
__dosmaperr.LIBCMT ref: 6C24497F

Part of subcall function 6C2447DE: __getptd_noexit.LIBCMT ref: 6C2447DE

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 46af890373a99abdfd16287d833484e96066ab21d859ace98bb3c62b64bcfb6d
Instruction ID: f77478ce19fddede868f2dcbfe5484e10e32b9fe36a9a75b7af426f86961c645
Opcode Fuzzy Hash: 46af890373a99abdfd16287d833484e96066ab21d859ace98bb3c62b64bcfb6d
Instruction Fuzzy Hash: D411253221570EAFAB099FA9DC40ECB3BA8EF05338B108129FC15C6A80DB31D8058B64

Uniqueness

Uniqueness Score: -1.00%

Function 6C17D9E5 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C17D772,6C17AFB2,6C17A952,?,6C17AB62,?,00000001,?,?,00000001,?,6C193340,0000000C,6C17AC4B), ref: 6C17D9F3
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C17DA01
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C17DA1A
SetLastError.KERNEL32(00000000,6C17AB62,?,00000001,?,?,00000001,?,6C193340,0000000C,6C17AC4B,?,00000001,?), ref: 6C17DA6C

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 39af3185454425b078dad5023fe5be749c1ed1dce3294043bd980dc81f716dc7
Instruction ID: 1425ce80c303eab09b69a1ffda891c0008d9bcc1fa72f6d9dc53467bfd6e4fed
Opcode Fuzzy Hash: 39af3185454425b078dad5023fe5be749c1ed1dce3294043bd980dc81f716dc7
Instruction Fuzzy Hash: 6901FC3370E7199EAF343A756C94B863A74FB87FBD7240329F11056AD0EF51981561A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F8580 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0001AC70,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,?,6C1F8850,00000000,00000000,?,?), ref: 6C1F8607

Strings

%s at line %d of [%.10s], xrefs: 6C1F8600
malformed database schema (%s), xrefs: 6C1F85A3
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1F85F1
%z - %s, xrefs: 6C1F85BC
database corruption, xrefs: 6C1F85FB

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$%z - %s$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$malformed database schema (%s)
API String ID: 632333372-4291173163
Opcode ID: 95c31db595cb5469e776862445aace9c932aa8be58e041f42980124bcda7e1fe
Instruction ID: 8252ee7f44e40f4da8b3dca53383dc487519a17b67c3c2d62da503f010a2a056
Opcode Fuzzy Hash: 95c31db595cb5469e776862445aace9c932aa8be58e041f42980124bcda7e1fe
Instruction Fuzzy Hash: B70126356046049BE702DA5EDC00B977BE8CB5222CF4441A5FC18DFF92EB74E95287E5

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C9E6D Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 19COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API called with NULL prepared statement), ref: 6C1C9E85
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00011DCF,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1C9EA3

Strings

%s at line %d of [%.10s], xrefs: 6C1C9E9C
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C9E8D
misuse, xrefs: 6C1C9E97
API called with NULL prepared statement, xrefs: 6C1C9E6D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-861783068
Opcode ID: c76d6837faf24b16bd1878f1f7a4fe36ce34e3476b5da10e41450e2285506490
Instruction ID: 52e6d782ada112f140b1bb0d9b4dd5ba7c25d2eb42897bde6efc9074457af6ff
Opcode Fuzzy Hash: c76d6837faf24b16bd1878f1f7a4fe36ce34e3476b5da10e41450e2285506490
Instruction Fuzzy Hash: 50D0C76A78458C63D501218D7D02BD9760493E171FF440AF9BF18ADE879547155920FB

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C9E7E Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 18COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,API called with NULL prepared statement), ref: 6C1C9E85
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00011DCF,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1C9EA3

Strings

%s at line %d of [%.10s], xrefs: 6C1C9E9C
API called with finalized prepared statement, xrefs: 6C1C9E7E
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C9E8D
misuse, xrefs: 6C1C9E97

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-1044111978
Opcode ID: 3783d06f446dbfa63893ae455c45b8d7b2c394142ccc96a58b3421fc38ef40ce
Instruction ID: f3392dfc7434dbdc07cd2843280c770767e263b4acd5f85b48dc1fbff1ef59f1
Opcode Fuzzy Hash: 3783d06f446dbfa63893ae455c45b8d7b2c394142ccc96a58b3421fc38ef40ce
Instruction Fuzzy Hash: ACD0C96AB8498C62D501228A7D02BD97A0483D171FF4409F9BF18ADE87A98214A920F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C2255C0 Relevance: 9.2, APIs: 6, Instructions: 225COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 6C225634
sqlite3_free.SQLITE3(?), ref: 6C225640
_memset.LIBCMT ref: 6C225650
sqlite3_mprintf.SQLITE3(6C25D55C,00000000), ref: 6C2256BE
sqlite3_mprintf.SQLITE3(6C25D55C,00000000), ref: 6C225763
_memset.LIBCMT ref: 6C2257EA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_freesqlite3_mprintf
String ID:
API String ID: 666323890-0
Opcode ID: ff5c40af1000f69783928beaa4f1fb4220a1734951200b930b815a89b6e3441b
Instruction ID: 683e0d5cfbc88cde7983b5b3fc4e6ce3d85c6d179827e4bcddee508afe93d4c4
Opcode Fuzzy Hash: ff5c40af1000f69783928beaa4f1fb4220a1734951200b930b815a89b6e3441b
Instruction Fuzzy Hash: 7181DDB0A4570A9FE310CF19C940BA6B3E4BF44319F148939FC9587B89E778E854CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C223500 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 6C229630: sqlite3_bind_int64.SQLITE3(?,00000001,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C229666
Part of subcall function 6C229630: sqlite3_step.SQLITE3(?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6C22966C
Part of subcall function 6C229630: sqlite3_column_type.SQLITE3(?,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00000000), ref: 6C22967B
Part of subcall function 6C229630: sqlite3_reset.SQLITE3(?,?,?,?,?,?,00000000,00000000,00000000,?,00000000), ref: 6C229689

sqlite3_column_blob.SQLITE3(?,00000000,00000000), ref: 6C22353D
sqlite3_column_bytes.SQLITE3(?,00000000,?,00000000,00000000), ref: 6C223547
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2235AC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2235B9
sqlite3_reset.SQLITE3(?,00000000,?,?,?,?,?,00000001,?,?,?,?,?,?,00000000), ref: 6C2235C5
sqlite3_reset.SQLITE3(?,?,?,?,?,?,00000000), ref: 6C2235E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_reset$Unothrow_t@std@@@__ehfuncinfo$??2@$sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_column_typesqlite3_step
String ID:
API String ID: 3336900204-0
Opcode ID: 5c207430033aa27ffa6b33ee6f718d6eece4d712d88b3e2dcee26887f7bcf45f
Instruction ID: caee444a4b4a34d93e2fc0ce04eb4c50ecad41944d1dc25ff7be36c6631f3b26
Opcode Fuzzy Hash: 5c207430033aa27ffa6b33ee6f718d6eece4d712d88b3e2dcee26887f7bcf45f
Instruction Fuzzy Hash: 70318FB5E0020D9BDB01CFA9DCC19AFB3FDAB88214F144569E909D3B00E779AA058B61

Uniqueness

Uniqueness Score: -1.00%

Function 6C182ABB Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6C17EBA7,?,?,?,6C17E746,?,?,?,00000000), ref: 6C182ABF
_free.LIBCMT ref: 6C182AF2
_free.LIBCMT ref: 6C182B1A
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 6C182B27
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 6C182B33
_abort.LIBCMT ref: 6C182B39

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: feb8bf54872bdac69b32ba64ecad46a92c6d588c88492da49f4b97879eec4d36
Instruction ID: 4b9fef47f25fe66e698f366b406711ea78305aa146a4535f89e7b1987cf86e11
Opcode Fuzzy Hash: feb8bf54872bdac69b32ba64ecad46a92c6d588c88492da49f4b97879eec4d36
Instruction Fuzzy Hash: BFF0CD3664F90266C6139B655C0CF8A31799FD3779F264215F814D3F80FF29C8466DA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C247942 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C24794E

Part of subcall function 6C246FDB: __getptd_noexit.LIBCMT ref: 6C246FDE
Part of subcall function 6C246FDB: __amsg_exit.LIBCMT ref: 6C246FEB

__amsg_exit.LIBCMT ref: 6C24796E
__lock.LIBCMT ref: 6C24797E
InterlockedDecrement.KERNEL32(?), ref: 6C24799B
_free.LIBCMT ref: 6C2479AE
InterlockedIncrement.KERNEL32(01B71658), ref: 6C2479C6

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: f564e2aa555484c404dff300e97762b7fdd369d9b38bc9e1ac5a44b8d499b8ab
Instruction ID: 4d9bd29151b46767a4f2c12678467704d8e29b84cfbcf8d58cfec5c2daf17d86
Opcode Fuzzy Hash: f564e2aa555484c404dff300e97762b7fdd369d9b38bc9e1ac5a44b8d499b8ab
Instruction Fuzzy Hash: 7F018071A01A2AEBDB19DB69C48879E77B0BF05B29F118145EC30A7F80CB34A545DFE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D6FE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 266COMMON

Download Yara Rule

Strings

%r ORDER BY term does not match any column in the result set, xrefs: 6C1D72BA
ORDER, xrefs: 6C1D7128
%r %s BY term out of range - should be between 1 and %d, xrefs: 6C1D712F
too many terms in ORDER BY clause, xrefs: 6C1D7013

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: %r %s BY term out of range - should be between 1 and %d$%r ORDER BY term does not match any column in the result set$ORDER$too many terms in ORDER BY clause
API String ID: 0-3892209816
Opcode ID: 413bf4ea750f425ce3a7caa70b684e3b201cee4634d9905a619e6fc3e58cef0e
Instruction ID: 2130a910dfcdea48a536f09321a58d62879a763703b0a9e0774dd704284418a4
Opcode Fuzzy Hash: 413bf4ea750f425ce3a7caa70b684e3b201cee4634d9905a619e6fc3e58cef0e
Instruction Fuzzy Hash: 49A18C706043029BD700CF29D880B5AB7E4FF95328F158A5EE8998BB89E735F945CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C241D60 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C241E2C
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C241E54
_strncpy.LIBCMT ref: 6C241F97
sqlite3_free.SQLITE3(?), ref: 6C242006

Strings

string or blob too big, xrefs: 6C241FEB

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _strncpysqlite3_freesqlite3_initializesqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 1666847392-2803948771
Opcode ID: b8ba3aee4f60b93904785396f855024756f1fa66e5f0d43b508c6364efd4accd
Instruction ID: 2322159783fe12854fdefdf5a6879bba85cdb647162024fba99b28d7b053cb01
Opcode Fuzzy Hash: b8ba3aee4f60b93904785396f855024756f1fa66e5f0d43b508c6364efd4accd
Instruction Fuzzy Hash: F8818F767083174BD3188F29C8406A577E1EF82329F19C26AFCA58BBD1D735C49AC381

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CEF42 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 240COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: 73c6017f3b1ecbb75cfdf24d291d13f1a7f7614970ed5abee6b14024598f168a
Instruction ID: 84e06072e03b1eaf1f81a60b693eac491c65cae442c618479b38d14155081c0b
Opcode Fuzzy Hash: 73c6017f3b1ecbb75cfdf24d291d13f1a7f7614970ed5abee6b14024598f168a
Instruction Fuzzy Hash: 8CA1C070A002148FDB24CF18C880BAAB7B1FF59318F1585DDE8499BB51D739EA85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BC8E0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000F0E1,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BC91D
_memset.LIBCMT ref: 6C1BC9D3

Strings

%s at line %d of [%.10s], xrefs: 6C1BC916
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BC907
database corruption, xrefs: 6C1BC911

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 1972405431-2708572664
Opcode ID: 4689563bf6db5cdd21c6ee73e61fd6762ba17143b5cb0d029fe78be3998481a2
Instruction ID: b0ddec6b96f727bc8c9ead91d8f1b1b5845b1ee67706e938fee297c310984361
Opcode Fuzzy Hash: 4689563bf6db5cdd21c6ee73e61fd6762ba17143b5cb0d029fe78be3998481a2
Instruction Fuzzy Hash: 2B819E72A092028FC714DF29C450B5AB7E1AF98768F164A68EC49EBB51E730EC45CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0EF9 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 217COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: 6fd666351bcd6df36f06fcdeb2cc4a5b24a2f88af39c1062e7eb9794c8fa4c88
Instruction ID: ebb2b00fa0a6b296d41b981c43e582b5b78a021385684896456815b3a3a9d049
Opcode Fuzzy Hash: 6fd666351bcd6df36f06fcdeb2cc4a5b24a2f88af39c1062e7eb9794c8fa4c88
Instruction Fuzzy Hash: A891D174A043598FDB24CF18C890BEAB7B0BB25318F2541EED84997B41D739E985CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF630 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 210COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0, 6C1D1680
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: af6edc57ae350095a68fd68c3886d1a6415c334f7c10d23d87bf4028388e98c7
Instruction ID: 4f29643e294641f4b07b152ce0ca1f006ee39820e20cc08e66a2a2168dee20b8
Opcode Fuzzy Hash: af6edc57ae350095a68fd68c3886d1a6415c334f7c10d23d87bf4028388e98c7
Instruction Fuzzy Hash: 4B81C074A003548FDB24CF24C880BEAB7B0EB15318F2945AAD949A7B41D739FA85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BB5B0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?,?,?,?,?,6C1B73B4,?,00000000,?,?,?,?,?,?), ref: 6C1BB5D9

Strings

%s at line %d of [%.10s], xrefs: 6C1BB7B5
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BB7A6
database corruption, xrefs: 6C1BB7B0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 2313487548-2708572664
Opcode ID: d2d89217e825064ad637081c30a902e9b85240a018b8b068dd6c4f81e93dda07
Instruction ID: d58d178104a48761791924230cd3f72678517528a62d39d089bf261ae5527655
Opcode Fuzzy Hash: d2d89217e825064ad637081c30a902e9b85240a018b8b068dd6c4f81e93dda07
Instruction Fuzzy Hash: 1E6143716046848FD324CB2AD481B66BBF1AF95318F08459ED99897F82D732E806CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0BCD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: fc035d3a9100782edb8c0557c2be4d868f5361c8f299883c44862aa37b4da685
Instruction ID: 4b3f5ad4f18a1baeae4960f6f6ebcdded4cc710b24537bc8d3330a6280f5d11b
Opcode Fuzzy Hash: fc035d3a9100782edb8c0557c2be4d868f5361c8f299883c44862aa37b4da685
Instruction Fuzzy Hash: 94818CB4A002598FDB24CF18C880BA9B3B1FB59318F1485E9E949A7B41D735FA85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF83A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 2e8db15dfa05b10d2509b616a66e03c3a14f7e9c12877da25ad7fdfdb20371eb
Instruction ID: c652069545f1dbeb2a320d6023c70620330a8f5eb3e5454a0f803a5f61ec59e5
Opcode Fuzzy Hash: 2e8db15dfa05b10d2509b616a66e03c3a14f7e9c12877da25ad7fdfdb20371eb
Instruction Fuzzy Hash: 2A81AD74A002548FDB24CF14C880BE9B7B1BF59318F25859AD909ABB41D739FD86CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF5A2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 8c7c3956c363a0b674ee9cabbed30c4c6a227070e0e09501817510c72f66e1fb
Instruction ID: b6d37036d38f6da886389e43279631370b70cdcc7003c26814d5f65707e65726
Opcode Fuzzy Hash: 8c7c3956c363a0b674ee9cabbed30c4c6a227070e0e09501817510c72f66e1fb
Instruction Fuzzy Hash: AD71E274A003548BDB20CF14C880BE9B7B0EF55318F1545DAD849ABB42D739F989CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0DAE Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 6C1C8F10: sqlite3_free.SQLITE3(00000000,?,?,00000001,?,?,?,?,?,?,?,6C1C6ED4), ref: 6C1C8FCE

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 1159705175-3899832264
Opcode ID: 3c219ea2f3dbb0175223060a02912a998a84e0a77fb8f8efc2782ebf766580d4
Instruction ID: 81f619f97ab1410c25abbb8c18b9f0af9517a67661873b867c8eea77bcf09a00
Opcode Fuzzy Hash: 3c219ea2f3dbb0175223060a02912a998a84e0a77fb8f8efc2782ebf766580d4
Instruction Fuzzy Hash: 8F71C0B4A003148BEB24CF24D980BEAB3B1BB55328F1445ADE84997B41D739F985CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF9FF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 0f7c5b87f2e83b9a969d7b960e2a4db8eabd58a0475211287779de23ab3edd9d
Instruction ID: 16f4337f2030ac5c21b15465f1e3ad50bd486e337268b5d93544850fa61772aa
Opcode Fuzzy Hash: 0f7c5b87f2e83b9a969d7b960e2a4db8eabd58a0475211287779de23ab3edd9d
Instruction Fuzzy Hash: 5A719074A003148BDB24CF28C880BE9B7B0EB19318F2485A9D84DA7B41D779ED85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CEC2E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 7dda0644c14509d359d2ab76f1cc57cd7f9e1f5b9b868ef4eef30334e84ae8e6
Instruction ID: 71c9458c314f1e36bb6b76408def3b4ef54a89b0737724d01971a3a54c636f57
Opcode Fuzzy Hash: 7dda0644c14509d359d2ab76f1cc57cd7f9e1f5b9b868ef4eef30334e84ae8e6
Instruction Fuzzy Hash: A771A174A003148FDB24CF18C880BAAB7B0FB55318F1485ADD84997B41D779F985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF961 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: 5cb9c1d6d1434f5096722ba04186ea849639151abe3d9b0195148e5c7e6e7bce
Instruction ID: 8f8de4dd69e93d12a880cd00c1083b945d58040e5a446aec2c34e2241953a5a3
Opcode Fuzzy Hash: 5cb9c1d6d1434f5096722ba04186ea849639151abe3d9b0195148e5c7e6e7bce
Instruction Fuzzy Hash: 5071A074A002148BDB24CF14C890BE9B3B1EB55318F2445AAD949A7B42D779EA85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CCCFF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 8e7679324eeba9a54383d3963405e8b38ae03bc298340dd0a11ee9b9ac97f831
Instruction ID: 67995d3fea8f85cc7ceef71fc7da99aa8f6aa839f468784c79372c1560f080ca
Opcode Fuzzy Hash: 8e7679324eeba9a54383d3963405e8b38ae03bc298340dd0a11ee9b9ac97f831
Instruction Fuzzy Hash: AC61B474A003148BDB24CF14C890BF9B7B0EB2532CF2445ADD8499BB51D779F986CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C242440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C242558
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C24257C
_strncpy.LIBCMT ref: 6C24258E
sqlite3_free.SQLITE3(00000000), ref: 6C2425D0

Strings

string or blob too big, xrefs: 6C2425B9

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _strncpysqlite3_freesqlite3_initializesqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 1666847392-2803948771
Opcode ID: 2132b03837b5ebf3662c2918b76f8c1938f0a02bca0477f5e7f29f09dfbd82b4
Instruction ID: a31201865e68a2d78aa46a86ca168d5b658ed8777df00022eac41423d66697ee
Opcode Fuzzy Hash: 2132b03837b5ebf3662c2918b76f8c1938f0a02bca0477f5e7f29f09dfbd82b4
Instruction Fuzzy Hash: 7751D0F160460647D7188F2AD8583AAB7E5DF8132AF14866DFCA5C7BC1D371C449C391

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CF52A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 95b52930f0b016909a2c147cb37619608972cf29d474d566f55615569a15c1b6
Instruction ID: dda7f47c6feca4f80726a860068324c14ea1d8a7cb0f190846cd2142a223de8a
Opcode Fuzzy Hash: 95b52930f0b016909a2c147cb37619608972cf29d474d566f55615569a15c1b6
Instruction Fuzzy Hash: EB61E174A003148BDB24CF14C890BEAB7B1FB15318F2485AED849ABB41D339F989CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFACC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: c175cb3414dda68d4b76027fb7102b295b9a2b1153f8cfd61ea2e408ad891abd
Instruction ID: cc9e2572423625f410084d7673094a2d7f63c0dcb053aea9d811e5f9aad38e4c
Opcode Fuzzy Hash: c175cb3414dda68d4b76027fb7102b295b9a2b1153f8cfd61ea2e408ad891abd
Instruction Fuzzy Hash: 2A519070A003149BEB24CF18C890BA9B3B1FB55328F2586ADD8499BB41D779F989CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6C209A90 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C209AFA
sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,0001D26F,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C209C64

Strings

%s at line %d of [%.10s], xrefs: 6C209C5D
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C209C4E
misuse, xrefs: 6C209C58

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_log
String ID: %s at line %d of [%.10s]$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 1972405431-1907583247
Opcode ID: 46bd41c40c75886998a4b4f73a6afe828a06c304df76fcefd4ef944309d8afa9
Instruction ID: 3741adb13bca6c23fb0f5b58597f9a704347c35910a22eff9d361bb16e9d9e0c
Opcode Fuzzy Hash: 46bd41c40c75886998a4b4f73a6afe828a06c304df76fcefd4ef944309d8afa9
Instruction Fuzzy Hash: 11512670714B099FD300DB29D844B8BB7E4AF89729F08861AEC19CBB41D774E855CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C221BB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 6C221C4E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 33e0f9dc69fe4b96aa5ef7fff0a79dc45f583c1f742e3b099cf81ce91a03ad83
Instruction ID: edd32a26f281de05f15a7ecd8c6c120aea403472901bb98897290946bd23ce99
Opcode Fuzzy Hash: 33e0f9dc69fe4b96aa5ef7fff0a79dc45f583c1f742e3b099cf81ce91a03ad83
Instruction Fuzzy Hash: 7B41C4757043058BC710CF19E880A9AB3E5EB88329F14866AFD58C7740E736E959CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BA520 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E84A,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BA5E9
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E845,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?), ref: 6C1BA6BF

Strings

%s at line %d of [%.10s], xrefs: 6C1BA5E2, 6C1BA6B8
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BA5D3, 6C1BA6A9
database corruption, xrefs: 6C1BA5DD, 6C1BA6B3

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: dc6d23104153fd2130f81adb90a70c5fe853dd1434357974e84babb2520165aa
Instruction ID: a25a71df76d06f30ae254deea87b625388f0f86db6c690bcfeaba96cd588b017
Opcode Fuzzy Hash: dc6d23104153fd2130f81adb90a70c5fe853dd1434357974e84babb2520165aa
Instruction Fuzzy Hash: 1251B0B0B042069FD304DF29C880B5AB7E5FB58318F148669E809EBB81E771E895CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0E92 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Part of subcall function 6C1C8F10: sqlite3_free.SQLITE3(00000000,?,?,00000001,?,?,?,?,?,?,?,6C1C6ED4), ref: 6C1C8FCE

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 1159705175-3899832264
Opcode ID: 71ac9dd32f790897a28e7779bf1112ae6e52bed62a6cd8196522d0414758af89
Instruction ID: d55dc0f4c150a7147271e44faae008a328988edbb31c160b75bfd52a6c38abd5
Opcode Fuzzy Hash: 71ac9dd32f790897a28e7779bf1112ae6e52bed62a6cd8196522d0414758af89
Instruction Fuzzy Hash: 1C51D374A003049BEB24CF28C8D0BAAB3B5FB55328F2446ADD84997B81D779F945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFB4B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$_memset
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 2001445403-3899832264
Opcode ID: 336c2e6e11d9e120c36500bd9e5a2873f32639cdbd4b19c66663a608174770d7
Instruction ID: 67d00bbc18145ad24c6d8d5aeffcbc3b84e51fcfe4f4d7085f1dd4cef5a5edb3
Opcode Fuzzy Hash: 336c2e6e11d9e120c36500bd9e5a2873f32639cdbd4b19c66663a608174770d7
Instruction Fuzzy Hash: 6751E5B4A003049BEB24CF18D880BAA77B0BB55328F2545A9E84997F41D739F945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CDD14 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 176c45a27a0e1fdbf4203976099f2f1ec459bbfa05c68eb0f6558ed445085fdf
Instruction ID: dd07f8006b92b684137b276cc8a6a6028f03c7d6d9368b1fe8ef8e3a968c927f
Opcode Fuzzy Hash: 176c45a27a0e1fdbf4203976099f2f1ec459bbfa05c68eb0f6558ed445085fdf
Instruction Fuzzy Hash: BC51C0B4A003149BDB24CF24C880BFAB7B1BB55328F2546A9E84997B41D739F985CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CBFB1 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000000,abort at %d in [%s]: %s,?,?,?), ref: 6C1D1225

Strings

%s constraint failed, xrefs: 6C1D1202
abort at %d in [%s]: %s, xrefs: 6C1D121F
%s constraint failed: %s, xrefs: 6C1D11E0
gfff, xrefs: 6C1CBFD0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s constraint failed$%s constraint failed: %s$abort at %d in [%s]: %s$gfff
API String ID: 632333372-1460003598
Opcode ID: cecaee9572a68a8cb9e80c960bcde22f3c18b55b85ddd798735c639ca12077aa
Instruction ID: e57ba11583b3e01ff9e315799bae4d967e7aa5688c731485707e843ba25280f5
Opcode Fuzzy Hash: cecaee9572a68a8cb9e80c960bcde22f3c18b55b85ddd798735c639ca12077aa
Instruction Fuzzy Hash: 9F51BF74A002199BCB18CF28C880BA9B7B1BF55318F25829ED80D9BB42D735FD95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D091E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 81dddbf0dee8d27097082fb253b3c7e87b486f07c7a59e6200ff4444f2c97534
Instruction ID: 681a3aadc1451df23a951bf521cad493dfb6af2f0d934da8720a9f472c286bfb
Opcode Fuzzy Hash: 81dddbf0dee8d27097082fb253b3c7e87b486f07c7a59e6200ff4444f2c97534
Instruction Fuzzy Hash: 0551D5B4A003049BEB24CF24D890BBAB7B0FB55328F2445ADD84997F41D779F985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CCDAB Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 0-3899832264
Opcode ID: 6705575d0adc2a59708895fe55092841c250df9f73126fd048564098805df585
Instruction ID: b8638cc03ca097b9760ee93ccf81e4a571ce0911e402806ece6c0fbe20e2c057
Opcode Fuzzy Hash: 6705575d0adc2a59708895fe55092841c250df9f73126fd048564098805df585
Instruction Fuzzy Hash: 0651D274A003149BEB24CF24C890BF9B7B0BB15328F2445ADD84997F41D779F985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D09E9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 2313487548-3899832264
Opcode ID: d006a57eb6c339814c89920e577be7a30c0553e4a8fab63fcd41915ed83517e1
Instruction ID: ca3eb101217b3cd642b4bec49292552611e79541395502e12bf89ae4eca9ad4f
Opcode Fuzzy Hash: d006a57eb6c339814c89920e577be7a30c0553e4a8fab63fcd41915ed83517e1
Instruction Fuzzy Hash: 4951D475A003149BEB24CF14C880BEAB3B1BB55328F2546ADD849A7F41D739FD85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B9ED0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E6F8,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,00000000,?), ref: 6C1B9F06

Strings

%s at line %d of [%.10s], xrefs: 6C1B9EFF, 6C1BA014
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B9EF0, 6C1BA005
database corruption, xrefs: 6C1B9EFA, 6C1BA00F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 704999fa394be34537af9602cc1562806ab3690eeaaa5139462900333dcab97c
Instruction ID: 757530475f512d91e191e1f10ef6dba2a1cd7d9b5d5de01607703014c5fb3989
Opcode Fuzzy Hash: 704999fa394be34537af9602cc1562806ab3690eeaaa5139462900333dcab97c
Instruction Fuzzy Hash: 4E4127701092498BC310DF2AC4849AEBBF0EF64329F15499DF88DD7E41D771E985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D0AF9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: ada504fd2d383fe40b311dd6d6fd0d53a23c837e3011433594052dacae455c61
Instruction ID: 708382ee310d3c0c2dedadde2dc7c6d28ab633de1258ff2d7bd1335504ecc9e8
Opcode Fuzzy Hash: ada504fd2d383fe40b311dd6d6fd0d53a23c837e3011433594052dacae455c61
Instruction Fuzzy Hash: FB41C2B4A003049BEB24CF28D890BBAB3B4FB55328F2446ADD84997F41D779F945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFCE1 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 064000753fc814a2a3d07207dd0e377010115fb43fe6ca4c785b274d2d0673c4
Instruction ID: 49bd8bd5443983318c9c50c30529a7d0e3a137caaf8d110e6677b4b3267ee73e
Opcode Fuzzy Hash: 064000753fc814a2a3d07207dd0e377010115fb43fe6ca4c785b274d2d0673c4
Instruction Fuzzy Hash: 6A41D274A003049BEB24CF24C890BEAB7B1AB15328F2546ADD84997F41D779F985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D08F4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000012,statement aborts at %d: [%s] %s,?,?,00000000), ref: 6C1D1759

Strings

gfff, xrefs: 6C1D1741
unknown error, xrefs: 6C1CE6D0
statement aborts at %d: [%s] %s, xrefs: 6C1D1753
abort due to ROLLBACK, xrefs: 6C1D16E5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: abort due to ROLLBACK$gfff$statement aborts at %d: [%s] %s$unknown error
API String ID: 632333372-3899832264
Opcode ID: 3aa9dba7267c539c90051059ecd2f852b14d357f852f141403840a74f03bfff2
Instruction ID: 7eb0b928ca0d9588d484488bcf8d3e4086c7adc7ddd1d1491a6cd051c3b7a6df
Opcode Fuzzy Hash: 3aa9dba7267c539c90051059ecd2f852b14d357f852f141403840a74f03bfff2
Instruction Fuzzy Hash: 3341D2B4A003049BEB24CF24D890BFAB3B4BB15328F2546ADD84997F41D779F949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C22AB00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3(?,?,?), ref: 6C22AB7D
sqlite3_mprintf.SQLITE3(%s_segments,?), ref: 6C22AB99

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_blob_open.SQLITE3(?,?,00000000,block,?,?,00000000,?), ref: 6C22ABCE

Strings

block, xrefs: 6C22ABC6
%s_segments, xrefs: 6C22AB94

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_blob_opensqlite3_blob_reopensqlite3_initializesqlite3_mprintf
String ID: %s_segments$block
API String ID: 524226304-4076095781
Opcode ID: 512eeb7cf12d72f3c519e222766b195b0b0c2a7b81de5f78d47a8a6872c6b0f5
Instruction ID: f7077bff694e7160a2b97e66afa277f9df11eff39f50a9c7ee7b18a3e413a991
Opcode Fuzzy Hash: 512eeb7cf12d72f3c519e222766b195b0b0c2a7b81de5f78d47a8a6872c6b0f5
Instruction Fuzzy Hash: 80417C7160470ACFD718CF19D480B6BB7E6FB84708F14856EE85987E11E734E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7C80 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF8F,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7DAA

Strings

%s at line %d of [%.10s], xrefs: 6C1B7D73, 6C1B7DA3
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B7D64, 6C1B7D94
database corruption, xrefs: 6C1B7D6E, 6C1B7D9E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 505b3bae703b249fa7d63cbe4e124cb9996311344c03cf269f8f9eca8e5ee6df
Instruction ID: cde452fa025818a6a88dd6fa293132328e51b95a696f6a9b3c0af181d99d5520
Opcode Fuzzy Hash: 505b3bae703b249fa7d63cbe4e124cb9996311344c03cf269f8f9eca8e5ee6df
Instruction Fuzzy Hash: 81313A32A082541FC3118E1DDC40966BBE1EB81225F0986EFEC5CA7F42E636E815CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7500 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DD9F,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,00000000,?,?,6C1B9E9B,00000005,?,?,?,00000000), ref: 6C1B7534

Strings

%s at line %d of [%.10s], xrefs: 6C1B752D, 6C1B75C1
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B751E, 6C1B75B2
database corruption, xrefs: 6C1B7528, 6C1B75BC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 74755e5715d4a6a5cec640f24c364b9b8712a1c982c95f7fc00d0591ff930c32
Instruction ID: 535e828339111257f325223010d62e92551b9b2620b29013280aa22597ceac3c
Opcode Fuzzy Hash: 74755e5715d4a6a5cec640f24c364b9b8712a1c982c95f7fc00d0591ff930c32
Instruction Fuzzy Hash: E5313C7170421A9BCB11DF2DD88065B73A5EB54328F150666EC1CE7B45DB31E851CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C8C20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,00011AB5,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1C8D5B

Strings

%s at line %d of [%.10s], xrefs: 6C1C8D54
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C8D45
database corruption, xrefs: 6C1C8D4F
`$, xrefs: 6C1C8D2B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$`$$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-3616443185
Opcode ID: 0ab9c0211ff036776611acc5006769042b4f149ee0e1bf875f87b54d6a1a54d7
Instruction ID: efdcd96a467b134de236c5a5d1936a3c3571784d1339ae0e1e092e854bec3cd3
Opcode Fuzzy Hash: 0ab9c0211ff036776611acc5006769042b4f149ee0e1bf875f87b54d6a1a54d7
Instruction Fuzzy Hash: 6D41DF313083499BD700DF28C8C06EEB7E1ABA9368F40496EF98497745D778E949CB97

Uniqueness

Uniqueness Score: -1.00%

Function 6C228DD0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

sqlite3_declare_vtab.SQLITE3(?,CREATE TABLE x(input, token, start, end, position)), ref: 6C228DF3

Part of subcall function 6C209A90: _memset.LIBCMT ref: 6C209AFA

sqlite3_initialize.SQLITE3 ref: 6C228E7F
sqlite3_free.SQLITE3(?), ref: 6C228ED6

Strings

simple, xrefs: 6C228E2E
CREATE TABLE x(input, token, start, end, position), xrefs: 6C228DE1

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_declare_vtabsqlite3_freesqlite3_initialize
String ID: CREATE TABLE x(input, token, start, end, position)$simple
API String ID: 4017067616-3562386135
Opcode ID: 7f95dbd65b77aabbe30ab2805685c32ad33d324a8d6a9b88e0befa5ed93cb89b
Instruction ID: a7cd6319b77fe6df203e89a29a2d743836c52fdbb5bbb68edc2fa9323ebcd633
Opcode Fuzzy Hash: 7f95dbd65b77aabbe30ab2805685c32ad33d324a8d6a9b88e0befa5ed93cb89b
Instruction Fuzzy Hash: F331A4B6A0830A9FC710CF19D88095BB3E4AF88364F05462EFD199F741E734DD098BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7ACB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1B7BE3
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF6E,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C09
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF56,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C32
sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DF50,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7C5B

Strings

%s at line %d of [%.10s], xrefs: 6C1B7C02
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B7BF3
database corruption, xrefs: 6C1B7BFD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log$_memset
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 2320441212-2708572664
Opcode ID: bd5033a5ca95c7705539905e132ee7d397f7d2b83ffa461c351f49e3f85dbf68
Instruction ID: c10ada34799c3ab2dcb6ca0fb255283ad8a0b8a90a12734da73bd75dbcde15ca
Opcode Fuzzy Hash: bd5033a5ca95c7705539905e132ee7d397f7d2b83ffa461c351f49e3f85dbf68
Instruction Fuzzy Hash: 634173701083469FC314CF68D880A2BBBE1FFD5209F1489ADF49597B41D735E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F9C20 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3(?,?,?), ref: 6C1F9C6E

Strings

RIGHT and FULL OUTER JOINs are not currently supported, xrefs: 6C1F9CAC
}%l, xrefs: 6C1F9CF4
unknown or unsupported join type: %T %T%s%T, xrefs: 6C1F9D06
@, xrefs: 6C1F9C86

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: }%l$@$RIGHT and FULL OUTER JOINs are not currently supported$unknown or unsupported join type: %T %T%s%T
API String ID: 1961171630-2441478877
Opcode ID: 100bcf325916a4daee74923df0648ecba5fa6856c7a9bc3793deec8164e5911d
Instruction ID: a962d7aad05822d351e7bc88bdde8f79a2806bf8347283e4990f8d828e335c58
Opcode Fuzzy Hash: 100bcf325916a4daee74923df0648ecba5fa6856c7a9bc3793deec8164e5911d
Instruction Fuzzy Hash: 45310CB5E011099BCB04EF99D9A17EFB7F5EB95309F508069FC29D7700D630DA528B50

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C8D70 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,00011AD7,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1C8E63

Strings

%s at line %d of [%.10s], xrefs: 6C1C8E56
`$, xrefs: 6C1C8E1F
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C8E47
database corruption, xrefs: 6C1C8E51

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$`$$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-3616443185
Opcode ID: 5d959cb18e2473722996f5a7f75c625f9b4a9ae56b6ad48b187d58d65fe1e20c
Instruction ID: 7078a90170192af52860202a621018da54ad1c54600eb43dcffded283c34afe0
Opcode Fuzzy Hash: 5d959cb18e2473722996f5a7f75c625f9b4a9ae56b6ad48b187d58d65fe1e20c
Instruction Fuzzy Hash: 3E31AD703042059BD704CF69D8C07ABB7A4EFA8368F100A6EF9588B795E734D9548B92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFC0B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6C1CFC89

Strings

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid, xrefs: 6C1CFC46
sqlite_master, xrefs: 6C1CFC18
out of memory, xrefs: 6C1D1648
sqlite_temp_master, xrefs: 6C1CFC0E, 6C1CFC30

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_exec
String ID: SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid$out of memory$sqlite_master$sqlite_temp_master
API String ID: 2141490097-2807232816
Opcode ID: 8d63e32cef4f65d2f2adf96e091f7ca26a7d9811b41095d19b6eaba030bb2dd0
Instruction ID: bcedbbc5ba4c93c14c43dd91f36f93d102453c8be0259f13682697acaccfee3b
Opcode Fuzzy Hash: 8d63e32cef4f65d2f2adf96e091f7ca26a7d9811b41095d19b6eaba030bb2dd0
Instruction Fuzzy Hash: 0731C170E04669CBDB20CF64CC44BAAB7F0AF61308F1445DAD41CA6B41D778AAC9CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6C221DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat',?,?), ref: 6C221DF2

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_step.SQLITE3(00000000), ref: 6C221E2B
sqlite3_finalize.SQLITE3(00000000,00000000), ref: 6C221E3C
sqlite3_free.SQLITE3(?), ref: 6C221E57

Strings

SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat', xrefs: 6C221DED

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_finalizesqlite3_freesqlite3_initializesqlite3_mprintfsqlite3_step
String ID: SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat'
API String ID: 43187765-2424419347
Opcode ID: 0f3347a8561105287bd2026128ee12f4ab651bf59e6a112fd51792aa477f44db
Instruction ID: 2efe305bbc28a8c6586fa017cdd212000a71cb16a12fb38174fbb1dce2e17c2b
Opcode Fuzzy Hash: 0f3347a8561105287bd2026128ee12f4ab651bf59e6a112fd51792aa477f44db
Instruction Fuzzy Hash: 3211E975D0415967DB10DEA49D41BDF77A84B00719F1805A4FC08AB781E675DE5483E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1747E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C174710: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 6C17478B
Part of subcall function 6C174710: VerSetConditionMask.KERNEL32(00000000), ref: 6C17478F
Part of subcall function 6C174710: VerSetConditionMask.KERNEL32(00000000), ref: 6C174793
Part of subcall function 6C174710: VerifyVersionInfoW.KERNEL32(00000023), ref: 6C1747B8

GetModuleHandleW.KERNEL32(Kernel32.dll,GetVolumeInformationByHandleW), ref: 6C174836
GetProcAddress.KERNEL32(00000000), ref: 6C17483D
__Init_thread_footer.LIBCMT ref: 6C17484D

Strings

Kernel32.dll, xrefs: 6C174831
GetVolumeInformationByHandleW, xrefs: 6C17482C

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ConditionMask$AddressHandleInfoInit_thread_footerModuleProcVerifyVersion
String ID: GetVolumeInformationByHandleW$Kernel32.dll
API String ID: 897561383-578496313
Opcode ID: 67a7177a999d2ea83cbcadf0cb28fc02df2fb01b4fde7e4f4b3658e5b9797f2a
Instruction ID: 95a641f162eac74711badc3e9fa9b71dacfc4b5aaa76ee208b4c1173eefdeaa6
Opcode Fuzzy Hash: 67a7177a999d2ea83cbcadf0cb28fc02df2fb01b4fde7e4f4b3658e5b9797f2a
Instruction Fuzzy Hash: 09019672B00248ABDB50EFF5AC48E967BB8E7463A8B140534FA15C2A50D732D435DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6C181216 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6C1811C7,?,?,6C181167,?,6C193590,0000000C,6C18129A,00000000,00000000), ref: 6C181236
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C181249
FreeLibrary.KERNEL32(00000000,?,?,?,6C1811C7,?,?,6C181167,?,6C193590,0000000C,6C18129A,00000000,00000000,00000001,6C17AACC), ref: 6C18126C

Strings

mscoree.dll, xrefs: 6C18122F
CorExitProcess, xrefs: 6C181241

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7518517d31a4a040472a3d2429acfaa0e10c5e87259299fd9d6d0860453379c6
Instruction ID: 0c3b42c6fc9f95a68603f620bdb425268cd8aaeb92e66a1592c0f9b3c92fabaf
Opcode Fuzzy Hash: 7518517d31a4a040472a3d2429acfaa0e10c5e87259299fd9d6d0860453379c6
Instruction Fuzzy Hash: B9F04F71A0A208FBDF11AFA0D858B9EBFB9EF0A715F604165E809A2540DB30DA44DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C175300 Relevance: 7.8, APIs: 5, Instructions: 336timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C1753A1
__aulldiv.LIBCMT ref: 6C175484

Part of subcall function 6C175C80: __aulldvrm.LIBCMT ref: 6C175CA3

DosDateTimeToFileTime.KERNEL32(00000002,?,?), ref: 6C1754B1
DosDateTimeToFileTime.KERNEL32(00000002,?,?), ref: 6C1754C4
__aulldiv.LIBCMT ref: 6C1756C8

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: Time$__aulldiv$DateFile$__aulldvrm
String ID:
API String ID: 1573799075-0
Opcode ID: c424814daa678a30441c89ccb40a08f65a62ae62451ad4cdc9fbf83ec7c937b0
Instruction ID: 9c6522a7487ec284bc4308672f17a3837c3a5eff9cb23c3497cb11ed75dee4ce
Opcode Fuzzy Hash: c424814daa678a30441c89ccb40a08f65a62ae62451ad4cdc9fbf83ec7c937b0
Instruction Fuzzy Hash: A6D1A1716083419FD724CF28C4807AAFBF5BF89318F144A2EF89997A51D374E985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C22A630 Relevance: 7.7, APIs: 5, Instructions: 216COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?,00000000,?,?,6C22C75F,?,?,?,?,?,?,?), ref: 6C22A66F
sqlite3_initialize.SQLITE3(?,?,6C22C75F,?,?,?,?,?,?,?), ref: 6C22A698

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_initialize
String ID:
API String ID: 3419314104-0
Opcode ID: bd238acb9c3b8f1929069f0614e67ec773fbc67dbc683bc055a692e1316ec600
Instruction ID: 6d2cdada4a6506129f273c6ddf4549ed50ed71435f3e888d0da4af004263c56d
Opcode Fuzzy Hash: bd238acb9c3b8f1929069f0614e67ec773fbc67dbc683bc055a692e1316ec600
Instruction Fuzzy Hash: 1F7138B5A0461AEFD714CF25C880B96B7E4BB48319F044629ED5887F01E739F869CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E7860 Relevance: 7.7, APIs: 5, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?,?,?,E8565101,?,?,6C1F991E,00000010,E8565101,?,6C1F0817,?,?,?,6C1D8AA7,?), ref: 6C1E78CB
sqlite3_free.SQLITE3(?,?,?,E8565101,?,?,6C1F991E,00000010,E8565101,?,6C1F0817,?,?,?,6C1D8AA7,?), ref: 6C1E7916
sqlite3_free.SQLITE3(?,?,?,E8565101,?,?,6C1F991E,00000010,E8565101,?,6C1F0817,?,?,?,6C1D8AA7,?), ref: 6C1E7962
sqlite3_free.SQLITE3(?,?,?,E8565101,?,?,6C1F991E,00000010,E8565101,?,6C1F0817,?,?,?,6C1D8AA7,?), ref: 6C1E79B4
sqlite3_free.SQLITE3(E8565101,E8565101,?,?,6C1F991E,00000010,E8565101,?,6C1F0817,?,?,?,6C1D8AA7,?,E8565101), ref: 6C1E7A56

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 7b953ee20c524821c72c8e67c840ba384d847e4105a6e4a2b8d467eedbc52a19
Instruction ID: 139f57d69678c0f73f3beac9c1b86532b080a7e9bca468d0356badb137be8670
Opcode Fuzzy Hash: 7b953ee20c524821c72c8e67c840ba384d847e4105a6e4a2b8d467eedbc52a19
Instruction Fuzzy Hash: F5518C70501E048BEB25DF64D580BEA73E5AF1D318F11095BC8AACBB02DB31E955CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C181A20 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C181A92
_free.LIBCMT ref: 6C181AB2

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5659cf1672bd51d0f5c4308063b87632084f777d9c5829987db23b19d5beccf1
Instruction ID: 4bb373a1dbb7ceb061e60cf6c9832cc71c31a376edab212d12957d51af7163c8
Opcode Fuzzy Hash: 5659cf1672bd51d0f5c4308063b87632084f777d9c5829987db23b19d5beccf1
Instruction Fuzzy Hash: FE41DF77A052009FCB10CF78C880A9AB3F5EF85728B2546A9E526EB740E731E905CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6C225860 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_result_text.SQLITE3(?,?,?,000000FF), ref: 6C22588C
sqlite3_result_int.SQLITE3(?,?), ref: 6C2258AB
sqlite3_result_int64.SQLITE3(?,?,?), ref: 6C2258EE
sqlite3_result_int64.SQLITE3(?,?,?), ref: 6C225916

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_result_int64$sqlite3_result_intsqlite3_result_text
String ID:
API String ID: 1973503298-0
Opcode ID: 5bb35ac7de24ba2d39c4de8299ce952ae329ea984f9166d691b75124afc5a0fb
Instruction ID: a4227a5a534ce2c223a56427c88898869f61c10f3f43018b2e6e3135d142afe2
Opcode Fuzzy Hash: 5bb35ac7de24ba2d39c4de8299ce952ae329ea984f9166d691b75124afc5a0fb
Instruction Fuzzy Hash: 9B315EB57152089FDB00DF68EC85DB933E8EB89228B148699FC1CCB751E636DD21CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C187425 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,57E85006,6C17ECC7,00000000,00000000,6C17F4F5,?,6C17F4F5,?,00000001,6C17ECC7,57E85006,00000001,6C17F4F5,6C17F4F5), ref: 6C187472
__alloca_probe_16.LIBCMT ref: 6C1874AA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6C1874FB
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6C18750D
__freea.LIBCMT ref: 6C187516

Part of subcall function 6C182055: HeapAlloc.KERNEL32(00000000,?,?,?,6C17A5B9,?,?,6C171043,00000040,2ADA91DB,?,?,6C18BE4F,000000FF), ref: 6C182087

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 1f6446aa33c5cdd70de7f7f7a9a3f75243b429d423dbf57b7e5b29152a55327b
Instruction ID: 82e58a0a3463ac9ce7c24650c29ce4bbe420f12b4cf46ffa18143ba47cd2d797
Opcode Fuzzy Hash: 1f6446aa33c5cdd70de7f7f7a9a3f75243b429d423dbf57b7e5b29152a55327b
Instruction Fuzzy Hash: A8319C32A0660AABDF15CF74DC84EAE3BB5EB01718B14026AFC1496690EB35D954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C242E40 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C242EA2
_free.LIBCMT ref: 6C242ECA
_free.LIBCMT ref: 6C242ED6
sqlite3_result_int64.SQLITE3(?,?,?), ref: 6C242F09
sqlite3_result_double.SQLITE3 ref: 6C242F2F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _free$sqlite3_result_doublesqlite3_result_int64
String ID:
API String ID: 4142464551-0
Opcode ID: 8667ec824e36454806bcf46cabac08155db56ef91de55b94d97d6057d3c301a2
Instruction ID: 07b2c50fdc34b14ea8753bcd9fb6d57a9bd24b56245f271d8d1e6216bc8cc151
Opcode Fuzzy Hash: 8667ec824e36454806bcf46cabac08155db56ef91de55b94d97d6057d3c301a2
Instruction Fuzzy Hash: 0F31E7F1A047059BD3189A26D984B57B3E8FF44219F458968FC4AC7F11EB31F454CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C242D60 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C242DBC
_free.LIBCMT ref: 6C242DE4
_free.LIBCMT ref: 6C242DF0
sqlite3_result_int64.SQLITE3(?,?,?), ref: 6C242E18
sqlite3_result_double.SQLITE3(?), ref: 6C242E31

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _free$sqlite3_result_doublesqlite3_result_int64
String ID:
API String ID: 4142464551-0
Opcode ID: 4e731f377aa4bd5205496b4dbb318c3d4caaab6bb1ac56825aee0bf720186626
Instruction ID: 3b35e880c503e6fcfd0e7d5b5fdfb489ca15dcf6389732474e07a83405eb73b1
Opcode Fuzzy Hash: 4e731f377aa4bd5205496b4dbb318c3d4caaab6bb1ac56825aee0bf720186626
Instruction Fuzzy Hash: 6B21CCF5A017099BD6149E27ED84F5773A8AF4461EF048668FC59C7F00E731F458C692

Uniqueness

Uniqueness Score: -1.00%

Function 6C208570 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?), ref: 6C208598
sqlite3_column_text.SQLITE3(?,00000000), ref: 6C2085A8
sqlite3_step.SQLITE3(?), ref: 6C2085C0
sqlite3_errmsg.SQLITE3(?), ref: 6C2085F3
sqlite3_errmsg.SQLITE3(?), ref: 6C20863E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_errmsgsqlite3_step$sqlite3_column_text
String ID:
API String ID: 3631572263-0
Opcode ID: 54066ac4b14fc7006c63b21440eee0aeb31f4b1c28212641e336eded66cd8aa7
Instruction ID: f889d1cd24edef73ae1a92129b02bbf975dede856b7237841402ebf7cdb4d7f6
Opcode Fuzzy Hash: 54066ac4b14fc7006c63b21440eee0aeb31f4b1c28212641e336eded66cd8aa7
Instruction Fuzzy Hash: 262138B6B0020967C7104AA59CC0BAF33A85B54A2DF260633FD19DFF41EB75E91886C7

Uniqueness

Uniqueness Score: -1.00%

Function 6C220D10 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C220D39
sqlite3_free.SQLITE3(?), ref: 6C220D6B
sqlite3_free.SQLITE3(?), ref: 6C220D7D
sqlite3_blob_close.SQLITE3(?), ref: 6C220D89
sqlite3_free.SQLITE3(?), ref: 6C220D92

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_blob_closesqlite3_initialize
String ID:
API String ID: 2447611576-0
Opcode ID: a1a71b91de880684c29889f8bef54c9223646753d857c345a5afd7ccdf1e1fd8
Instruction ID: 5667eb7c070e827cd96477d2f36d8d53ffff4cecd186c192af45566d0ca3a9df
Opcode Fuzzy Hash: a1a71b91de880684c29889f8bef54c9223646753d857c345a5afd7ccdf1e1fd8
Instruction Fuzzy Hash: E8113ABAA056495BD320CA25E950B9773E8DF4432CF04062DED9983B40FB39F8048381

Uniqueness

Uniqueness Score: -1.00%

Function 6C179010 Relevance: 7.6, APIs: 5, Instructions: 72fileCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C179023
PathFileExistsW.SHLWAPI(?), ref: 6C17905F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000001,10000082,00000000), ref: 6C17907C

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: File$CreateExistsPath
String ID:
API String ID: 2955419453-0
Opcode ID: 8fba0c1e75b49ec0998ba3a9a5f6c490ff4f92712caa0f024753544df81132f7
Instruction ID: 356a6def2448aa451b077625244ec1ecdba85eea0a2dd9c875134fbbd796ee4c
Opcode Fuzzy Hash: 8fba0c1e75b49ec0998ba3a9a5f6c490ff4f92712caa0f024753544df81132f7
Instruction Fuzzy Hash: 161120B67166107BD2206A689C54FA9B31CEB5237DF204331F724D76C0C766D91A87F4

Uniqueness

Uniqueness Score: -1.00%

Function 6C185024 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C18502D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C185050

Part of subcall function 6C182055: HeapAlloc.KERNEL32(00000000,?,?,?,6C17A5B9,?,?,6C171043,00000040,2ADA91DB,?,?,6C18BE4F,000000FF), ref: 6C182087

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6C185076
_free.LIBCMT ref: 6C185089
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C185098

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 403077e26da1262409f1e64a0681b2be146c41a3cf2987777114fe5d6c120b1f
Instruction ID: f9c36d802825223dbbdde2cb2d385c73d5489ed08bfccd5ec966b0828f727926
Opcode Fuzzy Hash: 403077e26da1262409f1e64a0681b2be146c41a3cf2987777114fe5d6c120b1f
Instruction Fuzzy Hash: EE01717260B6157F3721167A5C8CDBB7A7DDAC7EA53210229B916C6604DF61CC0299F0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1ABFD0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 6C1ABFE2
sqlite3_free.SQLITE3(00000000,00000000), ref: 6C1AC006
sqlite3_win32_is_nt.SQLITE3 ref: 6C1AC034
sqlite3_free.SQLITE3(00000000), ref: 6C1AC047

Part of subcall function 6C1A8AB0: _memset.LIBCMT ref: 6C1A8AF0

sqlite3_free.SQLITE3(00000000), ref: 6C1AC061

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt$_memset
String ID:
API String ID: 1650657708-0
Opcode ID: 7761d6307160c2498ca3efa3ff2c3f80804aeb1939c3ede095d5e4f6b3d8f1b5
Instruction ID: 9b509cc71b969ec1b4824852e1c96895518e93380dacba3f15d3060c23166549
Opcode Fuzzy Hash: 7761d6307160c2498ca3efa3ff2c3f80804aeb1939c3ede095d5e4f6b3d8f1b5
Instruction Fuzzy Hash: 7A01E57EB1121413961166FA6E056DA33AD8BD216C7054636ED19C3B00FF26C80793E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C244FCA Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C244FD8

Part of subcall function 6C2443BB: __FF_MSGBANNER.LIBCMT ref: 6C2443D4
Part of subcall function 6C2443BB: __NMSG_WRITE.LIBCMT ref: 6C2443DB
Part of subcall function 6C2443BB: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,6C246CCE,00000000,00000001,00000000,?,6C249894,00000018,6C26EF60,0000000C,6C249924), ref: 6C244400

_free.LIBCMT ref: 6C244FEB

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 24ab8a138e2207f14b705e07514ee594b6dd9115539ce4c032b0495efd8f96c3
Instruction ID: fff310c441ecfec9b5f74a6de26d307d74107ebbdd580e0b01f80be6fb4a81ef
Opcode Fuzzy Hash: 24ab8a138e2207f14b705e07514ee594b6dd9115539ce4c032b0495efd8f96c3
Instruction Fuzzy Hash: DD11EE3650861E5BDB2E1F74D804A8E37A5AF4B376F11C535FC9A96EC0DF34844586D0

Uniqueness

Uniqueness Score: -1.00%

Function 6C18729C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C1872B4

Part of subcall function 6C18201B: HeapFree.KERNEL32(00000000,00000000,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?), ref: 6C182031
Part of subcall function 6C18201B: GetLastError.KERNEL32(?,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?,?), ref: 6C182043

_free.LIBCMT ref: 6C1872C6
_free.LIBCMT ref: 6C1872D8
_free.LIBCMT ref: 6C1872EA
_free.LIBCMT ref: 6C1872FC

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9e3e3c7b0428b991ee3f1579c2d103498e55e9e5102e76aa4805a117ee207937
Instruction ID: da5731ffdba4d3379413da1e3449656646f16a2e8447e1b71eb98548479df9ca
Opcode Fuzzy Hash: 9e3e3c7b0428b991ee3f1579c2d103498e55e9e5102e76aa4805a117ee207937
Instruction Fuzzy Hash: CFF0627170B60497CA25DF54D585D5B37EEAB187693B00806F818E7E00CB30F8819EE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C181C72 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C181C90

Part of subcall function 6C18201B: HeapFree.KERNEL32(00000000,00000000,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?), ref: 6C182031
Part of subcall function 6C18201B: GetLastError.KERNEL32(?,?,6C187333,?,00000000,?,00000000,?,6C18735A,?,00000007,?,?,6C185AC9,?,?), ref: 6C182043

_free.LIBCMT ref: 6C181CA2
_free.LIBCMT ref: 6C181CB5
_free.LIBCMT ref: 6C181CC6
_free.LIBCMT ref: 6C181CD7

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cc21733012783aba61d939eaa009e9040c870b0f8c1ac321f2fe81761ad5e495
Instruction ID: 305e52d76116ec187f50d469c59c37a703e96135661cd7dd85a4838f3a8ec884
Opcode Fuzzy Hash: cc21733012783aba61d939eaa009e9040c870b0f8c1ac321f2fe81761ad5e495
Instruction Fuzzy Hash: D7F05EB1A0AA248BCF965F24880458A3B74F70AB25361060AF418E3755C739955AFFE4

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E5BD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 344COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1E5CEE

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C1E5C52
unknown column "%s" in foreign key definition, xrefs: 6C1E5E6A
foreign key on %s should reference only one column of table %T, xrefs: 6C1E5C29

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 2102423945-272990098
Opcode ID: f0b1f58210ed35b5245b87ba958b2250d07bf3b62532641e45f1451b70974cae
Instruction ID: e41147469a85a7f69ef0ed05e5363a615e4c316d8723166948e18d113c5f2d90
Opcode Fuzzy Hash: f0b1f58210ed35b5245b87ba958b2250d07bf3b62532641e45f1451b70974cae
Instruction Fuzzy Hash: BDD1B074A046059FCB04CF68C494AAABBB5FF4D308F2881ADEC59DB742D731E955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1FC540 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1FC58E

Strings

%.*z:%u, xrefs: 6C1FC6DE
rowid, xrefs: 6C1FC650

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: %.*z:%u$rowid
API String ID: 2102423945-2995828178
Opcode ID: 289770a7e411c3010c22b28b452cd9ef2e2ca93dad9707604e8c68c5c6444e85
Instruction ID: 600adc6880f40510c393993903916d49ced98c0f54e9b3135f66d2ffd98d07a1
Opcode Fuzzy Hash: 289770a7e411c3010c22b28b452cd9ef2e2ca93dad9707604e8c68c5c6444e85
Instruction Fuzzy Hash: 3EC10070A052048FDB21EF58C8A4BAA77F1BF95318F184169DC289BB51E731D843DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C200610 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

'%s' is not a function, xrefs: 6C200675
multiple references to recursive table: %s, xrefs: 6C2007E0
table %s has %d values for %d columns, xrefs: 6C20086B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: '%s' is not a function$multiple references to recursive table: %s$table %s has %d values for %d columns
API String ID: 0-306050388
Opcode ID: 4bdbd8465309e55f9f07925879618664121b901f3e5e36a86baaadbae7b675ae
Instruction ID: 6d6ca999596ed1b449bced144cd8c6a44e4001c3a0f56e0e49546b67ce952779
Opcode Fuzzy Hash: 4bdbd8465309e55f9f07925879618664121b901f3e5e36a86baaadbae7b675ae
Instruction Fuzzy Hash: 3DA1B075B012099FEB00CF58D880BAAB7B5FF49319F20416AEC199BB50DB35E955CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A4CBE Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C1A4E43
__aullrem.LIBCMT ref: 6C1A4E5C
__aulldvrm.LIBCMT ref: 6C1A4EB5

Strings

+, xrefs: 6C1A4CF7

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: __aulldiv__aulldvrm__aullrem
String ID: +
API String ID: 1415644573-2126386893
Opcode ID: 4f8d27ae9bcaf89868b5da35e92e2ea2576b2f040fcfb070c5e8b12b37700ed9
Instruction ID: 0f0c9a336849f820768afc3399b374a8577feafd06bd8d6d8701e33667a5aeee
Opcode Fuzzy Hash: 4f8d27ae9bcaf89868b5da35e92e2ea2576b2f040fcfb070c5e8b12b37700ed9
Instruction Fuzzy Hash: C091F63870D7428FD701CFA8C49075AFBE1AF9A318F18456DE8949BB01DB74D84ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C0630 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 6C1C0830
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C0821
database corruption, xrefs: 6C1C082B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 0-2708572664
Opcode ID: 78b74388d251cdcb3b10b3139389367bebba2bb98c53c6b88c38547ca229161a
Instruction ID: e5457ac519c20897a4a9ab00774f48fc22ec5c477fc2d44581a6416aad8ae7a8
Opcode Fuzzy Hash: 78b74388d251cdcb3b10b3139389367bebba2bb98c53c6b88c38547ca229161a
Instruction Fuzzy Hash: 9B7128B0204B908FC325CF29C480BA7BBF5BFA5314F048559E99987A91D335E855CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AABC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6C1AA370: _memset.LIBCMT ref: 6C1AA420
Part of subcall function 6C1AA370: sqlite3_snprintf.SQLITE3(?,00000070,%s-shm,?), ref: 6C1AA43F
Part of subcall function 6C1AA370: sqlite3_initialize.SQLITE3 ref: 6C1AA48F
Part of subcall function 6C1AA370: sqlite3_win32_is_nt.SQLITE3 ref: 6C1AA69C

sqlite3_initialize.SQLITE3 ref: 6C1AACCF

Part of subcall function 6C1A8F00: sqlite3_log.SQLITE3(?,os_win.c:%d: (%lu) %s(%s) - %s,?,?,?,?,00000000), ref: 6C1A8F8B

Strings

winShmMap2, xrefs: 6C1AACB0
winShmMap3, xrefs: 6C1AAD93
winShmMap1, xrefs: 6C1AAC51

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initialize$_memsetsqlite3_logsqlite3_snprintfsqlite3_win32_is_nt
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 1531319308-3826999013
Opcode ID: 53d04d8e7b1b378ac1aebf31cd174a6ff50d2dbf7c056fe2c85aa2db146c545d
Instruction ID: d2370a3c9ee54e4e106d3da4b10e80320bdfcfc9c13540510dd42d3127c23f83
Opcode Fuzzy Hash: 53d04d8e7b1b378ac1aebf31cd174a6ff50d2dbf7c056fe2c85aa2db146c545d
Instruction Fuzzy Hash: 5A619CB86007019FD710CF64C884A5AB7F5FF99719F00892DE9869BB80E774E846CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C25097D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6C250A0D

Part of subcall function 6C251DA0: __87except.LIBCMT ref: 6C251DDB

Strings

pow, xrefs: 6C2509E5, 6C250A02

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 4d8deaf4546203ff4ac13b522a1f949ae11f15adaf34dd1f02ce6e41e2c84882
Instruction ID: 7978bac79cb43f71dc35969a22e375421fa9a1259a362e62ae02a45dc3f6aad7
Opcode Fuzzy Hash: 4d8deaf4546203ff4ac13b522a1f949ae11f15adaf34dd1f02ce6e41e2c84882
Instruction Fuzzy Hash: 45516A74E1D24F86DB02AB14C95079B37A49B4270EFE08E59FCD541AD8EB35C8F4C642

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CFF90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1D0190

Strings

too many levels of trigger recursion, xrefs: 6C1D1595
out of memory, xrefs: 6C1D1648
gfff, xrefs: 6C1D0065

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: gfff$out of memory$too many levels of trigger recursion
API String ID: 2102423945-2315875709
Opcode ID: 38d314121d509e6130d35cb63d50054f8fc0154df4619250ea93a07df9954d22
Instruction ID: 83a824c4058a302907ab06534f4558b46edc0ef4a24da022815cbee2514723bc
Opcode Fuzzy Hash: 38d314121d509e6130d35cb63d50054f8fc0154df4619250ea93a07df9954d22
Instruction Fuzzy Hash: D1911174A00A168FC724CF19C980B96F7F0BF58304F14869AD95AA7B11E335F996CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C242620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C242746
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C24276A
sqlite3_free.SQLITE3(00000000), ref: 6C2427C3

Strings

string or blob too big, xrefs: 6C2427AC

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 2051035253-2803948771
Opcode ID: 3eb414672df926c4adb6a7054c8e1c4e0e1d339dc9c88d0b9e2240ec6f06b737
Instruction ID: 55810b8a6cc4eb88a419a6edb03712fa87cce0355d97b9e9dd5c02e0bf3f9e3c
Opcode Fuzzy Hash: 3eb414672df926c4adb6a7054c8e1c4e0e1d339dc9c88d0b9e2240ec6f06b737
Instruction Fuzzy Hash: 5751A0B260565A47D3048F2AD8443A6B7E1EF8132AF288799FCE5C7BD1D721D44AC3D1

Uniqueness

Uniqueness Score: -1.00%

Function 6C242810 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C2428AE
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C2428D4

Strings

string or blob too big, xrefs: 6C2429B9

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initializesqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 530588951-2803948771
Opcode ID: 85237538bb49463d487aa3cfa913d8078e88d6767d766a5a3bee4ff6eab9da78
Instruction ID: 759f067dc0f51914ed47faeba2c1e0eedfff776d92293fb4733b2ab1c9fbde9f
Opcode Fuzzy Hash: 85237538bb49463d487aa3cfa913d8078e88d6767d766a5a3bee4ff6eab9da78
Instruction Fuzzy Hash: BF51A2727082464BD714CF2AC8487D973A5DF82329F28C2A9FC95C7B81E731D446C362

Uniqueness

Uniqueness Score: -1.00%

Function 6C23BBE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C23BC0E
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C23BC32
sqlite3_value_dup.SQLITE3(00000020), ref: 6C23BC87

Strings

string or blob too big, xrefs: 6C23BD8D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_initializesqlite3_result_error_nomemsqlite3_value_dup
String ID: string or blob too big
API String ID: 843840191-2803948771
Opcode ID: 34f23234fc3d266e1bc1ea36fbe700694144bfeb8cf60d471e9f6e6416fbb70d
Instruction ID: 9978a784b3bd05c61932d08e67d25865ac38345200a31a4cbf24c6ef6e6f5b0e
Opcode Fuzzy Hash: 34f23234fc3d266e1bc1ea36fbe700694144bfeb8cf60d471e9f6e6416fbb70d
Instruction Fuzzy Hash: 1751CFB5604B1A9FC720CF18D480B96B7B0BF88318F1449ADED994BB41D732E55ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C8AB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,00011A20,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1C8B27

Strings

%s at line %d of [%.10s], xrefs: 6C1C8B20
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1C8B11
database corruption, xrefs: 6C1C8B1B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: ee4160942fbc85644c4c9f7a18224e29de01409cc08d743dcd4e2659a2581b3a
Instruction ID: b614de6452eaac98cf9026e46c7a9e95d96c3055ec69df927eefdf5feede8e04
Opcode Fuzzy Hash: ee4160942fbc85644c4c9f7a18224e29de01409cc08d743dcd4e2659a2581b3a
Instruction Fuzzy Hash: A34148767081540BD710CE2DD4D05BDFBA1EBB5225B0C87EBFDAD8BA41C23AE411C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A9CB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 6C1A9CE6
sqlite3_win32_is_nt.SQLITE3 ref: 6C1A9D82
sqlite3_win32_is_nt.SQLITE3 ref: 6C1A9DEE

Strings

winUnlock, xrefs: 6C1A9D55

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_win32_is_nt
String ID: winUnlock
API String ID: 3558703804-3127648992
Opcode ID: d1407dab5413ed1c52084dc3e83b67267fbc24710dc80c60f5b9a25d3bbb39d0
Instruction ID: 1dc2b8d1a5ca9d2c451b437e1784954948db67d146a8d16b76096c44d7d6311a
Opcode Fuzzy Hash: d1407dab5413ed1c52084dc3e83b67267fbc24710dc80c60f5b9a25d3bbb39d0
Instruction Fuzzy Hash: 4C5192B4E00314AFDB11CFA5C895AEEBBF9FF49315F10851AE909E7640E7719982CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BDC60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000F472,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BDC93

Strings

%s at line %d of [%.10s], xrefs: 6C1BDC8C
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BDC7D
database corruption, xrefs: 6C1BDC87

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: d9bdda02e1ddd8daedbea6eb42ea0aa8fde0bbfc593764b7f5fe0fc8d5126035
Instruction ID: 00dd11b31acd121e653f64df61cd30342953fddd06dabd5ccf850c9c6f696d83
Opcode Fuzzy Hash: d9bdda02e1ddd8daedbea6eb42ea0aa8fde0bbfc593764b7f5fe0fc8d5126035
Instruction Fuzzy Hash: 0551D4711043029FC704DF69C880AABB7E4FF88718F044A59F998DB786E335E559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AEA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C1AEAC1
sqlite3_randomness.SQLITE3(00000004,?,00000000,?,?,?,?,?,?,6C1B2C6B,6C1C1D64,?), ref: 6C1AEB39
_memset.LIBCMT ref: 6C1AEB6E

Strings

0, xrefs: 6C1AEA8C

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_memsetsqlite3_randomness
String ID: 0
API String ID: 493287122-4108050209
Opcode ID: 3b847dbc7edc436512411af784d0dc8aef53c4c7205531d587866a8acfc5fc32
Instruction ID: ab88f1f6f046f7e24ff67b5e1a3baf4deef9c9aa96dc8c845836c6c48dfd1c14
Opcode Fuzzy Hash: 3b847dbc7edc436512411af784d0dc8aef53c4c7205531d587866a8acfc5fc32
Instruction Fuzzy Hash: F25105B4A00704DFD718CFA9C584AABB7F5BF89304F14896DD85A87B45D774EA02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C1A50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1C1AF1
sqlite3_free.SQLITE3(00000000), ref: 6C1C1B96

Strings

destination database is in use, xrefs: 6C1C1B84
source and destination must be distinct, xrefs: 6C1C1A86

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_free
String ID: destination database is in use$source and destination must be distinct
API String ID: 4091510324-3432668017
Opcode ID: 81941754bc74609a7526bd307afaf03a6862713a1857469c27a2f4ffb6905096
Instruction ID: 029aafbb1f8484a3217a279c3c531bae6368b0b070436fddcda0c50d5caddad1
Opcode Fuzzy Hash: 81941754bc74609a7526bd307afaf03a6862713a1857469c27a2f4ffb6905096
Instruction Fuzzy Hash: 9141B4B1B413009BEB05CF59D885B5B73A8BF61218F244525FC15DBB81E778E924CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B5E90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 6C1B5FE2
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B5FD3
database corruption, xrefs: 6C1B5FDD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 0-2708572664
Opcode ID: cbce3fd65729b88f016d20f621b7490a1afdb82adbbb6c70b36b1fefd0a2a563
Instruction ID: 4012b1099d301f6bce075f8817e82e47f409a67c40d3f28c2b84cfa7b5c77b19
Opcode Fuzzy Hash: cbce3fd65729b88f016d20f621b7490a1afdb82adbbb6c70b36b1fefd0a2a563
Instruction Fuzzy Hash: F241CF72A083068BD700DF49D88065AF3E1FB94324F054AAEF998A7B41E771E9458BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C208A40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,0001CFBF,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C208ABC

Strings

%s at line %d of [%.10s], xrefs: 6C208AB5
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C208AA6
misuse, xrefs: 6C208AB0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-1907583247
Opcode ID: c501b17404da9a4bdeca41de2dd3677c1f01174c213fb4a5d23e95769ff6730f
Instruction ID: 18e202478db37f5cfa7bfe1fe5ce4f2b670bbdaa041530afd245598b0d51d111
Opcode Fuzzy Hash: c501b17404da9a4bdeca41de2dd3677c1f01174c213fb4a5d23e95769ff6730f
Instruction Fuzzy Hash: B541B1B17043459BDB01CF19DC80B9777E4AB80319F184A2FED59CBA46E774E409C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D25F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00013F48,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1D261A

Strings

%s at line %d of [%.10s], xrefs: 6C1D2613
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1D2604
misuse, xrefs: 6C1D260E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-1907583247
Opcode ID: 6d2d267564bb24d3cc34f7aa91342c3c9d19aa3ed701307323be76cb58dc2d2f
Instruction ID: 4d584350929392434931df7e8de970426e0557b3c7bafd74dcce7b65d731f464
Opcode Fuzzy Hash: 6d2d267564bb24d3cc34f7aa91342c3c9d19aa3ed701307323be76cb58dc2d2f
Instruction Fuzzy Hash: D941F5B17003449BDB04CF18C888B1A77A5AF90318F1A41A5FC248BB43D770FC56CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1812BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe,00000104), ref: 6C1812FA
_free.LIBCMT ref: 6C1813C5
_free.LIBCMT ref: 6C1813CF

Strings

C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe, xrefs: 6C1812F1, 6C1812F8, 6C181327, 6C18135F

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
API String ID: 2506810119-2854642598
Opcode ID: 369c5898b361bd71350c277109128f8dca31d1c0cdc9c5852259748b17aa9f35
Instruction ID: 3fc3bb415be729782c0d9b71ff7766314232e2bc2a8f02ae4fae0aab17d897c6
Opcode Fuzzy Hash: 369c5898b361bd71350c277109128f8dca31d1c0cdc9c5852259748b17aa9f35
Instruction Fuzzy Hash: 9F316672A0A218AFDB11CF998884ADE7BFDEB96724B304056E914D7B00D774CA44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C226F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3(?,00000007,00000000,6C2271B6,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C226F16
_memset.LIBCMT ref: 6C226F46
sqlite3_free.SQLITE3(?,?,?,?,00000007,00000000,6C2271B6,00000000), ref: 6C226F55

Strings

temp, xrefs: 6C226F98

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_freesqlite3_initialize
String ID: temp
API String ID: 1083479658-190023114
Opcode ID: d598907fbba867c347bfb46dba54a3e02707bb561d83a9bc5efaa26f50f49cd7
Instruction ID: 604d804d249e06bc75b6c25ed19f2f69e222bd1aa8bb016e835d3932760b761b
Opcode Fuzzy Hash: d598907fbba867c347bfb46dba54a3e02707bb561d83a9bc5efaa26f50f49cd7
Instruction Fuzzy Hash: CA31ACB66153199BCB10CF08D4C0A5ABBA8EF88728F14856DFC598B702C776E905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1EDB10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3(?), ref: 6C1EDB82
sqlite3_value_bytes.SQLITE3(?,?), ref: 6C1EDB90
sqlite3_value_bytes.SQLITE3 ref: 6C1EDBF0

Strings

(%l, xrefs: 6C1EDBB4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_value_bytes$sqlite3_value_text
String ID: (%l
API String ID: 784005533-3571038445
Opcode ID: 3f384d7a1cea684a0f96efb227486c1d72aed614bb1f0bba6ae32795ed1671bd
Instruction ID: 97c26f642e5d7c679f8025696b4917c942085ead9fa05dd02e6d21360731f13c
Opcode Fuzzy Hash: 3f384d7a1cea684a0f96efb227486c1d72aed614bb1f0bba6ae32795ed1671bd
Instruction Fuzzy Hash: 3F31F175605B048FD700FF25C890A5673A5AFDE34CB1A81A8EC19CBB45F739E805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DDDF,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,00000000), ref: 6C1B7700

Strings

%s at line %d of [%.10s], xrefs: 6C1B76F9
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B76AB, 6C1B76EA
database corruption, xrefs: 6C1B76F4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: d4702a94b98a72a3bee170fd4359429dcc2391354abb8d5fead1b614231b1e1a
Instruction ID: 586528b555b1724b1a64d4a9b9d80bd96687ff9eaee52197a45e7ce8ff8d2a5f
Opcode Fuzzy Hash: d4702a94b98a72a3bee170fd4359429dcc2391354abb8d5fead1b614231b1e1a
Instruction Fuzzy Hash: 4C217D767041065BD714CE2DC88196BB3A5EB99328B094676EC59E7B41FB30E8128AE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BA420 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E815,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BA490

Strings

%s at line %d of [%.10s], xrefs: 6C1BA489
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BA47A
database corruption, xrefs: 6C1BA484

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 3d726f1ecebf4c3ffb2fc34d27c8863301197a8b14b41bd78c63213539579000
Instruction ID: dbeeb13f8dd3350924b45f4139d7862586a687a6bc319d4dcb32714ab1946758
Opcode Fuzzy Hash: 3d726f1ecebf4c3ffb2fc34d27c8863301197a8b14b41bd78c63213539579000
Instruction Fuzzy Hash: 4E3106317446045BD7009A19CC44B06B3A5AB84329F2D8559DC1CBFF82EB35FC868FE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B7E1B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000DFDD,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1B7E42

Strings

%s at line %d of [%.10s], xrefs: 6C1B7E3B
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B7E2C
database corruption, xrefs: 6C1B7E36

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: d4d85938b1efb02bb6a81979e67a96dfda4b67eb677488374d5b201c45b67e5a
Instruction ID: 59c39e7e7e41c6565e1479e6912242b2f7e5fbbe6dd0515782ab11d6097f2637
Opcode Fuzzy Hash: d4d85938b1efb02bb6a81979e67a96dfda4b67eb677488374d5b201c45b67e5a
Instruction Fuzzy Hash: E621B2323083464BD701CE69D880A6AB7A1EF9521DF144ABAFD49D7A41E731D849CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1B8900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 6C1B26F0: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000C0A5,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,?,?,00000000,00000001,?,?,00000000,?), ref: 6C1B275C

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E208,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,?,?,?,?,?,?,?,6C1BA29A,?), ref: 6C1B8983

Strings

%s at line %d of [%.10s], xrefs: 6C1B8976
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1B8967
database corruption, xrefs: 6C1B8971

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 81886beb4cfd24aceb31fd6a76d94368d2eba9fd418a98d49ca1aba149df1587
Instruction ID: e20fe47a64f9940a1ac1c8672144f5cb7cf5576f9e456546f2908bce4ebc4602
Opcode Fuzzy Hash: 81886beb4cfd24aceb31fd6a76d94368d2eba9fd418a98d49ca1aba149df1587
Instruction Fuzzy Hash: 1811CB72A012059BD700DF28D441A8AB7E4EB5432DF14459EEC4C9B742E773E986CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F6579 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

temp_store_directory, xrefs: 6C1F6586
not a writable directory, xrefs: 6C1F65C4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: not a writable directory$temp_store_directory
API String ID: 0-1820237481
Opcode ID: b8c0b74676a378eb7d34c9557164cef0b1e73823635de33053cfa29e66ae8ad5
Instruction ID: 347faf1f4c0a46cb1bcdb757f1f3b95b0b9b15df5672641f38da8873c5b95617
Opcode Fuzzy Hash: b8c0b74676a378eb7d34c9557164cef0b1e73823635de33053cfa29e66ae8ad5
Instruction Fuzzy Hash: 4C21F0B5A082059BE701CB60D840B9AB7E5ABD2718F04450EE8649BB84EB34E807C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BB880 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000EC9C,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BB930

Part of subcall function 6C1B87E0: sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000E1C0,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,?,?,?,?,?,6C1B73B4,?,00000000,?,?), ref: 6C1B8808

Strings

%s at line %d of [%.10s], xrefs: 6C1BB929
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BB91A
database corruption, xrefs: 6C1BB924

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: fefcdf92abe648ffb7ed375a31de2460e7667e17bb7c7d10c37bc1d9ea3e4676
Instruction ID: 632b289d3d3c84463f7232cf97775b1e484f0b2472b3367be56accd88157cbde
Opcode Fuzzy Hash: fefcdf92abe648ffb7ed375a31de2460e7667e17bb7c7d10c37bc1d9ea3e4676
Instruction Fuzzy Hash: DE213560108FE003D326CB358450633BBF59F66715B084A8DD9EA93E83E326F452CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6C221F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

sqlite3_value_blob.SQLITE3 ref: 6C221F4D
sqlite3_mprintf.SQLITE3(illegal first argument to %s,?), ref: 6C221F6B
sqlite3_free.SQLITE3(00000000,00000000,00000001,illegal first argument to %s,?), ref: 6C221F88

Strings

illegal first argument to %s, xrefs: 6C221F66

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_blob
String ID: illegal first argument to %s
API String ID: 996484615-2929609328
Opcode ID: 86be05c92a9b3795b98fd072b4ba6e88b1c2d244fbc0239bfb8b787a4a0b1a31
Instruction ID: 6cf5f7666fed823ae0f8298c7cb43e3ee3565f8a572dfe46b8fd1c60446beba8
Opcode Fuzzy Hash: 86be05c92a9b3795b98fd072b4ba6e88b1c2d244fbc0239bfb8b787a4a0b1a31
Instruction Fuzzy Hash: D51102B16056496FE3209B29D841F9673A8EF0232CB144359FDB587B81D32AEC8183A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F6625 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(00000000), ref: 6C1F667B
sqlite3_mprintf.SQLITE3(6C25D55C,?), ref: 6C1F668E

Strings

data_store_directory, xrefs: 6C1F6632
not a writable directory, xrefs: 6C1F65C4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: data_store_directory$not a writable directory
API String ID: 1840970956-325680049
Opcode ID: d328bed28e8a973531f3f6559f871de643e8a22ba1b430d159f03e4d4a3e7b50
Instruction ID: e0a3afb7aa84efcf6fe7642cce98b190a8a193422c466c78a3bb586c1a164dcd
Opcode Fuzzy Hash: d328bed28e8a973531f3f6559f871de643e8a22ba1b430d159f03e4d4a3e7b50
Instruction Fuzzy Hash: 3111B6B5A083059BEA05CB65D940B5EB7E49BD6318F00050AE8659BB40EB34E90BC793

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BADD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000EA35,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C1BADF9

Strings

%s at line %d of [%.10s], xrefs: 6C1BADF2
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BADE3
database corruption, xrefs: 6C1BADED

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: cc314cc93b0a679e92b4d522b1e4ec710a39ec3a458bbf662cfb429225d8f538
Instruction ID: 8d50aebf3fbd2af9dc6a66be7b3d7d88722064ecaefe5b2a41c68d840fd2d03d
Opcode Fuzzy Hash: cc314cc93b0a679e92b4d522b1e4ec710a39ec3a458bbf662cfb429225d8f538
Instruction Fuzzy Hash: 53014732B0414C3BE7009A599C41BBEF35CEB61238F044766FD28A7E81EB71AC1447E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C20A440 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,0001D432,fe7d3b75fe1bde41511b323925af8ae1b910bc4d), ref: 6C20A47A

Strings

%s at line %d of [%.10s], xrefs: 6C20A473
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C20A464, 6C20A4B4
misuse, xrefs: 6C20A46E

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$fe7d3b75fe1bde41511b323925af8ae1b910bc4d$misuse
API String ID: 632333372-1907583247
Opcode ID: 4c744499e30ca9cae1e0603a3434afe8fe5732d49d55f604befa0aa89966c564
Instruction ID: 2372cff7490de8599df157638cb65dc06c060725cf4d43ec72f6e169580179a7
Opcode Fuzzy Hash: 4c744499e30ca9cae1e0603a3434afe8fe5732d49d55f604befa0aa89966c564
Instruction Fuzzy Hash: 0101477470429DE7DB008E5DCCC9E8B3758BB0471AB4485A1FE19EFB46C6A0E81093F5

Uniqueness

Uniqueness Score: -1.00%

Function 6C23AF70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";,?,?,?,?,?,?,?,?,?), ref: 6C23AF95

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_exec.SQLITE3(?,00000000,00000000,00000000,00000000), ref: 6C23AFAE

Part of subcall function 6C1F4550: sqlite3_log.SQLITE3(00000015,%s at line %d of [%.10s],misuse,00019D0C,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,00000000,?,?,Function_00058620,?,00000000,?,SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid,?,6C25DEE8), ref: 6C1F458A

sqlite3_free.SQLITE3(00000000,?,00000000,00000000,00000000,00000000), ref: 6C23AFB6

Strings

ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";, xrefs: 6C23AF8B

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_execsqlite3_freesqlite3_initializesqlite3_logsqlite3_mprintf
String ID: ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";
API String ID: 4291405591-2843444156
Opcode ID: c5a4315c8a8e971a54931209eb85b1c06f19739eb7b7dd8925d3aa92fd799d92
Instruction ID: 54387c2c174ca6788bb3074d8c7f906269d104107aeb07d370917da6b46eff3f
Opcode Fuzzy Hash: c5a4315c8a8e971a54931209eb85b1c06f19739eb7b7dd8925d3aa92fd799d92
Instruction Fuzzy Hash: C3F06DB67012187FE210569AAC45FB7B39CEBC4A28F104225FA08D7B40D6A1FC1643F0

Uniqueness

Uniqueness Score: -1.00%

Function 6C236A70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3(DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';,?,?,?,?,?,?), ref: 6C236A89

Part of subcall function 6C1A6040: sqlite3_initialize.SQLITE3 ref: 6C1A6043

sqlite3_exec.SQLITE3(?,00000000,00000000,00000000,00000000), ref: 6C236AAA
sqlite3_free.SQLITE3(00000000,?,00000000,00000000,00000000,00000000), ref: 6C236AB2

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 6C236A84

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_execsqlite3_freesqlite3_initializesqlite3_mprintf
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 2307965828-2071071404
Opcode ID: f624a520a5e78093a3b392fdca62d8326e7089ae5300b4a5b7ea30a652dee04d
Instruction ID: d2356bf68b7f30e35eb0c6d696b2bc8cdee7018135114a737c740d9829ec79a4
Opcode Fuzzy Hash: f624a520a5e78093a3b392fdca62d8326e7089ae5300b4a5b7ea30a652dee04d
Instruction Fuzzy Hash: FDF0BBB63403197FE110AA9ADC85FA773ACEBC4669F044129FE0CD3B01E690FC0542B0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1BB530 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(0000000B,%s at line %d of [%.10s],database corruption,0000EC9C,fe7d3b75fe1bde41511b323925af8ae1b910bc4d,?,00000001,?,6C1BB78C,?,?,?,?,?,?,6C1B73B4), ref: 6C1BB559

Strings

%s at line %d of [%.10s], xrefs: 6C1BB552
fe7d3b75fe1bde41511b323925af8ae1b910bc4d, xrefs: 6C1BB543
database corruption, xrefs: 6C1BB54D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$database corruption$fe7d3b75fe1bde41511b323925af8ae1b910bc4d
API String ID: 632333372-2708572664
Opcode ID: 0206f4ec2f3788f4a802a3226b96418cfd3c5e395dc4ad117f246ba1727e805f
Instruction ID: 1cb5e50a8c476373678437d69b376e7278dcff63d5f0c77f25ec0ab6828f4cdc
Opcode Fuzzy Hash: 0206f4ec2f3788f4a802a3226b96418cfd3c5e395dc4ad117f246ba1727e805f
Instruction Fuzzy Hash: 7EF0A2221085881BD311C7299C11EA77F9C8F61311F0A03EAFA58DB9F3F752D5118795

Uniqueness

Uniqueness Score: -1.00%

Function 6C182CEE Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C182D79
__alldvrm.LIBCMT ref: 6C182F7A
__alldvrm.LIBCMT ref: 6C182F9C

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 0beadea4ce2a63937019cac39cd97d249e6202758758096cac59423bd60b3cef
Instruction ID: 42470aba9828cb68ed9c0411f286848c953ccaeac8eaa3445b04e5fba68f7ee3
Opcode Fuzzy Hash: 0beadea4ce2a63937019cac39cd97d249e6202758758096cac59423bd60b3cef
Instruction Fuzzy Hash: 6DA15971A0E2859FE713CF18C894B9EBBE5EF26314F1442ADE5549BB80D3388945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AC920 Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1AC992
_memset.LIBCMT ref: 6C1AC9CA
sqlite3_initialize.SQLITE3 ref: 6C1AC9D2

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset$sqlite3_initialize
String ID:
API String ID: 3524101724-0
Opcode ID: 5f8a3394b6cdc9199017ca6359edd98c22fd30d86956c5d575f318cd990739b0
Instruction ID: 6e90b358983c99845bf0925ef497674a64d06ca00c8a6dc1477859497b071988
Opcode Fuzzy Hash: 5f8a3394b6cdc9199017ca6359edd98c22fd30d86956c5d575f318cd990739b0
Instruction Fuzzy Hash: 32A124B97053129BDB01EFA8C89875A73F4BB85348F104529EC55D7780EB36D80ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C232A10 Relevance: 6.2, APIs: 4, Instructions: 244COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C232A96
sqlite3_free.SQLITE3(00000000,?,?,?,?,?,?,?,?,?,?,6C221D47,?,?,?), ref: 6C232D07
sqlite3_blob_close.SQLITE3(?), ref: 6C232D16

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_blob_closesqlite3_freesqlite3_initialize
String ID:
API String ID: 3377212840-0
Opcode ID: 20a6abd884a4558c1b6da61c197952ffd75670ef1f8ce4bec5dcb55be98c6fb6
Instruction ID: 4ae4ff0e110c3bd71268c9841b715653be7e49c671f486d1e241795e6aaec0c0
Opcode Fuzzy Hash: 20a6abd884a4558c1b6da61c197952ffd75670ef1f8ce4bec5dcb55be98c6fb6
Instruction Fuzzy Hash: D6919DF160871A9BD300DF15C884B5BB7E5BB84309F048A2DFC998B652D374E999CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C230A80 Relevance: 6.2, APIs: 4, Instructions: 244COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,00000000,?,?,?,?,6C23161F,00000000,?), ref: 6C230BC5
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,6C23161F,00000000), ref: 6C230BCE
sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,00000000,?,?,?,?,6C23161F,00000000,?), ref: 6C230CB4
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,6C23161F,00000000), ref: 6C230CBD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_resetsqlite3_step
String ID:
API String ID: 3797744065-0
Opcode ID: 2581145fb1fa56c866ce6b969fe01fb486d97a712f460fecf6bc1d54e63a9c0b
Instruction ID: 8e0d16fe515f9965ddee29558bb70e50216dd7adb11c230d0eced5d3b3e60300
Opcode Fuzzy Hash: 2581145fb1fa56c866ce6b969fe01fb486d97a712f460fecf6bc1d54e63a9c0b
Instruction Fuzzy Hash: 7191ADF460035A9FD700CF29D884A56B3A9FF98318F149929FD0D8BB51E734E915CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D35A0 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

Part of subcall function 6C1D3340: CloseHandle.KERNEL32 ref: 6C1D3398
Part of subcall function 6C1D3340: sqlite3_free.SQLITE3(?,?,?,?), ref: 6C1D33AF

sqlite3_free.SQLITE3(?,00000000,?,?,?,?,6C1D37AF,00000000,?,?,6C1C5FEC,?,?), ref: 6C1D35C5
sqlite3_free.SQLITE3(?,?,00000000,?,?,?,?,6C1D37AF,00000000,?,?,6C1C5FEC,?,?), ref: 6C1D35CE
_memset.LIBCMT ref: 6C1D35FD
sqlite3_free.SQLITE3(?), ref: 6C1D3661

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$CloseHandle_memset
String ID:
API String ID: 3215348618-0
Opcode ID: d8854f72ac2b7b3a14b4bf23afeff2d3334f6a93d00efc05576f39dfa09f2b64
Instruction ID: 370a650060eb963b7e2656839246fb2626459010a5d374d588a4e8e84cbaf5c0
Opcode Fuzzy Hash: d8854f72ac2b7b3a14b4bf23afeff2d3334f6a93d00efc05576f39dfa09f2b64
Instruction Fuzzy Hash: 6F51CBB16016109BDB15CF28C88479AB3B0FF09324F56067AEC498BB41EB31F956CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C176610 Relevance: 6.1, APIs: 4, Instructions: 125COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C176632
__aullrem.LIBCMT ref: 6C17669E

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID:
API String ID: 3839614884-0
Opcode ID: 94ef407ee23d70d843162505cdeca07cd76781f249e9ba6ff472702311743bf7
Instruction ID: da0062ae5acca057be6afdd7b785c5a97f7c71414c7904169495ddfb4fbdd392
Opcode Fuzzy Hash: 94ef407ee23d70d843162505cdeca07cd76781f249e9ba6ff472702311743bf7
Instruction Fuzzy Hash: 50314872E05129AAD7345A19C880BFAF769FF11798B60423AF874D7E90C724EC65D2F0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1D9850 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?,?,E8565101,?,6C1F0817,?,?,?,6C1A13DA,?,00000010), ref: 6C1D98C7
sqlite3_free.SQLITE3(?,?,E8565101,?,6C1F0817,?,?,?,6C1A13DA,?,00000010), ref: 6C1D9913
sqlite3_free.SQLITE3(80000446,?,6C1F0817,?), ref: 6C1D9971
sqlite3_free.SQLITE3(6C1D8AB6,?,6C1F0817,?), ref: 6C1D99BD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 04ca531607373ee438aed79cf3c20308dd4a76c8fa50c7e2e9af57171da660f5
Instruction ID: 8f3dfa346b78e105371e3e1e54827a5d24a1f2a717f854c1cd8ab921fb26d3ef
Opcode Fuzzy Hash: 04ca531607373ee438aed79cf3c20308dd4a76c8fa50c7e2e9af57171da660f5
Instruction Fuzzy Hash: AF418EB0501B048BDB299E25D5B07DAB3E4FF15718F12492AC9AA87B04CF35F591CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C237BA0 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C237C01
_memset.LIBCMT ref: 6C237C32
sqlite3_value_blob.SQLITE3(?,00000000), ref: 6C237C42

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_initializesqlite3_value_blob
String ID:
API String ID: 460375551-0
Opcode ID: 445e2524ffdb32bf57a95461d1d8bf4bde0b9fdd09e0b78c06d492325fca10d3
Instruction ID: b4f6e61346775b51b9353ac9779aae7cb4d55011cbf0f4d6446144ad5d500978
Opcode Fuzzy Hash: 445e2524ffdb32bf57a95461d1d8bf4bde0b9fdd09e0b78c06d492325fca10d3
Instruction Fuzzy Hash: 4131F6B1A04729CBDB10CF19E980B96B3A5EF84729F1585A9FC4D8BB41E731E846C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6C242AA0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

sqlite3_value_numeric_type.SQLITE3 ref: 6C242AB2
_calloc.LIBCMT ref: 6C242AF2
_calloc.LIBCMT ref: 6C242B52
_calloc.LIBCMT ref: 6C242BC4

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _calloc$sqlite3_value_numeric_type
String ID:
API String ID: 42847102-0
Opcode ID: 5a80f6452d234030f3673bc39fc185ea29c8ac9e31f924e2f97c5446d3c028d1
Instruction ID: c05609498a31621420b3cb69298de00af855e91af0c117d397f09eac235e14fd
Opcode Fuzzy Hash: 5a80f6452d234030f3673bc39fc185ea29c8ac9e31f924e2f97c5446d3c028d1
Instruction Fuzzy Hash: 1641AEB0A0070A8FC708CF19D484B56BBE4FF88355F15C1A9ED988B762DB31D855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C220C00 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C220C15
sqlite3_free.SQLITE3(?), ref: 6C220CA1
sqlite3_free.SQLITE3(00000000), ref: 6C220CAD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize
String ID:
API String ID: 3567857118-0
Opcode ID: 922fd21868276ac513a3d13ee5c919c48a5cd4ccd4def07487129a98f1b811a2
Instruction ID: 85479ae5f209d9d3b13e70fce8adc4e552d0883b711ee6c5209e020741722947
Opcode Fuzzy Hash: 922fd21868276ac513a3d13ee5c919c48a5cd4ccd4def07487129a98f1b811a2
Instruction Fuzzy Hash: 4731EBB660435AABD710DF69E8809AAB7D8FB44219F40466AFC5DC3700E736E41487E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C172DA0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C172E07
CreateEventW.KERNEL32 ref: 6C172E3D
new.LIBCMT ref: 6C172E6C
new.LIBCMT ref: 6C172E7F

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: 8013468158a8870168db9dcca69f128e46c2a1e26ba7d76f7ff63c569fb28325
Instruction ID: 2c866b982084721c388222e8a0795d12d51758f52a2548d2799daac54aa5ccf9
Opcode Fuzzy Hash: 8013468158a8870168db9dcca69f128e46c2a1e26ba7d76f7ff63c569fb28325
Instruction Fuzzy Hash: 10416F72A44704DFD720CF69D449B8ABBF0FB45724F108269D8299BBD0D775A904CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C24DD64 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6C24DD98
__isleadbyte_l.LIBCMT ref: 6C24DDCB
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 6C24DDFC
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 6C24DE6A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 4945e5dac735ccff2b2bbed6603eedf1a8332f46ede0616401a94ed5655b0eda
Instruction ID: 5a883e9cc7c63f05b0f5920e835a3edb1a5817d29a0cb8df8b0284f992138fdf
Opcode Fuzzy Hash: 4945e5dac735ccff2b2bbed6603eedf1a8332f46ede0616401a94ed5655b0eda
Instruction Fuzzy Hash: D431A236A1525AEFDB19CFA8C884EAE3BB5BF01319F14C569FC618B590D731D940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6C1AA4BB Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C1AA48F
sqlite3_free.SQLITE3(00000000), ref: 6C1AA523
sqlite3_win32_is_nt.SQLITE3 ref: 6C1AA57E
sqlite3_win32_is_nt.SQLITE3 ref: 6C1AA630
sqlite3_win32_is_nt.SQLITE3 ref: 6C1AA69C
sqlite3_free.SQLITE3(?,?,00000000), ref: 6C1AA706
sqlite3_free.SQLITE3(00000000), ref: 6C1AA710

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_freesqlite3_win32_is_nt$sqlite3_initialize
String ID:
API String ID: 1342186338-0
Opcode ID: c2c26a1a70bd1d095f1557dea0464bab7bbbf68e0695a9920d5bb432aec225a8
Instruction ID: 6d4b9616cc4040e213d6425ce3bbf3e153612e44eb04fc249298f4a43e6731a6
Opcode Fuzzy Hash: c2c26a1a70bd1d095f1557dea0464bab7bbbf68e0695a9920d5bb432aec225a8
Instruction Fuzzy Hash: 4531417D6083419FD7118FB985847667BB1BB12308F19415AEC8A87B81DB75E806CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C2084B0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

sqlite3_errmsg.SQLITE3(?), ref: 6C2084E9
sqlite3_errcode.SQLITE3(?), ref: 6C2084FF

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_errcodesqlite3_errmsg
String ID:
API String ID: 1373711215-0
Opcode ID: fd3603768299462587a08fbda3e578806c6b47916dff9a6c206c6913e944ae75
Instruction ID: 19475f52c3ba7eb049b156478c78bb06c760ac71060e2d9a213684d62bf336ac
Opcode Fuzzy Hash: fd3603768299462587a08fbda3e578806c6b47916dff9a6c206c6913e944ae75
Instruction Fuzzy Hash: 7D110167B0011823D20155AD7C417AFB3989B4593DF180172FE0CEBB00FB15EA1A42D3

Uniqueness

Uniqueness Score: -1.00%

Function 6C173AD0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C173AE5
new.LIBCMT ref: 6C173B39
new.LIBCMT ref: 6C173B63
new.LIBCMT ref: 6C173B85

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8741a586640aaf46f172fadba9bd5a6b966dbd9bbdbea3c2d8c57d6feb39f9a
Instruction ID: 5e3985c1fce916c939f2983fa4d7c1a7228bf5ae51cfc14d365078ff347f7b58
Opcode Fuzzy Hash: c8741a586640aaf46f172fadba9bd5a6b966dbd9bbdbea3c2d8c57d6feb39f9a
Instruction Fuzzy Hash: C53139B1541705AFE3208F15C859B46BFE4BF01328F508289D8545FBD1D3BADA99CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C173BE0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6C173BF5
new.LIBCMT ref: 6C173C49
new.LIBCMT ref: 6C173C73
new.LIBCMT ref: 6C173C95

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c3d4df29701a4896f3450d38b6fc32fd87684eccb610e0796b59def141fd4d
Instruction ID: c6dd3ddb9e65488959871af5d971c564563d9f22800d356db1d3b4dcd1452c32
Opcode Fuzzy Hash: b3c3d4df29701a4896f3450d38b6fc32fd87684eccb610e0796b59def141fd4d
Instruction Fuzzy Hash: A93139B1541705AFE3208F15C859B46BFE4BF01328F508289D8545FBD1D3BAEA99CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C174710 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 6C17478B
VerSetConditionMask.KERNEL32(00000000), ref: 6C17478F
VerSetConditionMask.KERNEL32(00000000), ref: 6C174793
VerifyVersionInfoW.KERNEL32(00000023), ref: 6C1747B8

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 2304cf293489b8c03dd48d602d5c0fa0bccc8c7191d2c771adeece62242734c2
Instruction ID: 5fb893e232040941a48f1a043eaabc046ffeb0e4833ee1cf0280c327becb7c78
Opcode Fuzzy Hash: 2304cf293489b8c03dd48d602d5c0fa0bccc8c7191d2c771adeece62242734c2
Instruction Fuzzy Hash: 0C11F4B0648304AEE730DF25DC1ABAB7BE8EB89714F00491DB589D62C0D77596188FD6

Uniqueness

Uniqueness Score: -1.00%

Function 6C183AF2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6C183A99,?,00000000,00000000,00000000,?,6C183C96,00000006,FlsSetValue), ref: 6C183B24
GetLastError.KERNEL32(?,6C183A99,?,00000000,00000000,00000000,?,6C183C96,00000006,FlsSetValue,6C18EA40,6C18EA48,00000000,00000364,?,6C182B8D), ref: 6C183B30
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6C183A99,?,00000000,00000000,00000000,?,6C183C96,00000006,FlsSetValue,6C18EA40,6C18EA48,00000000), ref: 6C183B3E

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e7f473e7db0d1f7fa78c7b4743466f4b8cbe8ef7889ca0fcc52f6dd09b92d0aa
Instruction ID: 7e3e910e2a108f169ebdb387f41b3efc8977ea7d43b62943dffd531b34ab54d6
Opcode Fuzzy Hash: e7f473e7db0d1f7fa78c7b4743466f4b8cbe8ef7889ca0fcc52f6dd09b92d0aa
Instruction Fuzzy Hash: 2E01F77674F222ABDB11996D8C94E4677A8EF17FA1B990720F905D3580E720D402DEE4

Uniqueness

Uniqueness Score: -1.00%

Function 6C24BE62 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6C24BE88

Part of subcall function 6C24BCB4: __fltout2.LIBCMT ref: 6C24BCDF

__cftog_l.LIBCMT ref: 6C24BEAE
__cftoe_l.LIBCMT ref: 6C24BEE0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: c0bfbffff7afabef33c75c19c539302cfdb00039c239bec9d9b0bb2bafe5e663
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: AC11553214494EBBCF0A4E84CC01DEE3F62BB89359F988414FE2858930D336C9B5EB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C17B8E2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 6C17B8F9

Part of subcall function 6C17BF31: ___AdjustPointer.LIBCMT ref: 6C17BF7B

_UnwindNestedFrames.LIBCMT ref: 6C17B910
___FrameUnwindToState.LIBVCRUNTIME ref: 6C17B922
CallCatchBlock.LIBVCRUNTIME ref: 6C17B946

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: e9cc6fb31723be821b80a52370bb26b75e92415cafb63a4d1c459609425f599c
Instruction ID: 585a71b51049961ff0be6c5e1d7a68447304370efd30b34cbc3dc04ec669f6d6
Opcode Fuzzy Hash: e9cc6fb31723be821b80a52370bb26b75e92415cafb63a4d1c459609425f599c
Instruction Fuzzy Hash: F601E572000109BBCF225F55CD00EDA3BBAFF59758F158118FA2866620D376E5B6EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C179EB0 Relevance: 6.0, APIs: 4, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 6C179EC4
SetEvent.KERNEL32(?), ref: 6C179ED8
TerminateThread.KERNEL32(000000FF,00000000), ref: 6C179EE7
CloseHandle.KERNEL32(000000FF), ref: 6C179EF6

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CloseHandle$EventTerminateThread
String ID:
API String ID: 2282348883-0
Opcode ID: e8df650211debc4515a98eab1697d3032086076d6dd7fef0580ac50f06fc5c0a
Instruction ID: 9228007f1add89c7896f1c3fa11fc7fd93ffbf930a9bc4020b1b0caf8c028a73
Opcode Fuzzy Hash: e8df650211debc4515a98eab1697d3032086076d6dd7fef0580ac50f06fc5c0a
Instruction Fuzzy Hash: DE0181752067049FD7305B68D818B46BBE8AF17379F208B18F9BAD6AD0D774E448CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C17A030 Relevance: 6.0, APIs: 4, Instructions: 32synchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 6C17A044
WaitForSingleObject.KERNEL32(000000FF,?), ref: 6C17A059
TerminateThread.KERNEL32(000000FF,000000FF), ref: 6C17A065
CloseHandle.KERNEL32(000000FF), ref: 6C17A074

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CloseEventHandleObjectSingleTerminateThreadWait
String ID:
API String ID: 1091591685-0
Opcode ID: 8d51e5d572a83a81d36258dd83f4fbdcc37ecda8b7bab9c6564c8eb714ad357e
Instruction ID: d55ba51634431b474a54eb33f56cdfe4e6fbfb8fc96925a1886e1f62c7626206
Opcode Fuzzy Hash: 8d51e5d572a83a81d36258dd83f4fbdcc37ecda8b7bab9c6564c8eb714ad357e
Instruction Fuzzy Hash: F9F04F341017009FDB309F68D808E567BA8BF16379B20CB18F8BA86AD0C735E415DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C17D744 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 6C17D744
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 6C17D749
___vcrt_initialize_locks.LIBVCRUNTIME ref: 6C17D74E

Part of subcall function 6C17E06E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 6C17E07F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 6C17D763

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e266b75475dbd6605134e12f1dafc1a25672b40b79fc2af9679af241dc0f1454
Instruction ID: 05b244d4567f7ce7f6178dab0cd624278bb81c55037de3bd8c9b86ec2e04a6fc
Opcode Fuzzy Hash: e266b75475dbd6605134e12f1dafc1a25672b40b79fc2af9679af241dc0f1454
Instruction Fuzzy Hash: 81C04C5410828D586C707A7613043CD13701FA678D7D515C0C8951BF455F4E520F94B3

Uniqueness

Uniqueness Score: -1.00%

Function 6C238B30 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 439COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6C238B97
_memset.LIBCMT ref: 6C238BEF

Strings

VUUU, xrefs: 6C238C8D

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_initialize
String ID: VUUU
API String ID: 3654290173-2040033107
Opcode ID: 22561223b1d411aad568c5e80faded2823f854fef9503c2fed2625a8b7245d2f
Instruction ID: 3c42db2075e814225158c9a83f653689cf177f1c1233f03bd2b6dc6896a39806
Opcode Fuzzy Hash: 22561223b1d411aad568c5e80faded2823f854fef9503c2fed2625a8b7245d2f
Instruction Fuzzy Hash: 7002ACB16083568BC705CF28D484A5BBBF1BBC9308F14491EF989DB350E735E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1ECF90 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 358COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6C1ECFF7
sqlite3_value_text.SQLITE3(?), ref: 6C1ED033

Strings

string or blob too big, xrefs: 6C1ED34A, 6C1ED385, 6C1ED3C0

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text
String ID: string or blob too big
API String ID: 737769566-2803948771
Opcode ID: 7babcca09900a55239937c66b50d58df1a067a43de68a5af2bcdc12c451b3867
Instruction ID: 4c7bd8d281eba63909537aea8a1744805c32cafc8919297fb1940449563afdfd
Opcode Fuzzy Hash: 7babcca09900a55239937c66b50d58df1a067a43de68a5af2bcdc12c451b3867
Instruction Fuzzy Hash: 8ED17970608B428FD311EF29C49475ABBF1AFDA318F188A6DE895CBB81D335D445CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C5800 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 326COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3(00000003,?,%.2x,?), ref: 6C1C5B8D

Strings

unknown error, xrefs: 6C1C5930, 6C1C593B
%.2x, xrefs: 6C1C5B85

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf
String ID: %.2x$unknown error
API String ID: 949980604-1651746750
Opcode ID: 2d834eba5f0538de4d0670aa66f8a37cb4de2c506a63b45290e1258aef541db0
Instruction ID: e8411683348b119deef5fb3a4c7f992f109ab4bbbaf534c156d3daef1b061b65
Opcode Fuzzy Hash: 2d834eba5f0538de4d0670aa66f8a37cb4de2c506a63b45290e1258aef541db0
Instruction Fuzzy Hash: C9D1BA70B007068FD714CF29C4C0B96B7B1FF68318F1486A9D9998BB42E739E844DB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C226620 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

lj"l, xrefs: 6C226629, 6C226725, 6C226766, 6C226861, 6C2268CC, 6C226790, 6C22672C, 6C22676A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: lj"l
API String ID: 0-4131566082
Opcode ID: 37cee9c9e0f2bc4fd83ba5df2fd73f1442011073c568d9424acb191f6e01cff9
Instruction ID: 49f3908f7a271cf4271b18a241e7942cc245a9211fb141e30cdd1d05f0fe679e
Opcode Fuzzy Hash: 37cee9c9e0f2bc4fd83ba5df2fd73f1442011073c568d9424acb191f6e01cff9
Instruction Fuzzy Hash: 22C126B66043068FC700CF29D4C4A1AB7F4FB85315F14892AEC59D7B51EB78E958CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C176820 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 197timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,0000009A), ref: 6C17690F
DosDateTimeToFileTime.KERNEL32(?,?,000000A2), ref: 6C176922

Part of subcall function 6C176610: __aulldiv.LIBCMT ref: 6C176632

Strings

, xrefs: 6C176944

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: Time$DateFile$__aulldiv
String ID:
API String ID: 3890921110-3916222277
Opcode ID: e396ef7bf3038ffb3caa87f48156f6c4ebb2cce4fda302391fff411accb05aa5
Instruction ID: 82578b766ca4facda15e8422f210ce707742fc7d68bff14a5a25fb49287400c6
Opcode Fuzzy Hash: e396ef7bf3038ffb3caa87f48156f6c4ebb2cce4fda302391fff411accb05aa5
Instruction Fuzzy Hash: 6F71BD71A002199FCB14CF69C480BAAB7F5FF48304F1582BAED49DB646E735A855CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E5530 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3(00000018,?,sqlite_stat%d,00000001), ref: 6C1E557F

Strings

sqlite_stat%d, xrefs: 6C1E5574
DELETE FROM %Q.%s WHERE %s=%Q, xrefs: 6C1E56AA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf
String ID: DELETE FROM %Q.%s WHERE %s=%Q$sqlite_stat%d
API String ID: 949980604-3667113883
Opcode ID: 07c13a3f12fa7fb4fb9f67d1448aaa63e6d407635cc8d32a8c150053015a76dc
Instruction ID: 201f400b4dda6760dabaa5c64626c4bb88aeb381df740724d9f573d884ac44a0
Opcode Fuzzy Hash: 07c13a3f12fa7fb4fb9f67d1448aaa63e6d407635cc8d32a8c150053015a76dc
Instruction Fuzzy Hash: B651EE76D046598FCB00CFA8C880AEEBBF5BF0D318F15419AE890E7641D775E906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C20EBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C20EC6E

Strings

Expression tree is too large (maximum depth %d), xrefs: 6C20ECA5
too many arguments on %s() - max %d, xrefs: 6C20ED47

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: Expression tree is too large (maximum depth %d)$too many arguments on %s() - max %d
API String ID: 2102423945-2328461651
Opcode ID: e608b1c03549382da05124f1dab6ce1acdfc868cf8ea8dfeffff0f20ab222d7a
Instruction ID: b339b14fbcdf8d160f51f4b13753996753d6c9895836773f6d73f6554750b35a
Opcode Fuzzy Hash: e608b1c03549382da05124f1dab6ce1acdfc868cf8ea8dfeffff0f20ab222d7a
Instruction Fuzzy Hash: 9741CF756003059BD310DF68D880B5AB7E8EF44318F104A6EFD998B791E770E989CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A1C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6C1A1BB0: __allrem.LIBCMT ref: 6C1A1BDC

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C1A1D19
__localtime64_s.LIBCMT ref: 6C1A1D3D

Strings

local time unavailable, xrefs: 6C1A1D55

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__localtime64_s
String ID: local time unavailable
API String ID: 1840914312-3313036412
Opcode ID: 6ede7fdac42d8fb7bb61adf8d1f1d074e85891e1b5b9647fade9970dd211fc00
Instruction ID: 6035463ea039d48798290e6d4fa3857c5a00e8249df3386952e0980e54f7e19a
Opcode Fuzzy Hash: 6ede7fdac42d8fb7bb61adf8d1f1d074e85891e1b5b9647fade9970dd211fc00
Instruction Fuzzy Hash: 3B51F775E002189FCB14CFA9D9806DDFBB5FF89314F20816AD919A7340D7745949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C241470 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

sqlite3_result_error_nomem.SQLITE3(?), ref: 6C241508

Strings

string or blob too big, xrefs: 6C24158F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 303137800-2803948771
Opcode ID: b5b0138b6bcdf28510a4c7eacffd71ca86070f1e6be70103133013f6d96a485a
Instruction ID: 911f5e3388cbb6e622f108f28acb91dc94bbb9f47acb3d0c571efc101b343a46
Opcode Fuzzy Hash: b5b0138b6bcdf28510a4c7eacffd71ca86070f1e6be70103133013f6d96a485a
Instruction Fuzzy Hash: B7417272A0524D4BDB14CF58D840BDA33A4AF4232DF18839AFC5A4BB82D7B5C5E5C391

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C1900 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1C199D

Strings

out of memory, xrefs: 6C1C19D2
unknown database %s, xrefs: 6C1C1A1A

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memset
String ID: out of memory$unknown database %s
API String ID: 2102423945-3235021497
Opcode ID: 67105e392346c3b53ae97be80264e07bcbc985b35e942a31e10992358519475c
Instruction ID: 2857d6833bb808272482def16d9c1b33e9b29131a7b6050ff8288cd4f66b2fe2
Opcode Fuzzy Hash: 67105e392346c3b53ae97be80264e07bcbc985b35e942a31e10992358519475c
Instruction Fuzzy Hash: 04310535B40108A7EB018BA9E885B6EB3A5EB91718F200025FD08D7B80EB79ED15C6D3

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E5569 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3(00000018,?,sqlite_stat%d,00000001), ref: 6C1E557F

Strings

sqlite_stat%d, xrefs: 6C1E5574
DELETE FROM %Q.%s WHERE %s=%Q, xrefs: 6C1E56AA

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf
String ID: DELETE FROM %Q.%s WHERE %s=%Q$sqlite_stat%d
API String ID: 949980604-3667113883
Opcode ID: bf3f4f70b7352ac84126a2c2a0002d1bae7bc37284c82572a4b26a768241f4f8
Instruction ID: 9051aa419740db070c480771ed505b12bf608256d21cddb4fd473e5ffbdedafa
Opcode Fuzzy Hash: bf3f4f70b7352ac84126a2c2a0002d1bae7bc37284c82572a4b26a768241f4f8
Instruction Fuzzy Hash: D631197AD056698ECB00CFB88480AFEBBB1AF0D314F154286ECA1E7641C7799406CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C174560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

GetVolumeNameForVolumeMountPointW.KERNEL32(00000000,?,00000104), ref: 6C174620
_wcschr.LIBVCRUNTIME ref: 6C174656

Strings

\, xrefs: 6C1745E1

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: Volume$MountNamePoint_wcschr
String ID: \
API String ID: 1074724583-2967466578
Opcode ID: 3840afe74500f752de347fc8dd86f519ff510f671e1e55ca570e74431199239a
Instruction ID: f03534797837de97ac18db41ee4781312e76ee8736e3e2e1090383eac7ff8a57
Opcode Fuzzy Hash: 3840afe74500f752de347fc8dd86f519ff510f671e1e55ca570e74431199239a
Instruction Fuzzy Hash: 5D31D971A4121C97DB30DF24DC45BEE73B8AF64708F1401D9D919A7680EB71DA89CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1DF4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C1DF545
sqlite3_result_error_nomem.SQLITE3(?), ref: 6C1DF5B7

Strings

string or blob too big, xrefs: 6C1DF596

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 3221470060-2803948771
Opcode ID: 8342f40d09db0079d03ed5c2ad99494493f264b1bea346274a1b051ea60c5d24
Instruction ID: 55bf532d8592cac850ffdaaf0f4666fa624c7f4ec18f91fd5fc834a7dfa8ab00
Opcode Fuzzy Hash: 8342f40d09db0079d03ed5c2ad99494493f264b1bea346274a1b051ea60c5d24
Instruction Fuzzy Hash: 7C21E5756017058FC720CF68D880B97B3E5EB88328F50462DE89987780D735FA0A8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A9500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C1A9531

Strings

winTruncate2, xrefs: 6C1A958F
winTruncate1, xrefs: 6C1A9565

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: winTruncate1$winTruncate2
API String ID: 885266447-470713972
Opcode ID: 166808f54c5c5fe1ef6d32657fb643727a6e99e50559ef241ec338219f3d53fa
Instruction ID: 998a082845957f4d16c0b4d79355244c56ddb95d50bca9822848e216708bacd2
Opcode Fuzzy Hash: 166808f54c5c5fe1ef6d32657fb643727a6e99e50559ef241ec338219f3d53fa
Instruction Fuzzy Hash: 7521B1B52003049FDB10CFA5C991A6B73EAFB88714F148A2EF959C7B80D731E8428F61

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C2D70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3(00000020,?,%!.15g,?,00000001), ref: 6C1C2DD7

Strings

%lld, xrefs: 6C1C2DBC
%!.15g, xrefs: 6C1C2DCF

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_snprintf
String ID: %!.15g$%lld
API String ID: 949980604-2983862324
Opcode ID: 024f2424806e3bac09f66bd2993f2372b21715152197f68c832b7faaea0d0072
Instruction ID: 28b731f952601740d4d7effb5d27bc09de044499fe63415558b37c4cff060995
Opcode Fuzzy Hash: 024f2424806e3bac09f66bd2993f2372b21715152197f68c832b7faaea0d0072
Instruction Fuzzy Hash: BD21F470604B458BD320CF29C849B77B7E4AF24308F108A1DFCF987A91EB29E4488792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1EBBA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

sqlite3_result_error_nomem.SQLITE3(?), ref: 6C1EBBFC
sqlite3_randomness.SQLITE3(00000000,00000000), ref: 6C1EBC0D

Strings

string or blob too big, xrefs: 6C1EBC2F

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_randomnesssqlite3_result_error_nomem
String ID: string or blob too big
API String ID: 1866630626-2803948771
Opcode ID: 1a91ec03a9268cd887ff9d915142659c7ddb732d8b75335f364e166235698a86
Instruction ID: 8514446b09bf43a923a4ea7283c8bd507c202b53806df8cd51920c76bb1b8225
Opcode Fuzzy Hash: 1a91ec03a9268cd887ff9d915142659c7ddb732d8b75335f364e166235698a86
Instruction Fuzzy Hash: 6E117B757047044BC310EE6C9881BDF7399EB98328F540A29FD58C7740EB75E80A83E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A29A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C1A27A0: _memset.LIBCMT ref: 6C1A27B3

Part of subcall function 6C1A1BB0: __allrem.LIBCMT ref: 6C1A1BDC

sqlite3_snprintf.SQLITE3(00000064,?,%04d-%02d-%02d %02d:%02d:%02d,?,?,?,?,?,00000000), ref: 6C1A2A1B

Strings

%04d-%02d-%02d %02d:%02d:%02d, xrefs: 6C1A2A0F
string or blob too big, xrefs: 6C1A2A46

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: __allrem_memsetsqlite3_snprintf
String ID: %04d-%02d-%02d %02d:%02d:%02d$string or blob too big
API String ID: 4046613686-1189373324
Opcode ID: 5b76067e4e72c162ac083b639f42d5647762aff2c1c62d66d215a6d49d305617
Instruction ID: c66f67286ce7dd2123c4f9b81ffe88626817dbd4ebd393930e0aaad964af7d57
Opcode Fuzzy Hash: 5b76067e4e72c162ac083b639f42d5647762aff2c1c62d66d215a6d49d305617
Instruction Fuzzy Hash: B42187756143049FD310DFA8DC41FAB77E9AF88324F504B18B9A9877C0E770E91987A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1DE610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

%s OR name=%Q, xrefs: 6C1DE665
name=%Q, xrefs: 6C1DE651

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: %s OR name=%Q$name=%Q
API String ID: 0-1621047680
Opcode ID: 2496206578f91fabad89aaff223dd18a89df6883287700335ba26f88468da1de
Instruction ID: 8a7174ee9fd8ed14189c940867bcabf68755653ed2f046a0b662de0e92200b92
Opcode Fuzzy Hash: 2496206578f91fabad89aaff223dd18a89df6883287700335ba26f88468da1de
Instruction Fuzzy Hash: F021D575A00A049BCB11CA59D880ADBB7B9EFA5309F160069ED4597700E734BE16CAD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C210530 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 6C2105D7

Strings

unknown error, xrefs: 6C21059A
abort due to ROLLBACK, xrefs: 6C2105BF

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free
String ID: abort due to ROLLBACK$unknown error
API String ID: 2313487548-832762323
Opcode ID: 802a0b151c555811812057342716bc297832eb076416b5a04e5290ce899aaafc
Instruction ID: 778828742a523b0fd857c9850c64408f485a9d75d597b426b53e7d9ee5d0710c
Opcode Fuzzy Hash: 802a0b151c555811812057342716bc297832eb076416b5a04e5290ce899aaafc
Instruction Fuzzy Hash: 4C21907060928AAFEB14CF05C490FA277E4BB41319F14446DEE199BE92EB36E861CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A2B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C1A27A0: _memset.LIBCMT ref: 6C1A27B3

sqlite3_snprintf.SQLITE3(00000064,?,%04d-%02d-%02d,?,?,?), ref: 6C1A2B8C

Strings

string or blob too big, xrefs: 6C1A2BB4
%04d-%02d-%02d, xrefs: 6C1A2B80

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: _memsetsqlite3_snprintf
String ID: %04d-%02d-%02d$string or blob too big
API String ID: 3698178229-725873148
Opcode ID: 9ab33fdf18394a52eca2e5d21aaf0a13c1e55c2210ca86d2fa10c408281bdd98
Instruction ID: 9f3e8456afa4497d58d27540ae5449b790093e170b7478b841165b3dbd223acf
Opcode Fuzzy Hash: 9ab33fdf18394a52eca2e5d21aaf0a13c1e55c2210ca86d2fa10c408281bdd98
Instruction Fuzzy Hash: 761193766143049FD310DFA8DC45BAB77E9EB89324F404B08F9A9877C0E770A90987A3

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A2A70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 6C1A27A0: _memset.LIBCMT ref: 6C1A27B3

Part of subcall function 6C1A1BB0: __allrem.LIBCMT ref: 6C1A1BDC

sqlite3_snprintf.SQLITE3(00000064,?,%02d:%02d:%02d,?,?,00000000), ref: 6C1A2AD0

Strings

%02d:%02d:%02d, xrefs: 6C1A2AC4
string or blob too big, xrefs: 6C1A2AF8

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: __allrem_memsetsqlite3_snprintf
String ID: %02d:%02d:%02d$string or blob too big
API String ID: 4046613686-2715048039
Opcode ID: 9b82d76e49ee64d0bad48b0d1c8e5df0656a0290333b428a98e57c355daf5b54
Instruction ID: 5cc24b96d1c54faddf27cb5a9872542e43c4c9708976695ce952b7beb10eac54
Opcode Fuzzy Hash: 9b82d76e49ee64d0bad48b0d1c8e5df0656a0290333b428a98e57c355daf5b54
Instruction Fuzzy Hash: C71184756143045FD720DF64DC41BEB77A8AF89324F400719F9A8876C0E770A5198792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1F7FDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_compileoption_get.SQLITE3(00000000), ref: 6C1F8001
sqlite3_compileoption_get.SQLITE3(?), ref: 6C1F8034

Strings

compile_option, xrefs: 6C1F7FE1

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_compileoption_get
String ID: compile_option
API String ID: 1719694041-1898719443
Opcode ID: fc66457a903e23571b63dd9d0e8f76e22f31642dd6102129d192310254f4d02c
Instruction ID: 9b48e6f68f4a78e8ef66788e16afb6f53fd9cbabac709bc1f97a35b05507133d
Opcode Fuzzy Hash: fc66457a903e23571b63dd9d0e8f76e22f31642dd6102129d192310254f4d02c
Instruction Fuzzy Hash: 8601D8BA7083004BE300CB59E84079FB3E5AB9421CF500529EC4987741EB35ED0B87C3

Uniqueness

Uniqueness Score: -1.00%

Function 6C1DE590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

%s OR name=%Q, xrefs: 6C1DE5A7
name=%Q, xrefs: 6C1DE596

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID:
String ID: %s OR name=%Q$name=%Q
API String ID: 0-1621047680
Opcode ID: 822aeef3e5db65be2b4bfd790d420a26dbf989bf73948b7636dfa5e1902ce2f1
Instruction ID: 55cb9d7e9bdd71028cd7da842c16d18105ad5875d60444d30732964e7b8fe34d
Opcode Fuzzy Hash: 822aeef3e5db65be2b4bfd790d420a26dbf989bf73948b7636dfa5e1902ce2f1
Instruction Fuzzy Hash: C0F0FCBA606F008BD31206985C907CBF2B49F95309F11052DF85986701FB31F65596C1

Uniqueness

Uniqueness Score: -1.00%

Function 6C2355B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6C2347A0: sqlite3_free.SQLITE3(?,?,00000001,?,?,?,?,?,?,?,6C235606,?,00000000,?,00000001,6C222278), ref: 6C234836
Part of subcall function 6C2347A0: sqlite3_free.SQLITE3(?,?,00000001,unrecognized matchinfo request: %c,?), ref: 6C2348C7

sqlite3_blob_close.SQLITE3(?,?,00000000,?,00000001,6C222278), ref: 6C23560D

Part of subcall function 6C1D2550: sqlite3_finalize.SQLITE3(?), ref: 6C1D2575

Strings

pcx, xrefs: 6C2355BA
string or blob too big, xrefs: 6C2355E6

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_free$sqlite3_blob_closesqlite3_finalize
String ID: pcx$string or blob too big
API String ID: 302958490-142857962
Opcode ID: f2b83dc876d82b9d268f745b5a86b95c4f38759a9b1d9109aa31e315f9f046e3
Instruction ID: 610a6596370ad81cb34bcf59eeef81d5c436ef97f966151a8696fbf696b1bbef
Opcode Fuzzy Hash: f2b83dc876d82b9d268f745b5a86b95c4f38759a9b1d9109aa31e315f9f046e3
Instruction Fuzzy Hash: C2F046B17002055BD7209F78AC45B9B73A68F4432AF640A3AFD49CBF81E371E55946B1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1DE9D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3(?,sqlite_,00000007), ref: 6C1DE9FB

Strings

table %s may not be altered, xrefs: 6C1DEA0B
sqlite_, xrefs: 6C1DE9F5

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: sqlite_$table %s may not be altered
API String ID: 1961171630-3113691233
Opcode ID: 9629cccecfb562685b270b34909f731e134ee0b2e412f8211bf1c6d6f29fe6a4
Instruction ID: 7bf6792281e3b153887df9b915c9ecec456569fccf46d66778baa5ba65d1bd6d
Opcode Fuzzy Hash: 9629cccecfb562685b270b34909f731e134ee0b2e412f8211bf1c6d6f29fe6a4
Instruction Fuzzy Hash: B4F05C3654861A17D1044595BC41BC677488F2231CF140A50FC0CDBF44F906F70642C0

Uniqueness

Uniqueness Score: -1.00%

Function 6C1E2DC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3(00000000,sqlite_,00000007), ref: 6C1E2DE3

Strings

object name reserved for internal use: %s, xrefs: 6C1E2DF0
sqlite_, xrefs: 6C1E2DDD

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: object name reserved for internal use: %s$sqlite_
API String ID: 1961171630-4055618681
Opcode ID: 149d7bb238e8777ee5395862ad33b02a2c8dfc4948211b11290e77d7c2b249dd
Instruction ID: 52dc6faaeb4a5ad50368f214faf6d117bb6b4e4bf3a0b6685f6c95b596d3d628
Opcode Fuzzy Hash: 149d7bb238e8777ee5395862ad33b02a2c8dfc4948211b11290e77d7c2b249dd
Instruction Fuzzy Hash: E2E02660848A4429E31447229C0DF4336F46B6931CF1D0568F849C4D82F75C836AA2C1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A3580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C1A3589

Part of subcall function 6C2443BB: __FF_MSGBANNER.LIBCMT ref: 6C2443D4
Part of subcall function 6C2443BB: __NMSG_WRITE.LIBCMT ref: 6C2443DB
Part of subcall function 6C2443BB: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,6C246CCE,00000000,00000001,00000000,?,6C249894,00000018,6C26EF60,0000000C,6C249924), ref: 6C244400

sqlite3_log.SQLITE3(00000007,failed to allocate %u bytes of memory,?), ref: 6C1A359F

Strings

failed to allocate %u bytes of memory, xrefs: 6C1A3598

Memory Dump Source

Source File: 00000009.00000002.2971285546.000000006C1A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000009.00000002.2971252230.000000006C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2973825497.000000006C255000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974233615.000000006C272000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974271065.000000006C273000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974350517.000000006C277000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2974405078.000000006C27A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c1a0000_WiseCare365.jbxd

Similarity

API ID: AllocHeap_mallocsqlite3_log
String ID: failed to allocate %u bytes of memory
API String ID: 3600094993-1168259600
Opcode ID: 81132c80ad8e87faaeb7ed9af40c2b885065cce0bd1b9c89507658736f0d9611
Instruction ID: 176561b4c0c72dae29666fecdf6ef03e4ea42a40cb32e9003243b345a331dfcb
Opcode Fuzzy Hash: 81132c80ad8e87faaeb7ed9af40c2b885065cce0bd1b9c89507658736f0d9611
Instruction Fuzzy Hash: 72D0A71BE4412C33C11111CAAC01FDF7A5C8BC2DF9F040131FE0C97B02D645A91B42E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C18BE1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 6C18BE02

Part of subcall function 6C17D6D6: RaiseException.KERNEL32(?,?,?,6C17AE61,?,?,?,?,?,?,?,?,6C17AE61,?,6C19335C), ref: 6C17D735

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 6C18BE2A

Strings

Access violation - no RTTI data!, xrefs: 6C18BE21

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: d538bb59798ad6b0d27d7b0d100c7a92c9f232e49a152b85841ebac4b08068c4
Instruction ID: a74eab80f1fe77d693e7eaf579084164e2fb66f915d8829ef7e4d41b060d18c3
Opcode Fuzzy Hash: d538bb59798ad6b0d27d7b0d100c7a92c9f232e49a152b85841ebac4b08068c4
Instruction Fuzzy Hash: 7AE08C769082089FCF04CBE0D84ABDE73B8AB0931AF210456E411A7A40E774E8908F64

Uniqueness

Uniqueness Score: -1.00%

Function 6C173620 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C173631
LeaveCriticalSection.KERNEL32(?), ref: 6C17363E
EnterCriticalSection.KERNEL32(?), ref: 6C17364B
LeaveCriticalSection.KERNEL32(?,?,?), ref: 6C17367A

Memory Dump Source

Source File: 00000009.00000002.2970570041.000000006C171000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C170000, based on PE: true

Associated: 00000009.00000002.2970539460.000000006C170000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2970962965.000000006C18C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971102181.000000006C195000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971153426.000000006C197000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2971187934.000000006C199000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c170000_WiseCare365.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: bcaf9c510d123c943f58420473b5cf015f260cf977f50b6daa96ff86aba59d90
Instruction ID: ca91aeb3f5ffcf53e414f8b352e054c259f65066047ecada7aa55671a729fddb
Opcode Fuzzy Hash: bcaf9c510d123c943f58420473b5cf015f260cf977f50b6daa96ff86aba59d90
Instruction Fuzzy Hash: EF016975605609AFCB04EF68C859F15B7B8BF1632AB148218F82AC7B40CB30E425CBA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.FileRepPup.14974.19067.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Wise\Wise Care 365\AutoUpdate.exe (copy)

C:\Program Files (x86)\Wise\Wise Care 365\BootLauncher.exe (copy)

C:\Program Files (x86)\Wise\Wise Care 365\BootPack.wpk (copy)

C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (copy)

C:\Program Files (x86)\Wise\Wise Care 365\DManager.dll (copy)

C:\Program Files (x86)\Wise\Wise Care 365\DefragOptions.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Abkhazian.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Arabic.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Azerbaijani(Latin).ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Belarusian.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Bulgarian.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Catalan.ini (copy)

C:\Program Files (x86)\Wise\Wise Care 365\Languages\Chinese(Simplified).ini (copy)

Windows Analysis Report
SecuriteInfo.com.FileRepPup.14974.19067.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre